Edit tour

Windows Analysis Report
http://www.wheel-done.com/

Overview

General Information

Sample URL:	http://www.wheel-done.com/
Analysis ID:	1562876
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML page contains hidden javascript code

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1936,i,7320407238425932596,807607496568096639,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.wheel-done.com/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: http://www.wheel-done.com/

HTTP Parser: Base64 decoded: x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.13

Source: http://api.map.baidu.com/getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958

HTTP Parser: window.tile_version={"ditu":{"normal":{"version":"088","updatedate":"20241109"},"satellite":{"version":"009","updatedate":"20241109"},"normaltraffic":{"version":"081","updatedate":"20241109"},"satellitetraffic":{"version":"083","updatedate":"20241109"},"mapjs":{"version":"104","updatedate":"20241109"},"satellitestreet":{"version":"083","updatedate":"20241109"},"earthvector":{"version":"001","updatedate":"20241109"}},"webapp":{"high_normal":{"version":"001","updatedate":"20241109"},"lower_normal":{"version":"002","updatedate":"20241109"}},"api_for_mobile":{"vector":{"version":"002","updatedate":"20241109"},"vectoricon":{"version":"002","updatedate":"20241109"}}};window.bmap_authentic_key="kfnslxugpyk9bbyhnsqzsyokxn7mugxx";(function(){function aa(a){throw a;}var k=void 0,o=!0,p=null,q=!1;function t(){return function(){}}function da(a){return function(b){this[a]=b}}function v(a){return function(){return this[a]}}function ea(a){return function(){return a}}var fa,ga=[];function ha(a){return function(){return ga[a]...

Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50067 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.5
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: F-WEBDate: Tue, 26 Nov 2024 07:19:55 GMTContent-Type: text/css; charset=UTF-8Content-Length: 5955Connection: keep-aliveContent-Encoding: gzipFAI-W-FLOW: 1016410014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389P3P: CP=CAO PSA OURUpdate-Time: 1680503039Src-Update: trueOrigin-Agent-Cluster: ?0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-EncodingSet-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:19:55 GMT; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d ef 8e db 48 72 ff ae a7 60 6c 1c 70 7b f0 8c 45 91 4d 49 33 08 10 db 1b 9f 7d 59 7b 7d 6b 27 07 24 08 04 8e c4 d1 70 2d 89 82 44 79 ec 1d f8 63 1e 20 9f f3 0e c9 03 04 77 6f 73 40 ee 2d d2 ec 26 a9 6e 76 55 ff a3 74 71 f6 6e d7 a6 54 ff ba bb ba ba 7f d5 a5 e6 df cd ef d2 dd 3e 2b 83 47 87 f2 f6 62 f2 e8 7a 30 08 ea 7f 1e af 8b c5 61 95 91 28 0c 2e 6f 8b dd fa 79 ba d9 64 3b fa f8 10 2c f2 fd 76 95 7e b9 da 14 9b ec 3a f8 da b2 d0 7f 06 1d d6 87 9b 62 b7 c8 76 9c f4 ab 22 f4 4d be 58 b0 47 5b 3a 26 5f f8 e8 45 b6 29 b9 55 7a 01 1f 8a 6d 45 24 59 fe b5 6b 2c 6f 67 51 96 c5 5a 25 c6 6d 12 1f 7f c8 6e 4b 5f de 9f f2 e5 1d c0 3c 68 fb 55 e9 db 74 fe 71 b9 2b 0e 9b 85 59 8f 0b 71 ab 0c ee 68 4b 41 2f 0a ca b1 29 41 96 01 e4 2b 02 6f b7 93 96 b3 bb e2 53 b6 0b d2 60 bf 4d 37 4f 5c b9 5c 19 3c 94 3c dc d2 e6 5e ec f3 5f b2 ab 20 4c b6 9f af d9 f3 6d ba ce 57 5f ae 82 3f ff e9 3f ff e7 8f ff f5 97 ff f8 b7 bf fc f7 bf f3 6f ee b3 6a b4 af 82 9b 62 b5 e0 9f ec cb 2f 2b ca bc a1 e2 d3 d5 75 99 7d 2e 2f 16 d9 bc d8 a5 65 5e 6c 28 e1 2a df 7c bc 9e 17 ab 62 77 15 ec 96 37 e9 af 47 84 3c 09 46 11 fd 4f 32 7c 12 84 df d1 6e 1d 68 fa b4 b6 76 9f ad b2 79 99 2d 0c 7d a9 50 5b 12 ba f6 83 dc 6a a9 6b ec 7b 22 0a 69 fb 23 d6 1b 23 a9 27 b4 bd f1 20 9a 26 59 66 35 37 b6 f9 fc 62 9d 7f 7e 9b dd ef df 57 8d 78 7f 58 af d3 dd 97 9e 52 d7 d9 fa 26 db fd 50 2c f3 cd eb 32 5b 7b 49 03 66 a1 30 a5 3f 5e 6c ef 8a b2 f8 2d 9d 8f db 0f 79 b9 ca 6a f1 3d 0d 57 54 32 55 fb 2c dd cd ef de 64 9b c3 1f 68 7c d6 a8 68 05 49 96 6e b2 fb f7 4c c2 7b e6 5e 95 1c 6e 83 28 f9 1f b2 2f ce c2 f5 d3 24 b5 91 85 44 65 c8 c7 6a 8f ae 1d fa ab 99 cd a5 3b 25 e1 74 c2 09 16 ba 35 17 b3 d2 b2 a9 55 14 58 e7 94 fb 81 4f 4d 1e a3 46 74 42 1e ff c3 a6 a6 9b c8 fd 36 9b e7 e9 ea Data Ascii: ]Hr`lp{EMI3}Y{}k'$p-Dyc wos@-&nvUtqnT>+Gbz0a(.oyd;,v~:bv"MXG[:&_E)UzmE$Yk,ogQZ%mnK_<hUtq+YqhKA/)A+oS`M7O\\<<^_ LmW_??ojb/+u}./e^l(*\|bw7G<FO2\|nhvy-}P[jk{"i##' &Yf57b~WxXR&P,2[{If0?^l-yj=WT2U,dh\|hInL{^n(/$De
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:19:57 GMTContent-Type: text/css; charset=UTF-8Content-Length: 7056Connection: keep-aliveExpires: Fri, 24 Nov 2034 01:36:56 GMTServer: F-WEBFAI-W-FLOW: 35495043FAI-W-AGENT_AID: 0Last-Modified: Wed, 21 Sep 2016 16:00:00 GMTVary: Accept-EncodingContent-Encoding: gzipOrigin-Agent-Cluster: ?0Cache-Control: max-age=315360000X-Ser: i63242_c21843, i2103125_c25795, i1872258_c17483X-Cache: HIT from i1872258_c17483(cloudsvr)Data Raw: 1f 8b 08 00 00 00 00 00 00 00 e5 9d eb 8a 23 49 76 c7 bf fb 29 c4 0c 03 b3 eb d6 ac 54 5d ea 56 ab 31 18 2f 06 2f ac 61 d9 9d 0f 3b 18 b3 a8 aa 54 dd f2 a8 a4 42 ca be 16 fe e8 07 f0 e7 7d 07 fb 01 8c fd 36 06 ef 5b 38 6f 92 e2 72 22 ce 35 aa 4b ea 6e 18 a6 95 19 ff 3c 71 8f 8c df 39 91 7f 7b fd 76 be dd 2d aa c1 37 ef aa db e1 f4 9b d7 3f dc 6e b6 77 bb c1 0f ff f2 79 78 b7 b9 79 b7 5a fc 38 bf fa e3 ef e6 55 b5 d8 ae 27 2f 2e 07 0f 57 9b ed cd 62 3b 5b 6f d6 8b d7 ff 8a dd bd bf 7d b8 9d df 2c df ed 66 23 42 92 f6 86 7f 5c de dc ac 16 bf de ac ab c5 ba 7a b8 9a 5f ff fc 66 bb 79 b7 be 21 3e b7 bd 5e ff e6 cb dc cd b7 6f 96 eb e1 6a 71 5b cd 46 f7 1f 95 32 db e5 9b b7 16 3a d5 e6 de 40 e5 6a 53 55 9b 3b 9a d0 a0 5a 7c ac e6 db c5 fc 61 b5 5c 2f 86 6f 17 6d 4e 2e 5e b0 d2 ce 66 c3 0f 8b ab 9f 97 d5 70 b9 be 7f 57 0d ef 57 f3 eb c5 db cd aa ae 6d 95 6c 7d fd b3 2b 36 f8 d5 2f 07 b7 cb ed e2 76 f3 71 30 9e 0e 07 bf fc 95 d2 ea 40 df 95 7f f5 d7 06 f2 bb e1 fe 5f da 32 69 0b 36 57 ce b7 75 1b 18 de ce ef 96 ab 4f b3 c1 ff fe cf 7f fc df 7f ff e7 5f fe fc 6f 7f f9 af 7f 37 aa 47 8d 7e 67 7c 58 da 36 26 13 da 88 de f4 42 b6 13 1a a0 89 ed bb 72 ed 25 d5 c4 d5 76 ff 53 f5 e9 7e f1 37 df 34 e2 df fc b3 a1 dc ca 50 6d 71 37 5f 5a ea dd cf 77 bb 0f f5 24 a9 94 3c 0c e9 1a 91 dd 62 b5 b8 ae 54 12 3f dc fe fc a7 d5 e6 c3 6f fe fe 77 c7 86 f1 87 ea d3 6a a1 51 dd af 22 9a a9 b2 5d 00 f4 ff ee 27 3d f7 a7 76 72 77 7f e8 a6 69 e2 72 65 3f c5 fe dd bb 5a 78 fd db e5 ae 0a 66 5d 2f 17 ec a2 c1 c4 af 37 ab cd 76 f6 ed 8b f6 8f 4c f1 66 f9 de 17 fd 87 cd fb ba 6b 76 ca db 37 57 df 5f 4c 26 cf 06 fb ff fc c2 ae 4c 76 cb cf 8b d9 98 34 b1 c5 8a 0f fd c4 f8 62 2a 4c df 64 f2 b6 6e 77 b3 b7 b5 49 8b 35 57 e3 c7 cd fd 6f eb 86 23 5f 68 1e 64 7e 5d af c9 ea f2 d6 0b fd be 29 90 87 9b e5 ae 1e 61 3f c9 db 6f 64 09 d0 75 e4 b9 94 68 55 cb aa fd b1 6e 38 fd bb c4 e8 b5 b8 b8 0e 6f 08 9c b7 12 78 21 2d 92 e8 4a c4 5d ca 4f 1e ab 05 83 95 8d 0f 82 84 a1 f4 60 ca fb e5 6e 59 d7 13 bb 3a dc 77 b8 87 fb f9 cd cd 72 fd e6 f8 da b5 ff e1 f8 02 b5 ff 65 ff 2a b4 ff 37 e7 a5 26 33 4c b5 5d bb 1f 61 9e 0b 47 a8 c3 4f 5d bf b4 52 eb cb 48 21 d7 8d ef bd c0 fc 5d b5 b1 b0 c7 7d 59 e1 19 d5 94 f5 b3 01 af 07 d2 ef ef 0a 3f 1a 2d fe Data Ascii: #Iv)T]V1//a;TB}6[8or"5Kn<q9{v-7?nwyxyZ8U'/.Wb;[o},f#B\z_fy!>^ojq[F2:@jSU;Z\|a\/o
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:19:58 GMTContent-Type: text/css; charset=UTF-8Content-Length: 1573Connection: keep-aliveExpires: Fri, 24 Nov 2034 01:36:56 GMTServer: F-WEBFAI-W-FLOW: 1974338115FAI-W-AGENT_AID: 0Last-Modified: Wed, 21 Sep 2016 16:00:00 GMTVary: Accept-EncodingContent-Encoding: gzipOrigin-Agent-Cluster: ?0Cache-Control: max-age=315360000X-Ser: i11791_c17987, i2103127_c25795, i1872264_c17483X-Cache: HIT from i1872264_c17483(cloudsvr)Data Raw: 1f 8b 08 00 00 00 00 00 00 00 bd 5a dd 8e e3 34 14 be e7 29 a2 1d 21 01 da 74 d2 aa 33 bb b4 42 20 f6 06 a1 5d 84 98 15 b7 23 37 f1 b4 d6 a4 71 e4 b8 9d 99 ad f6 92 07 e0 9a 77 80 07 40 f0 36 48 ec 5b e0 c4 49 6a 27 b6 73 9c 96 9d 6a b7 69 72 be cf 3e f6 f9 b1 8f f3 4d bc 41 ac c0 3c 78 b6 e3 77 e1 cb 67 cb 8b 0c ed 7f 9e 05 87 0d 26 eb 0d 5f 5c 45 f9 e3 f2 fd 27 f5 dd 89 f8 7a 83 48 f6 8a 66 1c 67 bc 11 9a 46 d1 a7 47 a1 4a ea 95 78 8c 99 53 ae 12 93 02 96 e6 a0 4c 87 15 8a ef d7 8c ee b2 64 91 d1 0c 1b db 78 1e 28 f7 de d2 5c fb dd f4 a3 bc 7e 8d ef b8 f5 e1 4f 65 f3 d6 a7 5a 5f 07 a4 9e 2b 4f bf a5 9c d3 ad 43 0d c2 f1 d6 a5 66 f5 bc fa bf ec 3d 48 50 f6 02 24 5a 29 3d 20 69 31 98 8a 04 1d b6 88 ad 49 16 72 9a 2f a2 65 50 ff 5a 55 5a 97 37 72 94 24 24 5b 37 cf 9b 9f ad 40 8f cf d8 18 0a 0e 1c 3f f2 30 c1 31 65 88 13 9a c9 8e de 89 b1 0f 0b f2 0e 2f a6 d7 42 be fa f9 20 09 32 ca b6 28 95 b7 ee d0 96 a4 4f 8b 7f fe fe fd df bf fe f8 f0 db 2f 1f fe fc 75 19 d3 94 b2 c5 c5 6c 55 7e 96 15 7b b1 41 09 7d 90 cc 82 66 75 4f 78 d8 7f 40 0d f7 b6 85 e9 26 7d d7 bf ab eb fb 1d dd 63 56 6a 57 f7 26 9e 47 e2 6f 19 e8 52 37 38 c5 31 c7 09 5c 70 60 46 5b 39 a8 5d e9 00 90 7d e9 10 88 9d 99 1a 11 06 e1 06 c9 11 04 09 41 95 55 a4 41 9a f6 e4 81 9d f6 18 98 3c 38 3c 90 84 6f 16 b3 d2 2d 12 52 e4 29 7a 5a 90 2c 25 42 f8 08 0e 73 5a 90 ca 3b 82 b8 ea c9 d2 ee ba 82 f4 b5 40 6b fe a6 b4 21 85 5b 51 cd cd c5 e3 a0 4f 7c 94 1d d4 a6 6c d8 34 67 65 c0 bc d9 ad de e0 6c 57 05 cf 1b fe 94 e2 60 22 75 69 23 84 31 12 f4 1c 4d 09 0d 73 73 68 a8 20 28 25 eb 6c 51 8f d6 50 b0 98 27 e5 07 d6 d1 da b5 cd bd d5 bd 18 a6 78 33 53 73 39 e4 a0 b1 1a 09 2a cd 2a f4 47 aa 33 7a 71 57 fd 05 0e 68 93 37 85 4d 8d 85 ca 34 02 42 d3 1d 2f 2f de 32 82 b2 75 5a 9a 1f 65 09 66 75 26 0a eb 19 91 60 b0 be 15 85 8f f5 b6 31 68 ac f9 ab 61 e6 14 8a 2a ee 0c 31 a8 0a 02 a6 c3 25 de 6d 09 44 e7 0d 99 6c 49 92 a4 fd d8 e2 05 f5 d2 b9 81 4d 52 d3 a4 fa 10 c4 e6 49 1d 45 31 4e 05 66 b4 09 b0 0b 37 69 09 0a 6a 9c 17 8a eb 05 57 6b 42 f7 67 31 27 7a 7f 1e 63 3a f7 a1 31 85 32 07 be 68 6e 75 4c 60 98 b0 dd 60 c9 30 c8 50 42 76 c5 22 0a aa 8f 71 9b 35 28 5a 6d 16 6c 42 9a 02 4e 49 95 4e 5b 18 c2 11 b5 e6 80 ae 70 b4 4a 31 ac 15 33 cc dd 54 42 Data Ascii: Z4)!t3B ]#7qw@6H[Ij'sjir>MA<xwg&_\E'zHfgFGJxSLdx(\~OeZ_+OCf=HP$Z)= i1Ir/ePZUZ7r$$[7
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:20:06 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:20:08 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:20:29 GMTContent-Type: text/css; charset=UTF-8Content-Length: 7140Connection: keep-aliveExpires: Fri, 24 Nov 2034 03:16:26 GMTServer: F-WEBFAI-W-FLOW: 705436043FAI-W-AGENT_AID: 0Last-Modified: Wed, 21 Sep 2016 16:00:00 GMTVary: Accept-EncodingContent-Encoding: gzipOrigin-Agent-Cluster: ?0Cache-Control: max-age=315360000X-Ser: i37174_c25891, i2103127_c25795, i1872278_c17483X-Cache: HIT from i1872278_c17483(cloudsvr)Data Raw: 1f 8b 08 00 00 00 00 00 00 00 e5 9d db 6e 23 49 72 86 ef fd 14 c4 0c 06 98 5d 37 67 45 b5 d4 07 35 0c 18 5e 18 f0 02 6b 60 b1 3b 17 3b 30 8c 05 25 51 dd f4 50 a4 40 56 1f 05 5f fa 01 7c bd ef 60 3f 80 61 bf 8d 01 ef 5b b8 0e 3c 64 56 46 66 c4 1f 11 d5 2d aa bb 81 c1 34 ab f2 af c8 f3 e1 8b a8 fa db ab 37 d3 f5 66 56 8d be 79 5b dd 8c 5f 7c f3 ea 87 9b d5 fa 76 33 fa e1 5f 3e 8d 6f 57 d7 6f 17 b3 1f a7 97 7f fc dd b4 aa 66 eb e5 f9 f3 a7 a3 fb cb d5 fa 7a b6 be 58 ae 96 b3 57 ff ca dd bd bb 7d bc 9e 5e cf df 6e 2e 4e 04 49 da 1b fe 71 7e 7d bd 98 fd 7a b5 ac 66 cb ea fe 72 7a f5 f3 eb f5 ea ed f2 5a f8 dc f6 7a fd 5b 2c 73 3b 5d bf 9e 2f c7 8b d9 4d 75 71 72 f7 c1 28 b3 9e bf 7e e3 a1 53 ad ee 1c 54 2e 57 55 b5 ba 95 09 8d aa d9 87 6a ba 9e 4d ef 17 f3 e5 6c fc 66 d6 e6 e4 f4 19 94 f6 e2 62 fc 7e 76 f9 f3 bc 1a cf 97 77 6f ab f1 dd 62 7a 35 7b b3 5a d4 b5 6d 92 ad af 7f 0a c5 46 bf fa e5 e8 66 be 9e dd ac 3e 8c 26 2f c6 a3 5f fe ca 68 75 4f 3f 94 7f f9 d7 0e f2 9b f1 ee 5f d6 32 69 0b b6 54 ce 37 75 1b 18 df 4c 6f e7 8b 8f 17 a3 ff fd 9f ff f8 bf ff fe cf bf fc f9 df fe f2 5f ff ee 54 8f 16 fd ce f8 7e 69 fb 98 2c 68 23 76 d3 07 b2 5d d0 00 5d 6c df 0c d7 5e 72 4d dc 6c f7 3f 55 1f ef 66 7f f3 4d 23 fe cd 3f 3b ca 2d 1c d5 66 b7 d3 b9 a7 de dd 74 b3 79 5f 4f 92 46 c9 fd 90 6e 11 d9 cc 16 b3 ab ca 24 f1 c3 cd cf 7f 5a ac de ff e6 ef 7f 77 68 18 7f a8 3e 2e 66 16 d5 dd 2a a2 99 2a db 05 c0 f6 df db 49 2f fc a9 9d dc c3 1f ba 69 5a b8 5c d9 4d b1 7f f7 b6 16 5e fe 76 be a9 7a b3 6e 94 0b b8 68 38 f1 ab d5 62 b5 be f8 f6 59 fb 47 a7 78 3d 7f 17 8b fe c3 ea 5d dd 35 3b e5 f5 eb cb ef 4f cf cf 9f 8c 76 ff f9 85 5f 99 6c e6 9f 66 17 13 d1 c4 96 2a de 6f 27 c6 67 2f 94 e9 9b 4c de d4 ed ee e2 4d 6d d2 6c 89 6a fc b8 ba fb 6d dd 70 f4 0b cd bd cc af eb 35 59 5d de 76 a1 df 37 05 72 7f 3d df d4 23 ec 47 7d fb 4d 2c 21 ba 8e 3e 97 1a ad 6a 5e b5 3f d6 0d 67 bb 97 38 79 a5 2e ae fd 0e 01 d9 95 d0 0b 69 95 44 57 22 e1 52 fe fc 73 b5 60 b2 b2 f9 41 50 30 94 ee 4d 79 37 df cc eb 7a 82 ab 23 dc c3 dd df 4d af af e7 cb d7 87 6d d7 ee 87 c3 06 6a f7 cb 6e 2b b4 fb 37 b2 a9 29 0c 53 6d d7 de 8e 30 4f 95 23 d4 fe a7 ae 5f 7a a9 6d cb c8 20 d7 8d ef 5b 81 e9 db 6a e5 61 4f b8 59 c1 8c 6a ca fa c9 08 eb 81 f2 fb Data Ascii: n#Ir]7gE5^k`;;0%QP@V_\|`?a[<dVFf-47fVy[_\|v3_>oWofzXW}^n.NIq~}zfrzZz[,s;]/Muqr(~ST.WUjMl
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:20:29 GMTContent-Type: text/css; charset=UTF-8Content-Length: 1573Connection: keep-aliveExpires: Fri, 24 Nov 2034 03:16:26 GMTServer: F-WEBFAI-W-FLOW: 126688043FAI-W-AGENT_AID: 0Last-Modified: Wed, 21 Sep 2016 16:00:00 GMTVary: Accept-EncodingContent-Encoding: gzipOrigin-Agent-Cluster: ?0Cache-Control: max-age=315360000X-Ser: i11791_c17987, i2103127_c25795, i1872264_c17483X-Cache: HIT from i1872264_c17483(cloudsvr)Data Raw: 1f 8b 08 00 00 00 00 00 00 00 bd 5a dd 8e e3 34 14 be e7 29 a2 1d 21 01 da 74 d2 aa 33 bb b4 42 20 f6 06 a1 5d 84 98 15 b7 23 37 f1 b4 d6 a4 71 e4 b8 9d 99 ad f6 92 07 e0 9a 77 80 07 40 f0 36 48 ec 5b e0 c4 49 6a 27 b6 73 9c 96 9d 6a b7 69 72 be cf 3e f6 f9 b1 8f f3 4d bc 41 ac c0 3c 78 b6 e3 77 e1 cb 67 cb 8b 0c ed 7f 9e 05 87 0d 26 eb 0d 5f 5c 45 f9 e3 f2 fd 27 f5 dd 89 f8 7a 83 48 f6 8a 66 1c 67 bc 11 9a 46 d1 a7 47 a1 4a ea 95 78 8c 99 53 ae 12 93 02 96 e6 a0 4c 87 15 8a ef d7 8c ee b2 64 91 d1 0c 1b db 78 1e 28 f7 de d2 5c fb dd f4 a3 bc 7e 8d ef b8 f5 e1 4f 65 f3 d6 a7 5a 5f 07 a4 9e 2b 4f bf a5 9c d3 ad 43 0d c2 f1 d6 a5 66 f5 bc fa bf ec 3d 48 50 f6 02 24 5a 29 3d 20 69 31 98 8a 04 1d b6 88 ad 49 16 72 9a 2f a2 65 50 ff 5a 55 5a 97 37 72 94 24 24 5b 37 cf 9b 9f ad 40 8f cf d8 18 0a 0e 1c 3f f2 30 c1 31 65 88 13 9a c9 8e de 89 b1 0f 0b f2 0e 2f a6 d7 42 be fa f9 20 09 32 ca b6 28 95 b7 ee d0 96 a4 4f 8b 7f fe fe fd df bf fe f8 f0 db 2f 1f fe fc 75 19 d3 94 b2 c5 c5 6c 55 7e 96 15 7b b1 41 09 7d 90 cc 82 66 75 4f 78 d8 7f 40 0d f7 b6 85 e9 26 7d d7 bf ab eb fb 1d dd 63 56 6a 57 f7 26 9e 47 e2 6f 19 e8 52 37 38 c5 31 c7 09 5c 70 60 46 5b 39 a8 5d e9 00 90 7d e9 10 88 9d 99 1a 11 06 e1 06 c9 11 04 09 41 95 55 a4 41 9a f6 e4 81 9d f6 18 98 3c 38 3c 90 84 6f 16 b3 d2 2d 12 52 e4 29 7a 5a 90 2c 25 42 f8 08 0e 73 5a 90 ca 3b 82 b8 ea c9 d2 ee ba 82 f4 b5 40 6b fe a6 b4 21 85 5b 51 cd cd c5 e3 a0 4f 7c 94 1d d4 a6 6c d8 34 67 65 c0 bc d9 ad de e0 6c 57 05 cf 1b fe 94 e2 60 22 75 69 23 84 31 12 f4 1c 4d 09 0d 73 73 68 a8 20 28 25 eb 6c 51 8f d6 50 b0 98 27 e5 07 d6 d1 da b5 cd bd d5 bd 18 a6 78 33 53 73 39 e4 a0 b1 1a 09 2a cd 2a f4 47 aa 33 7a 71 57 fd 05 0e 68 93 37 85 4d 8d 85 ca 34 02 42 d3 1d 2f 2f de 32 82 b2 75 5a 9a 1f 65 09 66 75 26 0a eb 19 91 60 b0 be 15 85 8f f5 b6 31 68 ac f9 ab 61 e6 14 8a 2a ee 0c 31 a8 0a 02 a6 c3 25 de 6d 09 44 e7 0d 99 6c 49 92 a4 fd d8 e2 05 f5 d2 b9 81 4d 52 d3 a4 fa 10 c4 e6 49 1d 45 31 4e 05 66 b4 09 b0 0b 37 69 09 0a 6a 9c 17 8a eb 05 57 6b 42 f7 67 31 27 7a 7f 1e 63 3a f7 a1 31 85 32 07 be 68 6e 75 4c 60 98 b0 dd 60 c9 30 c8 50 42 76 c5 22 0a aa 8f 71 9b 35 28 5a 6d 16 6c 42 9a 02 4e 49 95 4e 5b 18 c2 11 b5 e6 80 ae 70 b4 4a 31 ac 15 33 cc dd 54 42 f6 Data Ascii: Z4)!t3B ]#7qw@6H[Ij'sjir>MA<xwg&_\E'zHfgFGJxSLdx(\~OeZ_+OCf=HP$Z)= i1Ir/ePZUZ7r$$[
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: F-WEBDate: Tue, 26 Nov 2024 07:20:29 GMTContent-Type: text/css; charset=UTF-8Content-Length: 6021Connection: keep-aliveContent-Encoding: gzipFAI-W-FLOW: 1018988014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389P3P: CP=CAO PSA OURUpdate-Time: 1680503039Src-Update: trueOrigin-Agent-Cluster: ?0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-EncodingSet-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:29 GMT; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f ac af cb f4 a1 bc 5c a6 8b 62 97 94 59 91 13 c2 75 96 7f ba 5e 14 eb 62 37 f3 76 ab 9b e4 b7 a3 28 ba f0 46 01 f9 4f 3c bc f0 fc ef 48 b7 0e 14 7d 5a 5b bb 4f d7 e9 a2 4c 97 9a be 94 a8 0d 09 6d fb 41 6c b5 d0 35 e6 3d 11 f8 a4 fd 01 ed 8d 91 d0 13 ca de 78 e4 4d 13 2c 33 9a 1b db 6c 71 b9 c9 1e de a5 f7 fb 0f 55 23 3e 1c 36 9b 64 f7 a5 a7 d4 4d ba b9 49 77 3f 14 ab 2c 7f 53 a6 1b 27 69 c0 2c e4 a6 f4 a7 cb ed 5d 51 16 bf 27 f3 71 fb 31 2b d7 69 2d be a7 e1 92 4a aa 6a 9f 26 bb c5 dd db 34 3f fc 91 c4 67 85 8a 56 90 60 69 9e de 7f a0 12 3e 50 f7 aa e4 30 1b 78 c9 7f 97 7e b1 16 ae 9e 26 89 89 2c 24 2a 43 3e 56 7b 74 ed d0 5f f5 6c 36 dd 29 08 27 13 8e b3 d0 ae b9 98 95 86 4d ad a2 c0 26 23 dc 8f 6c 6a b2 18 35 22 13 f2 f8 1f 3a 35 ed 44 ee b7 e9 22 4b d6 2f d7 c9 7e af Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:20:33 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:20:34 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: F-WEBDate: Tue, 26 Nov 2024 07:20:42 GMTContent-Type: text/css; charset=UTF-8Content-Length: 6021Connection: keep-aliveContent-Encoding: gzipFAI-W-FLOW: 1019971014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389P3P: CP=CAO PSA OURUpdate-Time: 1680503039Src-Update: trueOrigin-Agent-Cluster: ?0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-EncodingSet-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:42 GMT; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f ac af cb f4 a1 bc 5c a6 8b 62 97 94 59 91 13 c2 75 96 7f ba 5e 14 eb 62 37 f3 76 ab 9b e4 b7 a3 28 ba f0 46 01 f9 4f 3c bc f0 fc ef 48 b7 0e 14 7d 5a 5b bb 4f d7 e9 a2 4c 97 9a be 94 a8 0d 09 6d fb 41 6c b5 d0 35 e6 3d 11 f8 a4 fd 01 ed 8d 91 d0 13 ca de 78 e4 4d 13 2c 33 9a 1b db 6c 71 b9 c9 1e de a5 f7 fb 0f 55 23 3e 1c 36 9b 64 f7 a5 a7 d4 4d ba b9 49 77 3f 14 ab 2c 7f 53 a6 1b 27 69 c0 2c e4 a6 f4 a7 cb ed 5d 51 16 bf 27 f3 71 fb 31 2b d7 69 2d be a7 e1 92 4a aa 6a 9f 26 bb c5 dd db 34 3f fc 91 c4 67 85 8a 56 90 60 69 9e de 7f a0 12 3e 50 f7 aa e4 30 1b 78 c9 7f 97 7e b1 16 ae 9e 26 89 89 2c 24 2a 43 3e 56 7b 74 ed d0 5f f5 6c 36 dd 29 08 27 13 8e b3 d0 ae b9 98 95 86 4d ad a2 c0 26 23 dc 8f 6c 6a b2 18 35 22 13 f2 f8 1f 3a 35 ed 44 ee b7 e9 22 4b d6 2f d7 c9 7e af Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:20:45 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:20:45 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 23Content-Type: image/gifServer: bfeDate: Tue, 26 Nov 2024 07:20:45 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 23Content-Type: image/gifServer: bfeDate: Tue, 26 Nov 2024 07:20:46 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: F-WEBDate: Tue, 26 Nov 2024 07:20:52 GMTContent-Type: text/css; charset=UTF-8Content-Length: 6021Connection: keep-aliveContent-Encoding: gzipFAI-W-FLOW: 1020953014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389P3P: CP=CAO PSA OURUpdate-Time: 1680503039Src-Update: trueOrigin-Agent-Cluster: ?0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-EncodingSet-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:52 GMT; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f ac af cb f4 a1 bc 5c a6 8b 62 97 94 59 91 13 c2 75 96 7f ba 5e 14 eb 62 37 f3 76 ab 9b e4 b7 a3 28 ba f0 46 01 f9 4f 3c bc f0 fc ef 48 b7 0e 14 7d 5a 5b bb 4f d7 e9 a2 4c 97 9a be 94 a8 0d 09 6d fb 41 6c b5 d0 35 e6 3d 11 f8 a4 fd 01 ed 8d 91 d0 13 ca de 78 e4 4d 13 2c 33 9a 1b db 6c 71 b9 c9 1e de a5 f7 fb 0f 55 23 3e 1c 36 9b 64 f7 a5 a7 d4 4d ba b9 49 77 3f 14 ab 2c 7f 53 a6 1b 27 69 c0 2c e4 a6 f4 a7 cb ed 5d 51 16 bf 27 f3 71 fb 31 2b d7 69 2d be a7 e1 92 4a aa 6a 9f 26 bb c5 dd db 34 3f fc 91 c4 67 85 8a 56 90 60 69 9e de 7f a0 12 3e 50 f7 aa e4 30 1b 78 c9 7f 97 7e b1 16 ae 9e 26 89 89 2c 24 2a 43 3e 56 7b 74 ed d0 5f f5 6c 36 dd 29 08 27 13 8e b3 d0 ae b9 98 95 86 4d ad a2 c0 26 23 dc 8f 6c 6a b2 18 35 22 13 f2 f8 1f 3a 35 ed 44 ee b7 e9 22 4b d6 2f d7 c9 7e af Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:20:55 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:20:56 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 23Content-Type: image/gifServer: bfeDate: Tue, 26 Nov 2024 07:20:56 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 23Content-Type: image/gifServer: bfeDate: Tue, 26 Nov 2024 07:20:56 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: F-WEBDate: Tue, 26 Nov 2024 07:21:01 GMTContent-Type: text/css; charset=UTF-8Content-Length: 6021Connection: keep-aliveContent-Encoding: gzipFAI-W-FLOW: 1021721014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389P3P: CP=CAO PSA OURUpdate-Time: 1680503039Src-Update: trueOrigin-Agent-Cluster: ?0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-EncodingSet-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:21:01 GMT; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f ac af cb f4 a1 bc 5c a6 8b 62 97 94 59 91 13 c2 75 96 7f ba 5e 14 eb 62 37 f3 76 ab 9b e4 b7 a3 28 ba f0 46 01 f9 4f 3c bc f0 fc ef 48 b7 0e 14 7d 5a 5b bb 4f d7 e9 a2 4c 97 9a be 94 a8 0d 09 6d fb 41 6c b5 d0 35 e6 3d 11 f8 a4 fd 01 ed 8d 91 d0 13 ca de 78 e4 4d 13 2c 33 9a 1b db 6c 71 b9 c9 1e de a5 f7 fb 0f 55 23 3e 1c 36 9b 64 f7 a5 a7 d4 4d ba b9 49 77 3f 14 ab 2c 7f 53 a6 1b 27 69 c0 2c e4 a6 f4 a7 cb ed 5d 51 16 bf 27 f3 71 fb 31 2b d7 69 2d be a7 e1 92 4a aa 6a 9f 26 bb c5 dd db 34 3f fc 91 c4 67 85 8a 56 90 60 69 9e de 7f a0 12 3e 50 f7 aa e4 30 1b 78 c9 7f 97 7e b1 16 ae 9e 26 89 89 2c 24 2a 43 3e 56 7b 74 ed d0 5f f5 6c 36 dd 29 08 27 13 8e b3 d0 ae b9 98 95 86 4d ad a2 c0 26 23 dc 8f 6c 6a b2 18 35 22 13 f2 f8 1f 3a 35 ed 44 ee b7 e9 22 4b d6 2f d7 c9 7e af Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:21:04 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:21:04 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 23Content-Type: image/gifServer: bfeDate: Tue, 26 Nov 2024 07:21:05 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 23Content-Type: image/gifServer: bfeDate: Tue, 26 Nov 2024 07:21:05 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: F-WEBDate: Tue, 26 Nov 2024 07:21:10 GMTContent-Type: text/css; charset=UTF-8Content-Length: 6021Connection: keep-aliveContent-Encoding: gzipFAI-W-FLOW: 1022532014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389P3P: CP=CAO PSA OURUpdate-Time: 1680503039Src-Update: trueOrigin-Agent-Cluster: ?0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-EncodingSet-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:21:10 GMT; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f ac af cb f4 a1 bc 5c a6 8b 62 97 94 59 91 13 c2 75 96 7f ba 5e 14 eb 62 37 f3 76 ab 9b e4 b7 a3 28 ba f0 46 01 f9 4f 3c bc f0 fc ef 48 b7 0e 14 7d 5a 5b bb 4f d7 e9 a2 4c 97 9a be 94 a8 0d 09 6d fb 41 6c b5 d0 35 e6 3d 11 f8 a4 fd 01 ed 8d 91 d0 13 ca de 78 e4 4d 13 2c 33 9a 1b db 6c 71 b9 c9 1e de a5 f7 fb 0f 55 23 3e 1c 36 9b 64 f7 a5 a7 d4 4d ba b9 49 77 3f 14 ab 2c 7f 53 a6 1b 27 69 c0 2c e4 a6 f4 a7 cb ed 5d 51 16 bf 27 f3 71 fb 31 2b d7 69 2d be a7 e1 92 4a aa 6a 9f 26 bb c5 dd db 34 3f fc 91 c4 67 85 8a 56 90 60 69 9e de 7f a0 12 3e 50 f7 aa e4 30 1b 78 c9 7f 97 7e b1 16 ae 9e 26 89 89 2c 24 2a 43 3e 56 7b 74 ed d0 5f f5 6c 36 dd 29 08 27 13 8e b3 d0 ae b9 98 95 86 4d ad a2 c0 26 23 dc 8f 6c 6a b2 18 35 22 13 f2 f8 1f 3a 35 ed 44 ee b7 e9 22 4b d6 2f d7 c9 7e af Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:21:12 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Tue, 26 Nov 2024 07:21:13 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=0&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=0&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=sGCWyK4YEzKrS2O&MD=xlvBVOTx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605606177 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.original.js?_=10026 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605606177 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.original.js?_=10026 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /abdr?_o=http%3A%2F%2Fwww.wheel-done.com HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22M%2FcaOoj0hIWoHDH7%2FLYL79gpE%2FwL0GcCwFB1bEgZcCVLOOOXx8p3JOBATa9bh7kvp0aaMMfkyqpL96Pg03HgBX7g2B3X%2FjGr%2FkhRv5qJoEBU34Cu9w1dKZo41z8bALfm1pkoICCh0J6DdKEItcykD%2Fcn4nTQ5DYh8XHxuNtYNqmodHScw95quJybJjXI3l8SG%2F1JMYFkPms1GJMk2M3L5QbB1E2d5zxwCL%2Fm0NgnnmX2aVaL%2BKFYYIrS7F7gumy4yX70A47a55%2FhYupVDVcosvlZ3USaYsH6%2Bfq4y0MU61hG7%2B2Gqa9x15pi5al7hh2ku9hMPSVSlkQPvN1Pjp3UvkutWes%2BAW6%2BE4SbFs1GJ1FkLHxsOLTmIcpqw9WINv5lOXqpdcODk6Qk0JUKrYCC31%2BIyZIrpiNeqpVkWhmsr9VhLPMedYaXi2fneI5OkbPTkYXkMH6Gw8ABiNUFEXL5ObdS6wTCKessx4YNMnC42EQNZAkvtajtWuGYWSsvWCbHoJMvBBAkuIBGbxYtLk1xoA%3D%3D%22%2C%22key_id%22%3A%22e27381f9d0d847ab%22%2C%22enc%22%3A2%7D&_=0.6455062262011355 HTTP/1.1Host: miao.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22QKsUApL0F%2BYJYOjcQylm4S6nR%2Fbscxvf1sAw%2F1X5keb5y1hnaB7lw408Bqzh%2FnpLIVZGCYk%2BWkPUGJefJIWJsRQ5pKthIAgZh0jHeb56R%2FN6Zm%2B0tkKCNnUA7fRXWmr8%2FapnmqwJG3yq7qczcvdyTFFM5knqTlMXolRPy0AorUCXm8biQsa9ioF2nchjq%2BoQz50%2FhYqyhjUDBtaWa0%2FITmrjO5l0famguo%2BaysqMDw1kn4%2BirlIJDvS0Y03E7lCB72T6hDt51yqTsiSGx%2Fo15pPWJW43F6UrcU0Tq7Kfkqu8YYXakWZzSS0Ai3fRNDah3%2FTNxB%2BYWFXXvL8TlGN59%2BOANg8HEdC2tIOxV0npymHQWm1idHL9a3TvleziNRRe1%2BhJyls8JZZfumizA84jp6ksAke8cYNjQ9a6wrEW%2BFWiNVIPHOrHj1Eq6pQpZpE22it7RhkUnLDg4rGsuKnmKxkF3sc%2FzqkMfCzYPFvh%2B1OilXCKb26ZB6GVqlAR7wSI0OhqKUFz80FLyDO0tujACFlTZDxMclNSV2YfAORumFEcz1bjPEjRxor2lb2JEhGsrMd8n2iEY%2BlPIldGbL3HtvIHt23oh3uU%2FTe4rkthB1JwlXXS2gioeRLzGYPFDIvCLwp2CZ91DSswl%2FXfpUnZpmWaBH2fSzQZnxEfESmJSTkEP4zrqmGpyoOJds1eZgm3aPXnd11vHTZuDJHpeGtjIYGfM61PKVyJduQigMCQKibZGb%2FolBi0BTLbPZRD%2Bc2AHNDxNsrZwcDRl3uFM%2BGotGKaV0kPlNvMRa%2BKJP4ma7CMLGI2T7KyPMVkRrRyv%2Fb%2FxA0UVl3vk1FoLgxpt9fBH1a%2B3%2Fs5wBmM1ZqJAo7lRkYRV3gGHBAUe1FPGpK63NdbiPXlFKKnhJj9qXQJ5bpSpTCvuntkga%2BQtj3rKahFJLHGtn6j9rmuCNEkQuDrCW51tXpURrpGJQj2yrmkbFYhYwjeXXNhlkcbXSWi6mqRWlyQSJfkKuKlyeSkenFOD%2FdemSOCpb1LEf6r8KjDzxJzN%2BbsJZPlM%2FzkHFxiKZVmbZLa1CfL9338vFX4BZJ2fYw4QhGEYBy59VqtUCVx7pP%2FwGUNCD8dPcGkrhOLs6l792uCwSM371PL%2BORsw8Gz9lEtO5t7%2FsrxtgKiZCcS0zooV%2Bd%2Biatx%2BXaKYACVuhR43sR%2FDxMnKsWNRwYa%2FiTV7veQZeDlKxX%2BYiDoFvkcsTSOb%2BEtrZ9DAIM482IB60CiK38%3D%22%2C%22key_id%22%3A%22e27381f9d0d847ab%22%2C%22enc%22%3A2%7D&_=0.6640850790151052 HTTP/1.1Host: miao.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22M%2FcaOoj0hIWoHDH7%2FLYL79gpE%2FwL0GcCwFB1bEgZcCVLOOOXx8p3JOBATa9bh7kvp0aaMMfkyqpL96Pg03HgBX7g2B3X%2FjGr%2FkhRv5qJoEBU34Cu9w1dKZo41z8bALfm1pkoICCh0J6DdKEItcykD%2Fcn4nTQ5DYh8XHxuNtYNqmodHScw95quJybJjXI3l8SG%2F1JMYFkPms1GJMk2M3L5QbB1E2d5zxwCL%2Fm0NgnnmX2aVaL%2BKFYYIrS7F7gumy4yX70A47a55%2FhYupVDVcosvlZ3USaYsH6%2Bfq4y0MU61hG7%2B2Gqa9x15pi5al7hh2ku9hMPSVSlkQPvN1Pjp3UvkutWes%2BAW6%2BE4SbFs1GJ1FkLHxsOLTmIcpqw9WINv5lOXqpdcODk6Qk0JUKrYCC31%2BIyZIrpiNeqpVkWhmsr9VhLPMedYaXi2fneI5OkbPTkYXkMH6Gw8ABiNUFEXL5ObdS6wTCKessx4YNMnC42EQNZAkvtajtWuGYWSsvWCbHoJMvBBAkuIBGbxYtLk1xoA%3D%3D%22%2C%22key_id%22%3A%22e27381f9d0d847ab%22%2C%22enc%22%3A2%7D&_=0.6455062262011355 HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22QKsUApL0F%2BYJYOjcQylm4S6nR%2Fbscxvf1sAw%2F1X5keb5y1hnaB7lw408Bqzh%2FnpLIVZGCYk%2BWkPUGJefJIWJsRQ5pKthIAgZh0jHeb56R%2FN6Zm%2B0tkKCNnUA7fRXWmr8%2FapnmqwJG3yq7qczcvdyTFFM5knqTlMXolRPy0AorUCXm8biQsa9ioF2nchjq%2BoQz50%2FhYqyhjUDBtaWa0%2FITmrjO5l0famguo%2BaysqMDw1kn4%2BirlIJDvS0Y03E7lCB72T6hDt51yqTsiSGx%2Fo15pPWJW43F6UrcU0Tq7Kfkqu8YYXakWZzSS0Ai3fRNDah3%2FTNxB%2BYWFXXvL8TlGN59%2BOANg8HEdC2tIOxV0npymHQWm1idHL9a3TvleziNRRe1%2BhJyls8JZZfumizA84jp6ksAke8cYNjQ9a6wrEW%2BFWiNVIPHOrHj1Eq6pQpZpE22it7RhkUnLDg4rGsuKnmKxkF3sc%2FzqkMfCzYPFvh%2B1OilXCKb26ZB6GVqlAR7wSI0OhqKUFz80FLyDO0tujACFlTZDxMclNSV2YfAORumFEcz1bjPEjRxor2lb2JEhGsrMd8n2iEY%2BlPIldGbL3HtvIHt23oh3uU%2FTe4rkthB1JwlXXS2gioeRLzGYPFDIvCLwp2CZ91DSswl%2FXfpUnZpmWaBH2fSzQZnxEfESmJSTkEP4zrqmGpyoOJds1eZgm3aPXnd11vHTZuDJHpeGtjIYGfM61PKVyJduQigMCQKibZGb%2FolBi0BTLbPZRD%2Bc2AHNDxNsrZwcDRl3uFM%2BGotGKaV0kPlNvMRa%2BKJP4ma7CMLGI2T7KyPMVkRrRyv%2Fb%2FxA0UVl3vk1FoLgxpt9fBH1a%2B3%2Fs5wBmM1ZqJAo7lRkYRV3gGHBAUe1FPGpK63NdbiPXlFKKnhJj9qXQJ5bpSpTCvuntkga%2BQtj3rKahFJLHGtn6j9rmuCNEkQuDrCW51tXpURrpGJQj2yrmkbFYhYwjeXXNhlkcbXSWi6mqRWlyQSJfkKuKlyeSkenFOD%2FdemSOCpb1LEf6r8KjDzxJzN%2BbsJZPlM%2FzkHFxiKZVmbZLa1CfL9338vFX4BZJ2fYw4QhGEYBy59VqtUCVx7pP%2FwGUNCD8dPcGkrhOLs6l792uCwSM371PL%2BORsw8Gz9lEtO5t7%2FsrxtgKiZCcS0zooV%2Bd%2Biatx%2BXaKYACVuhR43sR%2FDxMnKsWNRwYa%2FiTV7veQZeDlKxX%2BYiDoFvkcsTSOb%2BEtrZ9DAIM482IB60CiK38%3D%22%2C%22key_id%22%3A%22e27381f9d0d847ab%22%2C%22enc%22%3A2%7D&_=0.6640850790151052 HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605632363 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605632363 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /abdr?_o=http%3A%2F%2Fwww.wheel-done.com HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_bid=f6231e06bbdccab42ea5585e9afacbc4b64c; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=sGCWyK4YEzKrS2O&MD=xlvBVOTx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605643770 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605643770 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605654028 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605654028 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605662824 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1732605662824 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /abdr?_o=http%3A%2F%2Fwww.wheel-done.com HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_bid=231e06bbdccab42ea5585e9afacbc4b64dab; ab_sr=1.0.1_NTNkN2IwOTIwZjJiZjQzNjY1OGJjNzAwZTc1NGEyMjY5NjE5YWY1YzExZDhmYjE1NzNjMDQ2ZDZhMDgxNDk5ZjA3ZGU0ZTg2NzM2NWFmYTYyNmI0MTE0NTQ1MzIxNjFlNWNjZmI0NDRkNWQ5YzMwYzFmN2RmNDg0YWZhMjI2OGI5MzY4M2QzNTRjYjE4OTEzMjA0YzJmZmJiMTYwNzk0Yw==
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1Host: fe.faisco.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26
Source: global traffic	HTTP traffic detected: GET /dist/jz/biz-shared/bizShared.min.css?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/jz/request/jzRequest.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/jz/utils/jzUtils.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/jz/biz-shared/bizShared.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/jz/locale/2052.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/styles/siteBase2.min.css?v=202408051114 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/styles/base2.min.css?v=202410151713 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/module.min.css?v=202410281356 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/styles/themeMixin.min.css?v=202402221530 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/styles/newSearchBoxStyle.min.css?v=202404081140 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/styles/floatBtn1.min.css?v=202402221530 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /998/fkTheme.min.css?v=20240808102706&aid=28088389&wid=0&isNavV2=true&isBannerV2=true HTTP/1.1Host: jzs.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3115/fkNav.min.css?v=20240808102706&aid=28088389&wid=0 HTTP/1.1Host: jzs.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/4_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=0 HTTP/1.1Host: jzs.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4/4_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=0 HTTP/1.1Host: jzs.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/vue/vue-2.7.14.min.js?v=202310161432 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/libs/comMethods.min.js?v=202402281530 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/libs/jzUtils.min.js?v=202404081140 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/polyfill.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/jquery/jquery-core.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/jquery/jquery-mousewheel.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/jz/request/jzRequest.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/jz/utils/jzUtils.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/jz/locale/2052.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/jz/biz-shared/bizShared.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/frontend.min.js?v=202407231110 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/jquery/jquery-ui-core.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/partitionSite.min.js?v=202410281114 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/site.min.js?v=202411111122 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/module.min.js?v=202410281356 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/jquery/jquery-mousewheel.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/libs/comMethods.min.js?v=202402281530 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/libs/jzUtils.min.js?v=202404081140 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/jquery/jquery-core.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/vue/vue-2.7.14.min.js?v=202310161432 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/polyfill.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/loading/dot.gif HTTP/1.1Host: 0.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/styles/fontsIco.min.css?v=202404081140 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/locater/national_text.png?v=202410141113 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/locater/locater_Arrow3.png?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/frontend.min.js?v=202407231110 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/module.min.js?v=202410281356 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jssdk_1_1/js/hawkEye.min.js?v=202403151700 HTTP/1.1Host: fe.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/site.min.js?v=202411111122 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/jquery/jquery-ui-core.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/partitionSite.min.js?v=202410281114 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/comm/video.js/video-js.min.css?v=202307101206 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/styles/video.min.css?v=202407231110 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/v2/mbg01.png?v=202407221109 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/site/left.png?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/site/right.png?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26
Source: global traffic	HTTP traffic detected: GET /image/loading/loading_2b.gif?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAgj4iFjAYonO_WGjCKDzjYBA.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4/ABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26
Source: global traffic	HTTP traffic detected: GET /image/locater/national_text.png?v=202410141113 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/locater/locater_Arrow3.png?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/site/left.png?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/site/right.png?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/loading/dot.gif HTTP/1.1Host: 0.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/loading/loading_2b.gif?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605599277 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: application/json, text/plain, /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26
Source: global traffic	HTTP traffic detected: GET /ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605599598 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /jssdk_1_1/js/hawkEye.min.js?v=202403151700 HTTP/1.1Host: fe.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /image/v2/mbg01.png?v=202407221109 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /js/comm/video.js/video.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/libs/photoSlide.min.js?v=202408061027 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4/ABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAgj4iFjAYonO_WGjCKDzjYBA.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/libs/imageEffect.min.js?v=202404081140 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAglYiFjAYo6LX7oAIwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAgl4iFjAYoubm42Qcwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/site_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605599277 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAglIiFjAYojfzulQEwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/libs/photoSlide.min.js?v=202408061027 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/libs/imageEffect.min.js?v=202404081140 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/comm/video.js/video.min.js?v=202307101206 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAguoiFjAYohvfQqQUwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAgloiFjAYokPLbwgcwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg_Ofz6gUogJ7O9QEwgA84kwc.jpg HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg_Ovz6gUo67PL4AIwoAY4sAM.jpg HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg1_Hz6gUos_moVjC6BDjHAw.jpg.webp HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAgl4iFjAYoubm42Qcwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605600361 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /api?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=onlineMapCallBack HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAglYiFjAYo6LX7oAIwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605601025 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Source: global traffic	HTTP traffic detected: GET /image/v2/mbg01.png?v=202011021234 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://2.ss.508sys.com/css/dist/styles/video.min.css?v=202407231110Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAguoiFjAYohvfQqQUwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAglIiFjAYojfzulQEwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4/418/AKIDCAQQi_WOvgUY4fSTngQ.png HTTP/1.1Host: 1.s60i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://jzs.508sys.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /push.js HTTP/1.1Host: push.zhanzhang.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg1_Hz6gUo4NKP5wQwugQ4xwM.jpg.webp HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/v2/mbg01.png?v=202011021234 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/v2/mbg01.png?v=202011021234 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg1_Hz6gUos_moVjC6BDjHAw.jpg.webp HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/newInnerFontsIco/icomoon.ttf?-2mgmdr&v=70 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveOrigin: http://www.wheel-done.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://2.ss.508sys.com/css/dist/styles/fontsIco.min.css?v=202404081140Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg_Ofz6gUogJ7O9QEwgA84kwc.jpg HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg_Ovz6gUo67PL4AIwoAY4sAM.jpg HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/ABUIABACGAAgloiFjAYokPLbwgcwig842AQ.jpg.webp HTTP/1.1Host: 28088389.s21i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg1_Hz6gUo4NKP5wQwugQ4xwM.jpg.webp HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=onlineMapCallBack HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4/418/AKIDCAQQi_WOvgUY4fSTngQ.png HTTP/1.1Host: 1.s60i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /push.js HTTP/1.1Host: push.zhanzhang.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/openhand.cur HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/onlineMap/close.png?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://2.ss.508sys.com/css/dist/module.min.css?v=202410281356Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/onlineMap/close.png?v=202104251101 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780
Source: global traffic	HTTP traffic detected: GET /images/openhand.cur HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://www.wheel-done.com/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24811&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline1.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24812&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline2.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24813&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline2.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24811&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline0.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24812&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline1.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24813&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline3.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk86802&v=2.1&seckey=-1%2C-1&timeStamp=1732605606170&sign=8c783803c2fb HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getmodules?v=2.0&t=20140707&mod=map_5t4s3f,scommon_qzcf2k,mapclick_u1fb2e,oppc_dwynzr,navictrl_cgpeke,canvablepath_4aihkt,common_qliwoy,symbol_1t1tgb,marker_doq5jl,vectordrawlib_wqglq1,style_exrf4k,tile_znc1s3&seckey=-1%2C-1&timeStamp=1732605606185&sign=8cfb777cfc75 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk86802&v=2.1&seckey=-1%2C-1&timeStamp=1732605606170&sign=8c783803c2fb HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://www.wheel-done.com/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=95963881&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg1_Hz6gUopJONngIwugQ4xwM.jpg.webp HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/newFontsIco/icomoon.ttf?-2mgmdr&v=49 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveOrigin: http://www.wheel-done.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://2.ss.508sys.com/css/dist/styles/fontsIco.min.css?v=202404081140Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605607162&callback=BMap.logCbk4206044938&sign=8817e55d060a HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605608165&callback=BMap.logCbk6093782709&sign=563b1c95e849 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605609176&callback=BMap.logCbk5542380316&sign=498e4551a420 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24811&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline0.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24812&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline2.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24813&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline2.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24813&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline3.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24812&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline1.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=24811&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline1.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getmodules?v=2.0&t=20140707&mod=map_5t4s3f,scommon_qzcf2k,mapclick_u1fb2e,oppc_dwynzr,navictrl_cgpeke,canvablepath_4aihkt,common_qliwoy,symbol_1t1tgb,marker_doq5jl,vectordrawlib_wqglq1,style_exrf4k,tile_znc1s3&seckey=-1%2C-1&timeStamp=1732605606185&sign=8cfb777cfc75 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/copyright_logo.png HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=95963881&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /2/AD0IidHSCRACGAAg1_Hz6gUopJONngIwugQ4xwM.jpg.webp HTTP/1.1Host: 20228233.s61i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/mapctrls1d3.gif HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/onlineMap/multi_only.png?v=201809101152 HTTP/1.1Host: 0.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/mapctrls2d0.png HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk73838&seckey=-1%2C-1&timeStamp=1732605609720&sign=021634ea5dfa HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/copyright_logo.png HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /getmodules?v=2.0&t=20140707&mod=copyrightctrl_kneba2&seckey=-1%2C-1&timeStamp=1732605609767&sign=0aa625ac9280 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605607162&callback=BMap.logCbk4206044938&sign=8817e55d060a HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53093328&code=load_mapclick&da_src=load_mapclick HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/fontsIco/icomoon.ttf?-2mgmdr&v=182 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveOrigin: http://www.wheel-done.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://2.ss.508sys.com/css/dist/styles/fontsIco.min.css?v=202404081140Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/onlineMap/multi_only.png?v=201809101152 HTTP/1.1Host: 0.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=cen&b=12703713.02%2C2560839.99%3B12704353.11%2C2561320.07&l=17&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk87276&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=-1%2C-1&timeStamp=1732605610224&sign=6e8c8dfcda44 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605608165&callback=BMap.logCbk6093782709&sign=563b1c95e849 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605609176&callback=BMap.logCbk5542380316&sign=498e4551a420 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605610720&callback=BMap.logCbk6219177233&sign=0c25ae630a48 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk73838&seckey=-1%2C-1&timeStamp=1732605609720&sign=021634ea5dfa HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/mapctrls2d0.png HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /getmodules?v=2.0&t=20140707&mod=copyrightctrl_kneba2&seckey=-1%2C-1&timeStamp=1732605609767&sign=0aa625ac9280 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53093328&code=load_mapclick&da_src=load_mapclick HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=cen&b=12703713.02%2C2560839.99%3B12704353.11%2C2561320.07&l=17&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk87276&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=-1%2C-1&timeStamp=1732605610224&sign=6e8c8dfcda44 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/mapctrls1d3.gif HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605610720&callback=BMap.logCbk6219177233&sign=0c25ae630a48 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/setCookie_h.jsp?cmd=setWafCk_setCheckSiteLvBrowser HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D
Source: global traffic	HTTP traffic detected: GET /ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D
Source: global traffic	HTTP traffic detected: GET /js/dist/svg.min.js?v=202411111122 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/report?b_pi=03675761c4b29133&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=0&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2F&u_ru=&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=1552&pe_tt=121&pe_rt=2350&pe_rpt=3790&pe_dpt=17303&pe_wst=8986&pe_fst=26288&pe_drt=9120&pe_ft=26302&pe_hreqt=2064&pe_hrest=286&pe_fet=22227&pe_jst=6585&pe_csst=4918&pe_imgt=7389&pe_ajaxt=1910&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605606177&pe_css_url=http%3A%2F%2F2.ss.508sys.com%2Fcss%2Fdist%2Fstyles%2FfontsIco.min.css%3Fv%3D202404081140&pe_img_url=http%3A%2F%2F28088389.s21i.faiusr.com%2F4%2FABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fajax%2Flog_h.jsp&b_ct=1732605616480&b_rt=1&b_dl=1.3&b_et=3g&b_dc=1090& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true
Source: global traffic	HTTP traffic detected: GET /ajax/setCookie_h.jsp?cmd=setWafCk_setCheckSiteLvBrowser HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true
Source: global traffic	HTTP traffic detected: GET /ajax/module_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true
Source: global traffic	HTTP traffic detected: GET /js/report?b_pi=03675761c4b29133&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=0&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2F&u_ru=&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=03675761c4b29133&b_ct=1732605617389&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1090& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/report?b_pi=03675761c4b29133&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=0&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2F&u_ru=&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=1552&pe_tt=121&pe_rt=2350&pe_rpt=3790&pe_dpt=17303&pe_wst=8986&pe_fst=26288&pe_drt=9120&pe_ft=26302&pe_hreqt=2064&pe_hrest=286&pe_fet=22227&pe_jst=6585&pe_csst=4918&pe_imgt=7389&pe_ajaxt=1910&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605606177&pe_css_url=http%3A%2F%2F2.ss.508sys.com%2Fcss%2Fdist%2Fstyles%2FfontsIco.min.css%3Fv%3D202404081140&pe_img_url=http%3A%2F%2F28088389.s21i.faiusr.com%2F4%2FABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fajax%2Flog_h.jsp&b_ct=1732605616480&b_rt=1&b_dl=1.3&b_et=3g&b_dc=1090& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/dist/svg.min.js?v=202411111122 HTTP/1.1Host: 1.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/report?b_pi=03675761c4b29133&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=0&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2F&u_ru=&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=03675761c4b29133&b_ct=1732605617389&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1090& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=80032489&code=5054&da_src=5054&pic=6 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=89714645&code=5030&da_src=5030&load_script_time=1071&load_tiles_time=3350&map_width=320&map_height=240&map_size=76800 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=80032489&code=5054&da_src=5054&pic=6 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=89714645&code=5030&da_src=5030&load_script_time=1071&load_tiles_time=3350&map_width=320&map_height=240&map_size=76800 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/ HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Source: global traffic	HTTP traffic detected: GET /ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Source: global traffic	HTTP traffic detected: GET /1010/fkTheme.min.css?v=20240808102706&aid=28088389&wid=1&isNavV2=true&isBannerV2=true HTTP/1.1Host: jzs.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/styles/moduleAnimation.min.css?v=202402221530 HTTP/1.1Host: 2.ss.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3115/fkNav.min.css?v=20240808102706&aid=28088389&wid=1 HTTP/1.1Host: jzs.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2/2048_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=1 HTTP/1.1Host: jzs.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4/2048_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=1 HTTP/1.1Host: jzs.508sys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/en/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Source: global traffic	HTTP traffic detected: GET /dist/jz/locale/1033.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/jz/locale/1033.min.js?v=202411131400 HTTP/1.1Host: jzfe.faisys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4/427/AKsDCAQQy_iOvgUY0eC-vgY.png HTTP/1.1Host: 1.s60i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://jzs.508sys.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://www.wheel-done.com/en/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Source: global traffic	HTTP traffic detected: GET /4/427/AKsDCAQQy_iOvgUY0eC-vgY.png HTTP/1.1Host: 1.s60i.faiusr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://www.wheel-done.com/en/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605631122 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: application/json, text/plain, /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.wheel-done.com/en/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Source: global traffic	HTTP traffic detected: GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Source: global traffic	HTTP traffic detected: GET /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Source: global traffic	HTTP traffic detected: GET /push.js HTTP/1.1Host: push.zhanzhang.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605631122 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Source: global traffic	HTTP traffic detected: GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605631424 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Source: global traffic	HTTP traffic detected: GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk15045&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632356&sign=4ea4a809dda8 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /push.js HTTP/1.1Host: push.zhanzhang.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=50602536&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk71768&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632385&sign=ca9adc6fe98e HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49625&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline1.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49624&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline0.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49626&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline2.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Source: global traffic	HTTP traffic detected: GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605632371 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Source: global traffic	HTTP traffic detected: GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk15045&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632356&sign=4ea4a809dda8 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /tb/pms/img/st.gif?ts=4&t=pageview&sid=m3y4npye3nz&ver=5&pid=241&px=12801024&ref=http%3A%2F%2Fwww.wheel-done.com%2F&page=18_1&p=18&dv=6&cmd=open HTTP/1.1Host: static.tieba.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49626&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline2.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49625&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline1.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49625&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline0.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49623&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline3.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49624&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline3.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49626&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline1.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605633116 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49624&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline0.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49623&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline2.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49626&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline1.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2F&l=http://www.wheel-done.com/en/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49625&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline0.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk66656&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632887&sign=378b64229bc9 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49623&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline3.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49624&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline3.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605633310&callback=BMap.logCbk7886880435&sign=3e06f861dce5 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRE6YZsKXUOQfX5KBkpg1DRH%2FbaDnpvEYAWQ_yDjRaaEE%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=50602536&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605634322&callback=BMap.logCbk1399821954&sign=d2ba6044c010 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=16384724&code=load_mapclick&da_src=load_mapclick HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tile/?qt=vtile&x=49623&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1Host: maponline2.bdimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk71768&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632385&sign=ca9adc6fe98e HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2F&l=http://www.wheel-done.com/en/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk66656&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632887&sign=378b64229bc9 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRE6YZsKXUOQfX5KBkpg1DRH%2FbaDnpvEYAWQ_yDjRaaEE%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605634322&callback=BMap.logCbk1399821954&sign=d2ba6044c010 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605635316&callback=BMap.logCbk7744760272&sign=e17821be048f HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=16384724&code=load_mapclick&da_src=load_mapclick HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /tb/pms/img/st.gif?ts=4&t=pageview&sid=m3y4npye3nz&ver=5&pid=241&px=12801024&ref=http%3A%2F%2Fwww.wheel-done.com%2F&page=18_1&p=18&dv=6&cmd=open HTTP/1.1Host: static.tieba.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605635316&callback=BMap.logCbk7744760272&sign=e17821be048f HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605633310&callback=BMap.logCbk7886880435&sign=3e06f861dce5 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /js/report?b_pi=036757da3bf4da65&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=0&pe_tt=0&pe_rt=1627&pe_rpt=1049&pe_dpt=5099&pe_wst=5005&pe_fst=10104&pe_drt=5078&pe_ft=10120&pe_hreqt=1032&pe_hrest=596&pe_fet=8476&pe_jst=3390&pe_csst=1047&pe_imgt=2737&pe_ajaxt=1170&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605632363&pe_css_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fjzcusstyle.jsp%3Fid%3D-1%26colId%3D2%26extId%3D0%26_csw%3D0%26clientSupportWebp%3Dtrue&pe_img_url=http%3A%2F%2Fstatic.tieba.baidu.com%2Ftb%2Fpms%2Fimg%2Fst.gif%3Fts%3D4%26t%3Dpageview%26sid%3Dm3y4npye3nz%26ver%3D5%26pid%3D241%26px%3D12801024%26ref%3Dhttp%253A%252F%252Fwww.wheel-done.com%252F%26page%3D18_1%26p%3D18%26dv%3D6%26cmd%3Dopen&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fajax%2Flogin_h.jsp%3Fcmd%3DwafNotCk_checkMemberSameTimeLogin&b_ct=1732605636259&b_rt=1&b_dl=1.3&b_et=3g&b_dc=1067& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605636310&callback=BMap.logCbk7658843111&sign=c2c7c7c838f9 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/ajax/module_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Source: global traffic	HTTP traffic detected: GET /js/report?b_pi=036757da3bf4da65&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=http%3A%2F%2Fwww.wheel-done.com%2F&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=036757da3bf4da65&b_ct=1732605637152&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1191& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605636310&callback=BMap.logCbk7658843111&sign=c2c7c7c838f9 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /js/report?b_pi=036757da3bf4da65&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=0&pe_tt=0&pe_rt=1627&pe_rpt=1049&pe_dpt=5099&pe_wst=5005&pe_fst=10104&pe_drt=5078&pe_ft=10120&pe_hreqt=1032&pe_hrest=596&pe_fet=8476&pe_jst=3390&pe_csst=1047&pe_imgt=2737&pe_ajaxt=1170&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605632363&pe_css_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fjzcusstyle.jsp%3Fid%3D-1%26colId%3D2%26extId%3D0%26_csw%3D0%26clientSupportWebp%3Dtrue&pe_img_url=http%3A%2F%2Fstatic.tieba.baidu.com%2Ftb%2Fpms%2Fimg%2Fst.gif%3Fts%3D4%26t%3Dpageview%26sid%3Dm3y4npye3nz%26ver%3D5%26pid%3D241%26px%3D12801024%26ref%3Dhttp%253A%252F%252Fwww.wheel-done.com%252F%26page%3D18_1%26p%3D18%26dv%3D6%26cmd%3Dopen&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fajax%2Flogin_h.jsp%3Fcmd%3DwafNotCk_checkMemberSameTimeLogin&b_ct=1732605636259&b_rt=1&b_dl=1.3&b_et=3g&b_dc=1067& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/report?b_pi=036757da3bf4da65&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=http%3A%2F%2Fwww.wheel-done.com%2F&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=036757da3bf4da65&b_ct=1732605637152&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1191& HTTP/1.1Host: datareport.webportal.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/setCookie_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /ajax/setCookie_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /en/ HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.wheel-done.com/en/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /en/ajax/log_h.jsp?_v=1732605638909 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /en/jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.wheel-done.com/en/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://www.wheel-done.com/en/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestReferer: http://www.wheel-done.com/en/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605642413 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveAccept: application/json, text/plain, /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.wheel-done.com/en/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Source: global traffic	HTTP traffic detected: GET /push.js HTTP/1.1Host: push.zhanzhang.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Source: global traffic	HTTP traffic detected: GET /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Source: global traffic	HTTP traffic detected: GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Source: global traffic	HTTP traffic detected: GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk9486&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643765&sign=c3a2f6498151 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605642413 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Source: global traffic	HTTP traffic detected: GET /push.js HTTP/1.1Host: push.zhanzhang.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /getmodules?v=2.0&t=20140707&mod=newvectordrawlib_phku2t&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643775&sign=1aae87229181 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=31034223&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/log_h.jsp HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Source: global traffic	HTTP traffic detected: GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk9486&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643765&sign=c3a2f6498151 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605642710 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605644762&callback=BMap.logCbk4966028254&sign=dc2c45f39f3d HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk27910&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605644934&sign=97db8b984019 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getmodules?v=2.0&t=20140707&mod=newvectordrawlib_phku2t&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643775&sign=1aae87229181 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=31034223&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53200280&code=load_mapclick&da_src=load_mapclick HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605644762&callback=BMap.logCbk4966028254&sign=dc2c45f39f3d HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Source: global traffic	HTTP traffic detected: GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605644548 HTTP/1.1Host: www.wheel-done.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Source: global traffic	HTTP traffic detected: GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk94280&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605645452&sign=b5626638a8cf HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.wheel-done.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.wheel-done.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fe.faisco.cn
Source: global traffic	DNS traffic detected: DNS query: 2.ss.508sys.com
Source: global traffic	DNS traffic detected: DNS query: jzs.508sys.com
Source: global traffic	DNS traffic detected: DNS query: 1.ss.508sys.com
Source: global traffic	DNS traffic detected: DNS query: jzfe.faisys.com
Source: global traffic	DNS traffic detected: DNS query: 0.ss.508sys.com
Source: global traffic	DNS traffic detected: DNS query: fe.508sys.com
Source: global traffic	DNS traffic detected: DNS query: 28088389.s21i.faiusr.com
Source: global traffic	DNS traffic detected: DNS query: 20228233.s61i.faiusr.com
Source: global traffic	DNS traffic detected: DNS query: 1.s60i.faiusr.com
Source: global traffic	DNS traffic detected: DNS query: api.map.baidu.com
Source: global traffic	DNS traffic detected: DNS query: push.zhanzhang.baidu.com
Source: global traffic	DNS traffic detected: DNS query: datareport.webportal.top
Source: global traffic	DNS traffic detected: DNS query: api.share.baidu.com
Source: global traffic	DNS traffic detected: DNS query: maponline2.bdimg.com
Source: global traffic	DNS traffic detected: DNS query: maponline1.bdimg.com
Source: global traffic	DNS traffic detected: DNS query: maponline3.bdimg.com
Source: global traffic	DNS traffic detected: DNS query: maponline0.bdimg.com
Source: global traffic	DNS traffic detected: DNS query: dlswbr.baidu.com
Source: global traffic	DNS traffic detected: DNS query: miao.baidu.com
Source: global traffic	DNS traffic detected: DNS query: stun.services.mozilla1.com
Source: global traffic	DNS traffic detected: DNS query: static.tieba.baidu.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: F-WEBDate: Tue, 26 Nov 2024 07:20:04 GMTContent-Type: text/html; charset=UTF-8Content-Length: 0Connection: keep-aliveFAI-W-FLOW: 1017152014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389Origin-Agent-Cluster: ?0Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.nData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: F-WEBDate: Tue, 26 Nov 2024 07:20:33 GMTContent-Type: text/html; charset=UTF-8Content-Length: 0Connection: keep-aliveFAI-W-FLOW: 1019317014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389Origin-Agent-Cluster: ?0Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.nData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: F-WEBDate: Tue, 26 Nov 2024 07:20:45 GMTContent-Type: text/html; charset=UTF-8Content-Length: 0Connection: keep-aliveFAI-W-FLOW: 1020290014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389Origin-Agent-Cluster: ?0Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.nData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: F-WEBDate: Tue, 26 Nov 2024 07:20:54 GMTContent-Type: text/html; charset=UTF-8Content-Length: 0Connection: keep-aliveFAI-W-FLOW: 1021168014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389Origin-Agent-Cluster: ?0Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.nData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: F-WEBDate: Tue, 26 Nov 2024 07:21:03 GMTContent-Type: text/html; charset=UTF-8Content-Length: 0Connection: keep-aliveFAI-W-FLOW: 1021960014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389Origin-Agent-Cluster: ?0Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.nData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: F-WEBDate: Tue, 26 Nov 2024 07:21:12 GMTContent-Type: text/html; charset=UTF-8Content-Length: 0Connection: keep-aliveFAI-W-FLOW: 1022775014Service-Lane: 560dac0265d6c63cd3bf00ff7039f350FAI-W-AGENT_AID: 28088389Origin-Agent-Cluster: ?0Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.nData Raw: Data Ascii:

Source: chromecache_443.3.dr, chromecache_460.3.dr	String found in binary or memory: http://api.map.baidu.com/getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110
Source: chromecache_410.3.dr, chromecache_309.3.dr, chromecache_358.3.dr, chromecache_201.3.dr, chromecache_284.3.dr, chromecache_473.3.dr, chromecache_256.3.dr, chromecache_345.3.dr, chromecache_230.3.dr	String found in binary or memory: https://dlswbr.baidu.com/heicha/mw/abclite-

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50067 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/487@151/19

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1936,i,7320407238425932596,807607496568096639,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.wheel-done.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1936,i,7320407238425932596,807607496568096639,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	5 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	6 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://www.wheel-done.com/	0%	Avira URL Cloud	safe
http://www.wheel-done.com/	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
wsall.s60i.faiusr.com.wswebcdn.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605644548	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/log_h.jsp?_v=1732605638909	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605671481	0%	Avira URL Cloud	safe
http://1.s60i.faiusr.com/4/427/AKsDCAQQy_iOvgUY0eC-vgY.png	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/log_h.jsp?_v=1732605648714	0%	Avira URL Cloud	safe
http://www.wheel-done.com/ajax/setCookie_h.jsp?cmd=setWafCk_setCheckSiteLvBrowser	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605631424	0%	Avira URL Cloud	safe
http://20228233.s61i.faiusr.com/2/AD0IidHSCRACGAAg_Ofz6gUogJ7O9QEwgA84kwc.jpg	0%	Avira URL Cloud	safe
http://28088389.s21i.faiusr.com/2/ABUIABACGAAglIiFjAYojfzulQEwig842AQ.jpg.webp	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605663355	0%	Avira URL Cloud	safe
http://www.wheel-done.com/ajax/module_h.jsp	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/statistics_h.jsp?cmd=wafNotCk_visited	0%	Avira URL Cloud	safe
http://www.wheel-done.com/ajax/site_h.jsp	0%	Avira URL Cloud	safe
http://www.wheel-done.com/ajax/setCookie_h.jsp	0%	Avira URL Cloud	safe
http://www.wheel-done.com/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605633116	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605642413	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605652686	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605654961	0%	Avira URL Cloud	safe
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605662748	0%	Avira URL Cloud	safe
http://1.s60i.faiusr.com/4/418/AKIDCAQQi_WOvgUY4fSTngQ.png	0%	Avira URL Cloud	safe
http://www.wheel-done.com/ajax/log_h.jsp?cmd=wafNotCk_siteLogDog	0%	Avira URL Cloud	safe
http://20228233.s61i.faiusr.com/2/AD0IidHSCRACGAAg1_Hz6gUo4NKP5wQwugQ4xwM.jpg.webp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
share.n.shifen.com	14.215.182.161	true	false		high
api.share.n.shifen.com	112.34.113.148	true	false		high
fap-76fc5a00.faipod.com	107.150.119.147	true	false		unknown
api.map.n.shifen.com	180.76.11.161	true	false		high
post.n.shifen.com	45.113.194.211	true	false		high
zcmgbipv6.v.bsclink.cn	154.85.69.9	true	false		high
anti-bot.n.shifen.com	163.177.18.92	true	false		high
wsall.s60i.faiusr.com.wswebcdn.com	111.180.138.108	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.181.100	true	false		high
opencdnbdglobal.gshifen.com	185.10.104.124	true	false		high
us-kt0.faipod.com	107.150.104.134	true	false		unknown
opencdnbdsslv6.jomodns.com	182.61.128.141	true	false		unknown
push.zhanzhang.baidu.com	unknown	unknown	false		high
dlswbr.baidu.com	unknown	unknown	false		high
1.ss.508sys.com	unknown	unknown	false		high
datareport.webportal.top	unknown	unknown	false		high
fe.faisco.cn	unknown	unknown	false		high
2.ss.508sys.com	unknown	unknown	false		high
jzs.508sys.com	unknown	unknown	false		high
28088389.s21i.faiusr.com	unknown	unknown	false		unknown
maponline2.bdimg.com	unknown	unknown	false		high
fe.508sys.com	unknown	unknown	false		high
maponline3.bdimg.com	unknown	unknown	false		high
stun.services.mozilla1.com	unknown	unknown	false		high
0.ss.508sys.com	unknown	unknown	false		high
20228233.s61i.faiusr.com	unknown	unknown	false		unknown
api.share.baidu.com	unknown	unknown	false		high
maponline0.bdimg.com	unknown	unknown	false		high
www.wheel-done.com	unknown	unknown	false		unknown
maponline1.bdimg.com	unknown	unknown	false		high
1.s60i.faiusr.com	unknown	unknown	false		unknown
api.map.baidu.com	unknown	unknown	false		high
static.tieba.baidu.com	unknown	unknown	false		high
jzfe.faisys.com	unknown	unknown	false		high
miao.baidu.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://datareport.webportal.top/js/report?b_pi=0367582d98b4c0db&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=0367582d98b4c0db&b_ct=1732605658927&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1191&	false		high
http://2.ss.508sys.com/image/v2/mbg01.png?v=202407221109	false		high
http://2.ss.508sys.com/css/dist/styles/floatBtn1.min.css?v=202402221530	false		high
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605644548	false	Avira URL Cloud: safe	unknown
http://www.wheel-done.com/en/ajax/log_h.jsp?_v=1732605638909	false	Avira URL Cloud: safe	unknown
http://2.ss.508sys.com/css/dist/styles/newSearchBoxStyle.min.css?v=202404081140	false		high
http://api.map.baidu.com/?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk394&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605662833&sign=f2ae8e43acc7	false		high
http://1.ss.508sys.com/js/dist/libs/photoSlide.min.js?v=202408061027	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605609176&callback=BMap.logCbk5542380316&sign=498e4551a420	false		high
http://api.map.baidu.com/?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk94280&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605645452&sign=b5626638a8cf	false		high
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605671481	false	Avira URL Cloud: safe	unknown
http://1.s60i.faiusr.com/4/427/AKsDCAQQy_iOvgUY0eC-vgY.png	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk9486&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643765&sign=c3a2f6498151	false		high
http://www.wheel-done.com/en/ajax/log_h.jsp?_v=1732605648714	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605657349&callback=BMap.logCbk1914489283&sign=d18613173a5c	false		high
http://www.wheel-done.com/ajax/setCookie_h.jsp?cmd=setWafCk_setCheckSiteLvBrowser	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605664831&callback=BMap.logCbk7081181651&sign=69830daf9dbb	false		high
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605631424	false	Avira URL Cloud: safe	unknown
http://20228233.s61i.faiusr.com/2/AD0IidHSCRACGAAg_Ofz6gUogJ7O9QEwgA84kwc.jpg	false	Avira URL Cloud: safe	unknown
http://28088389.s21i.faiusr.com/2/ABUIABACGAAglIiFjAYojfzulQEwig842AQ.jpg.webp	false	Avira URL Cloud: safe	unknown
http://2.ss.508sys.com/image/onlineMap/close.png?v=202104251101	false		high
http://static.tieba.baidu.com/tb/pms/img/st.gif?ts=4&t=pageview&sid=m3y4npye3nz&ver=5&pid=241&px=1280*1024&ref=http%3A%2F%2Fwww.wheel-done.com%2F&page=18_1&p=18&dv=6&cmd=open	false		high
http://api.map.baidu.com/getmodules?v=2.0&t=20140707&mod=map_5t4s3f,scommon_qzcf2k,mapclick_u1fb2e,oppc_dwynzr,navictrl_cgpeke,canvablepath_4aihkt,common_qliwoy,symbol_1t1tgb,marker_doq5jl,vectordrawlib_wqglq1,style_exrf4k,tile_znc1s3&seckey=-1%2C-1&timeStamp=1732605606185&sign=8cfb777cfc75	false		high
http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=95963881&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32	false		high
http://datareport.webportal.top/js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRFwSulxsNHzxX%2FM7CSWzpCF1jWmNnk4sxvMmbG7ZmuMw%3D&is_outside_visit=false&report_type=2&b_rt=10&	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605658020&callback=BMap.logCbk2627632843&sign=50babe7b3c77	false		high
http://maponline1.bdimg.com/tile/?qt=vtile&x=24812&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0	false		high
http://maponline2.bdimg.com/tile/?qt=vtile&x=24813&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0	false		high
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605663355	false	Avira URL Cloud: safe	unknown
http://1.ss.508sys.com/js/dist/libs/jzUtils.min.js?v=202404081140	false		high
http://api.map.baidu.com/?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk66656&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632887&sign=378b64229bc9	false		high
http://api.share.baidu.com/s.gif?l=http://www.wheel-done.com/	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605608165&callback=BMap.logCbk6093782709&sign=563b1c95e849	false		high
http://www.wheel-done.com/ajax/module_h.jsp	false	Avira URL Cloud: safe	unknown
http://2.ss.508sys.com/image/locater/national_text.png?v=202410141113	false		high
http://2.ss.508sys.com/css/dist/styles/video.min.css?v=202407231110	false		high
http://2.ss.508sys.com/css/fontsIco/icomoon.ttf?-2mgmdr&v=182	false		high
http://jzs.508sys.com/2/2048_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=1	false		high
http://2.ss.508sys.com/css/dist/styles/siteBase2.min.css?v=202408051114	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605635316&callback=BMap.logCbk7744760272&sign=e17821be048f	false		high
http://www.wheel-done.com/en/ajax/statistics_h.jsp?cmd=wafNotCk_visited	false	Avira URL Cloud: safe	unknown
http://2.ss.508sys.com/image/v2/mbg01.png?v=202011021234	false		high
http://datareport.webportal.top/js/report?b_pi=03675761c4b29133&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=0&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2F&u_ru=&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=03675761c4b29133&b_ct=1732605617389&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1090&	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605636310&callback=BMap.logCbk7658843111&sign=c2c7c7c838f9	false		high
http://1.ss.508sys.com/js/comm/jquery/jquery-mousewheel.min.js?v=202307101206	false		high
https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1732605606177	false		high
http://datareport.webportal.top/js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTR7eSdvEOrzLa_UeZDolLKyig95q67kRmINT6HiImvcvk%3D&is_outside_visit=false&report_type=2&b_rt=10&	false		high
http://www.wheel-done.com/ajax/site_h.jsp	false	Avira URL Cloud: safe	unknown
http://www.wheel-done.com/ajax/setCookie_h.jsp	false	Avira URL Cloud: safe	unknown
https://miao.baidu.com/abdr?data=%7B%22data%22%3A%22M%2FcaOoj0hIWoHDH7%2FLYL79gpE%2FwL0GcCwFB1bEgZcCVLOOOXx8p3JOBATa9bh7kvp0aaMMfkyqpL96Pg03HgBX7g2B3X%2FjGr%2FkhRv5qJoEBU34Cu9w1dKZo41z8bALfm1pkoICCh0J6DdKEItcykD%2Fcn4nTQ5DYh8XHxuNtYNqmodHScw95quJybJjXI3l8SG%2F1JMYFkPms1GJMk2M3L5QbB1E2d5zxwCL%2Fm0NgnnmX2aVaL%2BKFYYIrS7F7gumy4yX70A47a55%2FhYupVDVcosvlZ3USaYsH6%2Bfq4y0MU61hG7%2B2Gqa9x15pi5al7hh2ku9hMPSVSlkQPvN1Pjp3UvkutWes%2BAW6%2BE4SbFs1GJ1FkLHxsOLTmIcpqw9WINv5lOXqpdcODk6Qk0JUKrYCC31%2BIyZIrpiNeqpVkWhmsr9VhLPMedYaXi2fneI5OkbPTkYXkMH6Gw8ABiNUFEXL5ObdS6wTCKessx4YNMnC42EQNZAkvtajtWuGYWSsvWCbHoJMvBBAkuIBGbxYtLk1xoA%3D%3D%22%2C%22key_id%22%3A%22e27381f9d0d847ab%22%2C%22enc%22%3A2%7D&_=0.6455062262011355	false		high
http://2.ss.508sys.com/css/dist/styles/fontsIco.min.css?v=202404081140	false		high
http://www.wheel-done.com/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605646761&callback=BMap.logCbk8973956757&sign=57d54babd95e	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605666438&callback=BMap.logCbk7242563566&sign=08745cff6d53	false		high
http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=83407359&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32	false		high
http://maponline2.bdimg.com/tile/?qt=vtile&x=49623&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0	false		high
http://maponline1.bdimg.com/tile/?qt=vtile&x=49626&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0	false		high
http://1.ss.508sys.com/js/comm/polyfill.min.js?v=202307101206	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605655021&callback=BMap.logCbk4406923950&sign=3878eae1f10c	false		high
http://api.map.baidu.com/?qt=cen&b=12703713.02%2C2560839.99%3B12704353.11%2C2561320.07&l=17&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk87276&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=-1%2C-1&timeStamp=1732605610224&sign=6e8c8dfcda44	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605648766&callback=BMap.logCbk9348424000&sign=6391d8f0bbc3	false		high
http://maponline1.bdimg.com/tile/?qt=vtile&x=24811&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0	false		high
http://www.wheel-done.com/en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605645776&callback=BMap.logCbk6226715041&sign=2072cc6b2c46	false		high
https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1732605632363	false		high
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605633116	false	Avira URL Cloud: safe	unknown
http://www.wheel-done.com/en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605642413	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605644762&callback=BMap.logCbk4966028254&sign=dc2c45f39f3d	false		high
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605652686	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk73493&seckey=QjkmsigYB6FtJVS1%2B1zLo9pV82ijWeQ1eQUvJVIpGCI%3D%2CmT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc&timeStamp=1732605671426&sign=a42e1535599b	false		high
http://maponline0.bdimg.com/tile/?qt=vtile&x=49624&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0	false		high
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605654961	false	Avira URL Cloud: safe	unknown
http://www.wheel-done.com/en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605662748	false	Avira URL Cloud: safe	unknown
https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1732605654028	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605610720&callback=BMap.logCbk6219177233&sign=0c25ae630a48	false		high
http://1.s60i.faiusr.com/4/418/AKIDCAQQi_WOvgUY4fSTngQ.png	false	Avira URL Cloud: safe	unknown
http://jzs.508sys.com/2/4_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=0	false		high
http://www.wheel-done.com/ajax/log_h.jsp?cmd=wafNotCk_siteLogDog	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk71768&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632385&sign=ca9adc6fe98e	false		high
http://2.ss.508sys.com/image/locater/locater_Arrow3.png?v=202104251101	false		high
http://api.share.baidu.com/s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/	false		high
http://2.ss.508sys.com/css/dist/module.min.css?v=202410281356	false		high
http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=88431406&code=load_mapclick&da_src=load_mapclick	false		high
http://2.ss.508sys.com/css/comm/video.js/video-js.min.css?v=202307101206	false		high
http://api.map.baidu.com/images/mapctrls1d3.gif	false		high
http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=89714645&code=5030&da_src=5030&load_script_time=1071&load_tiles_time=3350&map_width=320&map_height=240&map_size=76800	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605607162&callback=BMap.logCbk4206044938&sign=8817e55d060a	false		high
http://2.ss.508sys.com/image/loading/loading_2b.gif?v=202104251101	false		high
http://jzs.508sys.com/998/fkTheme.min.css?v=20240808102706&aid=28088389&wid=0&isNavV2=true&isBannerV2=true	false		high
http://20228233.s61i.faiusr.com/2/AD0IidHSCRACGAAg1_Hz6gUo4NKP5wQwugQ4xwM.jpg.webp	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/getmodules?v=2.0&t=20140707&mod=newvectordrawlib_phku2t&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643775&sign=1aae87229181	false		high
http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53093328&code=load_mapclick&da_src=load_mapclick	false		high
http://maponline3.bdimg.com/tile/?qt=vtile&x=49624&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0	false		high
http://2.ss.508sys.com/image/site/right.png?v=202104251101	false		high
http://jzfe.faisys.com/dist/jz/locale/1033.min.js?v=202411131400	false		high
http://jzs.508sys.com/3115/fkNav.min.css?v=20240808102706&aid=28088389&wid=1	false		high
http://jzs.508sys.com/3115/fkNav.min.css?v=20240808102706&aid=28088389&wid=0	false		high
http://api.map.baidu.com/api?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=onlineMapCallBack	false		high
http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605634322&callback=BMap.logCbk1399821954&sign=d2ba6044c010	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.map.baidu.com/getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110	chromecache_443.3.dr, chromecache_460.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.85.69.9	zcmgbipv6.v.bsclink.cn	Seychelles	35916	MULTA-ASN1US	false
14.215.182.161	share.n.shifen.com	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
112.34.113.148	api.share.n.shifen.com	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
180.76.11.230	unknown	China	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
107.150.119.147	fap-76fc5a00.faipod.com	United States	135377	UHGL-AS-APUCloudHKHoldingsGroupLimitedHK	false
107.150.104.134	us-kt0.faipod.com	United States	135377	UHGL-AS-APUCloudHKHoldingsGroupLimitedHK	false
154.85.69.10	unknown	Seychelles	35916	MULTA-ASN1US	false
182.61.128.141	opencdnbdsslv6.jomodns.com	China	58540	CHINATELECOM-SHANDONG-JINAN-IDCJinan250000CN	false
153.3.237.19	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
45.113.194.211	post.n.shifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
111.180.138.108	wsall.s60i.faiusr.com.wswebcdn.com	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
163.177.18.92	anti-bot.n.shifen.com	China	136958	UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	false
185.10.104.124	opencdnbdglobal.gshifen.com	European Union	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
180.76.11.161	api.map.n.shifen.com	China	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
182.61.244.229	unknown	China	38365	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562876
Start date and time:	2024-11-26 08:18:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.wheel-done.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/487@151/19
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 93.184.221.240, 172.217.19.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 172.217.17.42, 172.217.21.42, 172.217.17.74, 172.217.19.202, 172.217.19.234, 172.217.19.170, 142.250.181.106, 142.250.181.42, 142.250.181.74, 142.250.181.138, 172.217.17.35
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Input	Output
URL: http://www.wheel-done.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://www.wheel-done.com
URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	{ "brands": [ "Wheel-done (Shenzhen)" ] }
	{ "brands": [ "Wheel-done (Shenzhen)" ] }
URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	{ "brands": [ "WO" ] }
	{ "brands": [ "WO" ] }
URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	{ "brands": [ "WO" ] }
	{ "brands": [ "WO" ] }
URL: http://www.wheel-done.com/en/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	{ "brands": [ "Wheel-done (Shenzhen) Logistics Co., Ltd." ] }

URL: http://www.wheel-done.com/en/ Model: Joe Sandbox AI	{ "brands": [ "Wheel-done (Shenzhen)" ] }
	{ "brands": [ "Wheel-done (Shenzhen)" ] }
URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	```json{ "legit_domain": "unknown", "classification": "unknown", "reasons": [ "The brand 'WO' is not clearly associated with any well-known or known brand.", "The URL 'www.wheel-done.com' does not match any known legitimate domain for a recognized brand.", "The URL contains a hyphen, which can be a tactic used in phishing to create a domain similar to a legitimate one.", "The domain name 'wheel-done.com' does not provide any clear indication of a known brand association.", "The input fields are unknown, which makes it difficult to assess the purpose of the site." ], "riskscore": 7}
URL: www.wheel-done.com Brands: WO Input Fields: unknown
URL: http://www.wheel-done.com/ Model: Joe Sandbox AI	```json{ "legit_domain": "wheeldone.com", "classification": "unknown", "reasons": [ "The brand 'Wheel-done (Shenzhen) Logistics Co., Ltd.' is not widely recognized, making it difficult to classify as 'known' or 'wellknown'.", "The URL 'www.wheel-done.com' contains a hyphen, which could indicate a phishing attempt if the legitimate domain is 'wheeldone.com'.", "There is no clear indication that 'Wheel-done (Shenzhen) Logistics Co., Ltd.' is commonly associated with the domain 'wheel-done.com'.", "The presence of a hyphen in the domain name is a common tactic used in phishing to mimic legitimate domains." ], "riskscore": 7}
URL: www.wheel-done.com Brands: Wheel-done (Shenzhen) Logistics Co., Ltd. Input Fields: unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	807
Entropy (8bit):	2.722518518658819
Encrypted:	false
SSDEEP:	12:zSbBaxFaXl8e8JR4YNSR8buiuSLAbX87XwMreYaQ04raDFTsWqoDe5lV5+ejZl9x:GGF+ed4RU0T6XneYalTte5l7+ejb9Br
MD5:	AD1C41692C6E63785FF31E7D11F1970C
SHA1:	802B64D5CB7E5F13D53AECC8B7D76F867EB2D79A
SHA-256:	1DAFF9A9C6D7F19DE562A7BFA8B9082C1713C808BC003A206D9C762D13971C66
SHA-512:	FE94ADB6303B0ED52037D5304F9EFF530BFB4E20BF4BE6F612DCBCE7F2A653D5EB066AB9847E08410A242C7AE192C82E5391C1CD8CC835B85B21DFB5747AAB23
Malicious:	false
Reputation:	low
Preview:	GIF89a..................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...........................................................................................................................!.......,................;

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=16384724&code=load_mapclick&da_src=load_mapclick
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 108737
Category:	dropped
Size (bytes):	38649
Entropy (8bit):	7.993122917913921
Encrypted:	true
SSDEEP:	768:9Ml8lwVqRBM+zfA3MtDlz3xOtMEtIkO3mx89baGMFSdE9bYEp:9MR+zfm8Dlst1da9uhS29cm
MD5:	569BF1429C15ABC86E328B608E2E2833
SHA1:	13117DFA6DC2353AB6DB1AC2FAB4BBE6AFE2C68C
SHA-256:	2EFD8CEF1C151193D1B29171905E10BFB000A1132080BF3303206271265771ED
SHA-512:	C460B39ADF33856A737EFAA529B1AAD215F690D4E1FE803B1F23D1211689A50B9F7123AA5AB7B3694385B70CA94F18010D823B99AB470489E0378F5072CCC160
Malicious:	false
Reputation:	low
Preview:	............ys.F./.........h)y.......;..[q.G.QA.P.M...J.E..~..=.@..S..................o;.Wz....z.... %..;_.........yr..;..+\|y..:..tgULu..\..w^..].zHY.....o....I..E.(......z....Y.r..?-......d..z:....t5.c.......d`..5I.=..f..X.#.'Q..5p1/...e^..c.....!M.Z.D.%.......N.T9.et.....<......n7.....n.y.#[~.&#..t...y5...6.c....~,....U.....Yq..F4(V.s]....y9o...%-k0.A.Y.......A...qw....nb.nY.M.O.\|.C.s...>.zv..).N..l>.<..x.E.:]fU......^...L..w.........eY..P..Iy.4/.F.j..#.R.zfbH.....$k&....60.....:.e.^qk....z.........)T....7N..wB.7.y.{E..7....d..hbP...5.tFs..bU..^..&..A...pT>..s]\4..r.?.N....4.=t.>............#.-Q\|.I...n.x..hP..FM..,t....a....Q.J..g...zR....A.a.B.(.kl..YT..Wc....G..i...i2M....0.9a.O..P.....)$34.Q..b...6._f....ME....g.I.M]7..).._.5...f.p...t...6.nzw/....q..P..y...C3..r.....1..c7..\..M.........N...a.....4.<.G\.Qz......<E.?.e.......A.0..W.].......s.;....:...;..B.J..b. .-pY.2..;.7.l...DZ.\|q...kU..xc..xf..B.6.X^KO..Z..G~.....vl..w..

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 59030
Category:	downloaded
Size (bytes):	21781
Entropy (8bit):	7.987954642142
Encrypted:	false
SSDEEP:	384:9Ljjkfac1gOYHKOAlI+F2NmmmWqvyhUvTIQr3EvmBHIM2WeVDE6N:9wfac9kNmmmtKhIF3EvmqlqC
MD5:	07F9E5E007EDE4A40B91FC1CE6072CC4
SHA1:	9672B92A822D75EE689E28F462FDE70F15917660
SHA-256:	4306A8A4F5EBBD057F249396703B7D44F8F4A42054E30517DF4A3D74BAA0EDBA
SHA-512:	0E3490E14FBD6293E09AF2C3BFDE2BD6A134177280868F989A41A8D215B3DC608545756FF56AEA14CBF4533418BF7ED3AD5F7FF323C175E7350654257D5229BC
Malicious:	false
Reputation:	low
URL:	http://jzfe.faisys.com/dist/jz/request/jzRequest.min.js?v=202411131400
Preview:	...........ks....]......$.h>f.V3... ..x....=Puw6PDwU..x...m.d[..;VZo.".a9..{..vH...F..x.....sNfVeU.@.... .UY....\...j....Y.;.Q...?.l........ .8O.."....4.....`(F~ .V]....t,:....v\KW..$K7...M...h'.k.^...8.{..S?....b1.9....T...9.....l@0.4..8.\|.Q[........K.m.....N....D$...^.NE.\.\M..8.."~[..&i4.G.?NDd.}.v#..QP..bC..&aD}l. ......q..4.i\|..........y6....A.r\|.v..N.. ..c..$..`iI.$H..:.rt.^.\|q........5-v.....6...12.\.v......@w./.0..r.U._.P..B7.......j..:....pp.z..\|..f=...%.........Hx.H..nG.[..6.-.. .......9.....9..$.b..77k.aK.(%.......T.P.P..H...lVo..{6.OR....so...vp.4/"?Q..V.j.......p.w4..@O....v..U..M5%.:..,...2..._.<...&=.E..}cu...4..E.U........i...Y.@...k(w.. .7../....N.z.-.Q.N...f.B.F.g!..N..ot....H3..f..P.......f<.....-.....i..J`....BJ3.&..[....f...+.F..4.REV~.;.?.r..............L...P%wV....;p.#-.s..F.E-...C..f......#.X.DL.I-.k.4.....2-.@O..y.@4?.[...PD..._T.F.<.QM..6I.v..W[Xy.MDr..........6..,.l.<.j.:0.......f@.`h.Xa.a.

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x915, components 3
Category:	dropped
Size (bytes):	48652
Entropy (8bit):	5.811610122236321
Encrypted:	false
SSDEEP:	768:XGt8AYUXZfBD6yq7C/Oi/0BGGRC+LT6+A08ix:XVAYUzz90wGRfS6
MD5:	8BB122A50981E23EC67FAE3F777F7A1D
SHA1:	B6CE4A9230D5C8A6B6A7AF476A2C59E91B42DE1C
SHA-256:	C0BBB643A950E11F7834BF570A880D143099218864EE54856BC0421BA3CAF58A
SHA-512:	24DEDE36267984A75322F701D934495C94372F785A0075A62A3E58017E953A3D16D55B7BFAF22AF72426B0C582529459573BBAA6848613EE601892E52E894F95
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......P...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0C7967EDC3E611E9BCD0B6F55407B5FA" xmpMM:DocumentID="xmp.did:0C7967EEC3E611E9BCD0B6F55407B5FA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0C7967EBC3E611E9BCD0B6F55407B5FA" stRef:documentID="xmp.did:0C7967ECC3E611E9BCD0B6F55407B5FA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 46666
Category:	dropped
Size (bytes):	13745
Entropy (8bit):	7.985839666606708
Encrypted:	false
SSDEEP:	192:w7ZNW/mdI3bP219J15IH8IU8okmWw3WIfkeF9Vbr/y8hRqBGJ4W97LXii1xlgdg:w7bQaj19LiHNXmPseF9py8hCf27miOdg
MD5:	C38B49BC7F1AB04879E9887DFBC5CF90
SHA1:	1049BE905A301FD9E2F5D6E79074A28B4FB95B50
SHA-256:	86D06AD59DDA87D9F37D516EC34970913C051793CBC77281853DD4B1E37E8B4A
SHA-512:	AAD5C46D7602CA1E7EAC2E3BB8291170A245727756EF16D476161FA9165E53DAFA2951DA0855650EAFBA2BD0C50DE3D8665DCA589A3C744CCA82924178C02601
Malicious:	false
Reputation:	low
Preview:	...........}k...v._Q.k..b....{W.N[-.....H......b.DjEJ.d$..87v..6.8p....?...'.....7...rN=."EJ.A....:u.T.S.z.M.g..'.R.4..S.P.vv.G.q..e6":...:3c.....ba.C....&..R$...4..Z..9o..(.[.qN..=q;..0.a....N.T)..[k0..}.5G.=u...}....7.p,=cfv..yo...k..K...w.[.K...i~...Qdf......%...;.......e.N.C.~..<f_...'.F%W..y.Z\|./.[.Z.G...r).....b......&...V..y.B..E~!.t..V.w...%..Us...R3..g..V#.S...v^..../..Y.C.i.....IQu..$%P-...........%V_..c.M ]...Q....#X...N.#.E2\Jh.e..I.8.."u\B..k...2I.T..IR;.@H...y.....F.c:.i.$(.T.<.)...R5...p.f...~...&........?..F.y../1...._.F....8.,..5.).zc.J.#..&.r.:....7.g..b.).Hg.q.}..C.\|...R.Ur..!.u{].U.e..rYD...Z.U...!.,.....E....+.h.....EZ..&.....~ .9...2..ABc._i.J.P'....L......0,....A..d6.b..h.v...z.. ...0..Wi....9`h.0o+/.....y...cI_.#....!z...6.\.Y..w.R.j...sB.I..%......(........Z.f..1....<......z.R...F...T.O:.\..:_7..[..7....'.o..st.%x..I..J,.t=).gC......IX.O.b.$R.O#.#&.?x2.....l...~..J..#@...~....rZ*......H4.[H...b..{S......

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 53 x 74
Category:	downloaded
Size (bytes):	899
Entropy (8bit):	7.198420854395978
Encrypted:	false
SSDEEP:	24:SxAjoIfn5+vbm2/4Ox/S9nLM9VQCY958v6n4SmcCb6h:4AUOj5Q6xfCSiamcC8
MD5:	022EB20BAE35A4009D60D4235FA1940C
SHA1:	49B5B675A0891844CE0A0FCD4169BCC2117BC6ED
SHA-256:	AF7B710DB4D1D92C0B30B13F81145966E831B19612AE8D3E8E13768E20982230
SHA-512:	E23EC160A700B0FF37A1C3FEB7CD205BA9ECF93FAEBB5E1A01722058CCF9DBB8C6C531873B6922ED504D4498150E1A01AF4A84C500A89146B0E790EDFFE89DC8
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/mapctrls1d3.gif
Preview:	GIF89a5.J.......~~~\....................................................v...................................................................................................................................!.......,....5.J....@.pH$v..r.l"..sJuJ....`...vl.z.f1y.6..^7......:....O\|}\.OGz..p...SYJ..TQQ.~.E....................l.............................................................................t..pn..u..+.-C....L........D@@......j......(:..!Z.]..}t.@.Hu.".S..........`...5o.......&......F.....x$.<...j.{..H.7...`.....[7....Fr.Y.....)X0.....m0..?*..N+...F.....WaR.k..L...J.`Y"....,.(.4....B..Y..}.A..-.k.\|. ..{....cw...o.c.\W.....W...q..IW....e.L..'.p.......}C..U1..d[as.gh.3.6.Q&Nosa6.f..8.b.fh.+.j.... .(.#^B.(.h"........#..^...7..#.9..#.+.(b.,.y.A..O.B.X.$..H..0."...(%..0`.O:.%.dM...a&2&.U...i.2&.^.i$.@Nr..N6)".b.8c...:h.y..b.(.b...hc..&.f..>.).....;

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 16934
Category:	dropped
Size (bytes):	7070
Entropy (8bit):	7.963298998073958
Encrypted:	false
SSDEEP:	192:CW2WHqgk+rayGI7JuuzkErb/Tt1rGlEA3v5mZvPFFH8V1QuhLt:CW2Wy5yGkJbzUEZvr8V1Qudt
MD5:	472C66EC1A160CADBD3B476DD85837BE
SHA1:	641E9E5B1C65A3F41D33CEBA6DD76BF3FFA7D66F
SHA-256:	BB67BAB64A93E0F6746D6998B480CE3A276263DB51026011F963DDAE1AF75086
SHA-512:	A6DA6713B2A75E98DE4890444D073B25E9A7B77458F62CA8EA33DDE9D4A05357F73E3F98F637EFB784C0E0CCECE4CA7A40F2BF18353C9D2E5E7393822DA0FDEB
Malicious:	false
Reputation:	low
Preview:	...........;kw.....p.9........+..I;...f......8.....%...tf.=.9.znmm......a....4.eI.-.7.+....m.....o.$.(M......2...oi......;.I&..<.u6../....n.0./..8.q0.3.9.(...Y..O.e.rB.tx@....9.."-fcN.....i.....I.0..g5..e.F....Rls\s...7p..@.j..r..K..p..Z..y....-..>..<~.My...j..`.[t....?.<..g..,.......K...E6.....cYP8.b..)...".kz.n.b+f.l<..8..b_..F..;...n.+.o~.......\...~.O...SM.....w..d..bG.f..gTt..f.....$,.{.y=..`+......\|..'.(...yq.]i.Q?g$B...q..W.!...,..tR.+..M.t..$5....b.%./.,+g"$....za.Z.Q..9..A..s=5.FW.E..S...yfz.\|...=..M....;.a....f.5...^AI.E.......{z.D.a,.NcZ.z]..}2..pE1cR....{.X......\.^.`.......t.....4.L..N.)`w0z...,../.I...MV.~eH=....(...L~2.....%K..W~..Q:.9.o.vr......Ch[..b?.....E:.:(_.wv..P.,...,O...xB.W........ ..nK......J.....PD.....Ze;.-..D.VO"G..O.....=HG.4.... ..@...8..r... QAk..]..F..........=.i..`.\|.?..G...e....N.\...m./mm..8GJ....U.5..T...w.f...x.....P..8?.......(...}`.%}.........<..oT.Z8..yK.h.q%.C.....Cco[.

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	130434
Entropy (8bit):	7.998278136840757
Encrypted:	true
SSDEEP:	3072:TPw2PYH/mri5BLFOMU+ouP05X6XAD2wlGzE9KhdoxLXFb:Tg/mWrLFe+ousMQSmGI9KhEFb
MD5:	AC1B06B959A57AF3CC15E5A3AF920ED2
SHA1:	86FDECC60140AC10B08D1405DDEA4BB9A1615F5A
SHA-256:	D90F9840A942325B75E3A76896FD9F90368C566213A9A924FE3E5D168498399E
SHA-512:	DFB647370418C4BB865C1D5104F9FCF7EF62E83A4D1F72D703D8E371A29FE7EB2EAFEDEA184AB5B51769E626F10572CD10886940754CD9ACA9AF42DB90666790
Malicious:	false
Reputation:	low
URL:	http://28088389.s21i.faiusr.com/2/ABUIABACGAAglYiFjAYo6LX7oAIwig842AQ.jpg.webp
Preview:	RIFFz...WEBPVP8 n...P......X.>m2.G."..'T..`..M.a..F?.<....y...........q....\|....7o9`.o..r........}....g...{!..........<.M._.C.<.........[.....<../....{.S.....\|^.?...^.^{...............I...W.O..v...........c...../....._...~A.......................,.....;.o...W.O.?._.~..............O...}?.I...../..F.4.......~M.........../._....C.........'.G.?...~K.U@......G......+...O./......../.....~]}..S...........?..o.../..O...........C.........~..K............[...e.k..........}................W..fb.I.v.VQ...1o$.=k../...L<.A.p.,.;.4._y...........&j...k...j..'.{.F..h;l......BI..%.f-....2.e.6.[....;.."N....Q\|1.....giB...#2Yo...nn..;..v.V\|.......\|).f......u..e~._..........$p..s..N!...}.5.....7..v._....._]Al...MW.m.s3:..}.c[3...g53...#.....]......K..+....3..m..&M.T.......U..-......o...F.......E._... h...1.....l....E....@..D..F-.U.O&.....Bf\|5;........q=e.3\.Hp{...VT...o$.KO.<..]..7}..QQqE^......w..y.4"7.._Jg.9..Q../'_......v.H2...c....J._..\|..&..8..Pe~..o..C.GZ!.F..xR..

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 8636
Category:	downloaded
Size (bytes):	1372
Entropy (8bit):	7.833789927379505
Encrypted:	false
SSDEEP:	24:X5pcpW/dDBbRr7y9GL1BBSSc0HpnsPH+fsGvxJLZynTgdNOAbzwGf05tuQQpR:X5pzJpRrMGx2f0HpsPefsklZ+Tg+Abz3
MD5:	C81B02D23CB64D92A41D3D825B7CAE33
SHA1:	96E0B5DD801837B321164D3CABF34C244C6631C7
SHA-256:	07004258F41C6BD9D3106D2F26581A4FC2A494597EA3B3757338C3E465461E28
SHA-512:	0624089DAB8078DB9438FBE27124753042123F327564024201CAED5A52C9D120CE8E337E2D689BC91F4F51EEB1165DE451FE21DF2273128CEFA86D8948D97501
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/dist/styles/floatBtn1.min.css?v=202402221530
Preview:	...........Ymo.6..+..%.d..(.P..b.P.....TP..s.EC.. ...%.M.L...rA"J....xGy.....V.d..?....}.8h.....Q.......5....}...l%.MA?.U....5/...b.h..(..KZ...-i........d..y^....4...L.I#S.W.xH>qR.Z.f.....t......F......K..M.ByC?#..!...U....SKs^....d. 7{CK.L.t-j.pQ&.-p.oi...f..~]&.n-Le.nx3.>.)...BJQv..;W.(...uz.....kL...Ti...y......#......K\|!...e.]&..._...xd..\WbS..;....m.O...M....9...$CD.2...ciF......Z_.[_.9......@9[6.....!.}..(.\|.z<.D.........(.A..F.\|.H;.Hp...H..0.... .yG.\|.~.s%;...w?..~..^."tU.\...b.....x..f...Z.k.....-(..).6..2.m<....x....8.zcy..v..5s.k.B.......{...R9.r.\..Xv'..0....V....".M#V........?./.F.k.fs..2=0.Z.[..^..N%....j....I-..O... =#.B"...m..%.e..&2L.e.C.......>v........S]g."...w...8k....~?}..!...A..l...x....c.).sF.iG`..3..s?g......&.+i.!%.0...W....p.&.+...Vb.S.+........4..Q..b.............v....G..TA5..@..v.......U;.e!.kGF...-...j..@W;X..j.c..&"....d....h..JZ.!Ub.-..........%....hG..k......\......\......4]'8.:.A...]'....b?....

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.8983783655120074
Encrypted:	false
SSDEEP:	3:UR89KCmHycSWFeoCmHycSWFFsHfeSXiMn:U29ZZGefZGFs/F
MD5:	795927B89FC27357976A7F9A67A6CF13
SHA1:	191C004F0441B6F6C4FD0CF5AC897186CFB2A95A
SHA-256:	6E6F41B20E02AD5D5EF3CB3A03513BA2A65314E0311C3727EF2F888A6E385464
SHA-512:	7AB873940637FF5D6885B23CE2E57C53AECCBCF6935D3604C66C5F42458DC28DF54C6FF53E0A36A91239276BA532121A9D4537DF4A542BC405494237CBF51544
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605646761&callback=BMap.logCbk8973956757&sign=57d54babd95e
Preview:	/**/BMap.logCbk8973956757 && BMap.logCbk8973956757({"result":{"error":0}})

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.924055859159171
Encrypted:	false
SSDEEP:	3:UR89KCmHyWX5VAJDDdroCmHyWX5VABewWgHfeSXiMn:U29ZZQ5VARdfZQ5VAoM/F
MD5:	844951819AD23466CCE9EB998C21F94A
SHA1:	85DEFF5D5D346EC0FDB314CF9D687821AC7278F1
SHA-256:	8F9EDCA4048F6F0B919EF855802538C5B6EAE98DBEC6350AAC79BB9276239AFF
SHA-512:	40FED4DA3A627E4AFA76D9690B4C7DF7E4E4C36D9030FBE765E5680765221A0FDB449AE079E87176D2B6E34FF1A94859AEFF849169B663C2F1F9AF4FE5D635EE
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk8321850506 && BMap.logCbk8321850506({"result":{"error":0}})

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 76186
Category:	downloaded
Size (bytes):	24686
Entropy (8bit):	7.988995846983692
Encrypted:	false
SSDEEP:	768:RsGZw6vW+RIPoh+L+l0CagTqTINPozZags0CD:il6v1IgxahTINPofhI
MD5:	C1F003207EFE84957B62F5487097E936
SHA1:	2579898B2EBF0358CA344AEA9DC430E5D9B01A3C
SHA-256:	2D6289C480DD06119D038BC8E044804537D722FBCA0678FC0F9FB8D7261E27DD
SHA-512:	634B9693D6FFD1AED6CA8F03AA80B9CCE73BC9319235523C2C265110CF0A2D21D29FD8E03D2B34C1C3BF7A016BCA8A6389D1715F52BDC1049AEB877D623DB6DB
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/dist/frontend.min.js?v=202407231110
Preview:	............{..u(..4!....f._$..;.%Y.H#y...&9..n....h.h>..\|.o.;.I.\|....I.....;.wo^~.1.........4I....Ol..T.S...c.p...?.t.L.s-<..7H4.I.^xX.N.a.....I8...>...\|N...&..2..C?..o....S.^....^.........@.....zV...=9F.\\..M9.~..A..C,h....M=...<.Y.T..c7.x.ywmm}.VG..\|30C3...{i5.S2.;g..p.#..G>..'^.&a...K+..2.K.a\|/i... N....v.'._...i.&!.....A..5...]m.{...... ...O4..9M.s>..a.....A...^T..7O.Y.=...B.....E.{Q....\|ti..+..._..\|\|i..+.O/-o5..`\|y.Vy...R..X.oP:i.{.F~.kX.kp...irg...~...n..0..'~0.O.{......#/H..>9.....{....'...4....."..Qz.N#c..c/qT..9.....$.._.......U..Z5..c..F...... ....`.....l5..ns..f..A......j...6..<9.pgy...........=.`p......'FU.....5..z.....C......g;@}...r.3.9.nr..4....p...$..d9N....."..5cn...2d..a..8...........$..\.EB.4`...h3......:Q50...A.:........E oS..c.5zP...G..S..h&..e.....p.p..c.U.=.H..7...'.N*w...%.e.....f./...m{..$....4@.yZ..8........F.C........J1.....4.3z..5..dyYO.L.a.....g.W.1..12'..........]#]...%.. .9eD ...'^...0..y.........;X.'^

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 51957
Category:	downloaded
Size (bytes):	5955
Entropy (8bit):	7.956786562681875
Encrypted:	false
SSDEEP:	96:yWC+HkZvGDToEkoB0Xp9THfKrrUI1Rin5bj53GhF99g2dgHyO9v4Ob0CbbiJDVLB:yveDcEkSm/Krr6bdWH998S5YjSz3UaN
MD5:	52C7ED51F0D722F6DC98D6666C22DF0B
SHA1:	2CCEF1B3B151BCEF0A52EF6F836059ADA07ED8EF
SHA-256:	6A1353BA142B232682344376551CBE5EF795D2F380BFA7F1025E298A129A8700
SHA-512:	0A9C16B805D8D12E73B9A6E135FD5099009A8C52F968428221592C9050DA023264024F94D0760D5326FA0A720DA4B532405A782D74344BF58372A16410568D07
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true
Preview:	...........]..Hr...`l.p{..E.MI3.....}Y{}k'.$.....p-..Dy...c. ......wos@.-..&.nvU..tq.n.T.............>+.G...b..z0.......a..(..o...y..d;...,..v.~.....:........b..v...".M.X.G[:&_..E.).Uz...mE$Y..k,ogQ..Z%.m....nK_.....<h.U..t.q.+...Y..q...hKA/..)A...+.o......S...`.M7O\.\.<.<...^.._.. L.....m..W_..?..?.............o.j....b...../+.....u.}./...e^l(..\|....bw..7.G.<.F..O2\|....n.h...v...y.-.}.P[.....j.k.{".i.#..#.'... .&Yf57...b..~....W.x.X....R...&..P,...2[{I.f.0.?^l..-....y..j.=.WT2U.,....d...h\|.h.I.n...L.{.^..n.(.../....$...De..j.......;%.t....5....U.X...OM..FtB.......6............[.v..i..,f..].>.....U.mq.wg..W......5.2='p..........z7v.vt..yf..\|.._e..Ag..j<..h.z..-.`..T`..m."..Q..=...uIm..v+.*..u.Y.f..L...L...P<...q.D.G.z.q.....ipW....._;.r.~.K..a.5...!...Cd.=t.uh5...F......#.,.F.x;......C.7.../.bd=.%.7...f[.B\|n...T......0.U.83F.N.........1.....#c.u..P........[..1.......(\|0....../F..X.0.f..]...f..Fv...adl......#Gf../XZ,...?F.dycdU.=F

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3447 x 1754, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	654573
Entropy (8bit):	7.913264577217895
Encrypted:	false
SSDEEP:	12288:RBQYz3h5drtwx5ofEC6BV2wJ+MwS1FIl3o0rWlSgmlulBt:Resh5drtwxGq2wU9S1CVoJ51
MD5:	B8C8D98E1BD45B0B47CD2BD7FFA47ED1
SHA1:	C3CEF3DEE8A65285BABBC4FFE6264A9C683B5D82
SHA-256:	60E48DFC7A2C038F9AE70BBE2296C95901CC40D8CC1AF1036A15470B4ACE0782
SHA-512:	984A945B067BBA139FBC84AF067344AB79EA13773402DE2724BF9D6E65FE36724F0DB3B18766CE43F00CD4E2027DC85A437C7303C13F8C376FD856CB1BD0C948
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/image/v2/mbg01.png?v=202407221109
Preview:	.PNG........IHDR...w.........4.......tEXtSoftware.Adobe ImageReadyq.e<...oiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF" xmpMM:DocumentID="xmp.did:8100E979434211EF9671A8786D85B2AD" xmpMM:InstanceID="xmp.iid:8100E978434211EF9671A8786D85B2AD" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d4e9ec8f-bc07-9342-a86a-28d0735f5686" stRef:documentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..l.....IDATx.........H.s.[l...bz7&@..$p.

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 94694
Category:	dropped
Size (bytes):	33775
Entropy (8bit):	7.99179971956738
Encrypted:	true
SSDEEP:	768:sXGBtx6HNCNFyw5yw4O6sA8EXVIUHgIQrRBHv69/Jz9YcFv:fTwCWOtnA822IQTwd7
MD5:	36583E3506A4E6E7B8A4165899811A52
SHA1:	86E10FA4B98321690610489642224AB0ABB4F335
SHA-256:	D1EAECE17A9981BE8D89C1B46BBE40CEE00334CFA86F855EB448A5C7F70B57AD
SHA-512:	99A19B40136C0D18B5BC3A34C7AB8B7C6DFCB544DF6BDC76CE9F9A5DC259ADB54610D486BA544F8A134240239FFB990F431C3CA7D151260D2974080E0C8319E1
Malicious:	false
Reputation:	low
Preview:	.............z.F.(."..f."...4(..k.xI..I(..D.%. ...%Y`?.}..d.,........t,...N.:.Yn.y......f-./..BV."...[.2^....y...z%.h..$.,./&.....r..QHB.....y..U..C_Q...=.{....j.=..t.@G.n._....S\.$.&Z...\|..Y%$<..<.B...,..\..D.O.....(..=.G.."......R\|.y]..\.x.}.-...(.....y.\|...H....~....W."_.........d%>........Jg..^....!...#.yt<=;..&.$<[.?......S.l._....e.)`J.....X<.?e.X......l.....g...~.z.w\|!.P..}....}.dzvu.n...L.?..W...7G.....X\B.........'........a..;....L....j.........Z.8..5....5.........YQ....l..-..=..~....Ut.M.c..,...j.9Y/.u.I.........oa`G...X....\|.....$..'..U........O.R..).l.g~p{3...g..V.H.Jf...7.B..O......~.$.\|......3.....P>^..A.z.\|.Ne%..E7....+8...BV......<..%~._......m...v;&.._...sv..R .YTPe.....B$.d..d...eR..9..\|.._.-T..a:.E...NevQ]F#..{%....1.i.....5j..$SS.A...2.8pD4.,.~...1.......N......_D...<....G.?...>l..j*G#...I..'S.G!........s.rP.b:...Vj.~...j....&.;..X...U.........6..'.\|X......W.T..a.#..L.A~...T!S.3..............a...0...J..wuxH..&..

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 38
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.905297485303413
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fKPjy2DkIzxD:XtB8eKK9fd
MD5:	7103024B5D34569D2CEB1FEF0820039B
SHA1:	0DBB781F60DBE03EE5ED84DB310B01E601DE5BF1
SHA-256:	769CE690671A0B7CB3F924A3249A6E90D9D643A33CD51286262E05CC3E3EC1EA
SHA-512:	83760630526B04D9723342D4B35455F3050753AD0D4D1DC848F03A8C0A5B0CA3E3E3A41D58B35A4F0D4ADBFA23D0F411E2DCF89CFB859D7F955890F2410FC9F7
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz...l.Sf.X.^...N..w&...

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=31034223&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 114
Category:	downloaded
Size (bytes):	117
Entropy (8bit):	6.258710678477952
Encrypted:	false
SSDEEP:	3:FttKyVVZw4GdjmsLO0FPUzyvAgd1AgZ0zTqll:XtKui4gFPUmnXKzTel
MD5:	DE0361FEF0BA34F966B12A3E918BE937
SHA1:	0FC49C7D6B5168B7813CADCFCF64A80531B71E32
SHA-256:	066E3616B6254EB0486A00DFB7F5C8B17EFB9F0B7982B851B55315DC0D351EFB
SHA-512:	A4C85A9FA11CF7E11AA928408AC15E8EB3F356F1669CA06F7D67BAB13D00D50BFBF6E58026FB98616E1D32FE38DA6E6C07725194D4031A31018B3FA416203C47
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605642413
Preview:	..........5.1..0....9$..r.Xz.....Q.*B..S.1..Fm.!.wfq...K..w...f.U..+..E2h....g..Q.....{.}....D.-IN...^......6r...

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	70244
Entropy (8bit):	7.9968519632202515
Encrypted:	true
SSDEEP:	1536:Cr8rdxyFNZrSMVTmyw8CZWUNNhRzDuIuRNeGMOX7e:A8rLyNZjDCZtN3z5uxM47e
MD5:	59104E03D30007CD57E7DAE9DB27B3D5
SHA1:	A5F819A157742CEBF0BB60337CC7164F958FD0A3
SHA-256:	7FF5FF8A140CFBD5A4A0F0B9C3CBA07C131D2B49900F7317C0A3B8411DE34977
SHA-512:	2B484AA7347AD0795BCA28D7E3E1FDF6772BB3B4D1EACFE7E328329DF136C7077F3E612DC7C0039E95A303ADA32CE7D4A2C7CC8E5F285BE6E83F181A485D5057
Malicious:	false
Reputation:	low
Preview:	RIFF\...WEBPVP8 P..........X.>m6.I$".."v)(...gn..vm6..R...3........omr.<..L.0{G./N..y_.v......?..G...../>..?.z......+......z..@?.u0...........r.)............`...K...O.oE..i...S._..W.............].7.?..6.;.....=P.C..._............w?.z.....?......W..._.?...~..z.......;...._.}z...O.......B._...=V.G.......g.....Y.i...O.o...>C.q.g..................r.....O.....D...S.o........A...Q.{...........}......-.o.........7.g......1.....e.q.E....U....ms..[/;.......a9!.v;...Gg...rB\.T../K....k.E.xyoT..aK...U._.\k.......\.e~m.C.J.X.^w.iT[/;...-...ZU...6.'UZU.........^w........'...5...(K<....#4#.I/.k,w.;`c.....e..,-M?.+...U1.....e.q.E...J../;...x.J..yv.v{..?..!e.Y(..U....C.i........-.UAT...t...\|.#..,...Q.m..c...<.&......t(..'z..E...J..y.u.Ql..:....{/;...-....r.O.X... .H;.....S....\|.q.z.T..-euE............/.G.Ci....L...[e.\|.Z<......A..i.......-.3...b.[Z.x.r..4.-...ZU....*.e.q.E......M..E../;...,...m.$.".......E.....d..4..W....O..H(.Ye..}...&...M......\|...

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 115530
Category:	downloaded
Size (bytes):	13413
Entropy (8bit):	7.981852426357245
Encrypted:	false
SSDEEP:	384:q9kJui+K8MIgn/l3FADXRa8Im8RVubwGBBJMxNNY:IM+NcN34BxIm8RVwX0Nu
MD5:	81F98E3A037BC84023B105555DE431AC
SHA1:	7988A4606072AF120FF67C5498969081842B6DBE
SHA-256:	E851CD0F0B3FE4FACE66D7B7A84B04312F55B97606F49E40E049E7444230BF4C
SHA-512:	D4FA6B4BA96FE302C5879989844186F0827181424699B6E0FC4B56940624F287280F8B2798B2F9E7BF56242D3B42D6392FF5D578EAA39232DD9BB289A6E8BF16
Malicious:	false
Reputation:	low
URL:	http://jzs.508sys.com/1010/fkTheme.min.css?v=20240808102706&aid=28088389&wid=1&isNavV2=true&isBannerV2=true
Preview:	...........}[..H..{..X.q..E.d]T...U.W#u...V.w.^..$Q,.H...%...O...}....c.k...........J..J..9'Of...<_._..H.......?8..lS...yr'>.......<[g..."..F.\|....O.E1<.......</...x9....a...5....E..o~3>.\|.....ir.~.DEWY...o.N.d.H..l.l..m........JW..].....]&}IJ....$]^....j........a.-ny}....t\|...q..r.H.Y..i.9.6.&9......?..?...........8.g.,?}8a.....M%...O...V~..w..Ey}:..F$%..}2....xV...I..nHX^.7.&W.nUBo_$."..5..N........,.H..t.p......f.ee.......>.Mr...{..m.?..Lz..r........IZ.D....v..:..].XH.^...%._.AD.:..f.J.....h4T.x>.....&...Yt7...y..,N.^]]...??S.."..Hz......~=.u.u.....y.!.h.....XDw..p.r%kC......h....tW..<....O.\|....-O.7...............<z.~..v....A.l....G...*...:NV.M\f....4-...uvC[..^.%...g.N.y..$&mtW5...Q.a..t?.....hy.RI...H/......x:9"yeV1..5..Sb,..D.."..q.Q#.a..qr"~.-...xG..._..../~.....Iu.K.......R..3..~MO...~...3.DZ.#.^X..h{.._n......]P.xE&hh.r...>^.K..S.L:!.O.v..fy.I....3R.....\|#.L.,..L-..\|..e.##4.Y..E.Y.F...0.m.&....^..........zfX..I,.N..$...e.].

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 14599
Category:	downloaded
Size (bytes):	4598
Entropy (8bit):	7.962792344648021
Encrypted:	false
SSDEEP:	96:ruHEA1FYM274iRbH+kTepfYRkbXlKIa5rE1F2Adp5OvSS:ru1FYvPT+kq0kR9arE171QP
MD5:	AC98167050AE3671275A2DBF5A871E7E
SHA1:	BAFD78DB1F903B548F4A649EA52982E82BA8744C
SHA-256:	55133FC190826C6B6A98D5F9C962F7F150A02BEF84DA0319008967A01B5DDCEB
SHA-512:	4CC35C2B9FCBACFBA6AB2C28B609985C0D091C9B924B7BB03E2A8E5C43DEABC6C354CCC86995AEA3D85D6E004A024A1FC4CC55A95A4077317DE32B5D5126D54F
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/dist/libs/imageEffect.min.js?v=202404081140
Preview:	...........;.s.H...+w....p..+2.#.;N....W{..j.#.FH.$.X._.C....S..J..{f.{z...s.xa.S...-..E.D.8y....Y.%q.^.L.....cJ<...k..#.z....I...x.5.......mk.....6...f>..SuD}Y..+...i.7..zS2.}.e..5...L...8.ED.y......h;..%:..\....t.. ..?..L/..I...B..d}eU.A.[.....q...X.c.....,...M.Y.....@3<...I[R@..8...\==.=..X......fsCL...Ix.yS/...}..>......mph:.......B.~...m..nA..$..k.}....~......_.V..<Nj..,.. ......0]..y..$.........!..&..C)..t.+...u.E.5..........~..3.%.\....."....C.Z{M.'.z.y...y.\|^.....1L...n@..\...@g}.......i.tZB7.....aO.rQ.&S.k.F.C..I....`\S_...%......g-].{.O......W..}.....8.i....N.....gW...M...+:...f..vLTX.{~....niLy...Y...?Nor`7...:.=?./.7../......>......^.s`P.u..N9....^>m..`.QaZ....av../H..7........K2..Hl....;..u.r..jF....{~.....M.Ry.p..`....1..<N..<...a..:]..)VN>.x.._..?..:..........z.b:~r{../....._no......~...../....#._.......$..h....T4.#...[.?.......i.L.....tg......W.......[....}.}/./.=%q.D.6..~6q.0....y>.........@N'...9O....\q..p.B....o

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.930032569261316
Encrypted:	false
SSDEEP:	3:UR8OXBL1/DDFr4BL13eSkad2+WH8J0Tf4:U2ML1LDdML11huH8J0Tf4
MD5:	D63880A28B8E502828595392658D48B6
SHA1:	53D37C89451B7B30813A476FD685DC5AB0E9AC0E
SHA-256:	AC64547CB9D4F5D0A12DDCAF0ECDC021415AE84A636212626D6340E5B444066D
SHA-512:	DC20ADFB16E37CA1F00F2BBC181060F022A11C2AEA33C2270CE2E7DE0823CB4425CD5A584573E53CFC1E94577CB8E1D80ABDCA2CC1038291D1B088E23D4D0F8A
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk15045 && BMap._rd._cbk15045({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	82150
Entropy (8bit):	7.997509366694478
Encrypted:	true
SSDEEP:	1536:xpMuM3nfstpq/9ID2sQ6VUXuf4xo/+FxEHcP9Vrf9i41l03kE5ibwJQTwO:5M3nopqVPsQoUXufUg+XE8PPbI0hMQl
MD5:	70EB7BC64E3550BDD9F660CDF45C1FE5
SHA1:	CDB624B0CDC3B27A74325FB2C85374D839040DBA
SHA-256:	96CD875AC3E8CF69C0AACAABAD16532523077052BAD2F9DE3A32478AC6443B95
SHA-512:	00F8C2DCE3A629830F564747DAC46F348BE583033B1212EB3EA3633E45E264B2E5B938F7CDCFAB852C3899D6910A88B3B6036244C227771BC1D539C63B29E56C
Malicious:	false
Reputation:	low
URL:	http://28088389.s21i.faiusr.com/2/ABUIABACGAAglIiFjAYojfzulQEwig842AQ.jpg.webp
Preview:	RIFF.@..WEBPVP8 .@...@.....X.>m4.I$".........gm~..U.:.....:.?...}.y..dr....{..7....,?4.....G.......p...l...h.F...@.....d..._.....p.9..]..\|.....S=k..D.q.k......Q......{.....7..........z..v.....7............G...~.....9.._.W......c......?...m..?....V~......?.~'.....K.._...\|.~a...O.....&}..c..~.{.{..o....z...l....V...u...................~...?....1.O........n~.}m...........?.{t.2.......}..l]g.>m-....'& ............'1$GDWa..;+P./[.A~.v...wC/.uN.{.b.y[p.".f,^...s=H.r.^H......g..=.(.Q...../..bF..i..qM........3{....#%3.t#..sw.......C.x{s.V..L='....j.%.w..&.T.e.~s....?XP..... .;_.i....s.T6N..n...)?...\|.=,B.`..~...]...E{....x.Gz.e}....;.....7.T.[._.z...w.@.A...`=.....d..H#.md.....V.[k#..^.E.:..9J}m.Q{.%..w..JgLD..KG.?...9..-]^<.l...F..(..f.r.H...r...~6.........cP~b..C...w1f.:j...d.6.V.z~.i....hA.+..CCs..n.S..#..yY_....L%EJ...}../....\|...k\|..P.. ....!}.t7(.z.@.rT.s....l.z..#O6..=.~.....^U.#..z`!1..#..Wg..P..=j..>M...9lt.t.1..G...Q.n:....V...._.<X8.7wn..

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.773444412838541
Encrypted:	false
SSDEEP:	3:UR89KCmH9iRfDdoCmH9iRq38HfeSXiMn:U29Z7RfJf7RG8/F
MD5:	7B3237ED3AE90310E3CC7C2C27EB4866
SHA1:	2C98E8C5DFD0E69C99B1A60530D82569AF278CB1
SHA-256:	CD6028ED6B07A011D26F836272F93B77774E4DFE39B1824BD78A6F0C3F6F31D2
SHA-512:	9A822E9CB39E06DF9C1917E4E864FDA0DAFB00CE6A60F1CCA2F03AF3EC75082FD5FF97E3B2693B2B4DEFAE69EB30BB5365E35FC1306D5C35CCB79B722D478D96
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605635316&callback=BMap.logCbk7744760272&sign=e17821be048f
Preview:	/**/BMap.logCbk7744760272 && BMap.logCbk7744760272({"result":{"error":0}})

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 292 x 151, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	29451
Entropy (8bit):	7.981257141174357
Encrypted:	false
SSDEEP:	768:vFmMnHAFT7oo90APz71MgAVpD6d/NjxV94YcG1yOf:9mQ27oQPz7agAHD4jf9jcif
MD5:	7DB727BBC3B12173A978942FFA7D99A7
SHA1:	0DB60EAAAC29A1080CF55400B830286AA4E4C639
SHA-256:	02AC5A746991066CB8B9CF84D44B5EE3AD9DA81E0C1604205B8B031328FF1B79
SHA-512:	7EAC71EF01DA85094CEC7F6C762D72DE863C293A91B3CE210EF74E3A001EB0E6B342188E5A9D456AEC3E5C9730F6C300004F38C75F286F7E8AA0E0E5E67BE5F9
Malicious:	false
Reputation:	low
URL:	http://28088389.s21i.faiusr.com/4/ABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png
Preview:	.PNG........IHDR...$...........&.....sRGB.........gAMA......a.....pHYs...%...%.IR$...r.IDATx^.}.@UK..{.[^.EE...EQPBD.n%...;.[......](.tw....f.........tqv.={...X.. C...?.dB.!C.....d...@&$.2d.0..I...?.dB.!C.....d...@&$.2d.0..I...?.dB..?.."..LH2...JF2).x..I.........e>...7E2.C&$......8./. ..........x.KW....K8v."..z.7.\......4.-....d..P....g"...?!>!.Q....ERr..?}....S.......(\|....'.p...._.......@t.n.a...a.^<y..11q.2.E...d.0Pj6y.CZ.GDG'...W8y......g. ...).y...Tx.D........M].n.c.....n..z(S...j4D.....o0..<...`..~..$....)%%...Q.......n..`...w."n.{..W.b..p.....;...4......QI...5L.P...t.G_...=a..o.{._ &V&...2!..aPPBZ.z..w.B..z.......&rY....`....j..\.=.....+..>j6..Fa..U..$.^.......O.Yx KO&...2!....3.F... l.u.m.mPY...+4.z..(WY....Q....4...z.QF..h....T......~DB..MDbR..?.3..LH?.dB....Y....0,..h7...ix..=....F.P.^[4o...{...Q.1k.6....f...w..h...s.oF`h.h.f.Q.....2!..q!.(..(.......sR...!.?.7o=..).0h..._....\....p...u.a...%..{.8t.b.>>.J....@&$..._].....}L....B.).

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 281
Category:	dropped
Size (bytes):	232
Entropy (8bit):	7.0676437260056115
Encrypted:	false
SSDEEP:	3:FttbL1NiZoYX781qpKiRjsUQs3VoFXggY1nxU2ihA3Q8vatHdWHXbcfdg1imeE:XtbLzA81qpPo+lqE1xU21gaIWrSg1imz
MD5:	D26C13A934C8B22EE43899454C789B9C
SHA1:	416A6678C317A0C76B57D798B5262C58F9DF17FC
SHA-256:	F6922D720C4BCBACD3786AFBA731DC0276255C488139BA8E63339805C1AC505A
SHA-512:	3C1C844AC9ACDEF768EA49DD01965D019078AD0EC626FD0E2456E1AEEAF49B8772785EB1C075C293898EA893B81ECCCBC5D239900452C00F67C4F3E738CBF410
Malicious:	false
Reputation:	low
Preview:	..........d.Ak.0.G...IP'...%H.i..^.YJ.G..32..m...+=.2.....c.PH.I..w/..F].......3.\\|..P.....W........ .M.K.k..W.q.....d.rXF.......SG..sR..&...?E../..7....]Vs...Y#6+.....t~.qbBJ.OC...?/..f.h}.....-.,.z8...:.,.....!........Q.w....

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	16186
Entropy (8bit):	7.895174058613172
Encrypted:	false
SSDEEP:	384:ezRv7YateIxqH9XqT/xNqEDQB2Vc7z9IxpqCvGl2npljdpxX1n/Cl:wqeqH9aTJNq+u7ZQPv+2npl5Z/W
MD5:	65F636703C763621973D766725FDA43F
SHA1:	67A4B19260557D0CB9DF93A1074B48991C4B6997
SHA-256:	4ED810D8ED5906C81E55B639AB49BC6912195C276373D3F0342A7D70BDCC2777
SHA-512:	BCD098F9F572021AD3663C01F6C339B779223B8B938BB6E9D5BDDCE3CF01491F12C0ABB5D4CDCB682D4DB9807D9F3C0C230F3FED7B2F89582D180C6B4ECCF957
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE............f}.k..u.........................................x..........................{................................._.........d.o......v.^........U..`m...dab....Q..\|...x.....bKGD.h..V....pHYs...........~...=.IDATx.].c.6..n.H.v...7...Hf..Wo....>.$%J..d...I\|Ix.. .Z.i.3..O0~..gg..a.....6\.T.v....~...ZA./F.Z..zm.yn}.....'.;{...;.W..8z?...,.....z5I.Y.il...!<...i..-.\;$..[X........;(~B.~...\|q...h..W...y.hl.......t..S_..].X.."@.s:..'...k..Z..p.Fq..=5..i.3...6.77.0F......G....v9.......D... ..Tr....(...2...8.......o.S.q\..S)A.v......pa..._..4P7.....3...?..?....._iA.Ba.-.6.@P..d....@.M..D..?K.a.......Z0.,..K............G..OQ/..t.4.l._C.K% l.>...h:.%...L. G...:.J......<...............,.($.4........$...#.y...).4..3.M...&..p..p......&y..d...."....J1.Tl0VsxpY.s.B.l.^.1<..M.....<..l...~.B..:.w&.n....Ch. =W....i..6.....u.On6........

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33
Category:	downloaded
Size (bytes):	51
Entropy (8bit):	4.612547934030121
Encrypted:	false
SSDEEP:	3:Fttuc/IHNtKXq3WBkp/:XtB8N8s/
MD5:	09DA5E8AC1DAE5C1FC76F7E312A390DB
SHA1:	96B02766DFB5A6DAEB954AA9C5894CFABC062B3F
SHA-256:	DA6E1380172679049DA353BA6A0400B1320AEE5A54C360EBC01FE5E9B3ACCB13
SHA-512:	1B9A1D082F0F175E1C52697E7BEC38F3BE41474AF5E04383AC5D2C8708B97CE1CFADC72B88CA616DB62C5B28E586CC636FF8348115FE8405D3B5C8F04BE64182
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin
Preview:	...........V.MNN-.V.)M.Q../..,....s.Sk....!...

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.924055859159171
Encrypted:	false
SSDEEP:	3:UR89KCmH+RVTcXWcWroCmH+RVTcXWcbXAvHfeSXiMn:U29ZVRUWckfVRUWcz8/F
MD5:	649F489F9A085131E9CD81CB60F24F1A
SHA1:	0E03242E1E87F7FAB0FD89A731AA309C7B0DFD10
SHA-256:	A2197830C3A4681F57D5DC48B12949BCC7D487D963FAB0760293E963E45861AF
SHA-512:	C56D83C6EC14CF6B07BD481F37DC6EFEAA98A9F480D14BB243B05556C196A4944BEDD95D86B38B7EA383BD62F866C95BAD5FEA819B01BF5BFA3EE7DD4EAB582C
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605655021&callback=BMap.logCbk4406923950&sign=3878eae1f10c
Preview:	/**/BMap.logCbk4406923950 && BMap.logCbk4406923950({"result":{"error":0}})

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	54640
Entropy (8bit):	7.996049858116262
Encrypted:	true
SSDEEP:	1536:36VDwILmDBh6shE1bOFP4bFK46SaUC8Fa2bYJtg8DtIQXq4EQtnHz:KVJLqBLAbKCFKSaf8jbV8DtL6/QFz
MD5:	1629A5E2BBAF0243A84DA60486566ADC
SHA1:	2AD182BC2DCC47D29FE0E8CEE673BD2EA2202046
SHA-256:	6347E39B2481C9EEFEFE136CFEC2DCC606893594017111B39652BBACAA6F32BB
SHA-512:	8C7863054676FFB59EC62F418AC92E92F871ABE127B975ADF20A37FA5AB169B5AE6DD99CA3FD45AF2FC37B2C110FD2325978E0252295BC73BD6DA751EC68DD57
Malicious:	false
Reputation:	low
URL:	http://28088389.s21i.faiusr.com/2/ABUIABACGAAgj4iFjAYonO_WGjCKDzjYBA.jpg.webp
Preview:	RIFFh...WEBPVP8 \...P#.....X.>m6.I$"....aP..gn..e.Ef.<an.h}x...7-.%..=.?..&.2h.@..^....U.w..TK..E^}w...._.#......:.H..Q...?.oD..?...z......W.....G..P...Z........~.{U..............^j...5.O.....?.}o........\|........../.?......S.O...?.~..C...........5.7...c.W.O.!.....G..X............[.c..._......s.G..........{>B.........?........].s...7.o...?s..._.............{r...........o.?.?..4......\0.._..P.%.gkW..'+(..4..._(M.<f.....9.....e.].........t..36..e'.w../N.4^..I.E..$b....,...q..P.C.....$...........$.........R:o..h..... .A..6#........}n..uh.z.L..%......5.u.!{.t&..Q..$GD...R...Nrh.... ...R...B3"...uIl...e."......d...o....!.......Y.0zr]!...OH+..r 3....l@'.....66...f.r^.R...y..hS.-.W...1.I.+1..LJ,x.U.0.].Qv~.k.x..a....oR..2....D.!..V..e.......}....jo$9'.../lX......o.t .D......&...."..S..........8..h..i.3..........fh...<..@k-.\...Hv..K...".e.e.........2.....%.i.d....DD..!s.'.S.tG..kKW..R.....u..n=.K..Y.!..2._.Dd....4..E......2.......7.H......`m.L..

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	121
Entropy (8bit):	4.939069284095431
Encrypted:	false
SSDEEP:	3:UR8OXBL1ZNno84BL1Zaad2jRbrUWAqOLc5MWvQPmh:U2ML1c8ML1dGRbrPgLc5XIPU
MD5:	C764559A45DC62982F6BD6A5BEDD4081
SHA1:	F820A00779E1B5DFC116FCB5D584FA6EC506B8CF
SHA-256:	2CF3423E09DDD3975CBD3E93BEB1F04D028C99743C747570FE525ECC6F2FF2A6
SHA-512:	3DF0FCDDBB6A1514E47D7897AC688D9B9E3C67CA06FE65DE656FCC19EA94B3ECB47B083DAFD3EC0ED1F3C2F048FC6734934D0EEB88F21EC8499A16CEF87BE31A
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk71768&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632385&sign=ca9adc6fe98e
Preview:	/**/BMap._rd._cbk71768 && BMap._rd._cbk71768({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	93
Entropy (8bit):	4.930032569261316
Encrypted:	false
SSDEEP:	3:UR8OXBL1/DDFr4BL13eSkad2+WH8J0Tf4:U2ML1LDdML11huH8J0Tf4
MD5:	D63880A28B8E502828595392658D48B6
SHA1:	53D37C89451B7B30813A476FD685DC5AB0E9AC0E
SHA-256:	AC64547CB9D4F5D0A12DDCAF0ECDC021415AE84A636212626D6340E5B444066D
SHA-512:	DC20ADFB16E37CA1F00F2BBC181060F022A11C2AEA33C2270CE2E7DE0823CB4425CD5A584573E53CFC1E94577CB8E1D80ABDCA2CC1038291D1B088E23D4D0F8A
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk15045&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632356&sign=4ea4a809dda8
Preview:	/**/BMap._rd._cbk15045 && BMap._rd._cbk15045({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	17844
Entropy (8bit):	7.895271784759638
Encrypted:	false
SSDEEP:	384:P5m3QXQnHs1nJ8+RxOdFF41IcFENthFyhK5FgvvilWzp71wUHwY5cxdwsHBjm:aQgHsBu+Saz0HMOgvH71wew+laNm
MD5:	22151DDB4ACC5E87EEBFBA147EA56889
SHA1:	2309E09AB0E4A27504644F16FD7A3EB5440CE23F
SHA-256:	54CEF2CA79A6B57D3356C41F6C17FC54253B933E45F6513A0C3E83ABD6D81553
SHA-512:	DBB870612FE16D72A573B4136437653706DA893CBDA7DA73D22EA16D17067CEB0AE51B45E8EBD7C41A938DE9FDF80362E85F9C7C9FD48FB363F0F1A4FACF2BB0
Malicious:	false
Reputation:	low
URL:	http://maponline0.bdimg.com/tile/?qt=vtile&x=49624&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE......................kw.Sc........\|...........................................................................i...........c.o..^........U.v....t..{....k..w..f}.[..5.{..l(.....pHYs...........~...DQIDATx..}.{.F..:...th.U,QKyhR@.. ........;3{.JZ........6..{.3..3.\..;N.z3..O?....py..o.y.........><0.......{X.....\|2{......?.=..k.....y.<....z`j.n.$a..0..~..U.-n...3V....)./l%...5>..wQ1.....z....a....h._=<z+X...z.p.g?.....{.b..;....+...?...y.S.d..:.u.._..O\.^$L.....~%.....u.F._?=5.."Lc...'^.v..0..o.....Q...2..o.=.y.............7..I...... ........j'.8.e..f./.$.`...~.?..E.O.......d...E.....dR.X............I^y...........}\| b.8.8.y\|#_.^..z\|...z..I..I.z.(.8.....i....."7.tF...gzq....^G.~.[..x.......{.@5.d..o@= .o..-...~........<..C..i.A.......8N.......+s...]........!....p..Okg...;..o..wo80.[...i..T.$.^.R......$.._..8...!s... .

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	113008
Entropy (8bit):	5.173045459669979
Encrypted:	false
SSDEEP:	3072:vmHUwMDdtJp+D2CVYLODnA0d6W+dNfkJ6vMLXrta5sl+PF/IW6orgP48jC:vZFDMLXrE9GorgQ8jC
MD5:	92BA78238BBEE1456A812AAE4248E974
SHA1:	93D0FE2B5F6A803BAB3D5ACBA5605958E2E6895D
SHA-256:	E917F1D6CA010B02BED886045424FDC0858CFDAAFC73F6CC5F8F28FB39F352C8
SHA-512:	665913EBC5CEF35021F79FEC56FA0592ECD093F9CB598239BDC6F90CB87822373974587B033DAB64EFE7E39C2389969958CB52CA341E703D81FCAC8236CEE0E4
Malicious:	false
Reputation:	low
Preview:	(function _Eo4G(){var a=function(c,d){var e='\x31\x2e\x31\x2e\x32';function f(g,h){var j=g['\x6c\x65\x6e\x67\x74\x68'];var l=[];for(var m=0x0;m<j;m++){var n=h(g[m]);l['\x70\x75\x73\x68'](n);}return l;}var p,q,r,s,t,u=decodeURIComponent,v='\x43\x68\x61\x72',w='';var x=[a];p='\x64\x65';q='\x66\x72';r='\x6f';t=q+r+'\x6d';s='\x43\x6f'+p;var y=function(z){return(z+w)['\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72'][t+v+s](z);};var A=function(B){return f(B,function(C){return y(C);});};var D=A['\x63\x61\x6c\x6c'](y,[0x27,0x22,0x25,0x60,0x3c,0x78,0x61,0x41,0x62,0x42,0x63,0x43,0x64,0x44,0x65,0x45,0x66,0x46,0x67,0x6e,0x6d,0x6f,0x70,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39]);var E=f([0x706e,0x6c36,0x6730,0x624f,0x5e77],function(p){return u(p);});var G=A['\x63\x61\x6c\x6c'](E,[0x5752,0x58dd,0x5f5f,0x5b32,0x56f1,0x58a0,0x5ef2,0x6256,0x5c2b,0x63cb,0x59c8,0x645a,0x56c4,0x6b9b,0x545a,0x6a4a,0x5a32,0x7209,0x577a,0x72b8,0x735c,0x7313,0x735a,0x5e52,0x5fb4,0x66f0,0x6b31,0x7074,0x72ba,0x6c19,0x692d

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 229845
Category:	dropped
Size (bytes):	60390
Entropy (8bit):	7.995956926353215
Encrypted:	true
SSDEEP:	1536:6G99Hxn/Z1C3OyIaS/CoxtTuaPET5RgWj97xLm0mE1:6GB/j1zCoxtTuaPK5R9731
MD5:	4067B261C7710FEE30739A8573A94BD8
SHA1:	336E0B89B84C63C895D36C7DF57550B310800EAC
SHA-256:	4CA41ADB8174DF27A84EB1F37004A0C5AF55B6EBC3B3188761A5DBB4BBBDE61B
SHA-512:	63FCCC81B7194241D22F80A6AA305AACDFD407CE16B83B04FFF22AA872FCA4A97425BF5C1C987923A6273C579437094AB392CB7EDB80A7B4FF99218F896898B1
Malicious:	false
Reputation:	low
Preview:	............w.F.(.W$......e.+.`.c9.....83...@dKBB.\......_U... );...79'..........4EU.on....n...eJ.].2Q........j..AT..?cP4\|.7.b\|.......M........f..@_Y...}.{0_TM...j...8......x.f..K.7.'w...^.5.....5.4.w.._<.k.'.."....#.H$...r.lV5..I.j......MS....GH>.4.n."..7.iQ..3>M..&Y....b....%.r.C.C+e....xV.J..H......\|....9..c..h....l.G.....P#....{.Y...._.$k......~...q2.....]...b.+.k....U1.r\.l1.,.OON..Y.....bV4.Q.Z-...\|!......L..`....j..,...Y......>@i.o...........H..\|.....W/#...}.`I.\|.6=.3......~..Y.g......z....=}....(.g...q......g....<..o!..$.\|...w.....}......../....3h......go..G.....,}.'.....G.d._.<{.6.......O....c./.......'.....O....../.@w.C......g.r.Rd..?............i.Ti'.........W....z..F........G...7._....21.G_..o..H......=do.\|.~....._B;'...:..(.....?i.EJ.....?sHd./...y......M.Y.1.\^...\|.h3.....G..M.Y..7o.k^-..a....8a....$..R.9X')..6....@.\|q..........^..0..w.i.xFH:(....q..M1Y-...~..$.....h^.....6.A~^W.e.7...0..kw...jvuQ\|.S5..5-6..>.;_6.JL8

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.935606575000703
Encrypted:	false
SSDEEP:	3:UR89KCmH+cf9CoCmH+cf9pXzgHfeSXiMn:U29ZVPfV6X8/F
MD5:	A22D0EF809FC0987D72624E1977475F8
SHA1:	A426F72CFE75BC61E1D28FCDBE9E778173457F67
SHA-256:	155512A68E2F0B189443A0D0836C0E55B869A6E8A818ECAB9D14DA1B987AE799
SHA-512:	39832CD5FA488437BAF8B8491BEA7B0179FDBC5E07FC212A8A4294788BFC4A4644C1F937CDE96708DC0C96B4193A661B1B828295AB796F7DE923C74F50FC7BD2
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk4966028254 && BMap.logCbk4966028254({"result":{"error":0}})

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 166618
Category:	downloaded
Size (bytes):	46117
Entropy (8bit):	7.994024737440357
Encrypted:	true
SSDEEP:	768:sHqsstM3xYhzEWRwJaJgTtcrIjJXmUDl9d87RPCF8d/it/n6rvn4EC41rM22:WqssM3xYJEWHevjp9Dl9i7RPhP1Z1g22
MD5:	041F941CBF1701668F5DE4B20C586BF7
SHA1:	32191BFED8942E812081265E61BD5A0073B97ED7
SHA-256:	36C0C376365D9B29EA7DA8DCCB76820F0A2B1F0A26CBF3AD591B97A55C05002C
SHA-512:	187C474D094BF6B8CC5C54885312D24391F46C90B989239448728B2022210C2BC38A0E92B4DB84088BEF3351671414905D45BD8D9B2C8EC548DBA59C3580B354
Malicious:	false
Reputation:	low
URL:	http://jzfe.faisys.com/dist/jz/biz-shared/bizShared.min.js?v=202411131400
Preview:	............w$Gr.....@...".=h.KV......K`0.`....~...F.TW5...1..;..>\|>.NgK>...'K..,..I.Jg.3......"......p...o9............Fk.~k....w..i.gQ...0..I..>s..]Oh:\.W.4c..J-g...1.?-Y.`nF..F.u.V..Eq~.....5.......r1......D...........p<.O....H...v...Y...<.....DK...@h..zs.&b@.gY.!.....<.[.mF.4K..D.F}/1.........D$....)..O....:..'.......d..;.....I~J.8(Z.,e)..u.....,..]..a..).....$:]Y.&......G.#X.....(Y..;5....t.Ir.....[.WVb.N..F..[.y4d..zs>..fN...>'.........MN.'.....:.D.`Rp.....r..L.f>..J.+.F..@...<.....E.<k..\!.!..z.e.n.....A._++7.~.l.....9O1....\.......J0..^.4p..g3...4}..'.d:qH.w..p4..b.$.......q8.."zI3.<.Q.N..:..... .._.U\|....p....V....y..$}p....d5......&.5.l'...?.>.G..1l.8J^.&....?.....E9......I......e..A.A.....o6.T2Ez.P...uL.sJq...VF...........B.&.lz.y...Y1.im.........g..2.a1.~FCF.h..:C.P`..[.....+v...BiB.,.....pP`j.w..D2.c..'...z0...s...)..R.....Q2r\|Y.p....0..._-..l...#..`.....A......4y...Ugi.F1..>O\g5_u<..D?..D.ho..?...ln..m...l;./.....h..

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3447 x 1754, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	654573
Entropy (8bit):	7.913264577217895
Encrypted:	false
SSDEEP:	12288:RBQYz3h5drtwx5ofEC6BV2wJ+MwS1FIl3o0rWlSgmlulBt:Resh5drtwxGq2wU9S1CVoJ51
MD5:	B8C8D98E1BD45B0B47CD2BD7FFA47ED1
SHA1:	C3CEF3DEE8A65285BABBC4FFE6264A9C683B5D82
SHA-256:	60E48DFC7A2C038F9AE70BBE2296C95901CC40D8CC1AF1036A15470B4ACE0782
SHA-512:	984A945B067BBA139FBC84AF067344AB79EA13773402DE2724BF9D6E65FE36724F0DB3B18766CE43F00CD4E2027DC85A437C7303C13F8C376FD856CB1BD0C948
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...w.........4.......tEXtSoftware.Adobe ImageReadyq.e<...oiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF" xmpMM:DocumentID="xmp.did:8100E979434211EF9671A8786D85B2AD" xmpMM:InstanceID="xmp.iid:8100E978434211EF9671A8786D85B2AD" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d4e9ec8f-bc07-9342-a86a-28d0735f5686" stRef:documentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..l.....IDATx.........H.s.[l...bz7&@..$p.

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 35
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.80639513982528
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fOw0x4RTE/:XtB8eKmx4Ro/
MD5:	84AAD1B39C33701D2FA0C423DDE7AA23
SHA1:	918FDF533E772ED0196BC558BF0A7261493EFC72
SHA-256:	20AF8756A37D1EF526BC15C29A7D150A242DC06F5A78413604E02A834A42C64D
SHA-512:	8E3CC4D21CFE6677C41A326541CD6007980B8AEAD1AE100D440CEDBC1AD21213664B573BCB5C7A52C75E3BEF7B0767165E9476B3A45E4884879FF8BB68B2DFB3
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz6g....T...t.p#...

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2310
Category:	dropped
Size (bytes):	989
Entropy (8bit):	7.818862689163503
Encrypted:	false
SSDEEP:	24:XnBZol4PZBoL8lzUXsTCNsXU1cgAPoVWuC2geQkH+Igw57z5Os:XnB6OzoL8GD1UIFAcvN3r
MD5:	4C169147365C504891B96B373BB5DE83
SHA1:	60D2B4FDDEC7CB1F0A636AD2E9CBF749C7C667A9
SHA-256:	DE71F08CA6885B9DB7D55895BD9875C2FFCBB4DB1C6BCA7E92D81790CB7C670F
SHA-512:	76ADAB74B3DE7170C24515F17ACC33A2AAE5C2A2A6AE3421C84F7FFAF691268F89F6071BD7AC2CB0F0536467B67B58A4C1376F14D2FD87FF28EDD2EB3BF6B51D
Malicious:	false
Reputation:	low
Preview:	...........VMs.6...W.<PD..rgz....5My.:99...C...`I....{.")...6..\,v...........X.....7..u...bi....uz.@.L.?.A.i..>.............R..[.;...~.M...e...I6.@...4>..8>n.@.c.k...~..1.L.u.8G...:.6.9,..!. ..F&f.r."3.h].B....r.{.7.).....^........d!.m.{... 7..).."...4R......-.5....\|...$.......hL.....<.Qo...7.V.X0_g9fu...:6...Ke.].\Fn.....:.O.r...Xrc..i.e.eW4u....e..u"..Np..U....-.9n...6....a..X.....n...~.1...EY..A,..Y......g.!.X..~....v...5.......t?........a..Q}.../..Q".N.\|N...j9....YNr......N.(m... D4..../U,2..@..8..V..C...wc2..F..#W...N+...W.S...P..Py..b..........s.4H...<....P.}..H.4..r.....^...V\|.S%8..\|.M/.96+N7....AB.I.R._....%=)...m;..b..c......T~...W}.......2t.......8@.=.....U...&.*N........>.t...\|..Y..NV.j.@.e..G..x.Zr"ffU." ..h/..f..].]Bg..Y0...&....c.:....C...+.q..pJ_.~...5KS.9.y.R@......d...c..>./...+.&.@.O...N=..Q.B...>.....~....}wti..x$N.{.s.NE.z..0c....F.y.d..cX.i..F.........8..'...x..q..d.Y.w[Z...&..uL.U.4..........N...\|........

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	117
Entropy (8bit):	4.891261571423757
Encrypted:	false
SSDEEP:	3:UR8OXBL1Sdd4BL1SXH0ad2jRbrUWAqOLc5MWvQPmh:U2ML1SddML1SBGRbrPgLc5XIPU
MD5:	3B86BFFA27DD4755B5FDE36931627766
SHA1:	BBFC7992F85A0FDC5B3B7EB72C4325FA6DC9C1E2
SHA-256:	6A99CFAE83BFA770FD1663B5A32A8FA4682A96628F7D8A40B210C02E61921BFF
SHA-512:	13E41764C2FF139404020CC9333399463CF972F33C70D7E6229A896083E7DA658184E56B1A4AB89715A907702FE7EF91FAD820C160C55D33C234B4879EF932E7
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk394&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605662833&sign=f2ae8e43acc7
Preview:	/**/BMap._rd._cbk394 && BMap._rd._cbk394({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2310
Category:	downloaded
Size (bytes):	989
Entropy (8bit):	7.818862689163503
Encrypted:	false
SSDEEP:	24:XnBZol4PZBoL8lzUXsTCNsXU1cgAPoVWuC2geQkH+Igw57z5Os:XnB6OzoL8GD1UIFAcvN3r
MD5:	4C169147365C504891B96B373BB5DE83
SHA1:	60D2B4FDDEC7CB1F0A636AD2E9CBF749C7C667A9
SHA-256:	DE71F08CA6885B9DB7D55895BD9875C2FFCBB4DB1C6BCA7E92D81790CB7C670F
SHA-512:	76ADAB74B3DE7170C24515F17ACC33A2AAE5C2A2A6AE3421C84F7FFAF691268F89F6071BD7AC2CB0F0536467B67B58A4C1376F14D2FD87FF28EDD2EB3BF6B51D
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/getmodules?v=2.0&t=20140707&mod=copyrightctrl_kneba2&seckey=-1%2C-1&timeStamp=1732605609767&sign=0aa625ac9280
Preview:	...........VMs.6...W.<PD..rgz....5My.:99...C...`I....{.")...6..\,v...........X.....7..u...bi....uz.@.L.?.A.i..>.............R..[.;...~.M...e...I6.@...4>..8>n.@.c.k...~..1.L.u.8G...:.6.9,..!. ..F&f.r."3.h].B....r.{.7.).....^........d!.m.{... 7..).."...4R......-.5....\|...$.......hL.....<.Qo...7.V.X0_g9fu...:6...Ke.].\Fn.....:.O.r...Xrc..i.e.eW4u....e..u"..Np..U....-.9n...6....a..X.....n...~.1...EY..A,..Y......g.!.X..~....v...5.......t?........a..Q}.../..Q".N.\|N...j9....YNr......N.(m... D4..../U,2..@..8..V..C...wc2..F..#W...N+...W.S...P..Py..b..........s.4H...<....P.}..H.4..r.....^...V\|.S%8..\|.M/.96+N7....AB.I.R._....%=)...m;..b..c......T~...W}.......2t.......8@.=.....U...&.*N........>.t...\|..Y..NV.j.@.e..G..x.Zr"ffU." ..h/..f..].]Bg..Y0...&....c.:....C...+.q..pJ_.~...5KS.9.y.R@......d...c..>./...+.&.@.O...N=..Q.B...>.....~....}wti..x$N.{.s.NE.z..0c....F.y.d..cX.i..F.........8..'...x..q..d.Y.w[Z...&..uL.U.4..........N...\|........

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	15307
Entropy (8bit):	7.9352598354273844
Encrypted:	false
SSDEEP:	384:ptsGIMjRr34igDNlZWhEub4Ai/5fO4/GDqRz:pVIPiclZWCucUql
MD5:	09F87CF504E0AE587EF47F28DE17DED5
SHA1:	90D147312F6698CD8BBFC6057861DCE8D98FC239
SHA-256:	1E95FEBEFA01BDAB8D7248CD24A05DD8BC4BD1F9EBDF58936EA286A64FDCF9DC
SHA-512:	A74AC42BD1A79423C9B4B8435553748B5E2DF29ADAB32E809679B206C2AA2377D4C7EF346959668EA70101DC816B2CF146C5152A2D0F322208097DAD4D271827
Malicious:	false
Reputation:	low
URL:	http://maponline2.bdimg.com/tile/?qt=vtile&x=49623&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE......O..............m........................................1.w@.}........................................q........f}..............w............j..oy....X...\|..iv.Wf.=......bKGD...-.....pHYs...........~...:^IDATx..}.C........l'W...-..B.......?.UU/.Z.!a..../:...E..>....>\|.p..........].'.......O.[..`... N#5.....o.i.y..8...?..?.9g...q...N....?=9.>~.'#.<..g......p1....N>....N.'......<~r..?...Y..Y.....y..........G._.,....@....O?....NN.....?.....'''...P..?.....'#$.]...N..`p.H.. ..<O.,..sM..M..2.@...>}:9..D.............NH/.......U??9./...O."..........I..e./q...0.Q..%.....r..?.P.P..`.`.`...O..........8'.{.........D...'NOh...i.$..r...-......L.$~.2...G\|..s.NN....n..#.$..._h.;...}z~....93...$..0.t.x......,;^...p0 ...89..NF.~....O..U....?'x......vqa..O@.....N.....gW.Y.^_..2.m`.%.D.m.......< '.h>..A..'.....x........g.*.......^..S

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 246353
Category:	dropped
Size (bytes):	52800
Entropy (8bit):	7.995029399601792
Encrypted:	true
SSDEEP:	768:Gqv6LMQ5AXEkz8lGgwLj9C2Qk9TfPZKdlIRiwqnQOJ8u1t7ca+zeWWGFWH2:Gqv6oQkr5fQk9TfKqImO+GVcayeSZ
MD5:	7B2FCA2EC4B1762695A9F6D689D640A3
SHA1:	B06B81103950964675187152B57EA99D7515DB79
SHA-256:	8CA2894D1D5C1F6655FEAE3A5A40B99B8E1D3EBF7E86734C0F8017C3A4AEDFFF
SHA-512:	132885C8F7FF0DE67CCDBBA47FDBE20CFBABCEDC35E272742BEA855B751D4C247DEDD67B97422991C0D228AFD0ACDB42DA8FA52D015BFC05A5E5C14E1BC6A7C9
Malicious:	false
Reputation:	low
Preview:	...........}.[.X.._1z.Dj.c.#..K..b...@.......:B.Hr......+.$..k.5.A..z.{..$.WI.....q....{(.jRd.K..!+.!Mj...^...S..3..Tq.Uyq..b.p........lh......&}h?.C.....".r.v.....=.h...^.........t.:.l...,.../..C%/....<..-.Wx..\|0Ic..i..a.z.8-...].meu..mG...~...~E.>....l....?...M._G.!.c-Q.......QRz... ..I.=..b..Q.:.M.;.w...#.A..n..u^)/.K.../l"..."..IR........{....].x.>.i....fa..N."/\.(..j.D.lGZ/..b.y.x.jT.w...........O..;.z....c...^.........t..9\t...(M....:AR.{yQ]..J....N....b.K7e..G.9..D..."..Wa.W.D.4.n.Q.Z[.R7..xb.S...\...._x....%\...COla._.}u..o.J.V....(.....TT.M..n.J..FY..'.c..[t.3.......iT...._....'..Ji.C<....am..n..2{Q.....eI.DiR..z.........?\..R+.S.@....{*.....#..,. meWW.I.....q..C.S.e...N..'.......n.@~...Y....-.a..L../.].@,3.....pr.I....-...4.V..].T...C.ar3ay....E..Q..{....5..N.......VbZ(.+\....i.g...<.B......;..0..'....rN..I......0...{.\|.g.~.....~.zRU.AS..Q....(M..B.f..jc...".].x.P.......u`.."O.....,.......M...;$m.b.'.q>.T.[..y.R.4..^.u&2..

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	121
Entropy (8bit):	4.939069284095431
Encrypted:	false
SSDEEP:	3:UR8OXBL1TdFno84BL1TEad2jRbrUWAqOLc5MWvQPmh:U2ML1THno8ML1TBGRbrPgLc5XIPU
MD5:	B3F18B4ED94F53C17B031541AB2D46EF
SHA1:	42860A0EA482DDDA58225D30F59A8E8363642B7D
SHA-256:	F09754E6C1612FDB045A2DE6BFDBED04A19EEF61FC9440C64BFCCD8D7B7AF689
SHA-512:	22153B1716ECA70B60E64DABDA16054043162077E172194D49CB11FCC0A56B8C9703971E932074588C809F65F8258CE28563D5B8F5A148D87917617E4DDC8D25
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk82991&seckey=QjkmsigYB6FtJVS1%2B1zLo5Cn9S0I2rb%2FJ1brfUmjqgY%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605654036&sign=c74c2ea44a50
Preview:	/**/BMap._rd._cbk82991 && BMap._rd._cbk82991({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.773444412838541
Encrypted:	false
SSDEEP:	3:UR89KCmH9iRfDdoCmH9iRq38HfeSXiMn:U29Z7RfJf7RG8/F
MD5:	7B3237ED3AE90310E3CC7C2C27EB4866
SHA1:	2C98E8C5DFD0E69C99B1A60530D82569AF278CB1
SHA-256:	CD6028ED6B07A011D26F836272F93B77774E4DFE39B1824BD78A6F0C3F6F31D2
SHA-512:	9A822E9CB39E06DF9C1917E4E864FDA0DAFB00CE6A60F1CCA2F03AF3EC75082FD5FF97E3B2693B2B4DEFAE69EB30BB5365E35FC1306D5C35CCB79B722D478D96
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk7744760272 && BMap.logCbk7744760272({"result":{"error":0}})

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 246353
Category:	downloaded
Size (bytes):	52800
Entropy (8bit):	7.995029399601792
Encrypted:	true
SSDEEP:	768:Gqv6LMQ5AXEkz8lGgwLj9C2Qk9TfPZKdlIRiwqnQOJ8u1t7ca+zeWWGFWH2:Gqv6oQkr5fQk9TfKqImO+GVcayeSZ
MD5:	7B2FCA2EC4B1762695A9F6D689D640A3
SHA1:	B06B81103950964675187152B57EA99D7515DB79
SHA-256:	8CA2894D1D5C1F6655FEAE3A5A40B99B8E1D3EBF7E86734C0F8017C3A4AEDFFF
SHA-512:	132885C8F7FF0DE67CCDBBA47FDBE20CFBABCEDC35E272742BEA855B751D4C247DEDD67B97422991C0D228AFD0ACDB42DA8FA52D015BFC05A5E5C14E1BC6A7C9
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/comm/video.js/video.min.js?v=202307101206
Preview:	...........}.[.X.._1z.Dj.c.#..K..b...@.......:B.Hr......+.$..k.5.A..z.{..$.WI.....q....{(.jRd.K..!+.!Mj...^...S..3..Tq.Uyq..b.p........lh......&}h?.C.....".r.v.....=.h...^.........t.:.l...,.../..C%/....<..-.Wx..\|0Ic..i..a.z.8-...].meu..mG...~...~E.>....l....?...M._G.!.c-Q.......QRz... ..I.=..b..Q.:.M.;.w...#.A..n..u^)/.K.../l"..."..IR........{....].x.>.i....fa..N."/\.(..j.D.lGZ/..b.y.x.jT.w...........O..;.z....c...^.........t..9\t...(M....:AR.{yQ]..J....N....b.K7e..G.9..D..."..Wa.W.D.4.n.Q.Z[.R7..xb.S...\...._x....%\...COla._.}u..o.J.V....(.....TT.M..n.J..FY..'.c..[t.3.......iT...._....'..Ji.C<....am..n..2{Q.....eI.DiR..z.........?\..R+.S.@....{*.....#..,. meWW.I.....q..C.S.e...N..'.......n.@~...Y....-.a..L../.].@,3.....pr.I....-...4.V..].T...C.ar3ay....E..Q..{....5..N.......VbZ(.+\....i.g...<.B......;..0..'....rN..I......0...{.\|.g.~.....~.zRU.AS..Q....(M..B.f..jc...".].x.P.......u`.."O.....,.......M...;$m.b.'.q>.T.[..y.R.4..^.u&2..

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1371), with no line terminators
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.258241996501023
Encrypted:	false
SSDEEP:	24:Wyc54RWMuHKFmOthmk9++35E5TJIlGhjXgfIS7sa4/M63psI8S:Wy/w8hm6++3SlIGhrfeS
MD5:	0E236BEA2AECFB786B89CE0833EAAE45
SHA1:	0B8239AA353F379AF505ACD09B7237E8200492D7
SHA-256:	C30138BFA2DEC188C3CC960EC312C8BD75EAF9AF4DF4FAE2761D589BB2433B63
SHA-512:	8E38278046A39A450AF263C0FC44677DF305EEB7C5437489444B08A60191EB54E5EEE5E1BA3080E86C32E54EBA7ECADA6E8BB448B96493A4A129139B058DE0AB
Malicious:	false
Reputation:	low
Preview:	window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo8HBbnWrN1iWCEv6bCB5Lgw=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,e(a,o),a.onload\|\|t(a,o),r.appendChild(a)}function t(n,t){n.onload=function(){this.onerror=this.onload=null,t(null,n)},n.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),n)}}function i(n,t){var i="onreadystatechange",o="readyState";n[i]=function(){("complete"==this[o]\|\|"loaded"==this[o])&&(this[i]=null,t(null,n))}}function o(){for(;v.length;){var n=v.shift();n&&n(m)}}function r(t){if(s)return void t(m);if(f)return void v.push(t);var i=function(n){return d[h]===w\|\|n};f=!0,n(l,function(t){return i(t)?void n(l,function(n){s=!0,i(n)&&(m=n\|\|new Error("Load error")),o()}):(s=!0,o())})}function a(n,t){return function(){var i=this,o=arguments;r(function(r){return r?void(t&&t(o,r)):void d[h][n].apply(i,o)}

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, truncated
Category:	dropped
Size (bytes):	23
Entropy (8bit):	1.5342190211803406
Encrypted:	false
SSDEEP:	3:FttTt:XtTt
MD5:	F0D79988B7772C003D04A28BD7417A62
SHA1:	58423A999EEC2997BCFFFB247E9ECD3DFD0ABF44
SHA-256:	30E6FA98FB48C2B132824D1AC5E2243C0BE9E9082FF32598D34D7687CA7F6C7F
SHA-512:	1D497009F3AABD230BCD055EF09FD180E63E330C47F4C1AFDFC36172E5421A220B78E3E3CE30C9AE533C516ACCFA8976FD3F1198BD15FF79373D5FE87FC64CD2
Malicious:	false
Reputation:	low
Preview:	.......................

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.822006953966017
Encrypted:	false
SSDEEP:	3:UR89KCmHzc5VFDZroCmHzc5VNeHQvHfeSXiMn:U29ZB3fBAHs/F
MD5:	BD6ABB38F312069F82824DD46FB86D10
SHA1:	0EA897DB2E839B085F202CBFD21FB2AD0D0C2CCD
SHA-256:	C89B756471D4242AE685B04665F3701F625D08BDE2EC917937FFFDF78E93C30A
SHA-512:	8C28F4EFDB2CAC818CC70705A1D97B2B63A512CC12617B285784EB3E7E7F77AD755B774F1EB73532725F853F2B016315AC97F8CD85E20F8B586A6F9A27A2C664
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk9348424000 && BMap.logCbk9348424000({"result":{"error":0}})

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.827498466892594
Encrypted:	false
SSDEEP:	3:UR89KCmH9CB5Dq8oCmH9CBM38HfeSXiMn:U29Zdq8fM38/F
MD5:	FD2579915FE78D1853CDF6DCF6356386
SHA1:	6609261D74A8A039779F258179E344E6D00ED1F8
SHA-256:	33DA03BCE482065AE2ED5DEC8EA53D04862FD5F0BEC431D082412A1837056401
SHA-512:	5B4C9051271C23ABE9D52EFB942F5DC2FCBC334D7F7810D2DFA9595AB8691562244EE301D865D64F6FCD5B22E9464713BC2EB24595641F1C16D29A645C1BF342
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk7081181651 && BMap.logCbk7081181651({"result":{"error":0}})

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	19363
Entropy (8bit):	7.930280234305601
Encrypted:	false
SSDEEP:	384:e2yqOt508z55u190J8hmDteS6N3OJZIKCDH9ZL4EYxV:ezt+8zno90J8hmDtviOJ6KIHgEYn
MD5:	6C44A15E4FF77458B2AD834DE5295926
SHA1:	9C484AB2B9AB4A6D0E2A8A66ED711B94D5EF21C4
SHA-256:	ADFC6F58F4B6EECAE6E29618F7516DD992987E4EC83A8F448DB90C8F6238566A
SHA-512:	0CC13AE365DE264C99D07F806C6AC569FF01B598A60247CE7B7C2F6AA5205499F912C184D267694AF17BDED0B33A23B827049D7DC611BA4BD4276803380D49D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE...............................................................qsv............................y....q........f}....q....Z......P[.........:..my.......i.b................?.\|."[.....bKGD...-.....pHYs...........~...J3IDATx.}.z.8..@.b/.d...Dr...o...].)....,.....,q^L..@.)..h.RF...8.R...+."\I._.......H....w...?....r.....r...2..9<....b....,..e./).i........>$..?.....O.YO.._..Z=.....+.!.2\|.;C.j...b...+\|.T..V../..>^......"C.D.......{......x.......lV...].!.%b6...z.3........2R...y.H...=.......N..4....%.z....H\|$..,.....Z...fM2z.y4.Y.:x}...X-..~.L...g.d _.K\|.v.-....U.&k.:.&...+.g... ..\|...a..e.}......k5.R..-ni\|.......H.l...g..t.u..}..WU.._. ....&...J.........n`...%.W.\|.)..u...f..@...y!X.......b.X.o...T..(M".k[..k......r>O.0.k\i..CF....%.. ....... x..cW.5........V.F@..&...G(...`.t...Z.D..S.E.\..H...k..Q.Y$DoB<K.P..7..D`.Y.....u52.3..2..

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53093328&code=load_mapclick&da_src=load_mapclick
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 52
Category:	dropped
Size (bytes):	72
Entropy (8bit):	5.043906976252533
Encrypted:	false
SSDEEP:	3:Fttuc/IHxnLAUXnTV8c0S6Fd3p/l:XtB8xUOnZp6zT
MD5:	860E06B1C62729C812D6F6B7EF744892
SHA1:	A7A35CAE7650D7C03C2274E4155E818A77116EFA
SHA-256:	9272CD767AD0096B4AEA993463A8A40BD7259B5357C11032309EBF450050F4C5
SHA-512:	CA95745DC7BE2F922FF0D1B2597E5B7A52FCD7776CBD56D89ED5EA23FEDF5C2429FAECA6BD3FEA6C9E48E3863AC6BF73089BB6D383E8CA81C613EF6C13513CBC
Malicious:	false
Reputation:	low
Preview:	...........V.MNN-.V.)*M.QJI,IT..VJ...LQ.Rr6pIt,q2Jw.J.w5.P.......j4...

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 336914
Category:	downloaded
Size (bytes):	80402
Entropy (8bit):	7.99624506493903
Encrypted:	true
SSDEEP:	1536:hc8l77MZXBJQ6VLzqYQTXNUY6TzyntddVoKohA2NRQFGpQVKdwJq5:D7MzJQolQTXN/6TuLdVobW230GpQYdw0
MD5:	F5F278BF1506BC20E9550A00E57BB65B
SHA1:	2A4F97C113FFB61744BAD6F9E516C6360E880839
SHA-256:	7C0C607BED68DBA312D80BD753A861F0873B29984C50E9980AD9C50B12472B9E
SHA-512:	616561F825539AED5E4978FB07196211BE73A1C36E6D44FBB0F5EC095261B36EE217C73D5C3A34BB258E8E48CD3A1F5AA133A2CD5BEDD4E9E4DF9E5FC269B6DA
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/dist/site.min.js?v=202411111122
Preview:	...........y.$.q .U....".....U=5.9IPsy0$%c..W.n.LuU......~..lQ.d...Z...z....~.D..y.p.....2.h...Z..<..;####"#"......Qh....h..K..I..^4..v.Q.&....Q..^....r.g..W&~.F}..A......6.'.d.=.s.......(1,R^.S.$.....Q.&..$.....-....F...~.-,..uw.......Wo_.v..N.....K...g..0A`.......)Q..z0......r..7m..f..'.H..~..+....7..r.{...Wo..v...n...Z.8.D..jv..~.8...Z..n<...x.c....2...o.Z...$.4.$.\..>,i;..g...7=.?..5/........x..tj..7..M..E"'...o.E.8+..V..4.%...........,......}....k..Z.UO........z..}7u......5...:.S...LI.[.=o9Z...M.N.fY..mF.....g.aN..FqG.(o..L.vY&.Y.]Z.E!.v..av2}^....(..ZG......T.2b...:0..`^.cw..'./.Yb......N$q.B'.......mc.2..7...X.i.. ]7......!`;.N..IDb..Y. .3. .g..N.=.m..........z.)..O's..3..N!.I..iN......f{....wb.H........>.$[._.v....x.0............."'....}>.y.8....`l@..mZ.......1hhb.[q.3.M.\|M....A............7..&k..0.."n.z.q:.F@..bMbo....]..............4q...&..".Vp.S....&I:..n{s.\a.Mkn.[Q.n..TP...g..........<ti.6.<...

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.918780730435345
Encrypted:	false
SSDEEP:	3:UR89KCmH7ltcNmdo8oCmH7ltcN1AvHfeSXiMn:U29ZEdo8fcv/F
MD5:	8BAE368158C016630A8C24EA90B09C3F
SHA1:	B7AA5A931BCBFF9BE91EA8735B53FF4D1028DB35
SHA-256:	93A5B399DD070137744DBC7867481813A7D49E99F98384A795CEABD24558635F
SHA-512:	FB60CF4E8922DA1E198A5A415048C63663F02A3D5A2C88FE9A8CAACBB599207EFEB8CFDCA3025FBD5BE687C637F80806B2F68B70168C200A504C14F9BBFF09D8
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk1914489283 && BMap.logCbk1914489283({"result":{"error":0}})

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.903653494235835
Encrypted:	false
SSDEEP:	3:UR89KCmH+XVv/I8oCmH+XVv/A8HfeSXiMn:U29ZVXpI8fVXpA8/F
MD5:	BD15160E82048DCC855E3349BBC0D5D5
SHA1:	DF87A45F33DED401A4D3ADFA663B7908DA44820A
SHA-256:	37BC36674766A2DFED7EB73D65B7E027CB4A6AA7D673774413E441FFDD199FAD
SHA-512:	59B59F123C5ACB695477CC5D1535842D48C9B075989203CD839870AA7273A596A2CBB3993C2203F8DCB9720A4F58BDCBE5968EE171B2EAF4EB269969039A4493
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk4206044938 && BMap.logCbk4206044938({"result":{"error":0}})

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33
Category:	downloaded
Size (bytes):	51
Entropy (8bit):	4.612547934030121
Encrypted:	false
SSDEEP:	3:Fttuc/IHNtKXq3WBkp/:XtB8N8s/
MD5:	09DA5E8AC1DAE5C1FC76F7E312A390DB
SHA1:	96B02766DFB5A6DAEB954AA9C5894CFABC062B3F
SHA-256:	DA6E1380172679049DA353BA6A0400B1320AEE5A54C360EBC01FE5E9B3ACCB13
SHA-512:	1B9A1D082F0F175E1C52697E7BEC38F3BE41474AF5E04383AC5D2C8708B97CE1CFADC72B88CA616DB62C5B28E586CC636FF8348115FE8405D3B5C8F04BE64182
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin
Preview:	...........V.MNN-.V.)M.Q../..,....s.Sk....!...

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.822006953966017
Encrypted:	false
SSDEEP:	3:UR89KCmHzc5VFDZroCmHzc5VNeHQvHfeSXiMn:U29ZB3fBAHs/F
MD5:	BD6ABB38F312069F82824DD46FB86D10
SHA1:	0EA897DB2E839B085F202CBFD21FB2AD0D0C2CCD
SHA-256:	C89B756471D4242AE685B04665F3701F625D08BDE2EC917937FFFDF78E93C30A
SHA-512:	8C28F4EFDB2CAC818CC70705A1D97B2B63A512CC12617B285784EB3E7E7F77AD755B774F1EB73532725F853F2B016315AC97F8CD85E20F8B586A6F9A27A2C664
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605648766&callback=BMap.logCbk9348424000&sign=6391d8f0bbc3
Preview:	/**/BMap.logCbk9348424000 && BMap.logCbk9348424000({"result":{"error":0}})

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x915, components 3
Category:	downloaded
Size (bytes):	48652
Entropy (8bit):	5.811610122236321
Encrypted:	false
SSDEEP:	768:XGt8AYUXZfBD6yq7C/Oi/0BGGRC+LT6+A08ix:XVAYUzz90wGRfS6
MD5:	8BB122A50981E23EC67FAE3F777F7A1D
SHA1:	B6CE4A9230D5C8A6B6A7AF476A2C59E91B42DE1C
SHA-256:	C0BBB643A950E11F7834BF570A880D143099218864EE54856BC0421BA3CAF58A
SHA-512:	24DEDE36267984A75322F701D934495C94372F785A0075A62A3E58017E953A3D16D55B7BFAF22AF72426B0C582529459573BBAA6848613EE601892E52E894F95
Malicious:	false
Reputation:	low
URL:	http://20228233.s61i.faiusr.com/2/AD0IidHSCRACGAAg_Ofz6gUogJ7O9QEwgA84kwc.jpg
Preview:	......Exif..II*.................Ducky.......P...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0C7967EDC3E611E9BCD0B6F55407B5FA" xmpMM:DocumentID="xmp.did:0C7967EEC3E611E9BCD0B6F55407B5FA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0C7967EBC3E611E9BCD0B6F55407B5FA" stRef:documentID="xmp.did:0C7967ECC3E611E9BCD0B6F55407B5FA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	121
Entropy (8bit):	4.906011432855761
Encrypted:	false
SSDEEP:	3:UR8OXBL1fdHo84BL1fdGykad2jRbrUWAqOLc5MWvQPmh:U2ML11Ho8ML11GQGRbrPgLc5XIPU
MD5:	6AD25E002CB21CAAE55AA8D203A6B16C
SHA1:	8C3561E5E311C52375A9DEA6D2FF7C3CECE75F3D
SHA-256:	209B76CE2F4F6EF64C63B924944E14151BDB6D65EFC9230119CEFA326E7EC7A5
SHA-512:	5EBEBDBEA4F68560D2D0D2470C782FD4E3ACFA350D9FA9FF12DC2E9050AC275C552B8EA86A57948F487A7A4F0B7BF9607C496F18E746274558DF0C781E27E326
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk73838&seckey=-1%2C-1&timeStamp=1732605609720&sign=021634ea5dfa
Preview:	/**/BMap._rd._cbk73838 && BMap._rd._cbk73838({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 114
Category:	dropped
Size (bytes):	117
Entropy (8bit):	6.258710678477952
Encrypted:	false
SSDEEP:	3:FttKyVVZw4GdjmsLO0FPUzyvAgd1AgZ0zTqll:XtKui4gFPUmnXKzTel
MD5:	DE0361FEF0BA34F966B12A3E918BE937
SHA1:	0FC49C7D6B5168B7813CADCFCF64A80531B71E32
SHA-256:	066E3616B6254EB0486A00DFB7F5C8B17EFB9F0B7982B851B55315DC0D351EFB
SHA-512:	A4C85A9FA11CF7E11AA928408AC15E8EB3F356F1669CA06F7D67BAB13D00D50BFBF6E58026FB98616E1D32FE38DA6E6C07725194D4031A31018B3FA416203C47
Malicious:	false
Reputation:	low
Preview:	..........5.1..0....9$..r.Xz.....Q.*B..S.1..Fm.!.wfq...K..w...f.U..+..E2h....g..Q.....{.}....D.-IN...^......6r...

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 1254322
Category:	downloaded
Size (bytes):	335447
Entropy (8bit):	7.998733987990607
Encrypted:	true
SSDEEP:	6144:lR7anc5PFnFRQ+th6LUs/u64teE4wO6f2mTuJUCvjnBRNM5gYpw+NCJXfinq:RPVFys6LlrQ4wO6VS2CvbBboFpDoJXfP
MD5:	E0C23607CAF2CD7A7B548B089A35F57C
SHA1:	6C42DF3C8A3CBF627617EC0D383A23310969B263
SHA-256:	B199B776DBB0306E7871E045D4EFF1E6EC73F9A502446DB382E7965FD982F77D
SHA-512:	4F885E6944F54C22CEBB5392B710CB31A86D9172B0A5D801277300483D7EC72A1DF39CB76CEE70921CE11AF6AB578406F15BFC5A0F706D347B2B89FEFE4E3B79
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/dist/partitionSite.min.js?v=202410281114
Preview:	...........i...u ...D.2.f.Ifm.`"..R]..TY...J.$H...(...L.....K^.=...[>......x...........w....d2K%Y>S.$.@.q.nq..p..S?..y....z..p..d.E..\|..i....e..f...?.........=.hl=}1..0...V..QO.n...>=5&~.x...+/3K. ....We.lC.9............d....~...G.ow..;`.0J{.(;......L.......9...S7N}....z.......n....O.........G7n}.{..O.<~p.^........Z..u.lE...v..Nc/..aEUj...q..=.zS....!.A.^.jk..c%5=UO.,......p.=.?4`..Fq'..B.3..e......~.&i<.C....\|nL.(..XG..V.2..\..!...@.>@Z{..j%.F^.;_.ga.O.J.^..MOb.4N+f.l7[W...K.0e.=..............}/....w.Xve.........x.1L......V/.z[......u.....[..-...h..%.Y....C.).....<<.........\\|....3..0.:M..C.o.....d..w...]..D-....?/_.6.Onr.....s)..C.4.e.GO..e...Z.....AQ.S...3/.M..^...&......z?..T<.-........a..5.i.lB.3.8S.di...\My....:..lu*>....q&{....r.a.c.M=3.2[...w\.oFgg..V[4...3.~x.=..9.G......f.....q..X.m.Q<q....... 01.\.Z.J.=....=...q.N.)...1.Y2.....S@...hI..{..`#..{}@...`G..[a.x......u...gC8....6..Ef.>.4......eQ.....y.#9...l.y....\|n.1

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.612547934030121
Encrypted:	false
SSDEEP:	3:Fttuc/IHNtKXq3WBkp/:XtB8N8s/
MD5:	09DA5E8AC1DAE5C1FC76F7E312A390DB
SHA1:	96B02766DFB5A6DAEB954AA9C5894CFABC062B3F
SHA-256:	DA6E1380172679049DA353BA6A0400B1320AEE5A54C360EBC01FE5E9B3ACCB13
SHA-512:	1B9A1D082F0F175E1C52697E7BEC38F3BE41474AF5E04383AC5D2C8708B97CE1CFADC72B88CA616DB62C5B28E586CC636FF8348115FE8405D3B5C8F04BE64182
Malicious:	false
Reputation:	low
Preview:	...........V.MNN-.V.)M.Q../..,....s.Sk....!...

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 114
Category:	downloaded
Size (bytes):	117
Entropy (8bit):	6.258710678477952
Encrypted:	false
SSDEEP:	3:FttKyVVZw4GdjmsLO0FPUzyvAgd1AgZ0zTqll:XtKui4gFPUmnXKzTel
MD5:	DE0361FEF0BA34F966B12A3E918BE937
SHA1:	0FC49C7D6B5168B7813CADCFCF64A80531B71E32
SHA-256:	066E3616B6254EB0486A00DFB7F5C8B17EFB9F0B7982B851B55315DC0D351EFB
SHA-512:	A4C85A9FA11CF7E11AA928408AC15E8EB3F356F1669CA06F7D67BAB13D00D50BFBF6E58026FB98616E1D32FE38DA6E6C07725194D4031A31018B3FA416203C47
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605631122
Preview:	..........5.1..0....9$..r.Xz.....Q.*B..S.1..Fm.!.wfq...K..w...f.U..+..E2h....g..Q.....{.}....D.-IN...^......6r...

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	121
Entropy (8bit):	4.906011432855761
Encrypted:	false
SSDEEP:	3:UR8OXBL1fdHo84BL1fdGykad2jRbrUWAqOLc5MWvQPmh:U2ML11Ho8ML11GQGRbrPgLc5XIPU
MD5:	6AD25E002CB21CAAE55AA8D203A6B16C
SHA1:	8C3561E5E311C52375A9DEA6D2FF7C3CECE75F3D
SHA-256:	209B76CE2F4F6EF64C63B924944E14151BDB6D65EFC9230119CEFA326E7EC7A5
SHA-512:	5EBEBDBEA4F68560D2D0D2470C782FD4E3ACFA350D9FA9FF12DC2E9050AC275C552B8EA86A57948F487A7A4F0B7BF9607C496F18E746274558DF0C781E27E326
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk73838 && BMap._rd._cbk73838({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 114
Category:	downloaded
Size (bytes):	117
Entropy (8bit):	6.258710678477952
Encrypted:	false
SSDEEP:	3:FttKyVVZw4GdjmsLO0FPUzyvAgd1AgZ0zTqll:XtKui4gFPUmnXKzTel
MD5:	DE0361FEF0BA34F966B12A3E918BE937
SHA1:	0FC49C7D6B5168B7813CADCFCF64A80531B71E32
SHA-256:	066E3616B6254EB0486A00DFB7F5C8B17EFB9F0B7982B851B55315DC0D351EFB
SHA-512:	A4C85A9FA11CF7E11AA928408AC15E8EB3F356F1669CA06F7D67BAB13D00D50BFBF6E58026FB98616E1D32FE38DA6E6C07725194D4031A31018B3FA416203C47
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605661099
Preview:	..........5.1..0....9$..r.Xz.....Q.*B..S.1..Fm.!.wfq...K..w...f.U..+..E2h....g..Q.....{.}....D.-IN...^......6r...

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 7511
Category:	downloaded
Size (bytes):	1640
Entropy (8bit):	7.8911275574888045
Encrypted:	false
SSDEEP:	24:XM0O1H3bYE6BS4HAgYK+QcONg9NBDGQJlHSdmykkiD2shZSW+0fnijBEjy8bS/3z:XQEzZlY5a4ydSkiKYSW+aDy8Wra+
MD5:	73A7F24ECBF57938A8DB6BDFFC1B683A
SHA1:	4C2BBA656F74475CB4587EC0FD7252026520C1DD
SHA-256:	3A206EBF6C5CFF8DF2069DF37E5421FC020BF5BDC7967364CD6C5DC395B5C17F
SHA-512:	EF1F136F155AB37BA103BB7622C942D96CC7228FF6F3EEA524599E13580C250548E07DED3DA2BA5C28782769D89CA9D4A1184EC50AD8A1A28D5F5A1D038122E9
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/dist/styles/video.min.css?v=202407231110
Preview:	...........Y..6.~.7......9Ml........2..hG...x2..=..>B.o.g..C,..Lv.......?I6R.#..L4#......1.O...F..F\O.'d..1Hj.(...\.=l..E..c..-.....m.n.i........9XY.i....[3p..5.n..?......".."..r{...B...NP.m}..p.........w..$.=..Qr(8.3.:.K...W.......s,l.nB.#'...P.>.8...6...4E.1...GLA...\|......./..0.....aH..#.".=8M`...b8P.6...'....';.K.8=NP...."...4.AB....~Qn...9./1.;.y.hB..@7.....K.V...e.6!.....S..S.)B...5..8...C.".R..Wk.+.f.9....9....#...GP+....A....4{2qJi8"8B.K...T....(.......\|4........j..Nvd.\.e..n.u..5...-E...S\|...R&\|.6E..Y..Z.y.7M..b....yg.M.@.D.J.)........).4.....p..Q..]I_jTV.....FAn....I<.PT.....e.w.2W.QT.(k:....i.G.......E............5.{`..8.O...G.2.P..F.gj..2.C.?.s.F.c..V.y{....`...A. ..FL.T......>......._....B.......J.........j.....r3.....nJ.8<...6.0.B.......o.3...5...81.})!...K......,..f..g8.+......C.9.r....2.r..D:..%..\|Y.?.{..............s...r.A...._....6M..U...<...t.=..>..-......9&.!G...)z..;...y.B..U..mi.t..n0.U..U.\.T.J..m....t...I.!s

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	17844
Entropy (8bit):	7.895271784759638
Encrypted:	false
SSDEEP:	384:P5m3QXQnHs1nJ8+RxOdFF41IcFENthFyhK5FgvvilWzp71wUHwY5cxdwsHBjm:aQgHsBu+Saz0HMOgvH71wew+laNm
MD5:	22151DDB4ACC5E87EEBFBA147EA56889
SHA1:	2309E09AB0E4A27504644F16FD7A3EB5440CE23F
SHA-256:	54CEF2CA79A6B57D3356C41F6C17FC54253B933E45F6513A0C3E83ABD6D81553
SHA-512:	DBB870612FE16D72A573B4136437653706DA893CBDA7DA73D22EA16D17067CEB0AE51B45E8EBD7C41A938DE9FDF80362E85F9C7C9FD48FB363F0F1A4FACF2BB0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE......................kw.Sc........\|...........................................................................i...........c.o..^........U.v....t..{....k..w..f}.[..5.{..l(.....pHYs...........~...DQIDATx..}.{.F..:...th.U,QKyhR@.. ........;3{.JZ........6..{.3..3.\..;N.z3..O?....py..o.y.........><0.......{X.....\|2{......?.=..k.....y.<....z`j.n.$a..0..~..U.-n...3V....)./l%...5>..wQ1.....z....a....h._=<z+X...z.p.g?.....{.b..;....+...?...y.S.d..:.u.._..O\.^$L.....~%.....u.F._?=5.."Lc...'^.v..0..o.....Q...2..o.=.y.............7..I...... ........j'.8.e..f./.$.`...~.?..E.O.......d...E.....dR.X............I^y...........}\| b.8.8.y\|#_.^..z\|...z..I..I.z.(.8.....i....."7.tF...gzq....^G.~.[..x.......{.@5.d..o@= .o..-...~........<..C..i.A.......8N.......+s...]........!....p..Okg...;..o..wo80.[...i..T.$.^.R......$.._..8...!s... .

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=89714645&code=5030&da_src=5030&load_script_time=1071&load_tiles_time=3350&map_width=320&map_height=240&map_size=76800
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	17410
Entropy (8bit):	7.931527871261676
Encrypted:	false
SSDEEP:	384:FEUSfom1/EZR0q5Z22FUvecBPv3ncFUNf20LGJg7VkVbE0WWfeNzKv:FEhgC/EMx5GG3ncFo20yqOMKv
MD5:	714C626FFFCBE5754295A1BA5ECB946C
SHA1:	B4A6E72D608C10A5BBDFE76466EFE89C38AD27D2
SHA-256:	ABE7B0CE368409E80EF74A6E36BAEE0E4FA3E910E227640D130B2C8857D032A4
SHA-512:	C44D2232C1F422A5148C34627CF97827D410B54DBF6A6318735376F1765C8372C09816B9ED84226F7EDB7F27E214CD570342819A7A62C7CA5BF5F6A06E8CAD3E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE.........g}.k..{...................................j.....................u..............v.y............d.........................S=....\|.w.....rx.bdk......f..".P......R..D..&.......bKGD...z....pHYs...........~...B.IDATx.]...6.....>....v.Kp.9..6...W.....>..fc..<....#......x..F.#.0.....T..H.'...LJ.4Jb......Y...O......o.kJ.....I9..n-.5.ysm..'....K...G.rn!.6B.b44.$~)5H.A..a.t..L.t...Z....\|X..#...z-..h..Fr..a.?..l..6.5..'._.7...4..&)tM.>.....l.x...Y..."..Q..Z. C.....:.........Z....~...<...............5..'..I.?\|^....+.=>=>..n.._....o..[.fB......r...........I.`......o>l.....x.~..<i.X.7..z.?p.Gr............q.t..;..yD...j.....c..7....H..^/...-k..g.@.^..m7r...x....@.....n...),...8`......)p.v-.!w[M.v....zn;k.D...[..~...~./..X..p..,...H.Y..@.aU.-,........5\;...5`..<.)A.1.N7.(4.\..{.. .....]...-F.Z.D@S.l..;....... .P_L...c.\|.

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 29, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1311
Entropy (8bit):	6.831261668584174
Encrypted:	false
SSDEEP:	24:0c1hNo7FCWwjx82lY2T3/VgSKwPS0yJ3V6S/aSNG1Wb2XgbvzkQKVATIVKFWP:1zo7FDNn2DqGPkJ3QF6GWBvYQKVATIVd
MD5:	995341F77873DA8B4BA3E27E99C72F98
SHA1:	7A22DB6310F260C7E5CA774EB916D20D8EC41DBE
SHA-256:	7827A9A311F3A4FE8D85C70416A23013B46F84E84C3425A741981ED59ACEFF64
SHA-512:	868FEEEEE492556B6585EF486F076F74E7B3F799F9A36179B9577C4FB05B0D900935A942B8631FE90DDA392CDB6B7EC998DF47B04CA78D82EC5DA6B66A2FBF95
Malicious:	false
Reputation:	low
URL:	http://0.ss.508sys.com/image/onlineMap/multi_only.png?v=201809101152
Preview:	.PNG........IHDR................K....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:82161B336FA311E98835E35E3D1000FD" xmpMM:DocumentID="xmp.did:82161B346FA311E98835E35E3D1000FD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:82161B316FA311E98835E35E3D1000FD" stRef:documentID="xmp.did:82161B326FA311E98835E35E3D1000FD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..1K.A..7K. .La..". ZX....PQ.%.._.....V+.4F.c.h......&.D.D#.F&p.{.......M&.D.....Y0...'x....?...XO.5.

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=83407359&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	16729
Entropy (8bit):	7.896302602243815
Encrypted:	false
SSDEEP:	384:tHKIk5hVorIxcm7+43C+dy8VPxl9zthK1:tHF0hyrIz7+K19xn3K1
MD5:	62AF8AF5B45D5312F1C1C6BC60A4F801
SHA1:	0EBD95A29A535C544EED33E67CF9A2AE0E2B98A9
SHA-256:	D10BAFB079B2B6734A3A79F33AD93965F313ADCB76DD36A99A456F6019ED94FA
SHA-512:	91C5D4A9F66658C2E2BC219E14C1344413932199EA1AC6BFF0BD0641D074DD00EC5B61B3B35ACF0764AD6DFA723B3CD50FB4D79BD48F62F962798A8639BBFB07
Malicious:	false
Reputation:	low
URL:	http://maponline3.bdimg.com/tile/?qt=vtile&x=49624&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE......9.}...........s..\z...........................................................................]..k..^....3.................y._%(,]_a=@C;i.......a.o.U.........u....1z.N.....bKGD...-.....pHYs...........~...?.IDATx.}.C..v.....iS....8@..6....W.\$Y.%6...[.%..G3.fF.d2......'&..i\|=ug'''3.s....0...1...WQ.?b!D...sh.v./.#?.....W....1]\|?;......M.=A..s..?...&.......Y.?...S/.............R.D...#.D.p.l..g.n..._....../).a.......?. 0..7<.....q....._..@...>=y....K.%5......i?&:...._.@........."?9Q....,z.WU.V.A..........1Kry..Th....S.FL{.....:......1.8~....<..<@.D....q\|d..0.^.k.>..+.gz...r..w..$D.......!......a...H+7vHv.8...W...(.0o9...(..)..o.>...&!.~.....;X@....<.`%..G..q)....%..$z.......;..T&.X\|...............$.7.5.+x..H.WW.5~~)nEr.........W....A<.../......~z.#...@...J..xu.\..........^....m..q..n.%W...HT..p..].u...L#t.Spt...=.j.....?

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.881552520946649
Encrypted:	false
SSDEEP:	3:UR89KCmH971JoCmH97QMHfeSXiMn:U29ZU1JfUF/F
MD5:	A10EDAD55DD3D0B16B90A9D0B13254C6
SHA1:	8176C1E32D78C6A56797C95F095DACF8F2748F34
SHA-256:	2BC49E799AE2BE2B9D4B8AC19E94108A76900C98B00097F69E31A434B88039C2
SHA-512:	5DABC0B92B14A174B188735F89CF8E6CA955CD66CBDDBE40FFCBCF58DFF435A8E657ADD8D479E7F03C59C5E76443A8B5282E4D03A36350BD596C28436A1821EA
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk7886880435 && BMap.logCbk7886880435({"result":{"error":0}})

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1371), with no line terminators
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.273300751687743
Encrypted:	false
SSDEEP:	24:WcD54RWMuHKFmOthmk9++35E5TJIlGhjXgfIS7sa4/M63psI8S:Wc2w8hm6++3SlIGhrfeS
MD5:	C0C8CC8781ED7D9786FCDBF624F661BC
SHA1:	B6B4530D0B19F2E2ED25E829D1AECC456156FA6E
SHA-256:	8B6381CFDFD24F173EC6EB7F7CA3A461DE4F6BC9720EAA624AD06A99A68EE449
SHA-512:	CD5F7FC836955D7CF8F2525122F257C56527E15051025B6FD2BEB9D324875BCB20BA0A10CED71712B65C5516094E37A4DB14AFB72B1124F43E5B165708FA6899
Malicious:	false
Reputation:	low
Preview:	window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo09KtYPyfCGeMDW8KXcS6tU=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,e(a,o),a.onload\|\|t(a,o),r.appendChild(a)}function t(n,t){n.onload=function(){this.onerror=this.onload=null,t(null,n)},n.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),n)}}function i(n,t){var i="onreadystatechange",o="readyState";n[i]=function(){("complete"==this[o]\|\|"loaded"==this[o])&&(this[i]=null,t(null,n))}}function o(){for(;v.length;){var n=v.shift();n&&n(m)}}function r(t){if(s)return void t(m);if(f)return void v.push(t);var i=function(n){return d[h]===w\|\|n};f=!0,n(l,function(t){return i(t)?void n(l,function(n){s=!0,i(n)&&(m=n\|\|new Error("Load error")),o()}):(s=!0,o())})}function a(n,t){return function(){var i=this,o=arguments;r(function(r){return r?void(t&&t(o,r)):void d[h][n].apply(i,o)}

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 114
Category:	dropped
Size (bytes):	117
Entropy (8bit):	6.258710678477952
Encrypted:	false
SSDEEP:	3:FttKyVVZw4GdjmsLO0FPUzyvAgd1AgZ0zTqll:XtKui4gFPUmnXKzTel
MD5:	DE0361FEF0BA34F966B12A3E918BE937
SHA1:	0FC49C7D6B5168B7813CADCFCF64A80531B71E32
SHA-256:	066E3616B6254EB0486A00DFB7F5C8B17EFB9F0B7982B851B55315DC0D351EFB
SHA-512:	A4C85A9FA11CF7E11AA928408AC15E8EB3F356F1669CA06F7D67BAB13D00D50BFBF6E58026FB98616E1D32FE38DA6E6C07725194D4031A31018B3FA416203C47
Malicious:	false
Reputation:	low
Preview:	..........5.1..0....9$..r.Xz.....Q.*B..S.1..Fm.!.wfq...K..w...f.U..+..E2h....g..Q.....{.}....D.-IN...^......6r...

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	270234
Entropy (8bit):	7.999275216744395
Encrypted:	true
SSDEEP:	6144:jXorsbPVsQ/oetFbq5gE8obKQotchF4oBSiAzLZIoUcETVJDR:joobPVsogfoehu5V2oU5LF
MD5:	9B1C2E08FEC6E7D14EEAAF5E6B247F7E
SHA1:	C6F26D193FC59ED831704C538956AAE0C2243A89
SHA-256:	B3E53F9DDD96B8C708F40C9BC1C63F71C5303DB3365B515972269B774C02F17B
SHA-512:	65816F39266B905A2D4517A3A944C77764BCC06E341053FE18395F10C1EB02147DC2E57327793CF8EA760C41A9DBF5F76E468C4FBD0E14076786C1B947C5F209
Malicious:	false
Reputation:	low
Preview:	RIFF....WEBPVP8 .....9.....X.>m,.F."..,.l....bl...T...zm....5.9.q....2................\.m.Og.....w....~%...>.\............{l.O.>i...G.i...p}..n.y.!...g.G.W...o...?...`...................................>........#.w..._.?.?.{............'..........{...........<n........m...W............S...^ ...O........'.7.....;..._........._....._...~..........o....??_.g....@<...._...=......_.?....a.O.....{s.g._......}..=.....................?..O..?....]...........~..`.o...g._..........Y.s........_..y.....u.....a.....k....E.......x..W...'G.q,.......\.......8.A....u..^..._..B.gC8WZ...k.C..........t{..o....ZXw"M.z...^q...W.zJ.C.MMgf..l..CfE...i.R0..U..P..0...w>x.W.@6.-O..%..........d...fH<p..........O\.2;.......6*.......>..'..$.A;..T2....m,PN.C.?bO.y......m........q.kTM.^.k..a.....(I....>....F...P>...n.-GBA&...++.....O2.ROh...]`.....e.5.-K.O.q.;...C.......p<D%..$.}4:Y..i.N....z.%..U....c...........v.+^..z._..V..>Z....K..h7=Q......s.i..D..Wo.....l

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.920841677086334
Encrypted:	false
SSDEEP:	3:UR8OXBL1DZno84BL1GNad2+WH8J0Tf4:U2ML1tno8ML1GwuH8J0Tf4
MD5:	0F31E1A59966548CACB9FC69777D31D4
SHA1:	A239FE0A092FCE63E2C7604113967B58655D4C9C
SHA-256:	12FB5966508A3FEB8B5B140C6E3D4BFD546B945A635DAB2CC6C480C89D4AD834
SHA-512:	37ED31F285507AD97102B18920EC50244C0CC4A91F72AA20DE507CADE8E1A799380B549A5E098E0E7B3C2B2B7C7777BAA618B53D3A74A9042E8F7AD718D35616
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk13991 && BMap._rd._cbk13991({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.918780730435345
Encrypted:	false
SSDEEP:	3:UR89KCmH8XugAZo8oCmH8XugFwvHfeSXiMn:U29ZXXug0o8fXXugFwv/F
MD5:	94AE4D3AA93DF1E815230BC8743FE0B3
SHA1:	9341BFDBE23A37455E80A63844306CE004A31843
SHA-256:	ACEB79EDEF5BEA00AB9FCC71741C87903D55F97C694F279F7E34951A495AE779
SHA-512:	CE811629C1B0FB00DA7BB3BEC980F6C967DD50CC3B2169463FAE8A5EFDE9581CF48A0300F9938644E08044F5FEEB42F97D72C8F0DFA9396E60A9C0A32DBD2168
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605610720&callback=BMap.logCbk6219177233&sign=0c25ae630a48
Preview:	/**/BMap.logCbk6219177233 && BMap.logCbk6219177233({"result":{"error":0}})

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3447 x 1754, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	654573
Entropy (8bit):	7.913264577217895
Encrypted:	false
SSDEEP:	12288:RBQYz3h5drtwx5ofEC6BV2wJ+MwS1FIl3o0rWlSgmlulBt:Resh5drtwxGq2wU9S1CVoJ51
MD5:	B8C8D98E1BD45B0B47CD2BD7FFA47ED1
SHA1:	C3CEF3DEE8A65285BABBC4FFE6264A9C683B5D82
SHA-256:	60E48DFC7A2C038F9AE70BBE2296C95901CC40D8CC1AF1036A15470B4ACE0782
SHA-512:	984A945B067BBA139FBC84AF067344AB79EA13773402DE2724BF9D6E65FE36724F0DB3B18766CE43F00CD4E2027DC85A437C7303C13F8C376FD856CB1BD0C948
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/image/v2/mbg01.png?v=202011021234
Preview:	.PNG........IHDR...w.........4.......tEXtSoftware.Adobe ImageReadyq.e<...oiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF" xmpMM:DocumentID="xmp.did:8100E979434211EF9671A8786D85B2AD" xmpMM:InstanceID="xmp.iid:8100E978434211EF9671A8786D85B2AD" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d4e9ec8f-bc07-9342-a86a-28d0735f5686" stRef:documentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..l.....IDATx.........H.s.[l...bz7&@..$p.

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 37
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.550902333223265
Encrypted:	false
SSDEEP:	3:Fttuc/IHxduN8YA/n:XtB8xY7A/
MD5:	8AA11B9E8F9A40315C72741B801C187B
SHA1:	09004ABBAA45F134677082C1648567CEEF79E2EB
SHA-256:	95B6E0DEFD2B896214CD1971D66710399D7D1710DE365F7EDEB7AE4FCF798B52
SHA-512:	488D897804004D7CFE4EBF6B9CC705CC169D9D347C0F25D45648746F196EDCFB07F2EF374901261488674C0E99B8C0C38DA3DD9AE6BC84DD121FDDC6789010DE
Malicious:	false
Reputation:	low
Preview:	...........V.MNN-.V.)*M.Q.,vK.t..M..S.RHK.)N....1d%...

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 107698
Category:	downloaded
Size (bytes):	7140
Entropy (8bit):	7.96017931211102
Encrypted:	false
SSDEEP:	192:XYSd4sK6U9i08SIQIUl/yNbpmZRnuWh/CACKqfsU:34xv9i6INbInt/C10U
MD5:	03BE7386B90B9CD80DA43884A509A5ED
SHA1:	A7C65B4C73A4ADBBA0019F5D0EDF6CB658F32612
SHA-256:	3FDCDD34EC5A1F1729FCD602E36A9ECCFA8E0E9B28EF5A87293613E4D8199204
SHA-512:	7A4E0E3F2FADF455DEFD6755D971DDDC2F4AC43D83EFA4FE45FBE4F95AA8C2CB32A70694CC8BA0985F3E2D22FB15D1DEED24BF9C57E28C2A8E4A9F46ABACB9F1
Malicious:	false
Reputation:	low
URL:	http://jzs.508sys.com/4/2048_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=1
Preview:	............n#Ir........]7gE...5..^...k`.;.;0..%Q..P.@V.._..\|..`?.a....[..<dVFf....-....4.......7..fV..y[._\|....v3.._>.oW.o.........f........z..X...W....}..^..n.N.I...q~}...z..f...rz.......Z...z.[,s;]../..Muqr..(...~.S...T.WU.......j..M....l.f........b.~v....wo...bz5{.Z.m......F....f...>.&/._..huO?........_.2i..T.7u...Lo................._..T.....~i..,h#v...]..]l...^rM.l.?U..f..M#..?;.-..f.....t.y_O.F...n.......$.....Z......wh...>.f...........I/.......iZ.\.M.....^.v..z.n...h8..b....Y.G.x=......].5;.....O...v..._.l.f.....o'.g/..L.....Mm.l.j....m.p.....5Y].v..7.r.=..#.G}.M,!..>...j^.?..g..8y.........i.DW".R..s.`...AP0..My7...z..#....M.....m....j..n+..7..).Sm..0O.#...._z.m.. ..[...j.aO.Y..j.........OF...r<..>s.{..n[.\|..m.k8....Z8.^.B+=%h.Q]\|{z..=.u.%.L7l..).p.};.......w..B....o....fw..........)}..&P...a.TA.wE..z>]...\|S.vV..7.P.p...s~9.4..5.../."..Ag{.d.Zzz..y]...L....[...W..c-.......\..{e}Hm..9..N.....c...7.j.Z^leG?.o^..e.k..U.J.

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 118963
Category:	downloaded
Size (bytes):	17059
Entropy (8bit):	7.986642703720483
Encrypted:	false
SSDEEP:	384:An7cOz4cGwfMOFzSZZ7rJ9gUn168i33Xgy3ROUiSWKteErSJc7MvrV:AAQ2QdFC7t710XD3IRSdtmc7MTV
MD5:	2F3FC581BC9DBB91BCE5A06D4D46E1B3
SHA1:	BA7D4640DF704BAC6128B03C88DD10A9370C0E47
SHA-256:	2AF9DF6B68CF4290A71C708AC0F9CC5B79077B4E1092FEC4F33F4380B450CBDF
SHA-512:	F9C79ECB2D774C10907394644CE59FFABA551D740BF2B1CEC745500F8B88CD4DC93A52DC113C42EEC98311C0456FF67E2399BA908E4D5639A6F676F413F6F67B
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/dist/module.min.css?v=202410281356
Preview:	...........}....p\|.@.-..K....x......g.3;k..DU.$..U..B..O.d,./.....Y/....d^".I..jc.e.."3#......q.o.b.<..t]..o.\|...L.'.Of.`....r.OY...du.w.2]..6...M..^...g.-.ti.....[.D.~.\|Lu}.......E..tp.......B...2.....c.=<......,..,>..a.~@..y.1.2....D.0....}..?K...8.S...]vH]. ..a.>.....Mv...."...>.2.-w.s~....Y.K..4.9.s.l.\|.F....O>......F..\.".....W..!;..t[.{.c..d...2..@.....?...v.'.=.....8...6`...}...e...?...#...MZ.'..)..@..M..;..\|.n........+...v.......D\|..>....?....Bf.}...R+P..x...#.C......Z...xV`..Ez.6....w../.....i.`.U.V...~.MvJV.tS}.!/Q.].>.,.c.........~E...\....Iv....]14..<.....5.....[..\|)].....J.2.V.oZ....)..5...Y.;`~.h......G.U}{...3.~.Z. ..M..&..... '...Vr..7..j..@H...R.UBJ..W...jQ...Vi%\|.Q`.ZZ.,..&=........+.#]..4.....2.....6Y...j'....H.w.......Q....v.y..#"p.. ..X.\.."..{...G...s..?:a.c.6.....3.f...d....h.@............S....f............).2%i.%.t.O......e.V.f..'"..S"..........Hr.....3.e..#r......t......Hm...#Bbs..7.F..~_...N\|....v...<.'...

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1296), with no line terminators
Category:	downloaded
Size (bytes):	1296
Entropy (8bit):	5.392693523502034
Encrypted:	false
SSDEEP:	24:mAq6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9i9zeJ6Il9bnkhoMGQsHB:mAq6JFMzjet36iotbXriYfFnkFGQsHB
MD5:	1416B4462CF95749E9940597C4D016B6
SHA1:	0D02581E61A3790027868DEDEC51F1F828AB4AAD
SHA-256:	85C028F54938DFF3DF7A0AAEFBEB6F25E4A514AD937BECE2C2F1EB9601F33F0A
SHA-512:	155D6F875EC29830984562EEE4832B45AA4B35F89F1640791BBDE7B46C683A4511D7D2ED5B7B402AA244E1E9407D741D91FDFE9884A6DD0CC9A75157FA1555A3
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk94280&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605645452&sign=b5626638a8cf
Preview:	/**/BMap._rd._cbk94280 && BMap._rd._cbk94280({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk94

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	689
Entropy (8bit):	5.321416435755329
Encrypted:	false
SSDEEP:	12:2ruHna7Wgh0RPTUoDl619efhVnNwQ0uX9YSbSaGG/aGOBG9uLh20DRWZJU:2ruHalS/ZRDnNwXM3zC75Lh7RWZJU
MD5:	B282DAD03F6411D5F3F4DC5397E472FC
SHA1:	3504FDA553033B09090FEACB721162A8CE9B8B60
SHA-256:	4AB534EF14F55CE3ECF5728F8BB5EE752DCD8A00DD038974E838198B533A5979
SHA-512:	EE0EEE4ADC46C308F8B816C77CBFF2D786F1CC530669CB2D388803D0F5C340699F9B15DB1EDF6DCA299916EE5A92421F07AECCB4511D9DB5CBD2D0C935D75004
Malicious:	false
Reputation:	low
URL:	https://fe.faisco.cn/hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site
Preview:	(function() { .var fs = document.createElement("script"); .fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; .fs.id = "faiHawkEye"; .window.FAI_HAWK_EYE = {}; .window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; .window.FAI_HAWK_EYE.jssdk_report_url = "//datareport.webportal.top/js/report"; .window.FAI_HAWK_EYE.jssdk_appid = 3008; .window.FAI_HAWK_EYE.fai_is_oem = 1; .window.FAI_HAWK_EYE.fai_aid = 28088389; .window.FAI_HAWK_EYE.fai_bs_aid = 28088389; .window.FAI_HAWK_EYE.fai_bs_id = 0; .window.FAI_HAWK_EYE.fai_bs_wid = 1; .window.FAI_HAWK_EYE.fai_web_name = "site"; .var s = document.getElementsByTagName("script")[0]; .s.parentNode.insertBefore(fs, s);.})()

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:n:n
MD5:	9D4568C009D203AB10E33EA9953A0264
SHA1:	DD29ECF524B030A65261E3059C48AB9E1ECB2585
SHA-256:	12AE32CB1EC02D01EDA3581B127C1FEE3B0DC53572ED6BAF239721A03D82E126
SHA-512:	64D24560970CA14D349BEA0E7D2526D4754BF3283568AB4DD602BD79EB454DC3657D5BB6F9A30C90EA98D9600EBD0FB45D582F4CAE3F8E3C50B0E8FB18059892
Malicious:	false
Reputation:	low
URL:	https://miao.baidu.com/abdr?data=%7B%22data%22%3A%22QKsUApL0F%2BYJYOjcQylm4S6nR%2Fbscxvf1sAw%2F1X5keb5y1hnaB7lw408Bqzh%2FnpLIVZGCYk%2BWkPUGJefJIWJsRQ5pKthIAgZh0jHeb56R%2FN6Zm%2B0tkKCNnUA7fRXWmr8%2FapnmqwJG3yq7qczcvdyTFFM5knqTlMXolRPy0AorUCXm8biQsa9ioF2nchjq%2BoQz50%2FhYqyhjUDBtaWa0%2FITmrjO5l0famguo%2BaysqMDw1kn4%2BirlIJDvS0Y03E7lCB72T6hDt51yqTsiSGx%2Fo15pPWJW43F6UrcU0Tq7Kfkqu8YYXakWZzSS0Ai3fRNDah3%2FTNxB%2BYWFXXvL8TlGN59%2BOANg8HEdC2tIOxV0npymHQWm1idHL9a3TvleziNRRe1%2BhJyls8JZZfumizA84jp6ksAke8cYNjQ9a6wrEW%2BFWiNVIPHOrHj1Eq6pQpZpE22it7RhkUnLDg4rGsuKnmKxkF3sc%2FzqkMfCzYPFvh%2B1OilXCKb26ZB6GVqlAR7wSI0OhqKUFz80FLyDO0tujACFlTZDxMclNSV2YfAORumFEcz1bjPEjRxor2lb2JEhGsrMd8n2iEY%2BlPIldGbL3HtvIHt23oh3uU%2FTe4rkthB1JwlXXS2gioeRLzGYPFDIvCLwp2CZ91DSswl%2FXfpUnZpmWaBH2fSzQZnxEfESmJSTkEP4zrqmGpyoOJds1eZgm3aPXnd11vHTZuDJHpeGtjIYGfM61PKVyJduQigMCQKibZGb%2FolBi0BTLbPZRD%2Bc2AHNDxNsrZwcDRl3uFM%2BGotGKaV0kPlNvMRa%2BKJP4ma7CMLGI2T7KyPMVkRrRyv%2Fb%2FxA0UVl3vk1FoLgxpt9fBH1a%2B3%2Fs5wBmM1ZqJAo7lRkYRV3gGHBAUe1FPGpK63NdbiPXlFKKnhJj9qXQJ5bpSpTCvuntkga%2BQtj3rKahFJLHGtn6j9rmuCNEkQuDrCW51tXpURrpGJQj2yrmkbFYhYwjeXXNhlkcbXSWi6mqRWlyQSJfkKuKlyeSkenFOD%2FdemSOCpb1LEf6r8KjDzxJzN%2BbsJZPlM%2FzkHFxiKZVmbZLa1CfL9338vFX4BZJ2fYw4QhGEYBy59VqtUCVx7pP%2FwGUNCD8dPcGkrhOLs6l792uCwSM371PL%2BORsw8Gz9lEtO5t7%2FsrxtgKiZCcS0zooV%2Bd%2Biatx%2BXaKYACVuhR43sR%2FDxMnKsWNRwYa%2FiTV7veQZeDlKxX%2BYiDoFvkcsTSOb%2BEtrZ9DAIM482IB60CiK38%3D%22%2C%22key_id%22%3A%22e27381f9d0d847ab%22%2C%22enc%22%3A2%7D&_=0.6640850790151052
Preview:	""

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows cursor resource - 1 icon, 32x32, 2 colors, hotspot @8x8
Category:	dropped
Size (bytes):	326
Entropy (8bit):	2.5620714588910247
Encrypted:	false
SSDEEP:	6:Gl/0puls6M94pTiI+mBURd8EOJlZa8BBL:C0pqs6M94pTJyOZ77
MD5:	FEFF9159F56CB2069041D660B484EB07
SHA1:	0D0A08CF25A258511957F357B89D3908F3C5E6E3
SHA-256:	7342F390B12F636D14E25F698FC5E38CF6240994DC0C07FEFBBB4E78EC4D03C7
SHA-512:	F850277F48AC14FA363265469776E6F7F07F7DD743AA1D1AD7CF2329EEE6D323DA3422CF6BAAC066C84ECD24800A02088053EF3FC0488D170E7FC942AC8FFA99
Malicious:	false
Reputation:	low
Preview:	...... ......0.......(... ...@...............................................................................................................................?...w...g...............................................................................................................................................................

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.935606575000703
Encrypted:	false
SSDEEP:	3:UR89KCmH8XDQVYo8oCmH8XDQVxXAvHfeSXiMn:U29ZXXxo8fXXHv/F
MD5:	9638EB5655C156A10D5B8B79EAD12F41
SHA1:	EFC9675A50DC235E42A649345E8EE0BD075F5A40
SHA-256:	B0C5456B67447D499DCC91D6A351AD49ECEEC0F26BB8A4FCC60923050CBBBDC6
SHA-512:	6ED7A3A3B4A40F17CF4F3FEB5AD1A52C95DAF87D222005DF949FB7AB6B365B42519A1D4FA9E3EFA2BB73EDD3C25E51518D2314C8CD1CD17D4588DFF416E1E4A4
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605645776&callback=BMap.logCbk6226715041&sign=2072cc6b2c46
Preview:	/**/BMap.logCbk6226715041 && BMap.logCbk6226715041({"result":{"error":0}})

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:n:n
MD5:	9D4568C009D203AB10E33EA9953A0264
SHA1:	DD29ECF524B030A65261E3059C48AB9E1ECB2585
SHA-256:	12AE32CB1EC02D01EDA3581B127C1FEE3B0DC53572ED6BAF239721A03D82E126
SHA-512:	64D24560970CA14D349BEA0E7D2526D4754BF3283568AB4DD602BD79EB454DC3657D5BB6F9A30C90EA98D9600EBD0FB45D582F4CAE3F8E3C50B0E8FB18059892
Malicious:	false
Reputation:	low
URL:	https://miao.baidu.com/abdr?data=%7B%22data%22%3A%22M%2FcaOoj0hIWoHDH7%2FLYL79gpE%2FwL0GcCwFB1bEgZcCVLOOOXx8p3JOBATa9bh7kvp0aaMMfkyqpL96Pg03HgBX7g2B3X%2FjGr%2FkhRv5qJoEBU34Cu9w1dKZo41z8bALfm1pkoICCh0J6DdKEItcykD%2Fcn4nTQ5DYh8XHxuNtYNqmodHScw95quJybJjXI3l8SG%2F1JMYFkPms1GJMk2M3L5QbB1E2d5zxwCL%2Fm0NgnnmX2aVaL%2BKFYYIrS7F7gumy4yX70A47a55%2FhYupVDVcosvlZ3USaYsH6%2Bfq4y0MU61hG7%2B2Gqa9x15pi5al7hh2ku9hMPSVSlkQPvN1Pjp3UvkutWes%2BAW6%2BE4SbFs1GJ1FkLHxsOLTmIcpqw9WINv5lOXqpdcODk6Qk0JUKrYCC31%2BIyZIrpiNeqpVkWhmsr9VhLPMedYaXi2fneI5OkbPTkYXkMH6Gw8ABiNUFEXL5ObdS6wTCKessx4YNMnC42EQNZAkvtajtWuGYWSsvWCbHoJMvBBAkuIBGbxYtLk1xoA%3D%3D%22%2C%22key_id%22%3A%22e27381f9d0d847ab%22%2C%22enc%22%3A2%7D&_=0.6455062262011355
Preview:	""

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 129297
Category:	downloaded
Size (bytes):	44317
Entropy (8bit):	7.993332854822196
Encrypted:	true
SSDEEP:	768:wAlxMWEi5gVX/2yTCgzJ4nzECGg59wD1MTmDJAsf4Yd/A/AC5FfGOrZQVU9pLN:wAlmPiKVX/2yTf14ItD0fg//A/A7Org8
MD5:	AA00F9F6C111E992C3F76C09AEFEFD47
SHA1:	99697270DDBBC4FC0525132CBCBB6251FCD904F9
SHA-256:	3BC4A248019E1A3D783E2454A86D5DBF331C50BC3ED9EBEAA209A05275D095D0
SHA-512:	8CA02EE9BB3B8FEE9CCCE9031471358A209C33C9E35B6314760306AF39DAB84E15BE8D6CCF76B6E684958191C2F2BF9C001F59F7A40C47D620DAA7516D652D68
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/comm/polyfill.min.js?v=202307101206
Preview:	...........}.{.X.._1.wY..4"#\|.s.v....af.n..Q.......Wu....x...6J'.S.....,..?..90..\|....x..zj...K.....#..Y/...{.+o.#D.E.t.?l`.Q:.....r5..<.5.7v...........9......;..,....=....w.O-3.h...r8.6G.\'........O..n.\|.u....f.i}C..'..Y0_......h...3.....e....6....vk.n.v.....cg..d.d..._a..%.......>.7........F?.1.;z..o..:;C....s...3...},S,T.....`...s.\..Mn..c..`u.N./.I/E..........N....J.V....x...#._,...;..h...o..[..T...o.o.,.^...%.k.v..z....8.G0..H....~qG...m.....t.I..L.a.....3Y.log....r....l.,......^.......3_..._~..C...5..,....7_...../.q.q........ .=\|.....=.......33a*.....N.\..P.3Yu..(.\|s1.:tx.gi.V.....G+.....3'.by.....+x.~h.....B}8.Z..X.0$#.;.B..xn.a...~:.;.0.W.%.?9....o....`..._......u&)..U.=..'.........h#..>`.aC.f\|...]05.w.?xU..m...IG..y..MJ`s.......a..-:....W...L.P...P[q......K.%.~7.lw.!.o....nF.....9..4..;...\.o....MM.L......b._M....N.0.....^.d......L...YV..5.'..}..-@4:,....w...4...x......F.\Q.....}....?....j...i.n.B..S+........h.

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	91
Entropy (8bit):	4.959510541412091
Encrypted:	false
SSDEEP:	3:UR8OXBL1RZr4BL1kgUad2+WH8J0Tf4:U2ML1RZrML1vRuH8J0Tf4
MD5:	4D66C42846293F182ED68F01AA6DBDC1
SHA1:	CA54C4B51D6B32C84338A603F0ED0A57C24787E3
SHA-256:	9743C7ADA82E862984EDBCF6DAECB5F1A18935BD3B932251DDC9623D0A55C583
SHA-512:	7D70A3533E4312842370D5ECC7752B04A8183DDB149F0D469022F5502E4D001B7F60A174C20CB36E17D69E426DC6A14462DE4932314901087B77B365EB73881F
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk5925&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo5Cn9S0I2rb%2FJ1brfUmjqgY%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605654023&sign=6d791134464b
Preview:	/**/BMap._rd._cbk5925 && BMap._rd._cbk5925({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.952432419566062
Encrypted:	false
SSDEEP:	3:UR89KCmH7bzhLFroCmH7bzhmgHfeSXiMn:U29ZghLFrfghf/F
MD5:	613FDF43A71FE351C1931BDC0BB038BA
SHA1:	9F6EB82684AD797BD1097A26FA1EB65FA00722FF
SHA-256:	0B241DD491B30E89E8FB7E542DB9CA35F9247862FF5C7C75FF4F3067EBD31861
SHA-512:	9B43BF417DFAF05D36ADE8379532BCAD6114F715A5AD2BD18B181A90D3457E458948BD82D7253D7A29BD55812B3CA3007FC8C999D7C36E944DB2676507578E6C
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605634322&callback=BMap.logCbk1399821954&sign=d2ba6044c010
Preview:	/**/BMap.logCbk1399821954 && BMap.logCbk1399821954({"result":{"error":0}})

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3447 x 1754, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	654573
Entropy (8bit):	7.913264577217895
Encrypted:	false
SSDEEP:	12288:RBQYz3h5drtwx5ofEC6BV2wJ+MwS1FIl3o0rWlSgmlulBt:Resh5drtwxGq2wU9S1CVoJ51
MD5:	B8C8D98E1BD45B0B47CD2BD7FFA47ED1
SHA1:	C3CEF3DEE8A65285BABBC4FFE6264A9C683B5D82
SHA-256:	60E48DFC7A2C038F9AE70BBE2296C95901CC40D8CC1AF1036A15470B4ACE0782
SHA-512:	984A945B067BBA139FBC84AF067344AB79EA13773402DE2724BF9D6E65FE36724F0DB3B18766CE43F00CD4E2027DC85A437C7303C13F8C376FD856CB1BD0C948
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...w.........4.......tEXtSoftware.Adobe ImageReadyq.e<...oiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF" xmpMM:DocumentID="xmp.did:8100E979434211EF9671A8786D85B2AD" xmpMM:InstanceID="xmp.iid:8100E978434211EF9671A8786D85B2AD" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d4e9ec8f-bc07-9342-a86a-28d0735f5686" stRef:documentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..l.....IDATx.........H.s.[l...bz7&@..$p.

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1297), with no line terminators
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.388122027894674
Encrypted:	false
SSDEEP:	24:mAq6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9i9zeJ6Il9/HBTjhAJCdsn:mAq6JFMzjet36iotbXriYfTTjS2sn
MD5:	467C9B244734D5EFB7E3C4C97CCD4427
SHA1:	54092D2BBB5130E496F7890CB8C22257016132C0
SHA-256:	BCE9014CEDB04037535C66A2EA60EFF777739F0A66E87982314574A9BA3EB0AA
SHA-512:	3397AFDEEBE659850A8D4A63B4F032AECEE42A691F7EA2288B98B0F7CCF82DF1C10B6ACDF49F2E6E808502B1489F0F79BE8D5E3D3F053A252208786EA6A8F423
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk94280 && BMap._rd._cbk94280({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk94

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 52302
Category:	downloaded
Size (bytes):	6021
Entropy (8bit):	7.951551083539476
Encrypted:	false
SSDEEP:	96:sK2mpNCnglYo5S13M4W9E1X7ErEe8AEesznsu4qYLJS+EI5lVAbdDd1FeCBJu21w:sIPrjEHe8AJTxLd75l+bxdveiZ10cAB
MD5:	580B476DC5E184DDB838EE6A129EC6A2
SHA1:	EF0F7A9C2988416C8877EE623A3AE4BE3CBAE45C
SHA-256:	4B607BB6E9FF7190011BF022AFD190FEBEE85EAC33AEF8D7F5B24BD4D2FAC986
SHA-512:	5AE4324C3ACE74A893939CDAAE3507C72A4DE9E5E51A8B447BF5FEE3B6BDA8E9B14B915CD02942CF768DBAB2B8337481F2725D95CA656C03B8B268140D15E660
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/en/jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true
Preview:	...........]..Hv...`l,...n..E.F..x....,. ...[.D...nO.?...w.!y. y...H....X.....).[U.:U....,..>-.'...r..z0..n..a.F..]....$...y\|...~.N..."O...-..k.a}.)v.t.H.JB.f.%}4...^.y.R..Xl+"..]cY;..,621n...Cz[........A.R.&.O.]q.z=6.2.....,.G^.,..W8.n'..w..t.%.~....\...J.oIs/../......5}.M6................./..g..}Z...).K....&.9........\..b..Y...u...^..b7.v...(..F..O<....H...}Z[.O..L.......m.Al..5.=..........x.M.,3...lq.......U#>.6.d....M..Iw?..,.S..'i.,.....]Q..'.q.1+.i-...J.j.&....4?...g..V.`i.....>P...0.x...~....&..,$*C>V{t.._.l6.).'........M...&#.lj..5"....:5.D.."K./..~.....2..lO.U...Ov..<..lwV...aW.UCv{^.X.>Ok..J...i.;B.(_ek..{.l.......3.!d..\|..U..4..x\| .l.>[..9."d..<4..D.iY9".).{2...Di.V.V.......Q7..5.^.=.xh....n..ca.....^..!.S...GCB.}.\|.....Yf..lX..C....@.{..j ..X...cA-F.X..,.v..1...-...o.#K^...jjC.o.#w.6.....q...Y...ad.Pqf....#K..a..bd..<.F.k...(..#....#[.....cd+.....P.`d;....JA_..7..ad.R..#...#...7.l7....."..#....F....^..XT..w...r..,s.l....

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 11 tables, 1st "OS/2", 14 names, Macintosh, type 1 string, icomoon
Category:	downloaded
Size (bytes):	262140
Entropy (8bit):	6.2880738674960055
Encrypted:	false
SSDEEP:	6144:Aqf9ww3v1L/Clizdt+xgFYvF9akDGmjucFWj0b3NOe6QZR0YN1y+anCNnCbd9596:fFd0saPQwcA0YynIs1WFmvckb2DYnpqw
MD5:	9E02F46372379FD9B9D48528475E8D72
SHA1:	67D7F24B2C2E272D5256C7F2F7072246CD17A3C8
SHA-256:	B4EB78734D3EC2DAC0FE0B98F477E85ABBB85207484D196DA11FBF12ACE25D38
SHA-512:	F77152EDE98F0A67CA0AEB5C4C20204D877D6CB47178D1C9D5669A2BE67AB8CABF711887C2F42FD0F94DC868C860BE64EC18A4B8457406FC7CF20724DDF8BBBD
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/fontsIco/icomoon.ttf?-2mgmdr&v=182
Preview:	...........0OS/2...e.......`cmap.9.......tgasp............glyfi..........head.&$r...L...6hhea...2......$hmtx...........loca.......l....maxp.......4... name.J.....T....post........... ...........................3...................................@...9.....@...@............... .................................X............. .+.3.x...9......... ...0.w...................6.7............................................79..................79..................79.......p.P...0.....(.4.X......3!267...>.5...!".......>.32....>.754&."&54632.....1.4'..'&#!".....1!2...1..1..3265045.....:"............[.G<U................U.B.''..&&.<..7$%'.F......8].............Dp..:".6...U<..................<U.'..''..'..!.&&6.......]=.............p.V...*...!.;.M.Y.e....%!"&5.463!2.....#.".....3!265.4&#!."&'..."'&47.>.32........#'"&'&4?.62.......#%"&54632....'"....32654&.3.4'..'&#."....31!2...30.1..32650&1...G<UU<..<UU<.G&77&..'77'.G......................<.......................".."!//!........`...7%$(.G......9\

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1297), with no line terminators
Category:	downloaded
Size (bytes):	1297
Entropy (8bit):	5.378884985748103
Encrypted:	false
SSDEEP:	24:moS6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9i9zeJ6IlGN19moihcsq:moS6JFMzjet36iotbXriYfSaCsq
MD5:	2A9633A4C375A3EFC51F55A2F813E440
SHA1:	36E365864111BD9F5C552C41A83FF8656AC63C69
SHA-256:	66A85863D8B72A297A05BBBA3BF22447F83A083D7EC07934B0FE94B0B2F20EBB
SHA-512:	3EDE5EA0A83B3758C1CCC2859405E056879EDBB8AD24914DE9D8662E0469B2EDE157FF827E13A93DADA12F79715B98261649135BDB753EA41B02B9D4369F4968
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk66656&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632887&sign=378b64229bc9
Preview:	/**/BMap._rd._cbk66656 && BMap._rd._cbk66656({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk66

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 4762
Category:	downloaded
Size (bytes):	693
Entropy (8bit):	7.68660799411833
Encrypted:	false
SSDEEP:	12:XO6oCXgoZK0B00iqgTzX+aYwLcSp7NV9U9KRw16xgUZcu:XVFMgXiq4DISp9UMRw162hu
MD5:	BE66E03DA3D2D8B4EF6456A02C6DBE0D
SHA1:	553E68C3D03942AE19E65D30D0D562E576A0572E
SHA-256:	2229F29C4ACC6D84695FBDB81BB76EDDDB4E738EA6805CFB1EDE974CFA49C5CA
SHA-512:	A5B8C3A61CF6956DA2ACACD41FFE07235946F2CEBD85FAEE1656E6372AF017FB839FF58DE0AAE2AB37DFB9585AD3A13D4F162AE4348FFAA850A131CC933924F4
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/dist/styles/moduleAnimation.min.css?v=202402221530
Preview:	.............0.._.n 5..i......r.....iM.;r.-..N.9..gR.UOM....dl..<._.Kt..Q..kYp'..4/D<P.F.6.>......P.}...a.......}v% q...V..).%.+..Jsf...2..B.}..:...i..4J....{.n".n.a..6..wi.z.,$@../`3..NEV..!.V..6T.b..35....d.W...jC. wZ.1.~....Q.K..Y.(.>..YH.G...<...7L(^9.>r....R.....\)r....Puq....(.>Z.W"2..uI.Q....B0...uU..@I....E.......Z.. ..F..."..lH...6...cV.J.....o...<.....P.K..$?/&..d...1.p....."z..L...W.?..;....D@.......?/#=H.}5Y...._._.+......Af..eQ..n.N..)......g..rc..X..:v.\|.....HN..9.q...A ..I.F`y..`.;...0.`.8`..cZI-..5A...5..P...V.m.$......xm....jnS/}\^.aUp.2.*.,.F.]......UJf....00...<+.%....G...N.y...Z..?..u.!.l......{.. zqQ..va....I".'.3......7.A......

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=95963881&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53200280&code=load_mapclick&da_src=load_mapclick
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1371), with no line terminators
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.266249025950128
Encrypted:	false
SSDEEP:	24:WmP54RWMuHKFmOthmk9++35E5TJIlGhjXgfIS7sa4/M63psI8S:Wlw8hm6++3SlIGhrfeS
MD5:	76FB40C4E6F9F8F80FFD0D647B872DE1
SHA1:	BDF6F82E73585A505FDD1376D14B366B87520340
SHA-256:	C652E5BC61D5FB05662050CB13B7562748DB96C27707785932F9504897423DCB
SHA-512:	B313C0F941443DB1B5402ACEBB3183737CD061EB0EFB432A68E5FAD9D1FCF71067A5505AAB58EDD033D27FCEE2A177E128F3D5D4EAB04361E50430CA0AE3BBB0
Malicious:	false
Reputation:	low
Preview:	window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo5nkNstGZqGDKfgsWqPJnsQ=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,e(a,o),a.onload\|\|t(a,o),r.appendChild(a)}function t(n,t){n.onload=function(){this.onerror=this.onload=null,t(null,n)},n.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),n)}}function i(n,t){var i="onreadystatechange",o="readyState";n[i]=function(){("complete"==this[o]\|\|"loaded"==this[o])&&(this[i]=null,t(null,n))}}function o(){for(;v.length;){var n=v.shift();n&&n(m)}}function r(t){if(s)return void t(m);if(f)return void v.push(t);var i=function(n){return d[h]===w\|\|n};f=!0,n(l,function(t){return i(t)?void n(l,function(n){s=!0,i(n)&&(m=n\|\|new Error("Load error")),o()}):(s=!0,o())})}function a(n,t){return function(){var i=this,o=arguments;r(function(r){return r?void(t&&t(o,r)):void d[h][n].apply(i,o)}

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	130434
Entropy (8bit):	7.998278136840757
Encrypted:	true
SSDEEP:	3072:TPw2PYH/mri5BLFOMU+ouP05X6XAD2wlGzE9KhdoxLXFb:Tg/mWrLFe+ousMQSmGI9KhEFb
MD5:	AC1B06B959A57AF3CC15E5A3AF920ED2
SHA1:	86FDECC60140AC10B08D1405DDEA4BB9A1615F5A
SHA-256:	D90F9840A942325B75E3A76896FD9F90368C566213A9A924FE3E5D168498399E
SHA-512:	DFB647370418C4BB865C1D5104F9FCF7EF62E83A4D1F72D703D8E371A29FE7EB2EAFEDEA184AB5B51769E626F10572CD10886940754CD9ACA9AF42DB90666790
Malicious:	false
Reputation:	low
Preview:	RIFFz...WEBPVP8 n...P......X.>m2.G."..'T..`..M.a..F?.<....y...........q....\|....7o9`.o..r........}....g...{!..........<.M._.C.<.........[.....<../....{.S.....\|^.?...^.^{...............I...W.O..v...........c...../....._...~A.......................,.....;.o...W.O.?._.~..............O...}?.I...../..F.4.......~M.........../._....C.........'.G.?...~K.U@......G......+...O./......../.....~]}..S...........?..o.../..O...........C.........~..K............[...e.k..........}................W..fb.I.v.VQ...1o$.=k../...L<.A.p.,.;.4._y...........&j...k...j..'.{.F..h;l......BI..%.f-....2.e.6.[....;.."N....Q\|1.....giB...#2Yo...nn..;..v.V\|.......\|).f......u..e~._..........$p..s..N!...}.5.....7..v._....._]Al...MW.m.s3:..}.c[3...g53...#.....]......K..+....3..m..&M.T.......U..-......o...F.......E._... h...1.....l....E....@..D..F-.U.O&.....Bf\|5;........q=e.3\.Hp{...VT...o$.KO.<..]..7}..QQqE^......w..y.4"7.._Jg.9..Q../'_......v.H2...c....J._..\|..&..8..Pe~..o..C.GZ!.F..xR..

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	97494
Entropy (8bit):	7.997903000495766
Encrypted:	true
SSDEEP:	1536:InAuD5nFAX0OW0l3NpcXohZc6Zn117x4Ifg3eEkusZtEem+1ctODArk8brmci9nw:InT5F+4+DcR+n/x4wguEkZnEepEODArb
MD5:	E162AE45642EA3948D0602A1B20854CA
SHA1:	F671AD5C27205A5A41E26FCA74FF2755C247E308
SHA-256:	F0268C0A34C626E06ABF530E684CF9A159F2D91AE39094CE01CD7D3E651A4F03
SHA-512:	B4B20CB48DD6B44533C6FF4FF27C320428220B26F7EE3305935D228E8A93F47347917FD04F099AC3E83BB78F2D155A2BF1CE55E4F660E7CFF487C12FDF373D44
Malicious:	false
Reputation:	low
URL:	http://28088389.s21i.faiusr.com/2/ABUIABACGAAgl4iFjAYoubm42Qcwig842AQ.jpg.webp
Preview:	RIFF.\|..WEBPVP8 .\|.........X.>m6.H."..$......gns.Y........X........?..............g.o.X,_.......1..ox....G......#....aO...=s3...m~\|..>9x...0.....L.........\|'..{..z....-...o._.o....z..........K...G.....}......5...........w.w._.O..2..................X?..........o..D.....o...~y.6.....q.O.g..........o......x..........D.o.......O....].+.W\.Y.O.o..p.e~..3..................#.....'...............?...............o.?.?u..._...g.o......g......._.............%"..E.Oj..=.d#.6..jL..........Z.K....5..E.OiZ:...K...^..O3..y.....WZ;.D..?_f\|....6..m...:J..1r2......=x..Y\!..\j.>.s.+e..I..w.P~.....Za].^.}.v.../J.C..z.........)a...k..]...}R.~{?.1k..V].t.{....+.'.Z.......Np.......3..,.8.#]..\|N.uO/.............sR.4..{x..I.)..............x..N....K{.W..U_.2..D.......g.+"?ib.. .MZ..y.uw3.x.x[,@:HN^..pbd...!.]...<.$sR...E.Q.$7J.%...B.....o..;.r.....r~...).._P...!./.E9_ek^.<.$.a..A.x.);..M. I.5m..6...q........"8gn.E)c.p...6.^5.TZK .>...+.e.~.}.B;.nM.d.........d..>.1....

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.924055859159171
Encrypted:	false
SSDEEP:	3:UR89KCmH8VnS4GFroCmH8VnS4tgHfeSXiMn:U29ZXVS4WfXVS4q/F
MD5:	4F99ECA89E6AE8DC52520C750506A394
SHA1:	1B7ACEA5EDF7289A3808C285079AC15571048FD8
SHA-256:	FBB351122542477874DC5BA6927D7A5DA6A4642C4564ACF3333BACEBCFC26574
SHA-512:	096BF88C2F5899A7491BF68FACEE9ADF770275EDE45A46C323C9C921F75EB68590969A7E93284825C0F75D1ABFAFB7A2741D83723AF830538AD869C84A791FF2
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk6093782709 && BMap.logCbk6093782709({"result":{"error":0}})

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	16612
Entropy (8bit):	7.878695350092861
Encrypted:	false
SSDEEP:	384:h8DQv875avB/91/Rq+RWZHawww12yFgCzCDp44IhAs5E4jWwUrGh:mI8N4VZYtPww/yhVjIhASjUrO
MD5:	419F06CE9C167C5636798605538B9D67
SHA1:	27F3E7111A76F03BCE6060FBDA35BF25E656C52F
SHA-256:	89D85A604AB8ACEF435618BB0C2FCCC817D94F0B13B7C2AD79743F9CA63123CB
SHA-512:	1110E2D355F86BA4BA9AB410C39AEA649B2D1B10631C173D75E7BD484AD2F69E766E4B59B9365AB94993EC5C5C9BAE4771E858819CBA5E52DFB5F883A5265162
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE.........................................................................................b.p...........i.S........U.............w..t.....k{.egl..v..V..2x..=@C$'P.^.....pHYs...........~...?.IDATx.}.c.8.ls..^...ccC..._6.Ls.!m....7..-.q.].M...h..E#..B,.v.>c0.Uc8..-...?R=oS..1..Dy..t8.......1.?6....'./.0$...A/.-k.~..p...\..j.7.C..\............(............2....6..c%....#}.a....&........l.~...1I...J...?..?.NG.!4 ..,._..[..@...M.....M..K.,.?.....s.h...g:Au.Ik.2.2m..O.@..:...u.dk..N.c.U.6%K.5.`,8...hZ@...qi....p`...3.Uue..&t..8n~.h...A.$.#,........G.60.(`...&....W..S...@8.'U.i.%...`#l.@,.@..........T.:.W.D...".X....v..X....d&.`8.c.`..2q...0.@S....g..T.].......,@..la...D....{$.n.r..... g.a3...g..C$`........+....+.2~Q......t.......\|...0Y......_. tn)S.g......`..u?......d..@....P...G...ww.....7...7.....=4...{.P1..=......d..

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 77 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2586
Entropy (8bit):	7.9069706050837585
Encrypted:	false
SSDEEP:	48:08b3v3may6jQ4RJlmj5WjSNz9RCyYsf4tPrX0oTf3kK4IGTl1pXK3:0mPyO8j1z9IV70or3QrTlbK3
MD5:	5671641007DA542BDE236C087B3B4FE5
SHA1:	84A20702683B0CDE936C68FAEF2910D90BD107F9
SHA-256:	5F6A79338E876608D39F03C28E637CBD9158C57DCA823C76864E975249F5F2DA
SHA-512:	380C1D14E68417CF974B572A0939590D438EA693E2431C6A06EA6D52C4CDC875D7F779DA4EBC7A6039ECE0CE50402D1210675FBC53B3A7CAD2E4F6E81F712C58
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...M... .....Wc.4....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z{PT..?......yXV...(B)I...6.i....N.iF.t.L..QRB..$....Nk;.<tZkp:.mt..H........A......~..9..wq1....\|s.=..s..;.........a.I:"y...7f.#.)..M.e .%.#...M...;EW...M...z..@....'.....n....c?\|...z.$..2.....`.@._.H?.)...%~.....;::n{.....7.......;.......={.FGGgS."..a6dy....Ak"..jjj%X.c....~.p8&v..utbb..QP___.-[~Ic....q..Zf-*...\|m..o}.....)q..{...\|~a....bYAs....g.tb.&.8...=[%A....Y\|.38...U.......K..9..m.S..s.....8..)........v..CCnv.q.}Q7...e..]..~~MLLL.K..w.}.\.f!N:}......#.c.5..1.....~mW...5>>..n.HW.J.\|..C..&.....@jj.2."&&...EF....."....,Y...k.."......8h..~.../.0.....[leV..U?........XD..o...E.....#.^......Z.n]..0Eu..5A/T<B\|<V.0...'..@..(.}...........t.xF..B.K.:.}.a.`........}#K.j\|.@.f.>'J.\.;..&..2,..{"cw.zQ.=)........... wu../Izcw........B.Y..!........,5-..:u.hnn.....L..DE.V.."..H.s...(.Z...^(..~.........;w.t...4.9r..C..Qs/..)J...0kmm.....,.S:r%.\.J.S.U.......{w......

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 148798
Category:	downloaded
Size (bytes):	27727
Entropy (8bit):	7.990775381692776
Encrypted:	true
SSDEEP:	768:gorLRI6nqyfK5+T8P79OqypIrPxnLgjfVlR0SRo:7t7nqy2OrAxnLyfVnJRo
MD5:	C0EA99D015FF9C7200F1B2AF23BE98AF
SHA1:	64793177EA5F98780800EDDD46AF5F5EF49F0761
SHA-256:	3BD6B55151DDCF9B6436DEDDF0558D448700F9AD344EACD05CECC276F18D26E0
SHA-512:	E8C7FC4AB3C4A2D25DAB24D2BC6976DDA047F0B8BE35E32B4B2C1CF577AA04E1AD9D4D597038DDA8B1B07D16B7E34D3389B1AD9579A2B38376E2FA8B86B15552
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/en/
Preview:	...........ks..q(.y&B..n].g...@?.$...c...3.C..^E.......z.4..^FX~..\|u..sl.%y.kK.lY.ul.V.....X./...."4...........W7H69..pvI.U............].y..u..........k../v....bWW[./.?M.u./..e.....(...Y.VA.L.u....e..%u...@Y.....gx....7......?.......G_...\|............._>...?..'....>...~..o.8.J@.......~8.......[.R!?..l.ZKw5..{.m......y.i.....TXc..w.......<".uU.......$..4.=..M@.r.....=.[...T..-..L.Tw.......QNQF>E....i.'...UC(....t..u.i...6....i.Q-.m;=F.......(...4......::.0.....M.tO.b.......d.S:.....V..a.Xv...[-.....Po.......}.....vga....,.....aW.......m.mu`z3.n.(.._2Z..............h.3....xW.W]..u4V..@.....3.5.e.f.;k]..X..~.,.J.....K.z.>.....}.h-...C...p..%.....b.AB....@61L....Y....Z.p..z..$.^.............>....T.k.tH....q.H\|..7f..~..kB......ho"sO5.0;....5......^P.p/.V....rvSZ...a^x.2.s".........d..<o/.%.BK..8n.J..I.....5..v]....vk........^'@.A.....CED..L...........M..k.).Q.\|p.c.p....F=..B.. .=...%.1q.e......;.Cd..Sfz@5H....RR.z.*.r...G.AVx.

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 45
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.576663559094718
Encrypted:	false
SSDEEP:	3:FttuMXXwLo8xWwkGxvpfY/n:XtRMxWkZY
MD5:	646789679CF9D69394C7FBC78E7FE634
SHA1:	C7095DE77233A8331035E058A29B227746E8E57D
SHA-256:	054FC8AA63E0E126EA2DA0C85C225599FFDF23B25627A444874CDD69279A7D87
SHA-512:	6B0D605FFB057211D8051A1CB6BC5C8AA90B9DC32A3902A74B6224D75CD06079846C7F422992BA17E676E442D4F1B8F72AEEA3D9703A157E297748E799467601
Malicious:	false
Reputation:	low
Preview:	...........V*Q.2.Q.MNN-.V.)M.Q.-NW.RJ-*R.QJI,I.r.j.....-...

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	91
Entropy (8bit):	5.003466585368135
Encrypted:	false
SSDEEP:	3:UR8OXBL1VJ4BL1wHE0ad2+WH8J0Tf4:U2ML1VJML1yQuH8J0Tf4
MD5:	7D81B10DA633DDF235AD8BF91877774A
SHA1:	396A0C5CCD0E630F1CE4142BBECAC3925977FA9E
SHA-256:	53D2AB30F0C18EBF6BF39517F1693F7EA85803BBC8DEE22033EBBE0978D09DA2
SHA-512:	BACB0C4190112F34A039B399076E4ED741567BCDF03F5AF6FF181CF306572BED8DDB16449C119927114BBCD9610E0087D9D266061E442D0EAC195A82460A51BD
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk9486&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643765&sign=c3a2f6498151
Preview:	/**/BMap._rd._cbk9486 && BMap._rd._cbk9486({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.903653494235835
Encrypted:	false
SSDEEP:	3:UR89KCmH+XVv/I8oCmH+XVv/A8HfeSXiMn:U29ZVXpI8fVXpA8/F
MD5:	BD15160E82048DCC855E3349BBC0D5D5
SHA1:	DF87A45F33DED401A4D3ADFA663B7908DA44820A
SHA-256:	37BC36674766A2DFED7EB73D65B7E027CB4A6AA7D673774413E441FFDD199FAD
SHA-512:	59B59F123C5ACB695477CC5D1535842D48C9B075989203CD839870AA7273A596A2CBB3993C2203F8DCB9720A4F58BDCBE5968EE171B2EAF4EB269969039A4493
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605607162&callback=BMap.logCbk4206044938&sign=8817e55d060a
Preview:	/**/BMap.logCbk4206044938 && BMap.logCbk4206044938({"result":{"error":0}})

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 29, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	6.831261668584174
Encrypted:	false
SSDEEP:	24:0c1hNo7FCWwjx82lY2T3/VgSKwPS0yJ3V6S/aSNG1Wb2XgbvzkQKVATIVKFWP:1zo7FDNn2DqGPkJ3QF6GWBvYQKVATIVd
MD5:	995341F77873DA8B4BA3E27E99C72F98
SHA1:	7A22DB6310F260C7E5CA774EB916D20D8EC41DBE
SHA-256:	7827A9A311F3A4FE8D85C70416A23013B46F84E84C3425A741981ED59ACEFF64
SHA-512:	868FEEEEE492556B6585EF486F076F74E7B3F799F9A36179B9577C4FB05B0D900935A942B8631FE90DDA392CDB6B7EC998DF47B04CA78D82EC5DA6B66A2FBF95
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................K....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:82161B336FA311E98835E35E3D1000FD" xmpMM:DocumentID="xmp.did:82161B346FA311E98835E35E3D1000FD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:82161B316FA311E98835E35E3D1000FD" stRef:documentID="xmp.did:82161B326FA311E98835E35E3D1000FD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..1K.A..7K. .La..". ZX....PQ.%.._.....V+.4F.c.h......&.D.D#.F&p.{.......M&.D.....Y0...'x....?...XO.5.

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	15840
Entropy (8bit):	7.945457630056714
Encrypted:	false
SSDEEP:	384:IwbD6JjYcvXYHB9QBr8oykoQjU8TxDIWGA3Ehq6ZXTH:I8UBAjqrCkoQfebA3EUkb
MD5:	7AA80F72884B9C48A495B26DF1011B39
SHA1:	41885735127701F59135ED49EE6BA5CACF1A1517
SHA-256:	88F69548AB36E9B845C4017A0E898BFF221D08BDCD20B23533056272C1AB3E1C
SHA-512:	A752D0CF0CBB47DC04626DBE28986451AAB9791504740C135DA7687DF87504966FDF0A9139BCB5FCF971729D8D5A90CF6CDA9C30F838399B023EAA3CFE989143
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE..........................................l...................-.u...h........>..........es..........\|...q.....k{..............`hv.........n.........y........vm..l....a..Ix.>o...H5....bKGD.f.\|d....pHYs...........~...<pIDATx.}.c...$.l,7......&..+.....6.....3..o.$.j.&<5...H..!...RZ..c.....F..{mh....W..W..E....q...:.;.HL...1\|..$.L}A_..q..~N...\\|..!......xyy.>].....R..@..p.$..I..T.....+....,...4.w~O.^....>^hU.a..pQ..)?..?./`\|....~.@.?^.O.?..0...3.B bT...3LL2.._M<....e...dj..g.....}!.>....c......?.....O..x...17....`dx..@..l..I...V......A..dC...0b.......X9.......c.~.............B.jQ. 3r.....,I.....,........?....=t.D@.r4..\....a....%..D...................p.,..........A..F..?...3..)=y...r..]9......}....,?....J_\j.?+.@...$..qi.eL..\........C...../$.O.......,.[9c98..Z..dd..n....*A...."...XS..C.u...GV.../.s..y..Y...u.....rp..\|.,.........J

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 229845
Category:	downloaded
Size (bytes):	60390
Entropy (8bit):	7.995956926353215
Encrypted:	true
SSDEEP:	1536:6G99Hxn/Z1C3OyIaS/CoxtTuaPET5RgWj97xLm0mE1:6GB/j1zCoxtTuaPK5R9731
MD5:	4067B261C7710FEE30739A8573A94BD8
SHA1:	336E0B89B84C63C895D36C7DF57550B310800EAC
SHA-256:	4CA41ADB8174DF27A84EB1F37004A0C5AF55B6EBC3B3188761A5DBB4BBBDE61B
SHA-512:	63FCCC81B7194241D22F80A6AA305AACDFD407CE16B83B04FFF22AA872FCA4A97425BF5C1C987923A6273C579437094AB392CB7EDB80A7B4FF99218F896898B1
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/comm/jquery/jquery-ui-core.min.js?v=202307101206
Preview:	............w.F.(.W$......e.+.`.c9.....83...@dKBB.\......_U... );...79'..........4EU.on....n...eJ.].2Q........j..AT..?cP4\|.7.b\|.......M........f..@_Y...}.{0_TM...j...8......x.f..K.7.'w...^.5.....5.4.w.._<.k.'.."....#.H$...r.lV5..I.j......MS....GH>.4.n."..7.iQ..3>M..&Y....b....%.r.C.C+e....xV.J..H......\|....9..c..h....l.G.....P#....{.Y...._.$k......~...q2.....]...b.+.k....U1.r\.l1.,.OON..Y.....bV4.Q.Z-...\|!......L..`....j..,...Y......>@i.o...........H..\|.....W/#...}.`I.\|.6=.3......~..Y.g......z....=}....(.g...q......g....<..o!..$.\|...w.....}......../....3h......go..G.....,}.'.....G.d._.<{.6.......O....c./.......'.....O....../.@w.C......g.r.Rd..?............i.Ti'.........W....z..F........G...7._....21.G_..o..H......=do.\|.~....._B;'...:..(.....?i.EJ.....?sHd./...y......M.Y.1.\^...\|.h3.....G..M.Y..7o.k^-..a....8a....$..R.9X')..6....@.\|q..........^..0..w.i.xFH:(....q..M1Y-...~..$.....h^.....6.A~^W.e.7...0..kw...jvuQ\|.S5..5-6..>.;_6.JL8

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:n:n
MD5:	9D4568C009D203AB10E33EA9953A0264
SHA1:	DD29ECF524B030A65261E3059C48AB9E1ECB2585
SHA-256:	12AE32CB1EC02D01EDA3581B127C1FEE3B0DC53572ED6BAF239721A03D82E126
SHA-512:	64D24560970CA14D349BEA0E7D2526D4754BF3283568AB4DD602BD79EB454DC3657D5BB6F9A30C90EA98D9600EBD0FB45D582F4CAE3F8E3C50B0E8FB18059892
Malicious:	false
Reputation:	low
Preview:	""

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	19511
Entropy (8bit):	7.928187963464144
Encrypted:	false
SSDEEP:	384:UKMhqYZsvOai/njql/tIz2NwG+d95s9q81tUOMeZud:IqYzPj2/DNwZKwmUxeZE
MD5:	73BFBF541A4F10A77DD72D9E2411B94B
SHA1:	50FE5867031F8CBD0F3A66E6628248E50D62ED8B
SHA-256:	D721C8C499C29F0E3EBF6316804DA89080F6F6243809724F8F25CF4585F41974
SHA-512:	7A08566682310D51DA4C760EBC45D20FFB8BC18991E63551D0C4327084B21DA61FA3177AE91ED50B27661BD08DA37B1B5A7A49DB085ACC336D7CC24F3E5926F2
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE..............O.......m..2.w.............................................................n..h...............>.....................u..{....k........x...........f}.`.?.\|F.~y..-....bKGD...-.....pHYs...........~...J.IDATx.}...8.7.1..A....2....f.=9..H.....C.....o&....W..9.#nn.{'.Z...../..N......~.;..K.+....V.........~.....[...>..V.RJz...<>.........9I........1=..Y.....O.......?.......o.....^w."......wN..H...)......%H;..............G$c........S......eP...~..(W..!n....3...~ ^......X/..0+........qD?+>^......F......W./...2.!...xV...Q.o..c.<X@../....7........<.@iA 2.=..8...>?...V...oK/..i...[R..\|.......5.A.\|.........\|!q.x.'Jn.$l8J.......-.P$A..9...e..-.cC}...[z..9l{..5.\|L... .........=.x....U........z..88......q.......!.c....,.I.\|.a...'1.~.M6.~.#.."I..w.....@......O..g.#..o..W..w.b Q.x.:/....#7..S#....ZA..........v....I.P._

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.8983783655120074
Encrypted:	false
SSDEEP:	3:UR89KCmHyUWZFVroCmHyUWZNYQvHfeSXiMn:U29ZZRHrfZRlv/F
MD5:	29913EF7F6BD3087D598D05EBE8B5474
SHA1:	54A7555F01197FC7AB685DF550A12FA5FC42D7A2
SHA-256:	17B52628184F54DB540CDB3AE38EE09E5262601A3084DFE30A4589818FD6E5BC
SHA-512:	65FEF281620CDEADBC3A8F5F57532A15F3AB2F998528B05D22686D73FB97448D2672D458BBC8F28461D7E8667143FB6C3A27510FF0364CD89BBE38089662C706
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605656020&callback=BMap.logCbk8136133267&sign=a194ed09867f
Preview:	/**/BMap.logCbk8136133267 && BMap.logCbk8136133267({"result":{"error":0}})

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 1254322
Category:	dropped
Size (bytes):	335447
Entropy (8bit):	7.998733987990607
Encrypted:	true
SSDEEP:	6144:lR7anc5PFnFRQ+th6LUs/u64teE4wO6f2mTuJUCvjnBRNM5gYpw+NCJXfinq:RPVFys6LlrQ4wO6VS2CvbBboFpDoJXfP
MD5:	E0C23607CAF2CD7A7B548B089A35F57C
SHA1:	6C42DF3C8A3CBF627617EC0D383A23310969B263
SHA-256:	B199B776DBB0306E7871E045D4EFF1E6EC73F9A502446DB382E7965FD982F77D
SHA-512:	4F885E6944F54C22CEBB5392B710CB31A86D9172B0A5D801277300483D7EC72A1DF39CB76CEE70921CE11AF6AB578406F15BFC5A0F706D347B2B89FEFE4E3B79
Malicious:	false
Reputation:	low
Preview:	...........i...u ...D.2.f.Ifm.`"..R]..TY...J.$H...(...L.....K^.=...[>......x...........w....d2K%Y>S.$.@.q.nq..p..S?..y....z..p..d.E..\|..i....e..f...?.........=.hl=}1..0...V..QO.n...>=5&~.x...+/3K. ....We.lC.9............d....~...G.ow..;`.0J{.(;......L.......9...S7N}....z.......n....O.........G7n}.{..O.<~p.^........Z..u.lE...v..Nc/..aEUj...q..=.zS....!.A.^.jk..c%5=UO.,......p.=.?4`..Fq'..B.3..e......~.&i<.C....\|nL.(..XG..V.2..\..!...@.>@Z{..j%.F^.;_.ga.O.J.^..MOb.4N+f.l7[W...K.0e.=..............}/....w.Xve.........x.1L......V/.z[......u.....[..-...h..%.Y....C.).....<<.........\\|....3..0.:M..C.o.....d..w...]..D-....?/_.6.Onr.....s)..C.4.e.GO..e...Z.....AQ.S...3/.M..^...&......z?..T<.-........a..5.i.lB.3.8S.di...\My....:..lu*>....q&{....r.a.c.M=3.2[...w\.oFgg..V[4...3.~x.=..9.G......f.....q..X.m.Q<q....... 01.\.Z.J.=....=...q.N.)...1.Y2.....S@...hI..{..`#..{}@...`G..[a.x......u...gC8....6..Ef.>.4......eQ.....y.#9...l.y....\|n.1

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	15150
Entropy (8bit):	7.897183128041113
Encrypted:	false
SSDEEP:	384:qckIVhOwOocSKmdoQ2OYKY2/jN/a47Trd49HX4SA3JBH4:LkIkLna2OjN/a4TrdHZH4
MD5:	27421B0B15F7A4C38688E5C56AF594E6
SHA1:	34730B780B96208D51A7009E513B278FE844167F
SHA-256:	B6DB8DFA6DE06267786BA0511D171949FC7039D0285E78F1763FD7AFAC25DE73
SHA-512:	375538C16A8C23D6E4C83B77C85771BC52AC57D476EF44059C029BAFD269A2BD3D3AC130E6ACD21629AA7DDEA1B1B80079E597C132FACB43A18F0BF85FF31E8B
Malicious:	false
Reputation:	low
URL:	http://maponline0.bdimg.com/tile/?qt=vtile&x=49625&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE.........................................................................n....................y..............D.o....K....1..vvv...y....r........f}.......a.o.U...w.O.M$....bKGD.........pHYs...........~...9.IDATx.].c.8..Nm.-lL...@.;i.{.u6M.n....;......Ww.&..2....Hr..c4....\|..O&S.~:./..g...u]...../M.?o:Y,.#B\|.,G.E..To...'.'.o..\...KB...y.R.{...>.7.......?............v\|..1....."..d>.....n....>.1_.n...O......~.t.o^.F...V..H>....n.y....n..............Xw. .].d......`4n..f}.X..>.B...d....._..8.?xL.;...\|I.P.Xh/.T..P.,...b.j....._.j.....s+........>],.g.?p\|...z'\|]......_..O....P....c.. .......^.#.}M.....=...E..m.Q......<...+~E.....k.&.X..p..#.e.K..<..W.W%...\|.....\|^...............Ex..n.......o..`..x$'=.A.....0...T. ....&...H...v,]a....'..6....&....e... ..o+.F.....C.....q........x0..W.v.<6.....q.._.y..y.....G....%.,`1._....w

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:n:n
MD5:	9D4568C009D203AB10E33EA9953A0264
SHA1:	DD29ECF524B030A65261E3059C48AB9E1ECB2585
SHA-256:	12AE32CB1EC02D01EDA3581B127C1FEE3B0DC53572ED6BAF239721A03D82E126
SHA-512:	64D24560970CA14D349BEA0E7D2526D4754BF3283568AB4DD602BD79EB454DC3657D5BB6F9A30C90EA98D9600EBD0FB45D582F4CAE3F8E3C50B0E8FB18059892
Malicious:	false
Reputation:	low
Preview:	""

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 53 x 74
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.198420854395978
Encrypted:	false
SSDEEP:	24:SxAjoIfn5+vbm2/4Ox/S9nLM9VQCY958v6n4SmcCb6h:4AUOj5Q6xfCSiamcC8
MD5:	022EB20BAE35A4009D60D4235FA1940C
SHA1:	49B5B675A0891844CE0A0FCD4169BCC2117BC6ED
SHA-256:	AF7B710DB4D1D92C0B30B13F81145966E831B19612AE8D3E8E13768E20982230
SHA-512:	E23EC160A700B0FF37A1C3FEB7CD205BA9ECF93FAEBB5E1A01722058CCF9DBB8C6C531873B6922ED504D4498150E1A01AF4A84C500A89146B0E790EDFFE89DC8
Malicious:	false
Reputation:	low
Preview:	GIF89a5.J.......~~~\....................................................v...................................................................................................................................!.......,....5.J....@.pH$v..r.l"..sJuJ....`...vl.z.f1y.6..^7......:....O\|}\.OGz..p...SYJ..TQQ.~.E....................l.............................................................................t..pn..u..+.-C....L........D@@......j......(:..!Z.]..}t.@.Hu.".S..........`...5o.......&......F.....x$.<...j.{..H.7...`.....[7....Fr.Y.....)X0.....m0..?*..N+...F.....WaR.k..L...J.`Y"....,.(.4....B..Y..}.A..-.k.\|. ..{....cw...o.c.\W.....W...q..IW....e.L..'.p.......}C..U1..d[as.gh.3.6.Q&Nosa6.f..8.b.fh.+.j.... .(.#^B.(.h"........#..^...7..#.9..#.+.(b.,.y.A..O.B.X.$..H..0."...(%..0`.O:.%.dM...a&2&.U...i.2&.^.i$.@Nr..N6)".b.8c...:h.y..b.(.b...hc..&.f..>.).....;

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 8 x 4, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	964
Entropy (8bit):	5.890467283009064
Encrypted:	false
SSDEEP:	24:J1h4SHWwjx82lY2T3/VRXzyJ3VOJeG6aUmSV:XKS2Nn2D/OJ3L9agV
MD5:	EE54DF3BBBE4D6FA26B1C75EDF03CFD0
SHA1:	BB68BFBA9CE95BBDA826B099BA04A934BACA8AEF
SHA-256:	3298A3B99DE5CA0CC63ACF7A78773119B62556CD772A27882ADA32753F1B373E
SHA-512:	F9323908B173DD41B77F8D9155183652D2C5276B8A5FDF4C09D6A229FF7E04C67737B2B6513B76EEB2AD79A479E8A09597E6D639AB890F367FC34A8AA8CD2E1E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:4A40B5008FD411E4A4309E08706D44C8" xmpMM:DocumentID="xmp.did:4A40B5018FD411E4A4309E08706D44C8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A40B4FE8FD411E4A4309E08706D44C8" stRef:documentID="xmp.did:4A40B4FF8FD411E4A4309E08706D44C8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>'..F....PLTE(((...........tRNS...0J....IDATx.b`..F...f1... .. ......~D......IEND.B`.

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 10686
Category:	downloaded
Size (bytes):	3998
Entropy (8bit):	7.946744002576607
Encrypted:	false
SSDEEP:	96:wa3dMPm/Gtk8ippoZRDDtfI9m+WOmfRSj2Ise5Qif2r:wa3dMPyGW7yZR/tfI9m+om225Qif2r
MD5:	D76032F15DA91647C99DD59F9268D083
SHA1:	221E7431A7ED7B86265407866E92D819EFEF8D19
SHA-256:	6B45BBDF8A57331DEEE2B2E3EFCB038F3CD98E903B551E3CBC46AE95B15BC055
SHA-512:	D9B287F9BEAE64132D5E39DA5F5FDCAB2B702BEF4947355072AF8FF22D8D25E93C31EA846328FD2F851893659DBE737C0ABCB416CA76D53D7C810AA5F7890EBB
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/dist/libs/jzUtils.min.js?v=202404081140
Preview:	...........Zmo+.u.+. &v.....B..CKT.\IW..:.,,V.Zi....^].$`.-..v..q...~.j......../..\|........,I...@`_.s...yy..3,../<...2sJ.....b..v....^Lx(.Je.g....Z..J.lf....3....X..>-w<h...q....9=.u.B..A..}B..O+.".3.N....tNu...h..G...#r...!.....).i.D..%....K...<.>j.F.....P.................ay....a+_".0....N......A$..s.....wk.r.qX+...-Hq.y.e..2.f.v..0.g.H\6..2W`.3~..,..cP..g....5..dCo...r....3..+.#.nBO$}&}&.a)...\|.Bq..x.x.nM...\P....0..soh.(+..."..M..8KL#.q.=.=g.M...{.R.L.......8.lF@87..1...f.D...!.)....+w...I..=m..8.D)...&.]..".\......#..Z]..q../Xh..@...l.!9....-.`k..Q....V..p....?3..Fy.eC.<.....5...A.E.m...}7.J...m4.nF.[..r.$B.....)......8...&T.$..L..\.s...,.<....KI.../...._../ ........2j......Q%....s{*..yc...t)n..7.....^j.\|.Z.d...9.).....F...^.]k....F64...>.$.1..r_..].u..VH\.%../qm......4...l....[.0.+......}k.\|.kY..$nZ.x!(@.K....a ..<..%.Ns.4..l.f.2dC.....t@.8.AO......I..K.d...8......4_U....q.G\.\;.\^$7Q.Q.0.R..S.w..a>..\|.D;..]..`P.S.^..w..0..N6~

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	113008
Entropy (8bit):	5.173045459669979
Encrypted:	false
SSDEEP:	3072:vmHUwMDdtJp+D2CVYLODnA0d6W+dNfkJ6vMLXrta5sl+PF/IW6orgP48jC:vZFDMLXrE9GorgQ8jC
MD5:	92BA78238BBEE1456A812AAE4248E974
SHA1:	93D0FE2B5F6A803BAB3D5ACBA5605958E2E6895D
SHA-256:	E917F1D6CA010B02BED886045424FDC0858CFDAAFC73F6CC5F8F28FB39F352C8
SHA-512:	665913EBC5CEF35021F79FEC56FA0592ECD093F9CB598239BDC6F90CB87822373974587B033DAB64EFE7E39C2389969958CB52CA341E703D81FCAC8236CEE0E4
Malicious:	false
Reputation:	low
URL:	https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.original.js?_=10026
Preview:	(function _Eo4G(){var a=function(c,d){var e='\x31\x2e\x31\x2e\x32';function f(g,h){var j=g['\x6c\x65\x6e\x67\x74\x68'];var l=[];for(var m=0x0;m<j;m++){var n=h(g[m]);l['\x70\x75\x73\x68'](n);}return l;}var p,q,r,s,t,u=decodeURIComponent,v='\x43\x68\x61\x72',w='';var x=[a];p='\x64\x65';q='\x66\x72';r='\x6f';t=q+r+'\x6d';s='\x43\x6f'+p;var y=function(z){return(z+w)['\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72'][t+v+s](z);};var A=function(B){return f(B,function(C){return y(C);});};var D=A['\x63\x61\x6c\x6c'](y,[0x27,0x22,0x25,0x60,0x3c,0x78,0x61,0x41,0x62,0x42,0x63,0x43,0x64,0x44,0x65,0x45,0x66,0x46,0x67,0x6e,0x6d,0x6f,0x70,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39]);var E=f([0x706e,0x6c36,0x6730,0x624f,0x5e77],function(p){return u(p);});var G=A['\x63\x61\x6c\x6c'](E,[0x5752,0x58dd,0x5f5f,0x5b32,0x56f1,0x58a0,0x5ef2,0x6256,0x5c2b,0x63cb,0x59c8,0x645a,0x56c4,0x6b9b,0x545a,0x6a4a,0x5a32,0x7209,0x577a,0x72b8,0x735c,0x7313,0x735a,0x5e52,0x5fb4,0x66f0,0x6b31,0x7074,0x72ba,0x6c19,0x692d

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11657
Category:	downloaded
Size (bytes):	1573
Entropy (8bit):	7.865430863135281
Encrypted:	false
SSDEEP:	48:XS2U+M8SofuYCiW2RXPqCxVCPzCTi3Ps9:fmoWYCiFFPqEC5y
MD5:	814C15973825D52085B4CD6B32CB674C
SHA1:	F2A15653D59A617ED662B27524821694E112C643
SHA-256:	3D5FFED66B1B3FB60FAA5C3CC96BB5EE028314637DC15E09CC78E5793D8EA8DC
SHA-512:	2E42B5C0AB4CC3129E94D8AEACFDC9BE5DC0247B13ACBCA0C41EC07BC6CDEF5BF098F4688B6D5F5057E9A08596068F92F43A401F0F38522B83AC66A8D209427D
Malicious:	false
Reputation:	low
URL:	http://jzs.508sys.com/3115/fkNav.min.css?v=20240808102706&aid=28088389&wid=1
Preview:	...........Z..4...)..!..t.3..B ...]....#7..q........w..@.6H.[..Ij'.s...j.ir..>.....M.A..<x..w..g........&.._\E....'...z.H..f.g...F.G.J.x..S......L......d.....x.(...\.....~....Oe..Z_...+O....C....f.....=HP..$Z)= i1.......I.r./.eP.ZUZ.7r.$$[7...@.......?.0.1e........../..B... .2.(.....O........../...u.....lU~..{.A.}..fuOx..@.....&}......cVjW.&.G.o..R78.1..\p`F[9.]...}..............A.U.A......<8<..o...-.R.)zZ.,%B...sZ..;........@k...!.[Q....O\|...l.4ge.....lW......`"ui#.1...M..ssh. (%.lQ..P..'.........x3Ss9.....G.3zqW...h.7.M...4.B..//.2..uZ..e.fu&....`.......1h...a...*..1.....%.m.D...lI.........MR.....I.E1N.f....7i..j.....WkB.g1'z..c:..1.2..hnuL`...`.0.PBv."...q.5(Zm.lB..NI.N[.....p.J1..3..TB.Cn.$&.7,..2..t..UN=.IuN/p....x..t'.V.u.....Z../..'.......lTc._..7..~..r...!...a.\.[w&.m..Q1lzN.$..D.-U.-}.j..>6.....p.....s..dA.....w....... ...K.Abc.rKk1.C.......C.).v.q(...a}...Q.o.U5Ga..t.Eso...~...Q..WI?.W..?.....\..Mg...h....gbwg%.....

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 59
Category:	dropped
Size (bytes):	77
Entropy (8bit):	5.234527534781083
Encrypted:	false
SSDEEP:	3:FttpQwOw8+nSkAKXwJ11Etn:XtpQT+SMXwJ11Et
MD5:	8C115805E29157758153C8C31DABDA74
SHA1:	241644E4751746AE446A6165A05737B8593EE82C
SHA-256:	2F6BBEDC11B6D5E95DE48CDE428F77259331B8D6EA1809B9BCFC5CAAD541FBB1
SHA-512:	9DCEF8CF79B3DF5028575EFBE7C4FA35B85BAC6E4E9885293876105606EDF2B9D313319253C7B1F5D8FF242ED22BBB4270E2DC2CD180328A75052FD67CCED2EB
Malicious:	false
Reputation:	low
Preview:	............M-IT.()).M-,.,.UrNL.H.u..+)..QRH.2R.Jl...uK.....r.....-.b;...

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1371), with no line terminators
Category:	downloaded
Size (bytes):	1371
Entropy (8bit):	5.260646738603011
Encrypted:	false
SSDEEP:	24:Wmoh54RWMuHKFmOthmk9++35E5TJIlGhjXgfIS7sa4/M63psI8S:Wpow8hm6++3SlIGhrfeS
MD5:	C2EECD0C44FA9B61A0A95E3AF228470A
SHA1:	1F6E716A2FA5C25AD207A9C82C0FCED80B36DAE5
SHA-256:	901A69DC4469880DD7B298D74683A5D0EB08D1748BCE15D427AF71235D8687D1
SHA-512:	1824E9A1D48C041343E393381C9EB83B37B6950765FB4109C90C2E84DDD11CDE26AC0A57FF83CA084D689641E28BDEA25427C9757185010D8B3D66F2E7A388EA
Malicious:	false
Reputation:	low
URL:	https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1732605643770
Preview:	window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,e(a,o),a.onload\|\|t(a,o),r.appendChild(a)}function t(n,t){n.onload=function(){this.onerror=this.onload=null,t(null,n)},n.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),n)}}function i(n,t){var i="onreadystatechange",o="readyState";n[i]=function(){("complete"==this[o]\|\|"loaded"==this[o])&&(this[i]=null,t(null,n))}}function o(){for(;v.length;){var n=v.shift();n&&n(m)}}function r(t){if(s)return void t(m);if(f)return void v.push(t);var i=function(n){return d[h]===w\|\|n};f=!0,n(l,function(t){return i(t)?void n(l,function(n){s=!0,i(n)&&(m=n\|\|new Error("Load error")),o()}):(s=!0,o())})}function a(n,t){return function(){var i=this,o=arguments;r(function(r){return r?void(t&&t(o,r)):void d[h][n].apply(i,o)}

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 129297
Category:	dropped
Size (bytes):	44317
Entropy (8bit):	7.993332854822196
Encrypted:	true
SSDEEP:	768:wAlxMWEi5gVX/2yTCgzJ4nzECGg59wD1MTmDJAsf4Yd/A/AC5FfGOrZQVU9pLN:wAlmPiKVX/2yTf14ItD0fg//A/A7Org8
MD5:	AA00F9F6C111E992C3F76C09AEFEFD47
SHA1:	99697270DDBBC4FC0525132CBCBB6251FCD904F9
SHA-256:	3BC4A248019E1A3D783E2454A86D5DBF331C50BC3ED9EBEAA209A05275D095D0
SHA-512:	8CA02EE9BB3B8FEE9CCCE9031471358A209C33C9E35B6314760306AF39DAB84E15BE8D6CCF76B6E684958191C2F2BF9C001F59F7A40C47D620DAA7516D652D68
Malicious:	false
Reputation:	low
Preview:	...........}.{.X.._1.wY..4"#\|.s.v....af.n..Q.......Wu....x...6J'.S.....,..?..90..\|....x..zj...K.....#..Y/...{.+o.#D.E.t.?l`.Q:.....r5..<.5.7v...........9......;..,....=....w.O-3.h...r8.6G.\'........O..n.\|.u....f.i}C..'..Y0_......h...3.....e....6....vk.n.v.....cg..d.d..._a..%.......>.7........F?.1.;z..o..:;C....s...3...},S,T.....`...s.\..Mn..c..`u.N./.I/E..........N....J.V....x...#._,...;..h...o..[..T...o.o.,.^...%.k.v..z....8.G0..H....~qG...m.....t.I..L.a.....3Y.log....r....l.,......^.......3_..._~..C...5..,....7_...../.q.q........ .=\|.....=.......33a*.....N.\..P.3Yu..(.\|s1.:tx.gi.V.....G+.....3'.by.....+x.~h.....B}8.Z..X.0$#.;.B..xn.a...~:.;.0.W.%.?9....o....`..._......u&)..U.=..'.........h#..>`.aC.f\|...]05.w.?xU..m...IG..y..MJ`s.......a..-:....W...L.P...P[q......K.%.~7.lw.!.o....nF.....9..4..;...\.o....MM.L......b._M....N.0.....^.d......L...YV..5.'..}..-@4:,....w...4...x......F.\Q.....}....?....j...i.n.B..S+........h.

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1296), with no line terminators
Category:	downloaded
Size (bytes):	1296
Entropy (8bit):	5.3694306396964615
Encrypted:	false
SSDEEP:	24:mYi6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9i9zeJ6Il3kZ3WvccIETjhX5GQ1:mYi6JFMzjet36iotbXriYf3kZ38c7ETt
MD5:	0C96320D8C74B8F80527B20BBB4924F2
SHA1:	50CBDC8F1B4AABF4601D0CF15A162477417D3B03
SHA-256:	443EAD77C0CAD94C59BE543D6A3926F0293598DEA0A7FC008617CFCFAF1286EB
SHA-512:	857000FFD36ED1949D30FB299B0D795266365FE51085463EAD087B1466ABDCA1973EEA8212E1BED8CE0985E496DB4970F8FFF7702CF62E8AF830AB59F2DE3DE5
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk39410&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo5Cn9S0I2rb%2FJ1brfUmjqgY%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605654538&sign=c2a16d70705c
Preview:	/**/BMap._rd._cbk39410 && BMap._rd._cbk39410({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk39

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	54640
Entropy (8bit):	7.996049858116262
Encrypted:	true
SSDEEP:	1536:36VDwILmDBh6shE1bOFP4bFK46SaUC8Fa2bYJtg8DtIQXq4EQtnHz:KVJLqBLAbKCFKSaf8jbV8DtL6/QFz
MD5:	1629A5E2BBAF0243A84DA60486566ADC
SHA1:	2AD182BC2DCC47D29FE0E8CEE673BD2EA2202046
SHA-256:	6347E39B2481C9EEFEFE136CFEC2DCC606893594017111B39652BBACAA6F32BB
SHA-512:	8C7863054676FFB59EC62F418AC92E92F871ABE127B975ADF20A37FA5AB169B5AE6DD99CA3FD45AF2FC37B2C110FD2325978E0252295BC73BD6DA751EC68DD57
Malicious:	false
Reputation:	low
Preview:	RIFFh...WEBPVP8 \...P#.....X.>m6.I$"....aP..gn..e.Ef.<an.h}x...7-.%..=.?..&.2h.@..^....U.w..TK..E^}w...._.#......:.H..Q...?.oD..?...z......W.....G..P...Z........~.{U..............^j...5.O.....?.}o........\|........../.?......S.O...?.~..C...........5.7...c.W.O.!.....G..X............[.c..._......s.G..........{>B.........?........].s...7.o...?s..._.............{r...........o.?.?..4......\0.._..P.%.gkW..'+(..4..._(M.<f.....9.....e.].........t..36..e'.w../N.4^..I.E..$b....,...q..P.C.....$...........$.........R:o..h..... .A..6#........}n..uh.z.L..%......5.u.!{.t&..Q..$GD...R...Nrh.... ...R...B3"...uIl...e."......d...o....!.......Y.0zr]!...OH+..r 3....l@'.....66...f.r^.R...y..hS.-.W...1.I.+1..LJ,x.U.0.].Qv~.k.x..a....oR..2....D.!..V..e.......}....jo$9'.../lX......o.t .D......&...."..S..........8..h..i.3..........fh...<..@k-.\...Hv..K...".e.e.........2.....%.i.d....DD..!s.'.S.tG..kKW..R.....u..n=.K..Y.!..2._.Dd....4..E......2.......7.H......`m.L..

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 241 x 348, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15879
Entropy (8bit):	7.956293721480794
Encrypted:	false
SSDEEP:	384:Fe0YTqka8zR9Bnh+CQd2UKka3fLU1BfJxJzaELE2D76psy1k:fYGM+taUrx3LfDy1k
MD5:	8B00DD90D1585757483ECD1733AE3837
SHA1:	EDE97C29872B9304A4BD3BFB469103BCC2726AB1
SHA-256:	CDCB20E3209B45A4854F24E68784C9EE90D00894442782965084E00E63EDD374
SHA-512:	BCAD80A9DFB5540D822989F52C6BF8DAE168118624EBE21F53D75C33FB6298980155C4B97E4B12CFA10EBC8000E6AFD53139F3DC642DC1D0F8A262D0429100F7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......\......>X.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C22A46CA440A11EFB9D3B9225EEAF4C1" xmpMM:DocumentID="xmp.did:5997F33E852111EFB840B5172A7050BE" xmpMM:InstanceID="xmp.iid:5997F33D852111EFB840B5172A7050BE" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2b340e22-2aed-a941-8f0a-692beb4e46ae" stRef:documentID="adobe:docid:photoshop:5516a084-cfd1-184e-a047-7a26fe51f1ef"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.i....:.IDATx...\TU...@.

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.8983783655120074
Encrypted:	false
SSDEEP:	3:UR89KCmHyUWZFVroCmHyUWZNYQvHfeSXiMn:U29ZZRHrfZRlv/F
MD5:	29913EF7F6BD3087D598D05EBE8B5474
SHA1:	54A7555F01197FC7AB685DF550A12FA5FC42D7A2
SHA-256:	17B52628184F54DB540CDB3AE38EE09E5262601A3084DFE30A4589818FD6E5BC
SHA-512:	65FEF281620CDEADBC3A8F5F57532A15F3AB2F998528B05D22686D73FB97448D2672D458BBC8F28461D7E8667143FB6C3A27510FF0364CD89BBE38089662C706
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk8136133267 && BMap.logCbk8136133267({"result":{"error":0}})

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1297), with no line terminators
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.371761658271622
Encrypted:	false
SSDEEP:	24:mYi6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9i9zeJ6Il3kZ3Wmh2GQs0:mYi6JFMzjet36iotbXriYf3kZ3JoGQs0
MD5:	28A5852A02D358479B47F33725945AD2
SHA1:	A8EC9F3C8C6D44C3BD13A743289C544429EEBC15
SHA-256:	A3812E5ED3F03FB3F52BE90F2E721B3460F8EDACA16824849E23773F9E15F388
SHA-512:	006368AC2A67B101060384CC0E07654C4FB5128A9A9F927BB4EB45A4AB78A901B5F2D8AD5E5C40F01ACE7DDF20670188AE8A17B283B103F3CC85A144DC6728A0
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk39410 && BMap._rd._cbk39410({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk39

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 52
Category:	dropped
Size (bytes):	72
Entropy (8bit):	5.043906976252533
Encrypted:	false
SSDEEP:	3:Fttuc/IHxnLAUXnTV8c0S6Fd3p/l:XtB8xUOnZp6zT
MD5:	860E06B1C62729C812D6F6B7EF744892
SHA1:	A7A35CAE7650D7C03C2274E4155E818A77116EFA
SHA-256:	9272CD767AD0096B4AEA993463A8A40BD7259B5357C11032309EBF450050F4C5
SHA-512:	CA95745DC7BE2F922FF0D1B2597E5B7A52FCD7776CBD56D89ED5EA23FEDF5C2429FAECA6BD3FEA6C9E48E3863AC6BF73089BB6D383E8CA81C613EF6C13513CBC
Malicious:	false
Reputation:	low
Preview:	...........V.MNN-.V.)*M.QJI,IT..VJ...LQ.Rr6pIt,q2Jw.J.w5.P.......j4...

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 97554
Category:	downloaded
Size (bytes):	11642
Entropy (8bit):	7.767310275504022
Encrypted:	false
SSDEEP:	192:XmFG5zhCJ7w77aWgwcFFFF2KXgR01LwRJusO634zt6EwB07XDe+IMBwMwPCUGp:2FG5zh07w77aWg4ReLrM3q6+zaMBwLPq
MD5:	0C00A177B15FB7AC9322EF6C3E87B953
SHA1:	D429C090DDADFA844ADBF261A6015378A46DF9DA
SHA-256:	BB5D679A9431DB31B4871B37AC797367058614E73EE62E431A06D340ADD0408B
SHA-512:	63956D70366FF5D1000954953978DD9C17316E697DDF2FADF45B68CBB474DF317EBADB6EC8C9853A39DD1D2342D8F18371776E2B9E981F1F10688FCDB7B7DF90
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/dist/styles/fontsIco.min.css?v=202404081140
Preview:	.............o[...N.bS..I..2A..$.@..6.,.h...%Zf-.....$X@.E...Q.%Q.5.$Ro...[..o....(=v:.9.Ci..(..v=.{\|y.....!.....#.[....?........;..N.G~...e..J.=...'.^..dj.A..;..?....=..............u......I2...[]........;{.~\|..R.....{......Vr.^r` 9p+=...?.\|.....-...7.......?J............p$...._.;}?..!....nv.5.w...C.2j..]....u!.=2..\s5{:~.....%m.\|.K.A.{]_./r]=..........(16.....Z..z.....?..H...o........7..%...G.lb$.....0.......x&yk,..F..c...\|7.I....}g.._.}.:....J...c.6........s......o.....F....3.I.`...F......;..M.....$F.^8x9....n........$...O.%...........".'._.[..........d.R$....lkq.....Wo............S.d...<..o.~.......w.."p.....#.I....\|.....4...i...ip1...R.....L...L.+...W.wt...&.f..n..-v.....f.m....4.#v.l..}.}b.....{l..N...Yz;3Ko.f...,.]...gf...,.1m.65.....a...5L....ASs.0gj...L.1..9e.25..3..a...1L.....Ss.0_j...K...t.9]..5.........f..*d..f..o...\|.7.[7.9.....Mo.nzs.u...o=..\|.7.[..9.z....Co..zs.....o=..\|.7..y.M...7.kf.~.B..o.jf.n.n.o......Y

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 35
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.80639513982528
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fOw0x4RTE/:XtB8eKmx4Ro/
MD5:	84AAD1B39C33701D2FA0C423DDE7AA23
SHA1:	918FDF533E772ED0196BC558BF0A7261493EFC72
SHA-256:	20AF8756A37D1EF526BC15C29A7D150A242DC06F5A78413604E02A834A42C64D
SHA-512:	8E3CC4D21CFE6677C41A326541CD6007980B8AEAD1AE100D440CEDBC1AD21213664B573BCB5C7A52C75E3BEF7B0767165E9476B3A45E4884879FF8BB68B2DFB3
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz6g....T...t.p#...

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.827498466892594
Encrypted:	false
SSDEEP:	3:UR89KCmH9CB5Dq8oCmH9CBM38HfeSXiMn:U29Zdq8fM38/F
MD5:	FD2579915FE78D1853CDF6DCF6356386
SHA1:	6609261D74A8A039779F258179E344E6D00ED1F8
SHA-256:	33DA03BCE482065AE2ED5DEC8EA53D04862FD5F0BEC431D082412A1837056401
SHA-512:	5B4C9051271C23ABE9D52EFB942F5DC2FCBC334D7F7810D2DFA9595AB8691562244EE301D865D64F6FCD5B22E9464713BC2EB24595641F1C16D29A645C1BF342
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605664831&callback=BMap.logCbk7081181651&sign=69830daf9dbb
Preview:	/**/BMap.logCbk7081181651 && BMap.logCbk7081181651({"result":{"error":0}})

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.261229666895294
Encrypted:	false
SSDEEP:	3:CUXPQlG9h/:1Ql2/
MD5:	969FD31015EC5344C2CEF54101E23A56
SHA1:	6A38854F2E704BCAF53712A65C79EF68CF11E06A
SHA-256:	52B2C9CE5BB6933E1397DE740690260FE656C88970409B04BEAE1E098886C81B
SHA-512:	DD2F89935F7B17FAB8D7A0D72C1D646DF889D748E95D7C47219F54DA0A510555582734CE08FCD49F997CBE34DF0B518C5B5304703EC897F44BEE943533BD0E2B
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 52
Category:	dropped
Size (bytes):	72
Entropy (8bit):	5.043906976252533
Encrypted:	false
SSDEEP:	3:Fttuc/IHxnLAUXnTV8c0S6Fd3p/l:XtB8xUOnZp6zT
MD5:	860E06B1C62729C812D6F6B7EF744892
SHA1:	A7A35CAE7650D7C03C2274E4155E818A77116EFA
SHA-256:	9272CD767AD0096B4AEA993463A8A40BD7259B5357C11032309EBF450050F4C5
SHA-512:	CA95745DC7BE2F922FF0D1B2597E5B7A52FCD7776CBD56D89ED5EA23FEDF5C2429FAECA6BD3FEA6C9E48E3863AC6BF73089BB6D383E8CA81C613EF6C13513CBC
Malicious:	false
Reputation:	low
Preview:	...........V.MNN-.V.)*M.QJI,IT..VJ...LQ.Rr6pIt,q2Jw.J.w5.P.......j4...

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 38
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.905297485303413
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fKPjy2DkIzxD:XtB8eKK9fd
MD5:	7103024B5D34569D2CEB1FEF0820039B
SHA1:	0DBB781F60DBE03EE5ED84DB310B01E601DE5BF1
SHA-256:	769CE690671A0B7CB3F924A3249A6E90D9D643A33CD51286262E05CC3E3EC1EA
SHA-512:	83760630526B04D9723342D4B35455F3050753AD0D4D1DC848F03A8C0A5B0CA3E3E3A41D58B35A4F0D4ADBFA23D0F411E2DCF89CFB859D7F955890F2410FC9F7
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz...l.Sf.X.^...N..w&...

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.261229666895294
Encrypted:	false
SSDEEP:	3:CUXPQlG9h/:1Ql2/
MD5:	969FD31015EC5344C2CEF54101E23A56
SHA1:	6A38854F2E704BCAF53712A65C79EF68CF11E06A
SHA-256:	52B2C9CE5BB6933E1397DE740690260FE656C88970409B04BEAE1E098886C81B
SHA-512:	DD2F89935F7B17FAB8D7A0D72C1D646DF889D748E95D7C47219F54DA0A510555582734CE08FCD49F997CBE34DF0B518C5B5304703EC897F44BEE943533BD0E2B
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	16729
Entropy (8bit):	7.896302602243815
Encrypted:	false
SSDEEP:	384:tHKIk5hVorIxcm7+43C+dy8VPxl9zthK1:tHF0hyrIz7+K19xn3K1
MD5:	62AF8AF5B45D5312F1C1C6BC60A4F801
SHA1:	0EBD95A29A535C544EED33E67CF9A2AE0E2B98A9
SHA-256:	D10BAFB079B2B6734A3A79F33AD93965F313ADCB76DD36A99A456F6019ED94FA
SHA-512:	91C5D4A9F66658C2E2BC219E14C1344413932199EA1AC6BFF0BD0641D074DD00EC5B61B3B35ACF0764AD6DFA723B3CD50FB4D79BD48F62F962798A8639BBFB07
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE......9.}...........s..\z...........................................................................]..k..^....3.................y._%(,]_a=@C;i.......a.o.U.........u....1z.N.....bKGD...-.....pHYs...........~...?.IDATx.}.C..v.....iS....8@..6....W.\$Y.%6...[.%..G3.fF.d2......'&..i\|=ug'''3.s....0...1...WQ.?b!D...sh.v./.#?.....W....1]\|?;......M.=A..s..?...&.......Y.?...S/.............R.D...#.D.p.l..g.n..._....../).a.......?. 0..7<.....q....._..@...>=y....K.%5......i?&:...._.@........."?9Q....,z.WU.V.A..........1Kry..Th....S.FL{.....:......1.8~....<..<@.D....q\|d..0.^.k.>..+.gz...r..w..$D.......!......a...H+7vHv.8...W...(.0o9...(..)..o.>...&!.~.....;X@....<.`%..G..q)....%..$z.......;..T&.X\|...............$.7.5.+x..H.WW.5~~)nEr.........W....A<.../......~z.#...@...J..xu.\..........^....m..q..n.%W...HT..p..].u...L#t.Spt...=.j.....?

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 1084
Category:	dropped
Size (bytes):	408
Entropy (8bit):	7.4583789498236985
Encrypted:	false
SSDEEP:	12:Xj3HDpKM46j/Atc3IWdlEpmaFU+0VOEe0:XjHzdTWc3DdCpPS35
MD5:	7486714D21E3EDEA22781526A8ABDF3F
SHA1:	E11A25742DA85011C323D58006BA180C27354094
SHA-256:	920715299CC97A9B23F25533830B96EFF5E28CE43CB9D9255405D39C02C084AC
SHA-512:	EA031B15038892134BF1FA3B2D2DE479B0F89514B1354746D81D44761C9288A7CC96E50C385E260BC988D0C65177E28085A3E16A260684905245BBBBB7552131
Malicious:	false
Reputation:	low
Preview:	...........=o.0.....A a.j.........Zx...g...cIv!....@.O.2..{<.=.t.....8......".2.s...l.....?e........$RvA.{..5,..,..Pk]..%e..\..%.7wi...(F+.G..Q8...]...8qCj.....s.+...Z.......`...x;...q#~..]G."......................O0.eas....c...I~..G......h...t......Q.J..G.$i..P..3....:-...(......x)S.O.q..+.[J.4.Uk.)..KJr2;.b...r.....EY......jU...o.Y..I..5!....4......I...y......n..5.....\|.F...<...

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.935606575000703
Encrypted:	false
SSDEEP:	3:UR89KCmH8XDQVYo8oCmH8XDQVxXAvHfeSXiMn:U29ZXXxo8fXXHv/F
MD5:	9638EB5655C156A10D5B8B79EAD12F41
SHA1:	EFC9675A50DC235E42A649345E8EE0BD075F5A40
SHA-256:	B0C5456B67447D499DCC91D6A351AD49ECEEC0F26BB8A4FCC60923050CBBBDC6
SHA-512:	6ED7A3A3B4A40F17CF4F3FEB5AD1A52C95DAF87D222005DF949FB7AB6B365B42519A1D4FA9E3EFA2BB73EDD3C25E51518D2314C8CD1CD17D4588DFF416E1E4A4
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk6226715041 && BMap.logCbk6226715041({"result":{"error":0}})

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 110322
Category:	dropped
Size (bytes):	39237
Entropy (8bit):	7.994853307487242
Encrypted:	true
SSDEEP:	768:FAECfurr+KdjXnS3m2dvqfYA8u4MhwEzsCXLwc2b481YH8e:FAECGrK2XS1ZqgA8uzw+b7wc20ke
MD5:	0B24466B284A988971F6FBCD2034BF6A
SHA1:	1FE980201BFDE4B8D441621788C1334A4CC3F638
SHA-256:	FC8403E26A8315A8A3FF1412CB38EF70A12A69BB5F590E4AB76C1CD8171458B8
SHA-512:	8FECF981FD4EE6D76B7E9267C151A11B4ABEA466F9291D382951E78062CB23A3D0137C81E34FA3A509404F0EC0132B302338B70A70471AEF79D8411D959A8E52
Malicious:	false
Reputation:	low
Preview:	.............z.F.(........!..V.`..J..m..d..$[..&IH @c...x?..g.a...._...M..".......T.}.."..522......h..F..z......xa.&:..pt..D..d.`....a...[_..8.......b.f..".M....._..m......\...5.>..x>.?)..U%.x]ceG...?...XW.QjO.K.(h....N.`..'....hO.De.`....,..."..I.g..o.u..\|Z.{.P..\..UO..=.x.4x.V...E#cn%zd....c.<S:t/2B..,."......p..dE.X..Y.\|fB.S...Z[C}.U.@...W.Q...._#......7.tw.......]?e.rI...5.....-.E6Yl...XUD..i..B.....4.d..Jz....n.U.........Ni`...s.....kX...P....)N.'.&..(..u.:..\. '.$.T.....`..>O..r.M.l.6F^0.~.I4..F.........B..;?\.5.s\.1]q....a......J.(LB..1s.@...,.u,,E.#.plu.]X....G..1k .`&{INj.M..h\|g'...:.;+@.X.^...~.v`A..fL....4=..vW.].=.....O4...S..W...5.'........#q"X.....~8r\|}..q...F........,s....L...c.S...._.c F...Ce.0H....g.5KluaytB.vw..G....8....:..C1..Q..DO...ec...XVN...I....k.4..)...X.a.a83g.e@;\|z..B.......!.I.}qb..J xVf^b).....,...x].f%R.H...........iM..Xs........fw........f.A.k.>.C.}'3(...H.......i/..SDjYq.C.........zD[8........5P..L

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 107685
Category:	downloaded
Size (bytes):	7056
Entropy (8bit):	7.961820995195666
Encrypted:	false
SSDEEP:	96:/q+DEA5n9wp7FPZJEe4RR9TwOpoDgEMlAkBLHFU1kpY7jLlAEYRd/ewtAGML8Gp7:P4Ad923EMDgEMzltYfLlAVRd/DtA3VSK
MD5:	1A378AA5C115EDE8D23CE25B226AFD87
SHA1:	70312A92F5FB73675BE1C78DD4AE6BCA09977B42
SHA-256:	2336BD3A99736A1D4C08B12A2F3526243FF87954582F089048B9A53CF553DECE
SHA-512:	97D9EBF4384948B411425D72EF4E04A478AD2E9CDF7EFFD2D3CC8E159FC751DC9FC89032F8A6E2C81CD36FECE5DFBD1AA02522294F79F50F01D8EEE1D0BEBE02
Malicious:	false
Reputation:	low
URL:	http://jzs.508sys.com/4/4_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=0
Preview:	............#Iv..)......T].V.1././.a..;....T..B.......}.....6..[8o..r".5.K.n.....<q...9..{.v..-..7......?.n.w.....yx..y.Z.8.....U..'/...W...b;[o......}...,..f#B....\.......z.._..f.y..!>..^.....o...jq[.F...2...:...@.jSU.;..Z\|.....a.\/.o.mN.^...f.......p...W..W......m.l}..+6../.....v.q0........@........_.2i.6W.u.....O..........._..o....7.G.~g\|X.6&....B......r.%...v.S..~.7.4.......Pmq7_Z...w...$..<.....b...T.?.......o..w....j.Q."...]....'=..vrw..i.re?...Zx....f]/....7..v....L.f........kv..7W._L&......Lv...4......bL.d.nw...I.5W....o.#_h.d~]........).....a?..od..u.hU...n8......o....x!-..J.].O...........`...nY...:.w......r..........e...7.&3L.]..a..G..O]..R..H!....]....}Y............?.-.......T.nS.m..E....G^........Z.)N.......Q..T...O2.yq).g..9m.(.....&...N..T..T..?,.u+.}..H..S...i...,......i....r.~S...r.R..'!,a_.Q...\.@.-V.+./..........)k....u-..3_/..ne..._/.O.H..[....s.J..!....e:.......v..-..f=.e.?Lv.....]..&u%.(..

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1296), with no line terminators
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	5.374678835483639
Encrypted:	false
SSDEEP:	24:mDIW6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9i9zeJ6IlFt/7Hh2GQsU:mDIW6JFMzjet36iotbXriYfF9HoGQsU
MD5:	13B190028689F632B46B0717CD71F981
SHA1:	6E6C17D6C3E98EC74CF0CE5198A5D8FE8D25632C
SHA-256:	4E420983CB24A40D8C9D65153C9A7012D08A34BCA348888F1B5418C0B0CE951E
SHA-512:	0282937C15BF21716C98E6F5F53F72C243304DB8E8C973E251EDB00947DB7AC254C0AF2160B17E63AEC069E3C07F80F5F100E8B4F4062ECC7B54EFB41A08B881
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk76389 && BMap._rd._cbk76389({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk76

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5 x 16, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	935
Entropy (8bit):	5.836309213842877
Encrypted:	false
SSDEEP:	24:g1hJIwWwjx82lY2T37Vkx6QeyJ3VqxPubG+zg:+kNNn2v+V1J3MAbfg
MD5:	A3C5FD99A28F0E1665B067F040023DB3
SHA1:	79FE5841F09F4D32824BA4801135AB516B5F6526
SHA-256:	506FAECFCD0DCFA482778C5E0B07251921E548FFB04652D6F7355DB36CD0B86A
SHA-512:	12573DE983B8E49C9DB42C827067210D93D75A61DB5E7FB146A15598AE59E99F07A7DAD8C2186772CFAEADEE854F0E3D37FA3C4546A8027B8D12B5FB43C2A658
Malicious:	false
Reputation:	low
URL:	http://1.s60i.faiusr.com/4/427/AKsDCAQQy_iOvgUY0eC-vgY.png
Preview:	.PNG........IHDR.............Q.".....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1C5084813E7711E69D37E03DE81AE9D8" xmpMM:DocumentID="xmp.did:1C5084823E7711E69D37E03DE81AE9D8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1C50847F3E7711E69D37E03DE81AE9D8" stRef:documentID="xmp.did:1C5084803E7711E69D37E03DE81AE9D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^%......IDATx.b...f@.L..`..........C.~....IEND.B`.

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 281
Category:	downloaded
Size (bytes):	232
Entropy (8bit):	7.0676437260056115
Encrypted:	false
SSDEEP:	3:FttbL1NiZoYX781qpKiRjsUQs3VoFXggY1nxU2ihA3Q8vatHdWHXbcfdg1imeE:XtbLzA81qpPo+lqE1xU21gaIWrSg1imz
MD5:	D26C13A934C8B22EE43899454C789B9C
SHA1:	416A6678C317A0C76B57D798B5262C58F9DF17FC
SHA-256:	F6922D720C4BCBACD3786AFBA731DC0276255C488139BA8E63339805C1AC505A
SHA-512:	3C1C844AC9ACDEF768EA49DD01965D019078AD0EC626FD0E2456E1AEEAF49B8772785EB1C075C293898EA893B81ECCCBC5D239900452C00F67C4F3E738CBF410
Malicious:	false
Reputation:	low
URL:	http://push.zhanzhang.baidu.com/push.js
Preview:	..........d.Ak.0.G...IP'...%H.i..^.YJ.G..32..m...+=.2.....c.PH.I..w/..F].......3.\\|..P.....W........ .M.K.k..W.q.....d.rXF.......SG..sR..&...?E../..7....]Vs...Y#6+.....t~.qbBJ.OC...?/..f.h}.....-.,.z8...:.,.....!........Q.w....

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 41031
Category:	downloaded
Size (bytes):	10870
Entropy (8bit):	7.982682767743254
Encrypted:	false
SSDEEP:	192:9+o12Lnie0sZHTl0c3wk+Su2zsTUt42iJngP1dGVYu5Ajb7GLS8iVeuYSrrF1rRI:neH0sZHTunk+S8TIygzu5A6SbvT/rRI
MD5:	1FDAB41EC43EB6FEC201B05DC45BB2F5
SHA1:	108FDA83943A714CDE62258D9D484F40EDCE1B7E
SHA-256:	AF758E8702ACDE0F1BDBE3D80A86E1BA9B4BD7C5C29042C235CDF8C000575CD8
SHA-512:	F4278201413A6A97241C009262FD5C87E8267836016C8E1AF1D9A8A4CA3FA5C0436F26447D101B51B9B8B90D4D10A2EAB0DFD11C54D0319411CBA228841A2CFE
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/dist/svg.min.js?v=202411111122
Preview:	...........}.s.H...a.......9-...Y..r4....P7....8..%..g.\|q.O..W.\|q8\|.....l.._8.U.(t.)Q...{.3"........G..tR.Y:(.tx+go..MJy<.o...B.._gyY<~..s.M.I.....8..Gr]f.x.].i..1...................e...m.b....,..A)...ww.KE...%....r...i..6..y.JB.".r\|k..7..I..e.d!.</".(....\|......JF?.8z.m.^..}..e.........$..V...r.....C.jL/..zs.\|.6W..`.6ejJ......Ee..x[.m.T..."W..[U.\|.]d..p2....6UN.$#.<M...].W....4...@-...~..u. ..I.=?.1.(.j...>.x#.mr\|.^F;D.O._%.P..z.D.. I.zj.d.#}8..5HR.L.e.t\|[...v.T.@...R.........4{...F})2.r..z.(.x..O.e.8..........f.....M.J.x....S.(.}t......4~.Bz.L..IBe......2-..R...<.o..`...wz..o.f...IM..>..#m.d`E. ...~.$$...M.H.9..S.$.D.aM"Q.)GJ...`...4<..:....A4..T=...F.A..QA....%!.j..b6..4,...1..x..m)..V..6.)..^....P).PA(_....6...4U.6....5.n,.\.;g.4...b1.*.x.....}...(Z.......[Z..@X.>.f.'...U.\#..w.H\|1x.Z..].%QzY.1..,..I`0..<...E.....MH.,.'S.M$... .A]....(...L.8.).J-...Iw.f...2...P......~....F.ix..dboi!+.<.......{.N{giY~.c...(/.

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	295
Entropy (8bit):	4.699611587101214
Encrypted:	false
SSDEEP:	6:per1I/nk1uJMCJer1I/nk1uDdxHGjgpTjuP/rILS41G:per1Ic1Iler1Ic1CxqenW4Y
MD5:	869217C78B57E9978C6766B62B53568D
SHA1:	B08826FA55453BF6CB780F71B5C0BB38512AC2E4
SHA-256:	D65B2A57C22EE2A5BB0B94621AC463743163DF5006F4EAF76D6ECE6E0CC01C49
SHA-512:	52DE53DDF1CDC7B9893F6942EDA020DADF55E60EEB53BBF66BF51CCB9169A901CAFD1A53321017177B4EBD3BC39604F26670F96BE98CC3276FCD66694F8BFCB1
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/dist/styles/themeMixin.min.css?v=202402221530
Preview:	.msgSubmit .msgSAdd .msgAddButton_N .m_ibutton.not-allowed{opacity:.5}.msgSubmit .msgSAdd .msgAddButton_N .m_ibutton.not-allowed .middle{cursor:not-allowed}.msgBoard .msgAdd .msgAddButton .g_ibutton.not-allowed,.newsDetailV2 #newsCommentWrap .submitBtn.not-allowed{cursor:not-allowed;opacity:.5}

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1371), with no line terminators
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.265420325754637
Encrypted:	false
SSDEEP:	24:WG54RWMuHKFmOthmk9++35E5TJIlGhjXgfIS7sa4/M63psI8S:WFw8hm6++3SlIGhrfeS
MD5:	2B3A6D26D1214537343732555598684A
SHA1:	1E9B1BBD020AA218B22F391B20EF51E0416D3148
SHA-256:	A48C089A450CD6D9C545AB66219B65340326DE5D2687CBF07CB891FCAF492A3A
SHA-512:	46366BC0FECFE7D4FE3E0484D7DE12B2E905FCB081BA9EB41793E6264AD18FEA3FDF75CB388298E2C51661942E9EDC5DCD0EAF7E1FB75A2887BC8B462DA85D74
Malicious:	false
Reputation:	low
Preview:	window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLoxGGDt/rsGjWrMGEBoMzkNU=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,e(a,o),a.onload\|\|t(a,o),r.appendChild(a)}function t(n,t){n.onload=function(){this.onerror=this.onload=null,t(null,n)},n.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),n)}}function i(n,t){var i="onreadystatechange",o="readyState";n[i]=function(){("complete"==this[o]\|\|"loaded"==this[o])&&(this[i]=null,t(null,n))}}function o(){for(;v.length;){var n=v.shift();n&&n(m)}}function r(t){if(s)return void t(m);if(f)return void v.push(t);var i=function(n){return d[h]===w\|\|n};f=!0,n(l,function(t){return i(t)?void n(l,function(n){s=!0,i(n)&&(m=n\|\|new Error("Load error")),o()}):(s=!0,o())})}function a(n,t){return function(){var i=this,o=arguments;r(function(r){return r?void(t&&t(o,r)):void d[h][n].apply(i,o)}

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 114
Category:	dropped
Size (bytes):	117
Entropy (8bit):	6.258710678477952
Encrypted:	false
SSDEEP:	3:FttKyVVZw4GdjmsLO0FPUzyvAgd1AgZ0zTqll:XtKui4gFPUmnXKzTel
MD5:	DE0361FEF0BA34F966B12A3E918BE937
SHA1:	0FC49C7D6B5168B7813CADCFCF64A80531B71E32
SHA-256:	066E3616B6254EB0486A00DFB7F5C8B17EFB9F0B7982B851B55315DC0D351EFB
SHA-512:	A4C85A9FA11CF7E11AA928408AC15E8EB3F356F1669CA06F7D67BAB13D00D50BFBF6E58026FB98616E1D32FE38DA6E6C07725194D4031A31018B3FA416203C47
Malicious:	false
Reputation:	low
Preview:	..........5.1..0....9$..r.Xz.....Q.*B..S.1..Fm.!.wfq...K..w...f.U..+..E2h....g..Q.....{.}....D.-IN...^......6r...

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=50602536&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 71 x 71, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1633
Entropy (8bit):	7.19908796295723
Encrypted:	false
SSDEEP:	24:n1h4SHWwh82lYSgLbIVL3T3XyJ3VG/qnu8GqUIJdHern12ymeeCsr3xwDVxzq:1KS2vnoReJ3gi3FUcdm2RV9hqzq
MD5:	E1D65A6BF0F151BF0A671C79B7943659
SHA1:	5F6D9F2839F597310D195B9F84E9833AAB13F0C2
SHA-256:	C6E2964DF8E5416A527467B0E0461D05A4959D1D8B4550A0C46DA62F85A7C1AC
SHA-512:	875F7DBE88F8642D70B32D31C35DFB0EAF88813988C5769DE9DDF93BBB69E11F30C7F07545FC55E75106C2B4A38A33DDE54E447CE0F305BC7A3DE873A602483F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...G...G.....U.Z.....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:41DEBE66001A11E494DCE9E6A4A189DB" xmpMM:InstanceID="xmp.iid:41DEBE65001A11E494DCE9E6A4A189DB" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:66397EC4FC3A11E39614E69FBAB86579" stRef:documentID="xmp.did:66397EC5FC3A11E39614E69FBAB86579"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...q....IDATx..M..a...+.(_...,da. _K)cn.HJJ...Vb..X.(5QJ.....!M.BH).M...R.d...=.:.....;...ng6....9.5....c..P..P.

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 330983
Category:	downloaded
Size (bytes):	21355
Entropy (8bit):	7.938865299477129
Encrypted:	false
SSDEEP:	384:+ZcntqiUdLNB1ga0mpj0jvVy6zHSWKDvcF3zhn13B5sxUrvZx5bz/fGU:+ZctqiUdLezHATsjbB5wUrRxBXv
MD5:	CAD2E28F50E31C0964CAC5B3CE0F1895
SHA1:	C4762C1F02E2206EC17928B0DC4A5CBB0663667A
SHA-256:	BEE2DE115A464FC9A33FCB2275B1B31BA024B12777238F4D19702452ACCB1E26
SHA-512:	ED075C085E29A590877D1974A7894C388E4B518ACE2232BF524E332C9E987E258D4FEF64CA2DA2433D1C056F54CE7B5576044BA81B2704F17C1746542E5BDBD1
Malicious:	false
Reputation:	low
URL:	http://jzs.508sys.com/2/4_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=0
Preview:	............n.I....).m..Y7.E.R.$..t.w......m.%.$.6E.E.{z._..W......7.Oc..pFdfU..<.wN.eL5wz.:.9.......O....j{.~X\|.....W.................._............o.W.........Y.....?..a.xz.......j....t....}........7........a.Y..^_\|..%...z}....r.\.^.n_J.l..]>...a..^\|q{..........T./6....I.T._.Y4\|.....>t.K.....~.Y_....F.....Z.....Ncu.....+.p.#...HG=.^_...??.[.__<...p.>.....\|9]...ono...f.u..:.....vr.y.^.......{<.]?1.a...,....V7..@b<..<s?....i......1N..............7....a...G.{...mW..X.1.z.B...Y......j........^.t'.Ic.../o..n........./O...F......p..<......n.7...r..^=l~X..z...']y..w/..e.U....j}y.]y..........O/.......w................A..:.g......t..M7.\|....].~z........_.^w.Z..as.y...<..r.nsu....}...o..d..]?..u...\|..b2..R.k........N.$<?)~.\=.{y...?D.....r.....o._,>....../}.^.......o..;...o.^..Q..M..N.O.D.8Y..x..@.C.nuu..y{......f.Ex....<.....l...c8Y......a.........a..\0.....D?L.".?..\..._...;..+>.\{..F...(.....n.]W....+.g.P..B.qfl.Q.(O.....z....

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 37
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.550902333223265
Encrypted:	false
SSDEEP:	3:Fttuc/IHxduN8YA/n:XtB8xY7A/
MD5:	8AA11B9E8F9A40315C72741B801C187B
SHA1:	09004ABBAA45F134677082C1648567CEEF79E2EB
SHA-256:	95B6E0DEFD2B896214CD1971D66710399D7D1710DE365F7EDEB7AE4FCF798B52
SHA-512:	488D897804004D7CFE4EBF6B9CC705CC169D9D347C0F25D45648746F196EDCFB07F2EF374901261488674C0E99B8C0C38DA3DD9AE6BC84DD121FDDC6789010DE
Malicious:	false
Reputation:	low
Preview:	...........V.MNN-.V.)*M.Q.,vK.t..M..S.RHK.)N....1d%...

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 91749
Category:	dropped
Size (bytes):	29754
Entropy (8bit):	7.991541618752925
Encrypted:	true
SSDEEP:	768:2PM00Xo98UJf5xNrDP3KkJ856cBjmzt8feIiHKgB:2CqJf5xNrDPLJ8JBjKt7r
MD5:	301B3E16BE8B7938340F630A08BF2E79
SHA1:	3701B3A2087CF5872E588C67DD4D7F6B20E72EA8
SHA-256:	66D3757879320F26F60672025856F23E5809C96A833D5AB660CE0FB9AC3BF191
SHA-512:	68306CAEA09D6CAB0AF8F39AF6AE19E093CA1E3E25B0516039A8DFC08CD20E8FF626A7FBEC0DF9EE780ECC72D4A3A3B4DD8AD1DF7FEF18689194508956777C5E
Malicious:	false
Reputation:	low
Preview:	............k.$gv&.W...8...a7.....f....j.pd!.......d\.:{..``oX{....X.......k..!K.?.h...I...9....Y.....+"2.......u.r./~5.......u^l.M......y..{.\|=...&.W..p.o......o.......r.2..O...........w.>>.yZ.&U..~~....O.........}.9..o....w......./....C.".Q.......o......~p.?........G...../..3.....?.......{~..............p.....\|......o........w.._.3.'.....[.w.w.\|..q.A}L..\|C.S..q.N\|..'....:O........j...u...7..'.~...$..e.1z..yV.<x...NI.tM......u.$..}rE/.L......\.E...zx08..}V......-.d..,...\6...<i.I.?9>......L.js../.U..........6m.N.i^t5=.Nmn..X\......7j.d.%.4_$.\|^.f...=.E.$..?....,..7...&+..n.d..uFw...7.Mn.j.m.&...-..N........\t..k..=...p...ou......s..nV.....^.....>I.yV..]`'..^.6..2i....:8.7......dya...'i...2zgz.S..&.C#..,./.j......j..v~#ms.=j...o...&.K..2j.dQq;.q........I..0..dr6I.0..y..U...4.>....}..E..lxW~oV.U..Nn.U...0m3.1.W...I..7H...]t,Md..F{.6GK...;...5G.....N.V.eMp.UF.@..t.Z..._..c..r.R.8..r,)p0..t.'.N.f.p...7...Z..

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 11 tables, 1st "OS/2", 14 names, Macintosh, type 1 string, icomoon
Category:	downloaded
Size (bytes):	373156
Entropy (8bit):	6.384245798728287
Encrypted:	false
SSDEEP:	6144:bren5wHqs6x40cDVZmmF9IDDYogtUEqsRTURdL/JZV/vLAeswdaT7i23xAVwbYe4:E5LcD8Ujqgwax5l8eUFaiBl90IOILFHx
MD5:	511CC564DE286264909F42D6F98C251D
SHA1:	A2D278EF11DE2148CD17E5CB43A296418B1CA8CE
SHA-256:	A3238452AB7A70C2DF15112E261CD6CEF646F1641FF8F454DF9519E81C0CE8CE
SHA-512:	ED3D79C80855F05211EE9B5BAFDD918215563AF92DF33BB15C27964A371E1E225944E0CA9FA754547675C29E17C8BA614D8C34CEFDF2CB741467D262DFA1C847
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/newFontsIco/icomoon.ttf?-2mgmdr&v=49
Preview:	...........0OS/2...).......`cmap..g.........gasp............glyf...,.......`head..........6hhea.......T...$hmtx..y-...x....loca.O.....(....maxp.E.-....... name.J..........post........... ...........................3...................................@.........@...@............... .............4.......\|.......4.......\|.......4.......\|...H............. .....S......... .....S............................................................... ... ...............................S...S.......!...).......0...9.......@...I.......P...Y...$...`...i.......p...y...8...........B...........K... ...)...U...0...9..._...@...E...i...H...I...o...P...Y...q...`...i...{...p...y....................................................... ...).......0...9.......@...I.......P...Y.......`...i.......p...y....................................................... ...).......0...9...%...@...I.../...P...Y...9...`...i...C...p...y...M...........W...........a...........k...........u...........v... ...)...z...0...9.......@...I....

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.952432419566062
Encrypted:	false
SSDEEP:	3:UR89KCmH9sdhXC8oCmH9sdhfYX8HfeSXiMn:U29ZRhS8fRhgX8/F
MD5:	D866A5CE190DC2589F28C6E907EA1074
SHA1:	E76C19F09411A8F2552FEB76DCAF49E86081AB42
SHA-256:	FB2880AD6B6BC8767ED3998266DFA5DD13FD50E99D2D11116D7ED0A060D70DE9
SHA-512:	4B6502BFA94987210CEF658628DDBE3C08EFD3F7E099CFD601C4ED3D90803250589AE067BF551BDDC91931CAE104A39012C41D97508D5EA3C660F59F98ED843C
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605636310&callback=BMap.logCbk7658843111&sign=c2c7c7c838f9
Preview:	/**/BMap.logCbk7658843111 && BMap.logCbk7658843111({"result":{"error":0}})

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.842409318889354
Encrypted:	false
SSDEEP:	3:UR89KCmH8QVVHFtroCmH8QVVHNYsHfeSXiMn:U29ZX+Vl1fX+VtYs/F
MD5:	775C34D0997B31DB0507414D72CCD1FB
SHA1:	0A3FB70C310D883E59AC6638CA7782056E299B1B
SHA-256:	76618ADCCB843D84FFBCC1250F791C9C77A0C7131E757EF0C3326036A07C5AE9
SHA-512:	24DCB6DBEAE10A538126F65A698B448DEF780EC7FC62B8E82A51D4055F31BB34AEFE946A1418F74D9900C3771B16690F8532DB0FF1B9377912EA2D85C0D78118
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605663832&callback=BMap.logCbk6527070280&sign=052f50e74c7f
Preview:	/**/BMap.logCbk6527070280 && BMap.logCbk6527070280({"result":{"error":0}})

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.8983783655120074
Encrypted:	false
SSDEEP:	3:UR89KCmHycSWFeoCmHycSWFFsHfeSXiMn:U29ZZGefZGFs/F
MD5:	795927B89FC27357976A7F9A67A6CF13
SHA1:	191C004F0441B6F6C4FD0CF5AC897186CFB2A95A
SHA-256:	6E6F41B20E02AD5D5EF3CB3A03513BA2A65314E0311C3727EF2F888A6E385464
SHA-512:	7AB873940637FF5D6885B23CE2E57C53AECCBCF6935D3604C66C5F42458DC28DF54C6FF53E0A36A91239276BA532121A9D4537DF4A542BC405494237CBF51544
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk8973956757 && BMap.logCbk8973956757({"result":{"error":0}})

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	121
Entropy (8bit):	4.939069284095431
Encrypted:	false
SSDEEP:	3:UR8OXBL15J4BL1MHtad2jRbrUWAqOLc5MWvQPmh:U2ML1LML1MwGRbrPgLc5XIPU
MD5:	347C54ED7A3ED927909E1FCE3711F7DD
SHA1:	6D00983E0A04396F5A0E8485239F3B9534BFC706
SHA-256:	9EDAC5A4D4E24B01C98DA6AF337FCE91B9D6195906623B4A6EEF60AAE273A858
SHA-512:	395833704B5BAE07059B56E2E928E3903A4D645871D5FFD940DE23E3ED4C30A2D33E67BEF7BD158C1177AE7608E72D50377706BCDEEA9D2D2E61AA778947541D
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk27910 && BMap._rd._cbk27910({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 147325
Category:	downloaded
Size (bytes):	28357
Entropy (8bit):	7.9913229963790835
Encrypted:	true
SSDEEP:	768:lzNUWSkfpD/Fr8yG3OusJklfs51OD84prU0AgVSof:wqphrg3TsJklfeLD/O
MD5:	40D2CDBBF05649FB9A31CE6EB75F9F96
SHA1:	525166CA541EFCA896E3735859F953DD68327C94
SHA-256:	34EAB826829BC9B95D20036C490371697C4DB0992018F459708B288277064E9B
SHA-512:	9715F5C017393A00535A3A30C1EA9E83F7E6FE75403EE6F80577D0C78310E29F401D634AAAD4E9F7903437D0A18590AA848A6C946D228762C3005B60B93A0360
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/
Preview:	............s.G.8.."...g...cz^.I.....X^F..=....Q...qw....lc....7..^?0k...F.0........./.8..t...p3....{z^.H<.aOw.#.++++++k............=..~.q...7OXEuh.,.6..GF....{....._.U..[BG&BBV.LsK(.........4......g...R,U.Z:ys.....{.z....?.=].to.....?.~{.z....'......Ks@.lI.&..-.C..n.L(U.,Y...Z....A..f.PJ..k+.h....R..BY........gJ2...[...BvB2L..R....@j..!..U..fv..9/[Y@...m...FzL.'.I.3fOV/.Z..]A.q.y&...%/._...K....m...);!wc7......w[...y.(R..u....C.bI........-r. ...H..JVwN...,Y.K..&o....F../R.g.0n4...!k9.....9.X\|...d......e.o%.e..wzz.gzB......`......S.>.}F.#.!..C.0-.`F...d.d......#.S.zOV..z..%.#...z&..J.....DR...%...R.T./3..s4.%....\|*.>...2../..{.9.b.!.G.&C....m..oZ.r.t.N.La.p4T..KRC.!)W.......K...^.!..;...#..~;..3..j ..%~.M<}..[..(.....8...X..!7..!'.......9'.D@..\.M..Nbx.I\|.r....:..j.Xbi..-9.......q"9 g..C..Y.J7M.l..X....#!. /........D..nt.....H.-.`..\|('Y..`F2.d.......@.E...e.PW:...F....,4..O...bZ..5..f/...P.hO.....:.%...#.HB..x.5....`...J....(F..'.:[`Q

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	70244
Entropy (8bit):	7.9968519632202515
Encrypted:	true
SSDEEP:	1536:Cr8rdxyFNZrSMVTmyw8CZWUNNhRzDuIuRNeGMOX7e:A8rLyNZjDCZtN3z5uxM47e
MD5:	59104E03D30007CD57E7DAE9DB27B3D5
SHA1:	A5F819A157742CEBF0BB60337CC7164F958FD0A3
SHA-256:	7FF5FF8A140CFBD5A4A0F0B9C3CBA07C131D2B49900F7317C0A3B8411DE34977
SHA-512:	2B484AA7347AD0795BCA28D7E3E1FDF6772BB3B4D1EACFE7E328329DF136C7077F3E612DC7C0039E95A303ADA32CE7D4A2C7CC8E5F285BE6E83F181A485D5057
Malicious:	false
Reputation:	low
URL:	http://28088389.s21i.faiusr.com/2/ABUIABACGAAguoiFjAYohvfQqQUwig842AQ.jpg.webp
Preview:	RIFF\...WEBPVP8 P..........X.>m6.I$".."v)(...gn..vm6..R...3........omr.<..L.0{G./N..y_.v......?..G...../>..?.z......+......z..@?.u0...........r.)............`...K...O.oE..i...S._..W.............].7.?..6.;.....=P.C..._............w?.z.....?......W..._.?...~..z.......;...._.}z...O.......B._...=V.G.......g.....Y.i...O.o...>C.q.g..................r.....O.....D...S.o........A...Q.{...........}......-.o.........7.g......1.....e.q.E....U....ms..[/;.......a9!.v;...Gg...rB\.T../K....k.E.xyoT..aK...U._.\k.......\.e~m.C.J.X.^w.iT[/;...-...ZU...6.'UZU.........^w........'...5...(K<....#4#.I/.k,w.;`c.....e..,-M?.+...U1.....e.q.E...J../;...x.J..yv.v{..?..!e.Y(..U....C.i........-.UAT...t...\|.#..,...Q.m..c...<.&......t(..'z..E...J..y.u.Ql..:....{/;...-....r.O.X... .H;.....S....\|.q.z.T..-euE............/.G.Ci....L...[e.\|.Z<......A..i.......-.3...b.[Z.x.r..4.-...ZU....*.e.q.E......M..E../;...,...m.$.".......E.....d..4..W....O..H(.Ye..}...&...M......\|...

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2904
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	7.835060758396019
Encrypted:	false
SSDEEP:	24:XQnJjX9RVW2uh+dvV394mFdcthlBstwMagzOpjziiEeDo51xAb/0c2BS/iZx8unP:XQJL9RVW2fVOmFdcthlBs+MuzJESsxuU
MD5:	CED6B41069D1AFE25DF8AC0E9913F2B4
SHA1:	17B391C6CE49141A36888355865B25B2EF31F17D
SHA-256:	4F392E36BC2D02402822E3D219E9CEEAD622A527B4EDD1F23DE0CEEAF9AAF952
SHA-512:	DBB9E85A9300D16820C71244A80786FF4253DFAA26C50CFEC1C1935F064D92B01F63ECF6F2FDB1F2AC0A185F66C1B6DB49C787EDA6F49E3EF9943396CF83A0B8
Malicious:	false
Reputation:	low
Preview:	...........Vmo.6..+...d.pv6..]......,].....`..."5..Kc...)....l......Y..'..}vO....}..U.&;....&......[.......I..p.\..#.;..P.:.....~{I`...U..9......4.x.E..[..B.I..zd..2.1..<]4C......\|.V1.Ydn. qh.IT....~.0....n...Q..MZ)`;.....?.".&].)}...(....2z...(.rSYh'o//...)....%.>.GP;.v<2...z....A.......vpaRX..f..M.....MY..~_.U2...H......w..mifJ.......v....C.....z.."..Tso]t.[@".b}....J.5.E?.)..E..W.Q.......L..o..{i.h(....6@..X.0JX.&>..9(...3z....,.N...z....n@.7.....t..]..4..l..>....=.:v ..<.>s5......?..Q..R.K....B....;L.S.+Z......q<.a..[F&..S.)..`.^.KgQ..V..wt.w..n.Fo.I."..DZ8.h.XK..hw%...0.......O!.~....-}..I.`....zmg."....T.[PN...$...5.CR(..y...E...Aj<.M.a}.,.J.Q../.xJc.'..O.g...m...5.>.Y.(e...>.....,..c.....RO..!..\|.p...An.cn.@.-H6K.4..........c..?..u..7.?..>.j...:..Qj!g.3.....] .A.;.u.\|..4.xv&x.........K.{Jn.../..:7.x.+.#....>....K(%.......jtg..p...G.......n.."'.vk_.t<.'......?b-.$...2..Fg....57.(S.....Y!<.x.[... =@u...@y@...a.}.....6./.or...$..

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 570x455, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	14146
Entropy (8bit):	7.984742125054151
Encrypted:	false
SSDEEP:	384:UreODUIQMxCmK57gLvcLNSUd5S9DmVHgzK9opJpWtlUYaOq9rR:USOab5CMSi5SIHyiQotly
MD5:	0AB8F31CFF6C9BC7DC3C39D9E8041323
SHA1:	972F9FAF0ABB10213743674C0BE0E11B7C84C732
SHA-256:	65368BFF57982B4DC994D624A7C2E718AF3FAEDE3566BAB0D36B11DE96D15D81
SHA-512:	98B8796A1056E2F0CD03CAD64F3F08E0281E53EE107AE9851CA4E01FAFFF4513C05A5453E6944495CFF21C0DF579EC6059702558EE88E939179BCE2158D1E8D8
Malicious:	false
Reputation:	low
Preview:	RIFF:7..WEBPVP8 .7..Pc...:...>m4.G.#'.U..P..gns.:c..:.".3..p.6....3.{l4j(.F\|{.......p.._..o..<.......z.tNz........]....%.?.97.;........3.k..}..W.......G.....#..7......0_U..f.~.T...#...`..3k....J.c...-P=P<..k...9...k...-Aq...u(..U../.`F.G.B,...K......(.........X..._H..TK......Q.;>......q.s.HM.$.V.u/NI;c....J..1;./#).B....UK.&$........~O.6..%t.}."v.........9.E.K...!d$.........}.+K...&...Hk.....M.B.i.Bq. F..l.=..g........o..t....}uM2....^.1.........x.E..KjM....p...../1?..].\.L..3~r@hV.w]...W...p.0.....l.r=....J.z....&.]4.?h9..u..s.8..?.x%....D.....m.=K.0.~85.x.f.s..V..n..t\|.o..?..."VM....K.8.;:.K..i.=...#Z....:0..N.fa)!e..xV.u^..)81E..(......Ggc..N...6o..A.)...C..$.....Y...8.9.3yT..........>...G5.....'L.}^ ...K.....+-....;.......Z].O"..}.]$....].%....EQ..A.....).;...s....NB,.g..X...w..A..X.O.u......L...g....V....v.%...<2.h.$s.[.f..Y2.Dl ..W.......5.,...A..]\|...m.]..0Sf.....#=....m......z~..`\RNX..pn..t2..z.?{..K.g..t...Wr.x#8.b.0.t..*.

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:n:n
MD5:	9D4568C009D203AB10E33EA9953A0264
SHA1:	DD29ECF524B030A65261E3059C48AB9E1ECB2585
SHA-256:	12AE32CB1EC02D01EDA3581B127C1FEE3B0DC53572ED6BAF239721A03D82E126
SHA-512:	64D24560970CA14D349BEA0E7D2526D4754BF3283568AB4DD602BD79EB454DC3657D5BB6F9A30C90EA98D9600EBD0FB45D582F4CAE3F8E3C50B0E8FB18059892
Malicious:	false
Reputation:	low
Preview:	""

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 330179
Category:	downloaded
Size (bytes):	21359
Entropy (8bit):	7.931828121797606
Encrypted:	false
SSDEEP:	384:+Ej3YJprL1ZC39sT3kTOfeDi49bP+hFEOWPJg2dFalCCraFfGiKo2XX6Vw+wRcLn:NTSrZZnT34OfeDdbEFEva2d0WFuieXXa
MD5:	39155408997F2A3CF885F1B85E6191CE
SHA1:	F4B7E8F9B0C908A0DAD0B7B03E487689CDDD04A2
SHA-256:	E9E3D49DCAFD0FD08F70A21374489F02EF634577C394DA795EB6DCC0F8299FCC
SHA-512:	BD2CCBEFD0925E4BB06D809CC0B1F308E9B74B68128CADCF16873CF26775D7CB8936F0108A98C9311EB1537B49C5948FB8ABA2D8B198A431445E22853AB1FC49
Malicious:	false
Reputation:	low
URL:	http://jzs.508sys.com/2/2048_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=1
Preview:	............n$G........f...jRT7lx..z....j.....`........F#..W.2.......~...3#3.....}.D..S"4.j.........~......o.V.\|xx}t...^..._}..?.....p.............7/_..]n.~...........................\...W.........yw~}..?.>yq.............D..\o..6.c........<w..]<......z......._>l.\......W1k....c.....n....>t..K.....A..js...T?.....n.)...j._\|......r8O....z8.u.q.....v.n..a....A...xy.=_N.........D.....1v.7..[.?......1..o/.........p........7..Hb:._..?....i.qww..OiB...~.<[.\}.........?.m....z......m.\STr.....34.:....w.W..?..x..W.7...n..../o.6.(z..G.W..<..M.>r?l..}.....A....W............. v..IW.....O.2.....rsq{w....Z{....]]....................,<.....P..y...^m.......f......_.........0.......O._._....z.........F-...s../'.......I7n......_).5...V.r...E.^..?\]>.}..........+..[>......b.S?......y....4.8.....z.....`GH:..A.....D..5k.w...8D._^^.9zu.]..A3.*>...J..Y...b...W_.x.@%UD....`...E."0..4...pr&x...0..... pt...~.'..;_.A..n.5.&~....x.;....+..o..g.Q..b.if

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1297), with no line terminators
Category:	downloaded
Size (bytes):	1297
Entropy (8bit):	5.375761155941227
Encrypted:	false
SSDEEP:	24:mDIW6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9i9zeJ6IlFtbKTjhAJCdsA:mDIW6JFMzjet36iotbXriYfFgTjS2sA
MD5:	8A559F748D7B02D73B19163680987902
SHA1:	E6C24952A3B30733B37113A7C03B3C048587CA6F
SHA-256:	7CD6061C76F43AC0CFB5466E18F724537D106E33CB6B6A74702F1D190C018918
SHA-512:	F29E44B1CD9A6ACA6C9CA14C7CE2C140E288111AC0B5F8947AFFB555A13834F2D9220B4C766F753AA7B2F7F40718FF3C2B660FAE7689AB8468DBF6114D3BF7EC
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk76389&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605663341&sign=b91f519b6f46
Preview:	/**/BMap._rd._cbk76389 && BMap._rd._cbk76389({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk76

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 45
Category:	downloaded
Size (bytes):	63
Entropy (8bit):	4.576663559094718
Encrypted:	false
SSDEEP:	3:FttuMXXwLo8xWwkGxvpfY/n:XtRMxWkZY
MD5:	646789679CF9D69394C7FBC78E7FE634
SHA1:	C7095DE77233A8331035E058A29B227746E8E57D
SHA-256:	054FC8AA63E0E126EA2DA0C85C225599FFDF23B25627A444874CDD69279A7D87
SHA-512:	6B0D605FFB057211D8051A1CB6BC5C8AA90B9DC32A3902A74B6224D75CD06079846C7F422992BA17E676E442D4F1B8F72AEEA3D9703A157E297748E799467601
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie
Preview:	...........V*Q.2.Q.MNN-.V.)M.Q.-NW.RJ-*R.QJI,I.r.j.....-...

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 11 tables, 1st "OS/2", 14 names, Macintosh, type 1 string, icomoon
Category:	downloaded
Size (bytes):	101044
Entropy (8bit):	6.415480004193159
Encrypted:	false
SSDEEP:	3072:WdSbiaAmbFatAJScxIjSPZlFVjpt0he1vTx+kDUA0BqGYw0AySJnGs5fPAhuULaH:WdSbiaLbFatAJScxIjSR7Vjpt0he1vTe
MD5:	5A1DF665CBB2A56887BE0366C200092D
SHA1:	71A44C7369DD6F4D73EE10F5E2074F3736B25541
SHA-256:	A19439904055A9C4F850934976C65928D9A1EDD51DAD842D1BCBE39AE05211F9
SHA-512:	0693E8BE33DBEE99F5B925AD3C67A4A819EA8A79D3C9768D9E123D777EBB5A781C20AAF388306DDF97ADEA07DCD3678DC766805B687F0D6289FC9DCC89226FB0
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/newInnerFontsIco/icomoon.ttf?-2mgmdr&v=70
Preview:	...........0OS/2...(.......`cmap.o,X.......hgasp............glyf.........\|.head...R...\|...6hhea.I.........$hmtxV."........`loca.AQ....8....maxp.t.F....... name.J..........post........... ...........................3...................................@.........@...@............... .............4.......l.......4.......l.......4.......l...8............. .?......... .?.......................................)............... ... .......?...?.......!...).......0...8.......@...I.......P...Y...!...`...i...+...p...y...5...........?...........I... ...)...S...0...9...]...@...I...g...P...Y...q...`...i...{...p...y....................................................... ...).......0...9.......@...I.......P...Y.......`...i.......p...y....................................................... ...).......0...9...%...@...I.../...P...Y...9...`...f...C...i...i...J...p...y...K...........U..6z..6z...V..6...6....W......................79..................79..................79.......=.......1.O.k..."............

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 38
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.905297485303413
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fKPjy2DkIzxD:XtB8eKK9fd
MD5:	7103024B5D34569D2CEB1FEF0820039B
SHA1:	0DBB781F60DBE03EE5ED84DB310B01E601DE5BF1
SHA-256:	769CE690671A0B7CB3F924A3249A6E90D9D643A33CD51286262E05CC3E3EC1EA
SHA-512:	83760630526B04D9723342D4B35455F3050753AD0D4D1DC848F03A8C0A5B0CA3E3E3A41D58B35A4F0D4ADBFA23D0F411E2DCF89CFB859D7F955890F2410FC9F7
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz...l.Sf.X.^...N..w&...

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	19363
Entropy (8bit):	7.930280234305601
Encrypted:	false
SSDEEP:	384:e2yqOt508z55u190J8hmDteS6N3OJZIKCDH9ZL4EYxV:ezt+8zno90J8hmDtviOJ6KIHgEYn
MD5:	6C44A15E4FF77458B2AD834DE5295926
SHA1:	9C484AB2B9AB4A6D0E2A8A66ED711B94D5EF21C4
SHA-256:	ADFC6F58F4B6EECAE6E29618F7516DD992987E4EC83A8F448DB90C8F6238566A
SHA-512:	0CC13AE365DE264C99D07F806C6AC569FF01B598A60247CE7B7C2F6AA5205499F912C184D267694AF17BDED0B33A23B827049D7DC611BA4BD4276803380D49D9
Malicious:	false
Reputation:	low
URL:	http://maponline2.bdimg.com/tile/?qt=vtile&x=24812&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE...............................................................qsv............................y....q........f}....q....Z......P[.........:..my.......i.b................?.\|."[.....bKGD...-.....pHYs...........~...J3IDATx.}.z.8..@.b/.d...Dr...o...].)....,.....,q^L..@.)..h.RF...8.R...+."\I._.......H....w...?....r.....r...2..9<....b....,..e./).i........>$..?.....O.YO.._..Z=.....+.!.2\|.;C.j...b...+\|.T..V../..>^......"C.D.......{......x.......lV...].!.%b6...z.3........2R...y.H...=.......N..4....%.z....H\|$..,.....Z...fM2z.y4.Y.:x}...X-..~.L...g.d _.K\|.v.-....U.&k.:.&...+.g... ..\|...a..e.}......k5.R..-ni\|.......H.l...g..t.u..}..WU.._. ....&...J.........n`...%.W.\|.)..u...f..@...y!X.......b.X.o...T..(M".k[..k......r>O.0.k\i..CF....%.. ....... x..cW.5........V.F@..&...G(...`.t...Z.D..S.E.\..H...k..Q.Y$DoB<K.P..7..D`.Y.....u52.3..2..

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 570x455, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	68702
Entropy (8bit):	7.997415907732691
Encrypted:	true
SSDEEP:	1536:qELdHkyIwxVfZqi+LoucLKw7Xf54S1l0aCJgSVe+:dLtkyDGRoucLb548CJg5+
MD5:	6C14E42449CC766E7412D9EC2A857BBC
SHA1:	2BCAF1A44973563D25D38681CCC637BCAC3FFB13
SHA-256:	548963069F8ABFBCCA49F5D53B394937C6F62AEF3914F40A6550C5DAF798AC24
SHA-512:	80C62F47C18DED77C9637AA2C43484F9266E9F90E28962E9F36AF8E237B04B3C2BDD0015BFA9F7C1DB27A02E48797531326040B9C52C5CC9C64836486811EDB2
Malicious:	false
Reputation:	low
Preview:	RIFFV...WEBPVP8 J.......:...>m,.E."....\@......#`P..?...dQ.... ....A..`\.8..'v.d.J....y...-..........G....`?..\..?x.K~.................[_...?.........z..........c....\|.......u.K./._......9.....a......R?.......n?....I..............?S...G..........?.=.}...._.?.q>.>.....T.W...3.............T\|........?......K.........?..w...........?........g...........}......E..............._=z..=.#.\.....df...Z......]=~.\.. .peFP 1^..z.p.e~....SBT}..j.k'U%.JoA{.C&...Re.q..j?...]S..o..W\|....S.....~%..pa.v..fr..Nn...G..}..]..<.z........\|.......D.^\|o.........8/....A?./.....>...U..,}dS.t$.Sj...?....FY...-...j.)..&=..g......3....Y.[......Z..C........2.....qIR[..b -P..e+..e)...Z...@....(....p4...3mH.Epy..q...a[..#R.=..dR.h......\N~...u.w.x.pt.A......U.&...fG)..=T.a.g...Y.\|...I....l=:o.>....e9j.....hN....{.'.q...R.U..)...wr....@Ol..d..kP:a..QC..(5#.Hj17W.=.e.xh..jLC....G.KWLT%...P..i...h]3........ab..z;..\..P.z..hI8..k..%]..#.\.;..n.5.....n.Z&.[.gw..u..J..?~gQ..

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 35
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.80639513982528
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fOw0x4RTE/:XtB8eKmx4Ro/
MD5:	84AAD1B39C33701D2FA0C423DDE7AA23
SHA1:	918FDF533E772ED0196BC558BF0A7261493EFC72
SHA-256:	20AF8756A37D1EF526BC15C29A7D150A242DC06F5A78413604E02A834A42C64D
SHA-512:	8E3CC4D21CFE6677C41A326541CD6007980B8AEAD1AE100D440CEDBC1AD21213664B573BCB5C7A52C75E3BEF7B0767165E9476B3A45E4884879FF8BB68B2DFB3
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz6g....T...t.p#...

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	121
Entropy (8bit):	4.939069284095431
Encrypted:	false
SSDEEP:	3:UR8OXBL1TdFno84BL1TEad2jRbrUWAqOLc5MWvQPmh:U2ML1THno8ML1TBGRbrPgLc5XIPU
MD5:	B3F18B4ED94F53C17B031541AB2D46EF
SHA1:	42860A0EA482DDDA58225D30F59A8E8363642B7D
SHA-256:	F09754E6C1612FDB045A2DE6BFDBED04A19EEF61FC9440C64BFCCD8D7B7AF689
SHA-512:	22153B1716ECA70B60E64DABDA16054043162077E172194D49CB11FCC0A56B8C9703971E932074588C809F65F8258CE28563D5B8F5A148D87917617E4DDC8D25
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk82991 && BMap._rd._cbk82991({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	15307
Entropy (8bit):	7.9352598354273844
Encrypted:	false
SSDEEP:	384:ptsGIMjRr34igDNlZWhEub4Ai/5fO4/GDqRz:pVIPiclZWCucUql
MD5:	09F87CF504E0AE587EF47F28DE17DED5
SHA1:	90D147312F6698CD8BBFC6057861DCE8D98FC239
SHA-256:	1E95FEBEFA01BDAB8D7248CD24A05DD8BC4BD1F9EBDF58936EA286A64FDCF9DC
SHA-512:	A74AC42BD1A79423C9B4B8435553748B5E2DF29ADAB32E809679B206C2AA2377D4C7EF346959668EA70101DC816B2CF146C5152A2D0F322208097DAD4D271827
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE......O..............m........................................1.w@.}........................................q........f}..............w............j..oy....X...\|..iv.Wf.=......bKGD...-.....pHYs...........~...:^IDATx..}.C........l'W...-..B.......?.UU/.Z.!a..../:...E..>....>\|.p..........].'.......O.[..`... N#5.....o.i.y..8...?..?.9g...q...N....?=9.>~.'#.<..g......p1....N>....N.'......<~r..?...Y..Y.....y..........G._.,....@....O?....NN.....?.....'''...P..?.....'#$.]...N..`p.H.. ..<O.,..sM..M..2.@...>}:9..D.............NH/.......U??9./...O."..........I..e./q...0.Q..%.....r..?.P.P..`.`.`...O..........8'.{.........D...'NOh...i.$..r...-......L.$~.2...G\|..s.NN....n..#.$..._h.;...}z~....93...$..0.t.x......,;^...p0 ...89..NF.~....O..U....?'x......vqa..O@.....N.....gW.Y.^_..2.m`.%.D.m.......< '.h>..A..'.....x........g.*.......^..S

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 115528
Category:	downloaded
Size (bytes):	13421
Entropy (8bit):	7.982099908487786
Encrypted:	false
SSDEEP:	384:Ah5PUcdENyg35BiklaVJyvdwaqowZjbm+kWHE3EG:AvMZHuM6vlkW7G
MD5:	C8109BF6557880E600F2B13DE256B28A
SHA1:	8A0ECD76A2DDF983D9180D13B0A573C4F721C17C
SHA-256:	3D190E37ED253858DA695D8D836F2404FE1379A8F15ED7C549126F7A2DE69F87
SHA-512:	0F197DDCF2F23C04CA1E8E56D1277DE8514C344EF97D3C83E1F4A124237F337BF57177439EAAA38EBFF95DB63E5B407ADB404CFD55CDC9CAC2F88745E9964823
Malicious:	false
Reputation:	low
URL:	http://jzs.508sys.com/998/fkTheme.min.css?v=20240808102706&aid=28088389&wid=0&isNavV2=true&isBannerV2=true
Preview:	...........}[..Gv.~E....g. .../1c.)kH.H.b{...D.(.K.P..B...y..........7f..........:.y....x$..../o'o.....(..<......\..b.....m....?O..&M.._........?}:....xt...C...<.2...<}5.qZ..`.Ym.......h...v ..x.\|4..2.6Q....f./..b...mq..?.r..BQ,.lV.E..[@~H.vL.......q..)...Z\|..w.....tq'.#O~...G...f..,..x.fQ...s.M........................4;.<..]..3.....'.x.Z+.......9.OF#..}.!.].....,._.ES..gC..&..2^F.u.=}.G.8#....].q%...&.T^.bG.......-.8K.".\|.N.....`)......U.......2.F..i.X6i.$.~..r.^o.(.g.E........N.....([%..:^...h...r..]F.m...3r?...WY...../.KY.../4.fk..".w...`./~Y~........ahn....]^-.!<..R..a....a~2J..(....x&O..N.>..............\.~.t....Z=?M...~.[=.}t..8.....o....u\|..i6..0M.xs~....>.I....9h.N.y...MYr/...hD........R> >Y..RS.Fjt..].....x>9.e.V1>.-...j,wBD.....".!........t.V. .B1.T....A?.5..^.&..X1T1.h_.\.3..z\3.........L..y.;.a.]..j.L.=Y.!..x)&e..rO.p......Y..r../.n..Y.M.......~..L.Y.O.....M......(..Z,.....`..ZL.p]T..^..e......kynXd...Vg..F..K.H.,.C.

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 85865
Category:	dropped
Size (bytes):	30188
Entropy (8bit):	7.991132314432467
Encrypted:	true
SSDEEP:	768:HBdbFLszbJOMbHQ1CzjIZUnFuFL2sYeQBp/G:HFWbLbw1UI+nFuJOW
MD5:	8715F87016CFEAD2F3C6424FBE055E01
SHA1:	8DCCC7AE55EEF7473B3193BFA40681BE172448B4
SHA-256:	27BFCAC72763F815E82432278C5FADED98B5629FBFAD213F8F528C9C8419A6C9
SHA-512:	D3940BD86C4CDC4E9B630A55C083AD268FB853F4A1EE0EF1DAAF17F2ACBA7F3FB4B5697D638733B4FE3CFB38A4F865F304B98862C9D24ACB67EF41E35B596A2E
Malicious:	false
Reputation:	low
Preview:	............ys.W./.Uh".wf.2.{.{.L..6.....{n."U...TU.kA...!...IH..A...`6-H..3.._...g=yNV...=...\N..Y...9.w\|..........]=^!.....O...\.R.tgg..Y+..U.3A1...p~ls...?...:.s...s_.D........bogP.........k....<-...]~.n....k.[...V/Y...._.u.....2.w.i...a.9.........9......w..D.....#.....[...J...n.\J>Y....1;..L^,.mz2/K........c....>.......mx.g.u!..p_9....._.{}A....../..J^.._ ..x..N...I.F.._..?(.....K..W..k./.s.........:....[.b...;.AA\|..G.R.{w........^9.[...X.e.B.....+;...b.....]_W.*...e..tg}v.1.`sm.>.d'...U.A.....#.._...v%...]....oE3......Bt.ac.>.V...~.....C7.../..\}G?..A.....+.\|.=(......[.k.....=(..x........{....\|..z.\|g....v.2..l...'.F.S.+.........j......_..e..N_.g..;..{..... ...K.Y... .V..U//c....WNG..).i..?......N^......R.._.W...."\|8\|>\|4\.p.>sZ..c9X...C...-..U..w..+........i\|....<Cw.'.\|....Uy.@......A....j}.n}.t.q./...a.'.........;w.2......{._\|.^.V/....pGt.I../.h.~.../..Z.n.].'.6W..o..k..J......b...._R.............j.xis...w.is..J...

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 211932
Category:	dropped
Size (bytes):	75209
Entropy (8bit):	7.996788640454085
Encrypted:	true
SSDEEP:	1536:/WT6nU7ok/GXDYldoVdLnxctLs5/idZ46C7rbiEjQ+qfHL8g2u7:/46uR+szirxcds5oZ46ujQ/frB
MD5:	44ABD25EA9D5E3E272E09FB2CDB4B10D
SHA1:	2C27A283F9C42683B24E1D8728849E9DCF126C4A
SHA-256:	8D717C6F9420FB409B5553C689645A9614D0F5D04E5CD75A6820D9D68D22C168
SHA-512:	A8BA293A7995052DDB8B384476701989A5E7F452DEB5CACA0DE5AA83469F7A0F748A01285743B329A47D9BB33C02A075A35F27DA9382C51DD5F2FD182CCDBAEA
Malicious:	false
Reputation:	low
Preview:	...........}yW...Wqt.x.F.I..(<..!@.M8..`#...f...~U.%..{.].}.n.X]]]SOwQ7...{.....O.>..OZ...Z.I......m8.F..V.jU3.q?..p..G.c9E.j....j.#..B.+.dC...lF.l{....B..k.;...$[......h.....Z(...o.?..f..J.Q...D.Oe......Q.^.R.w..^(...G........E=p^k^...).7>i.I..8X?.X.z.a..to....OW..<<......k..??tOn....}..V...........P^...9!.B..].zw9..A...EA.2z.....q.m.o.FRj...h<..R.N&I......QK..L..^..I.....W...w.)..p..P_.^.%...j?.QC.Z.N....T..1.l!.Z...{%....'5..?f.,j....W{........F.b.....R.w..q.......~.v.$:.N:..<......9O..K1.\|.=....`.......8..7...oh.....`.d.M..wY...Q........9..,..p$.>}.p.Z...{f+.m.C.n<..............v].}....k.O}M....[@......5...).6.f^.....5.9.=.C3....xp._.....W......\...AA...gr T....rd...G.2G=.h...FQ..6n.!.W@~...\..q.b.1t%qp..f.n<l..pH.!.&.F...u.}).....!W.............>M@..d.9.-.D.K......].M.8lm...Z...~.um.[...=...eD."..m.V...l.....9...\|p.:7..v..E..E...M.Z}B...z.wr...G.......p}........x.z4....y...N_..-....0R.s..3..D.`.\...0...,.2...j$.

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 21608
Category:	downloaded
Size (bytes):	2826
Entropy (8bit):	7.9367339409385895
Encrypted:	false
SSDEEP:	48:X/mk8jpPOyyaZgReKC4zZr7pzDlXiPkHlre2JhPp2PyOQKRWac0Ks3bSXjr/tvW:PNkmTkMeH4FrhDlMygGhPoPbJ98OMjhW
MD5:	97FD48F56E390E28978AADD5312C4C9A
SHA1:	ABD15A12C6BB810E1E22293787F308E23F7C38C4
SHA-256:	E0061599F9A9F34D312228BBB1A73BF399F4F9D69A01749AF68A484137F2B75A
SHA-512:	D882F3AFDCEFC5094BF921B53C350D95F3CF2FF7B222E536A34C40FDE8BB5C77D6FAA64046FC6A558756254E04A652D5307169B0C9D4CD3FDFFBA7B321D93BE0
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/dist/styles/newSearchBoxStyle.min.css?v=202404081140
Preview:	...........\k...........d.A..2.`7.b...\.m..Z..I.Z......;.. Hn. {...e.Q$....i.Hb.c..b........8......>/6q...,^m.<..i..V.<..2.9^..}.....5./..)..c..}......@.l.<.6IyL..e..I...i.~X...u.....(N...k..w.:.eR%y.,.4...x..l...O....i........x...F.5. g.;_..cu....."..6.:..].i^,?..?..6:$...................~.%Cgx,..f.?V.c#..m6I.[.3.S?.(.>..~.4.....2.._.L.:..)...._..j".C.sW.\......dT....8......0....N......4.].".Z...7?132.Q..a.S.m?WY..FqE.i.z...EI.>.IV..3....sM'U.R.Q...:..6........i.....`u....l...8c.M....yV....EW.ir\R..u.p.GH.J.Q.6...._...Q4..\|..y.lf.2.>.s.9....}...@.#.../.85.P...)...r.[.......C..H..{.....%..B...Z..qJ.LJ...0...S.{...*.t...w?.....2.g....pM...}.<..m.Z...x$q.x.n..P.+.....\.z......@D.,.L..H..A..YF.U>#...._..G.zF.e.6..Il..\U...f&......!c..j..\..\.......f.:.OGaV_a(.H'"......y.c.~....].....t.3..c.....l.vL..-..nf.....aY>..,7...G.<.qBX..e..v`i:.u..p.?...}!Y.\Q.=D[...E^EU....M..Y.L.{.w...o.@.c. ....o...S....Dt.....s.,..W..u...\|F..m.M^~.....e.

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.881552520946649
Encrypted:	false
SSDEEP:	3:UR89KCmH971JoCmH97QMHfeSXiMn:U29ZU1JfUF/F
MD5:	A10EDAD55DD3D0B16B90A9D0B13254C6
SHA1:	8176C1E32D78C6A56797C95F095DACF8F2748F34
SHA-256:	2BC49E799AE2BE2B9D4B8AC19E94108A76900C98B00097F69E31A434B88039C2
SHA-512:	5DABC0B92B14A174B188735F89CF8E6CA955CD66CBDDBE40FFCBCF58DFF435A8E657ADD8D479E7F03C59C5E76443A8B5282E4D03A36350BD596C28436A1821EA
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605633310&callback=BMap.logCbk7886880435&sign=3e06f861dce5
Preview:	/**/BMap.logCbk7886880435 && BMap.logCbk7886880435({"result":{"error":0}})

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 70024
Category:	downloaded
Size (bytes):	6348
Entropy (8bit):	7.964728125517938
Encrypted:	false
SSDEEP:	96:4ZFDgopjc/6EwS7KLP9/WZDP6jOrMDp55MEHHJFXFOynxudBAVQKnQ5PA5WkH7j8:6FeSBysNWZDyS4Dp5hJFXDncBAH6ALf8
MD5:	C60760569E74EE7F05551E73C32EF124
SHA1:	23F8FEA5E3A33957A6B24772C5270417444A7BF8
SHA-256:	3B4A102228BC6942E4828CDEC11C235C1879E38A51A60A1916DD203148727FD6
SHA-512:	53BF3C211C03BE716822A89D4451891D8EE242F24D12B14F5E6721C9228ADE6F019EDCE47CEDCC688FDDC7AE00503B3E8B9F87259A747FC82C86859A2739D61F
Malicious:	false
Reputation:	low
URL:	http://jzfe.faisys.com/dist/jz/biz-shared/bizShared.min.css?v=202411131400
Preview:	...........=ko...Wxq1@.\=m.......hw....lQ.d[vt#K.,O&c../IQ.)..'.&.."yx^<..u.....e....w...?....)H.'.e.x;.0Z..h....G..../...N./...?.Oy./.v^..... .....~....`./.....-....S..........S..VA.27.9.i.E.M....S...14.6.c.]3n.......\1`\~.<;I.4eX..g.})4.b./B.e.(.....\|....R..o1..l.........".4.L.\|.E..v`...,(h.....N&c.A+.6.....\7.......r.t..j.2..1..R\|z..[....k..?...%..q...T..6.?uI........A..L.2(.$.%.Y..(..u./..M.e..z;=N.m....O..i.......w./.........>L..T..Kg.X..+..)=..6......a+............wH...d[..........+/..m..........y=slj....,.#E.i\|...&6y.4t);6l...F..q.I..j...`Y...)..7u~.g...TlP...........G..4......pv...wn.=zX.#b.d..B.<.X.......gr..2zb..ml.k..[.I..4&.jS.V..../.O..(.K.X6.e.W.....n....i..,+......K...`i'CC.d...a.U!.. >N.d._...+...A.'..z.Q..E....\..I.Y..F.X.....M.....a.P........Q.....7w........w.. Z.k....M.6.....r......f..q]YD"".m..T.\|w...hE.........mIa.X.\|...4..L..../...}..7...._...7...k.....z.YC..h..em..f^.f.m.o~..p..4.&.K%^.....\.~...5F.......B

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1371), with no line terminators
Category:	downloaded
Size (bytes):	1371
Entropy (8bit):	5.278850970844565
Encrypted:	false
SSDEEP:	24:WL54RWMuHKFmOthmk9++35E5TJIlGhjXgfIS7sa4/M63psI8S:Wuw8hm6++3SlIGhrfeS
MD5:	D6A04468273C3112B69F78DD190E676C
SHA1:	BCC7C101F494E4E0AEAB930060E74194351EAF9D
SHA-256:	2518849AEF837E52BF7B2BC742C4CCBC27A65FDC43B651430AEBDA993E20E681
SHA-512:	F949BAA597E8D6182C645F00F9F2901793ECEE158A6A7DEDDEB8672FF61602D25A2D23183D51F758232C79B163B9FAEFA91017BDE4094FA970FE5A99D2A167FB
Malicious:	false
Reputation:	low
URL:	https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1732605606177
Preview:	window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,e(a,o),a.onload\|\|t(a,o),r.appendChild(a)}function t(n,t){n.onload=function(){this.onerror=this.onload=null,t(null,n)},n.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),n)}}function i(n,t){var i="onreadystatechange",o="readyState";n[i]=function(){("complete"==this[o]\|\|"loaded"==this[o])&&(this[i]=null,t(null,n))}}function o(){for(;v.length;){var n=v.shift();n&&n(m)}}function r(t){if(s)return void t(m);if(f)return void v.push(t);var i=function(n){return d[h]===w\|\|n};f=!0,n(l,function(t){return i(t)?void n(l,function(n){s=!0,i(n)&&(m=n\|\|new Error("Load error")),o()}):(s=!0,o())})}function a(n,t){return function(){var i=this,o=arguments;r(function(r){return r?void(t&&t(o,r)):void d[h][n].apply(i,o)}

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 10686
Category:	dropped
Size (bytes):	3998
Entropy (8bit):	7.946744002576607
Encrypted:	false
SSDEEP:	96:wa3dMPm/Gtk8ippoZRDDtfI9m+WOmfRSj2Ise5Qif2r:wa3dMPyGW7yZR/tfI9m+om225Qif2r
MD5:	D76032F15DA91647C99DD59F9268D083
SHA1:	221E7431A7ED7B86265407866E92D819EFEF8D19
SHA-256:	6B45BBDF8A57331DEEE2B2E3EFCB038F3CD98E903B551E3CBC46AE95B15BC055
SHA-512:	D9B287F9BEAE64132D5E39DA5F5FDCAB2B702BEF4947355072AF8FF22D8D25E93C31EA846328FD2F851893659DBE737C0ABCB416CA76D53D7C810AA5F7890EBB
Malicious:	false
Reputation:	low
Preview:	...........Zmo+.u.+. &v.....B..CKT.\IW..:.,,V.Zi....^].$`.-..v..q...~.j......../..\|........,I...@`_.s...yy..3,../<...2sJ.....b..v....^Lx(.Je.g....Z..J.lf....3....X..>-w<h...q....9=.u.B..A..}B..O+.".3.N....tNu...h..G...#r...!.....).i.D..%....K...<.>j.F.....P.................ay....a+_".0....N......A$..s.....wk.r.qX+...-Hq.y.e..2.f.v..0.g.H\6..2W`.3~..,..cP..g....5..dCo...r....3..+.#.nBO$}&}&.a)...\|.Bq..x.x.nM...\P....0..soh.(+..."..M..8KL#.q.=.=g.M...{.R.L.......8.lF@87..1...f.D...!.)....+w...I..=m..8.D)...&.]..".\......#..Z]..q../Xh..@...l.!9....-.`k..Q....V..p....?3..Fy.eC.<.....5...A.E.m...}7.J...m4.nF.[..r.$B.....)......8...&T.$..L..\.s...,.<....KI.../...._../ ........2j......Q%....s{*..yc...t)n..7.....^j.\|.Z.d...9.).....F...^.]k....F64...>.$.1..r_..].u..VH\.%../qm......4...l....[.0.+......}k.\|.kY..$nZ.x!(@.K....a ..<..%.Ns.4..l.f.2dC.....t@.8.AO......I..K.d...8......4_U....q.G\.\;.\^$7Q.Q.0.R..S.w..a>..\|.D;..]..`P.S.^..w..0..N6~

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 114
Category:	dropped
Size (bytes):	117
Entropy (8bit):	6.258710678477952
Encrypted:	false
SSDEEP:	3:FttKyVVZw4GdjmsLO0FPUzyvAgd1AgZ0zTqll:XtKui4gFPUmnXKzTel
MD5:	DE0361FEF0BA34F966B12A3E918BE937
SHA1:	0FC49C7D6B5168B7813CADCFCF64A80531B71E32
SHA-256:	066E3616B6254EB0486A00DFB7F5C8B17EFB9F0B7982B851B55315DC0D351EFB
SHA-512:	A4C85A9FA11CF7E11AA928408AC15E8EB3F356F1669CA06F7D67BAB13D00D50BFBF6E58026FB98616E1D32FE38DA6E6C07725194D4031A31018B3FA416203C47
Malicious:	false
Reputation:	low
Preview:	..........5.1..0....9$..r.Xz.....Q.*B..S.1..Fm.!.wfq...K..w...f.U..+..E2h....g..Q.....{.}....D.-IN...^......6r...

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	5.003466585368135
Encrypted:	false
SSDEEP:	3:UR8OXBL1VJ4BL1wHE0ad2+WH8J0Tf4:U2ML1VJML1yQuH8J0Tf4
MD5:	7D81B10DA633DDF235AD8BF91877774A
SHA1:	396A0C5CCD0E630F1CE4142BBECAC3925977FA9E
SHA-256:	53D2AB30F0C18EBF6BF39517F1693F7EA85803BBC8DEE22033EBBE0978D09DA2
SHA-512:	BACB0C4190112F34A039B399076E4ED741567BCDF03F5AF6FF181CF306572BED8DDB16449C119927114BBCD9610E0087D9D266061E442D0EAC195A82460A51BD
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk9486 && BMap._rd._cbk9486({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 1084
Category:	downloaded
Size (bytes):	408
Entropy (8bit):	7.4583789498236985
Encrypted:	false
SSDEEP:	12:Xj3HDpKM46j/Atc3IWdlEpmaFU+0VOEe0:XjHzdTWc3DdCpPS35
MD5:	7486714D21E3EDEA22781526A8ABDF3F
SHA1:	E11A25742DA85011C323D58006BA180C27354094
SHA-256:	920715299CC97A9B23F25533830B96EFF5E28CE43CB9D9255405D39C02C084AC
SHA-512:	EA031B15038892134BF1FA3B2D2DE479B0F89514B1354746D81D44761C9288A7CC96E50C385E260BC988D0C65177E28085A3E16A260684905245BBBBB7552131
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/dist/libs/comMethods.min.js?v=202402281530
Preview:	...........=o.0.....A a.j.........Zx...g...cIv!....@.O.2..{<.=.t.....8......".2.s...l.....?e........$RvA.{..5,..,..Pk]..%e..\..%.7wi...(F+.G..Q8...]...8qCj.....s.+...Z.......`...x;...q#~..]G."......................O0.eas....c...I~..G......h...t......Q.J..G.$i..P..3....:-...(......x)S.O.q..+.[J.4.Uk.)..KJr2;.b...r.....EY......jU...o.Y..I..5!....4......I...y......n..5.....\|.F...<...

Chrome Cache Entry: 351

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	121
Entropy (8bit):	4.939069284095431
Encrypted:	false
SSDEEP:	3:UR8OXBL15J4BL1MHtad2jRbrUWAqOLc5MWvQPmh:U2ML1LML1MwGRbrPgLc5XIPU
MD5:	347C54ED7A3ED927909E1FCE3711F7DD
SHA1:	6D00983E0A04396F5A0E8485239F3B9534BFC706
SHA-256:	9EDAC5A4D4E24B01C98DA6AF337FCE91B9D6195906623B4A6EEF60AAE273A858
SHA-512:	395833704B5BAE07059B56E2E928E3903A4D645871D5FFD940DE23E3ED4C30A2D33E67BEF7BD158C1177AE7608E72D50377706BCDEEA9D2D2E61AA778947541D
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk27910&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605644934&sign=97db8b984019
Preview:	/**/BMap._rd._cbk27910 && BMap._rd._cbk27910({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 352

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 43013
Category:	downloaded
Size (bytes):	13423
Entropy (8bit):	7.979728966984555
Encrypted:	false
SSDEEP:	192:0bE8satcDPC43wlsrzPNMdwhotpSz35ZyJYpquqI/sjZsIOsxK1++MTDNigD2:XXaqxg+9NhapaKJ+I5w1++mDNit
MD5:	C6B10AD63945B2174CF4B73086120467
SHA1:	B4826632BEF49182462A4AFBB17F107F570869E7
SHA-256:	60D5A57E71B7127AA551DDFB077C47258A42A9DFA7D8A1358102A0962733DB52
SHA-512:	4CDC96E264B1F1113521579FAC846E1D77BC5DBB5EFD3C385378932622C81DB1E8AE2035FD61F99F74B7C1AADC8216C973E584BBF7BCBAEAC86AC9DA49348A8F
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/comm/video.js/video-js.min.css?v=202307101206
Preview:	...........}i...._....\.....=.Z. @..13..v..Z....>.b. ..v..=.S.V.r9y...3S...5..Y....V...6_6.rxY.Q.{.........T...yR....h......6.8.~l..l8...}'....V...F.?.[..ox....-.6.(......G....M..1...i../...?N.\.9\|."(...0P........_._.....G.._l...?A......X......)..M.l.[U.E.A^..0.....z..qd.4./.P.._.r......O.........^.!..y@.Z..M....`ur..9d......R`.$UYT...z......J.n_.....k...0.B..B...b.:.>..T.e...7US...K..C...#0d...-./..p..`...n.m..d....... kK......"x..j.h.n)d...Q.....:q.b=..U[.+.zQ..D.......`.m.%F..e.E..a....`....@[..0..I...6E.(..;..%.+.q}S.H....\....d.Z..)s...[q.-`.....P.Q#F..B....Yq..O&.PK......u.....Kw....;I..T#.p.b.:.>.I>.a.....c.d{...)&....e.7..:.;.m4.o...v...e..F.N..I.u..`..6...d.\.`s..:.al.R..O.Z...Z.@....c..................fV...8...L].xb...f.........,:\|M5....NweA.X..Y.l.......w.[r0U..:.z.0.6.......j;Cn....1..e../.)}e...]..he.....3`.$...l..w...T...^..J.y...f.Xs.%.>..0S....\.IG......s..1j8a5.f...~...L......f.k.-....m.Uo..Qk...i]....Lt[.. ..

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	689
Entropy (8bit):	5.321416435755329
Encrypted:	false
SSDEEP:	12:2ruHna7Wgh0RPTUoDl619efhVnNwQ0uX9YSbSaGG/aGOBG9uLh20DRWZJU:2ruHalS/ZRDnNwXM3zC75Lh7RWZJU
MD5:	B282DAD03F6411D5F3F4DC5397E472FC
SHA1:	3504FDA553033B09090FEACB721162A8CE9B8B60
SHA-256:	4AB534EF14F55CE3ECF5728F8BB5EE752DCD8A00DD038974E838198B533A5979
SHA-512:	EE0EEE4ADC46C308F8B816C77CBFF2D786F1CC530669CB2D388803D0F5C340699F9B15DB1EDF6DCA299916EE5A92421F07AECCB4511D9DB5CBD2D0C935D75004
Malicious:	false
Reputation:	low
Preview:	(function() { .var fs = document.createElement("script"); .fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; .fs.id = "faiHawkEye"; .window.FAI_HAWK_EYE = {}; .window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; .window.FAI_HAWK_EYE.jssdk_report_url = "//datareport.webportal.top/js/report"; .window.FAI_HAWK_EYE.jssdk_appid = 3008; .window.FAI_HAWK_EYE.fai_is_oem = 1; .window.FAI_HAWK_EYE.fai_aid = 28088389; .window.FAI_HAWK_EYE.fai_bs_aid = 28088389; .window.FAI_HAWK_EYE.fai_bs_id = 0; .window.FAI_HAWK_EYE.fai_bs_wid = 1; .window.FAI_HAWK_EYE.fai_web_name = "site"; .var s = document.getElementsByTagName("script")[0]; .s.parentNode.insertBefore(fs, s);.})()

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.952432419566062
Encrypted:	false
SSDEEP:	3:UR89KCmH9sdhXC8oCmH9sdhfYX8HfeSXiMn:U29ZRhS8fRhgX8/F
MD5:	D866A5CE190DC2589F28C6E907EA1074
SHA1:	E76C19F09411A8F2552FEB76DCAF49E86081AB42
SHA-256:	FB2880AD6B6BC8767ED3998266DFA5DD13FD50E99D2D11116D7ED0A060D70DE9
SHA-512:	4B6502BFA94987210CEF658628DDBE3C08EFD3F7E099CFD601C4ED3D90803250589AE067BF551BDDC91931CAE104A39012C41D97508D5EA3C660F59F98ED843C
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk7658843111 && BMap.logCbk7658843111({"result":{"error":0}})

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5 x 16, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	931
Entropy (8bit):	5.802575384591144
Encrypted:	false
SSDEEP:	24:g1hJIwWwjx82lY2T37VUv668yJ3V2vPAFGB89:+kNNn2vyvNvJ3ovYFC89
MD5:	AC10A8D83124EF9163C3B742946194E3
SHA1:	93E5B474266496977E700A6FA3383AE9A59B33C0
SHA-256:	013C9FA0D17DCB0068E095B70842B19482BF5F9B4FE6D9F48147134016295E88
SHA-512:	F4E335AF94CA3EFD931A4241946ECA7F0035278F25B3E46E0E845A0B29762EC915D73D988D17FBB5A48D70C38582D03160C6051BE5652E113C042580B1CC5B38
Malicious:	false
Reputation:	low
URL:	http://1.s60i.faiusr.com/4/418/AKIDCAQQi_WOvgUY4fSTngQ.png
Preview:	.PNG........IHDR.............Q.".....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:E503FA083E7611E69EC0AEAB23E3D8E1" xmpMM:DocumentID="xmp.did:E503FA093E7611E69EC0AEAB23E3D8E1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E503FA063E7611E69EC0AEAB23E3D8E1" stRef:documentID="xmp.did:E503FA073E7611E69EC0AEAB23E3D8E1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.+......IDATx.b<....F.. ...<..H......IEND.B`.

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 111
Category:	dropped
Size (bytes):	115
Entropy (8bit):	6.084760107854261
Encrypted:	false
SSDEEP:	3:FttKEjZZwm1UfF/rHtBhZKhMFLlSfWvW8LheoVtURmeRu7oWl/:XtK6Am1kNBvnufWvPhARtRusy
MD5:	D4D7C22858E0F14D6BB79EEBADB429DE
SHA1:	D1548D138855CB52C846B210096A01A1CFEA5A06
SHA-256:	E6C18E56FE155443A69A03D4400B3477D745F3AC6D8687722708EF22F5D126D1
SHA-512:	BC88D5999045FCFCD03B932E6082484EEF27A39FCD4B73F438B7EA5491FB038DEE6777C14938DC5F55984E69EE66B49A52AA8EAA0D600E4B76AF89D61C671B61
Malicious:	false
Reputation:	low
Preview:	..........5.A..0....umY.......q.p`.NIC.w..~.D....wfq..K..O...f.Yn.3.}..4.....N.fJ....$...m....q......o...

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1371), with no line terminators
Category:	downloaded
Size (bytes):	1371
Entropy (8bit):	5.248075242473128
Encrypted:	false
SSDEEP:	24:Wp54RWMuHKFmOthmk9++35E5TJIlGhjXgfIS7sa4/M63psI8S:Wgw8hm6++3SlIGhrfeS
MD5:	FBAA2DAAF0B95D2C8CA98B232BBC2766
SHA1:	D325FB8FCA8359198F919CAE023ACE74AF711D9B
SHA-256:	6E3BA4C4852A2623592DFE70E643887961FDC6E0FB7EEAA7A660DA1523D27C93
SHA-512:	44173D9C403220C092A50E3EC07FF5457ECD315A5A949F6FFF8913FF667AB528DC5462EBDC2CFFE0BB6578C88521923028B5413B6ABD456F0C5B4AB81B32A34E
Malicious:	false
Reputation:	low
URL:	https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1732605654028
Preview:	window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,e(a,o),a.onload\|\|t(a,o),r.appendChild(a)}function t(n,t){n.onload=function(){this.onerror=this.onload=null,t(null,n)},n.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),n)}}function i(n,t){var i="onreadystatechange",o="readyState";n[i]=function(){("complete"==this[o]\|\|"loaded"==this[o])&&(this[i]=null,t(null,n))}}function o(){for(;v.length;){var n=v.shift();n&&n(m)}}function r(t){if(s)return void t(m);if(f)return void v.push(t);var i=function(n){return d[h]===w\|\|n};f=!0,n(l,function(t){return i(t)?void n(l,function(n){s=!0,i(n)&&(m=n\|\|new Error("Load error")),o()}):(s=!0,o())})}function a(n,t){return function(){var i=this,o=arguments;r(function(r){return r?void(t&&t(o,r)):void d[h][n].apply(i,o)}

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.261229666895294
Encrypted:	false
SSDEEP:	3:CUXPQlG9h/:1Ql2/
MD5:	969FD31015EC5344C2CEF54101E23A56
SHA1:	6A38854F2E704BCAF53712A65C79EF68CF11E06A
SHA-256:	52B2C9CE5BB6933E1397DE740690260FE656C88970409B04BEAE1E098886C81B
SHA-512:	DD2F89935F7B17FAB8D7A0D72C1D646DF889D748E95D7C47219F54DA0A510555582734CE08FCD49F997CBE34DF0B518C5B5304703EC897F44BEE943533BD0E2B
Malicious:	false
Reputation:	low
URL:	http://static.tieba.baidu.com/tb/pms/img/st.gif?ts=4&t=pageview&sid=m3y4npye3nz&ver=5&pid=241&px=1280*1024&ref=http%3A%2F%2Fwww.wheel-done.com%2F&page=18_1&p=18&dv=6&cmd=open
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 288896
Category:	downloaded
Size (bytes):	60474
Entropy (8bit):	7.9955892447018355
Encrypted:	true
SSDEEP:	768:K0dpiAsMoASAmniAm2lOIy3djP5+bAxHMxdP6SF+QPr92jjbEeK7Mc2:KczoHAmiWONRkmHkPKY92j7KV2
MD5:	03822497706A3BCC2011F1BE276B7CD9
SHA1:	C2DBAB4FDFB09FEE003B32C4D5A4F1B80520F2DD
SHA-256:	11656776C03C68252DA01BED16D7DD90B16111C962880588BFE2F2294156FEC6
SHA-512:	1626758FCC5D0BF47E2572FB29736F3E6ABF6E3C5A0AD6937966304C5910F9B02288C4FDB654A3D936775577562AD4596ACA0BE351CCEAFAD0300B719AD8C014
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/dist/module.min.js?v=202410281356
Preview:	...........ks.Xv .W.h..4..LJ.!..U..b.^.YU...d...$$$.. .(27v.....=..{f6v=..<"&..l.zwz.3....'..=.......$.RW...CL..=....v8.Gy..v.2..J.^.Qn.~~>e.a..M.4...k9.d<....r>.S..Y.2...\|..a..9..7....q.2..C.:.0..,.5..T.....ZVa..Q...._U..,9.b.cv..l}.............?..p8..=....xMp........v..Q......zB./).#.B.5..M.8........._>.......}....g....>....G.ao....]P`...%.z.s..\|..-.%..,c.,OCX..I....Sv0.F..\|2.L..[=OGw7t....f...OkM.....5..Z&&.>M.!.3..v......1.O,.".<.mEA.y.d8..<...p.......{K..a.1,.....WqK.gm`.>...7.......l.R.....vU.d2I....a\|.I.,~1~...z..,..$.s..D,>..K.....r...E.L3.".c.~...'.\j...c...c}0>...+.vg.F.a8.p=p.a.....'!l.U.a.......t...)..N..IV..5;.bwa_.P....J7........../e..`..CX~....1..<..IJ.H.-[.5.\.0.C...>...%?@.<.....#.2..... ?..0.#..u.rZ......C.Mb.b.....gj6..1.e....hKr.....)U."...HU..%.VZ.b...'rb\.bM..48.]`FTY5..O....+..p.qrj..0@v......uG.j....m1.$......n:s.q..&.....$h...Y.. ......B.G..Q...$vy.... }.r..j..f..CV.y..$CZ.;a...'HV3..[.4e...ext.."e. ^..h.R.j=..

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 52
Category:	dropped
Size (bytes):	72
Entropy (8bit):	5.043906976252533
Encrypted:	false
SSDEEP:	3:Fttuc/IHxnLAUXnTV8c0S6Fd3p/l:XtB8xUOnZp6zT
MD5:	860E06B1C62729C812D6F6B7EF744892
SHA1:	A7A35CAE7650D7C03C2274E4155E818A77116EFA
SHA-256:	9272CD767AD0096B4AEA993463A8A40BD7259B5357C11032309EBF450050F4C5
SHA-512:	CA95745DC7BE2F922FF0D1B2597E5B7A52FCD7776CBD56D89ED5EA23FEDF5C2429FAECA6BD3FEA6C9E48E3863AC6BF73089BB6D383E8CA81C613EF6C13513CBC
Malicious:	false
Reputation:	low
Preview:	...........V.MNN-.V.)*M.QJI,IT..VJ...LQ.Rr6pIt,q2Jw.J.w5.P.......j4...

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	19511
Entropy (8bit):	7.928187963464144
Encrypted:	false
SSDEEP:	384:UKMhqYZsvOai/njql/tIz2NwG+d95s9q81tUOMeZud:IqYzPj2/DNwZKwmUxeZE
MD5:	73BFBF541A4F10A77DD72D9E2411B94B
SHA1:	50FE5867031F8CBD0F3A66E6628248E50D62ED8B
SHA-256:	D721C8C499C29F0E3EBF6316804DA89080F6F6243809724F8F25CF4585F41974
SHA-512:	7A08566682310D51DA4C760EBC45D20FFB8BC18991E63551D0C4327084B21DA61FA3177AE91ED50B27661BD08DA37B1B5A7A49DB085ACC336D7CC24F3E5926F2
Malicious:	false
Reputation:	low
URL:	http://maponline1.bdimg.com/tile/?qt=vtile&x=24812&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE..............O.......m..2.w.............................................................n..h...............>.....................u..{....k........x...........f}.`.?.\|F.~y..-....bKGD...-.....pHYs...........~...J.IDATx.}...8.7.1..A....2....f.=9..H.....C.....o&....W..9.#nn.{'.Z...../..N......~.;..K.+....V.........~.....[...>..V.RJz...<>.........9I........1=..Y.....O.......?.......o.....^w."......wN..H...)......%H;..............G$c........S......eP...~..(W..!n....3...~ ^......X/..0+........qD?+>^......F......W./...2.!...xV...Q.o..c.<X@../....7........<.@iA 2.=..8...>?...V...oK/..i...[R..\|.......5.A.\|.........\|!q.x.'Jn.$l8J.......-.P$A..9...e..-.cC}...[z..9l{..5.\|L... .........=.x....U........z..88......q.......!.c....,.I.\|.a...'1.~.M6.~.#.."I..w.....@......O..g.#..o..W..w.b Q.x.:/....#7..S#....ZA..........v....I.P._

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 110322
Category:	downloaded
Size (bytes):	39237
Entropy (8bit):	7.994853307487242
Encrypted:	true
SSDEEP:	768:FAECfurr+KdjXnS3m2dvqfYA8u4MhwEzsCXLwc2b481YH8e:FAECGrK2XS1ZqgA8uzw+b7wc20ke
MD5:	0B24466B284A988971F6FBCD2034BF6A
SHA1:	1FE980201BFDE4B8D441621788C1334A4CC3F638
SHA-256:	FC8403E26A8315A8A3FF1412CB38EF70A12A69BB5F590E4AB76C1CD8171458B8
SHA-512:	8FECF981FD4EE6D76B7E9267C151A11B4ABEA466F9291D382951E78062CB23A3D0137C81E34FA3A509404F0EC0132B302338B70A70471AEF79D8411D959A8E52
Malicious:	false
Reputation:	low
URL:	http://jzfe.faisys.com/dist/jz/utils/jzUtils.min.js?v=202411131400
Preview:	.............z.F.(........!..V.`..J..m..d..$[..&IH @c...x?..g.a...._...M..".......T.}.."..522......h..F..z......xa.&:..pt..D..d.`....a...[_..8.......b.f..".M....._..m......\...5.>..x>.?)..U%.x]ceG...?...XW.QjO.K.(h....N.`..'....hO.De.`....,..."..I.g..o.u..\|Z.{.P..\..UO..=.x.4x.V...E#cn%zd....c.<S:t/2B..,."......p..dE.X..Y.\|fB.S...Z[C}.U.@...W.Q...._#......7.tw.......]?e.rI...5.....-.E6Yl...XUD..i..B.....4.d..Jz....n.U.........Ni`...s.....kX...P....)N.'.&..(..u.:..\. '.$.T.....`..>O..r.M.l.6F^0.~.I4..F.........B..;?\.5.s\.1]q....a......J.(LB..1s.@...,.u,,E.#.plu.]X....G..1k .`&{INj.M..h\|g'...:.;+@.X.^...~.v`A..fL....4=..vW.].=.....O4...S..W...5.'........#q"X.....~8r\|}..q...F........,s....L...c.S...._.c F...Ce.0H....g.5KluaytB.vw..G....8....:..C1..Q..DO...ec...XVN...I....k.4..)...X.a.a83g.e@;\|z..B.......!.I.}qb..J xVf^b).....,...x].f%R.H...........iM..Xs........fw........f.A.k.>.C.}'3(...H.......i/..SDjYq.C.........zD[8........5P..L

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 16934
Category:	downloaded
Size (bytes):	7070
Entropy (8bit):	7.963298998073958
Encrypted:	false
SSDEEP:	192:CW2WHqgk+rayGI7JuuzkErb/Tt1rGlEA3v5mZvPFFH8V1QuhLt:CW2Wy5yGkJbzUEZvr8V1Qudt
MD5:	472C66EC1A160CADBD3B476DD85837BE
SHA1:	641E9E5B1C65A3F41D33CEBA6DD76BF3FFA7D66F
SHA-256:	BB67BAB64A93E0F6746D6998B480CE3A276263DB51026011F963DDAE1AF75086
SHA-512:	A6DA6713B2A75E98DE4890444D073B25E9A7B77458F62CA8EA33DDE9D4A05357F73E3F98F637EFB784C0E0CCECE4CA7A40F2BF18353C9D2E5E7393822DA0FDEB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/getmodules?v=2.0&t=20140707&mod=newvectordrawlib_phku2t&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643775&sign=1aae87229181
Preview:	...........;kw.....p.9........+..I;...f......8.....%...tf.=.9.znmm......a....4.eI.-.7.+....m.....o.$.(M......2...oi......;.I&..<.u6../....n.0./..8.q0.3.9.(...Y..O.e.rB.tx@....9.."-fcN.....i.....I.0..g5..e.F....Rls\s...7p..@.j..r..K..p..Z..y....-..>..<~.My...j..`.[t....?.<..g..,.......K...E6.....cYP8.b..)...".kz.n.b+f.l<..8..b_..F..;...n.+.o~.......\...~.O...SM.....w..d..bG.f..gTt..f.....$,.{.y=..`+......\|..'.(...yq.]i.Q?g$B...q..W.!...,..tR.+..M.t..$5....b.%./.,+g"$....za.Z.Q..9..A..s=5.FW.E..S...yfz.\|...=..M....;.a....f.5...^AI.E.......{z.D.a,.NcZ.z]..}2..pE1cR....{.X......\.^.`.......t.....4.L..N.)`w0z...,../.I...MV.~eH=....(...L~2.....%K..W~..Q:.9.o.vr......Ch[..b?.....E:.:(_.wv..P.,...,O...xB.W........ ..nK......J.....PD.....Ze;.-..D.VO"G..O.....=HG.4.... ..@...8..r... QAk..]..F..........=.i..`.\|.?..G...e....N.\...m./mm..8GJ....U.5..T...w.f...x.....P..8?.......(...}`.%}.........<..oT.Z8..yK.h.q%.C.....Cco[.

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	15730
Entropy (8bit):	7.893355080220368
Encrypted:	false
SSDEEP:	384:z1ssjR07gT8whGMyUgw7PyhV2g/DIB4g6b/mGl05qzCcPNTm:ps80gyUgCyhV2KIB4Zb/mToW
MD5:	B35A99605CF4BC2E60C9E17A2BA8EA43
SHA1:	5B520EF63AA35B98A641C5DFBEDF835FF4EB52B4
SHA-256:	6A2732F5DBF27DBDA4CA146131C20731499E5364A2198AEA3A96C6E7AACEA79F
SHA-512:	E65BE325876AD0B22E9A125FF413BFAB8B6B75BF25D20EFC9B2808723825AE96017DC9FC3936AB009925D1894837B1D9E2906998A2ABB6D0FE1BCF3BA7398260
Malicious:	false
Reputation:	low
URL:	http://maponline2.bdimg.com/tile/?qt=vtile&x=49626&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE....................................^..U...p.d............v..........................i.....U.........l..F\|....-G.mdab.....p.J.1.............k...y..e~............u....bKGD..o......pHYs...........~...<.IDATx.].c.F...@.l...P....$[R.4......9v...'..M....ww.Jd;#"Wx><.[Md...W.........M........:_.....E..}1_-.?....b..czw....(.%.T......7.....[....(^..b.Z..J..\|#Yy+Ox.E4..M.0?f.F.........x#...v.N.g.......b..E..F...V.b!...XO....\...T..X..s....Y..\|.F..s..U....x.....j.8%.. l....X.r..@ ..V?W;f.j../W.........0.R.`..i.......I....8...9..r;...4Z.G.x....S.....i#[......V....I(..s5c&.6I."`tA7...OV.GD.D.E...WI$....}..V.$Z...K..gq.hM..#.dk...'.9\|...z.2[............0(.........X........$.p...{I...........JG....5!.......(.R..."..[.&....X...P...x..EZ .H1...g...UQ.....o.....z....\|........F.....O..L$B.\"<2.H...Jb..m./...n. @.r...... ..n......S./.

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.924055859159171
Encrypted:	false
SSDEEP:	3:UR89KCmH8VnS4GFroCmH8VnS4tgHfeSXiMn:U29ZXVS4WfXVS4q/F
MD5:	4F99ECA89E6AE8DC52520C750506A394
SHA1:	1B7ACEA5EDF7289A3808C285079AC15571048FD8
SHA-256:	FBB351122542477874DC5BA6927D7A5DA6A4642C4564ACF3333BACEBCFC26574
SHA-512:	096BF88C2F5899A7491BF68FACEE9ADF770275EDE45A46C323C9C921F75EB68590969A7E93284825C0F75D1ABFAFB7A2741D83723AF830538AD869C84A791FF2
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605608165&callback=BMap.logCbk6093782709&sign=563b1c95e849
Preview:	/**/BMap.logCbk6093782709 && BMap.logCbk6093782709({"result":{"error":0}})

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 59
Category:	downloaded
Size (bytes):	77
Entropy (8bit):	5.234527534781083
Encrypted:	false
SSDEEP:	3:FttpQwOw8+nSkAKXwJ11Etn:XtpQT+SMXwJ11Et
MD5:	8C115805E29157758153C8C31DABDA74
SHA1:	241644E4751746AE446A6165A05737B8593EE82C
SHA-256:	2F6BBEDC11B6D5E95DE48CDE428F77259331B8D6EA1809B9BCFC5CAAD541FBB1
SHA-512:	9DCEF8CF79B3DF5028575EFBE7C4FA35B85BAC6E4E9885293876105606EDF2B9D313319253C7B1F5D8FF242ED22BBB4270E2DC2CD180328A75052FD67CCED2EB
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/ajax/setCookie_h.jsp?cmd=setWafCk_setCheckSiteLvBrowser
Preview:	............M-IT.()).M-,.,.UrNL.H.u..+)..QRH.2R.Jl...uK.....r.....-.b;...

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 108737
Category:	downloaded
Size (bytes):	38649
Entropy (8bit):	7.993122917913921
Encrypted:	true
SSDEEP:	768:9Ml8lwVqRBM+zfA3MtDlz3xOtMEtIkO3mx89baGMFSdE9bYEp:9MR+zfm8Dlst1da9uhS29cm
MD5:	569BF1429C15ABC86E328B608E2E2833
SHA1:	13117DFA6DC2353AB6DB1AC2FAB4BBE6AFE2C68C
SHA-256:	2EFD8CEF1C151193D1B29171905E10BFB000A1132080BF3303206271265771ED
SHA-512:	C460B39ADF33856A737EFAA529B1AAD215F690D4E1FE803B1F23D1211689A50B9F7123AA5AB7B3694385B70CA94F18010D823B99AB470489E0378F5072CCC160
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/comm/vue/vue-2.7.14.min.js?v=202310161432
Preview:	............ys.F./.........h)y.......;..[q.G.QA.P.M...J.E..~..=.@..S..................o;.Wz....z.... %..;_.........yr..;..+\|y..:..tgULu..\..w^..].zHY.....o....I..E.(......z....Y.r..?-......d..z:....t5.c.......d`..5I.=..f..X.#.'Q..5p1/...e^..c.....!M.Z.D.%.......N.T9.et.....<......n7.....n.y.#[~.&#..t...y5...6.c....~,....U.....Yq..F4(V.s]....y9o...%-k0.A.Y.......A...qw....nb.nY.M.O.\|.C.s...>.zv..).N..l>.<..x.E.:]fU......^...L..w.........eY..P..Iy.4/.F.j..#.R.zfbH.....$k&....60.....:.e.^qk....z.........)T....7N..wB.7.y.{E..7....d..hbP...5.tFs..bU..^..&..A...pT>..s]\4..r.?.N....4.=t.>............#.-Q\|.I...n.x..hP..FM..,t....a....Q.J..g...zR....A.a.B.(.kl..YT..Wc....G..i...i2M....0.9a.O..P.....)$34.Q..b...6._f....ME....g.I.M]7..).._.5...f.p...t...6.nzw/....q..P..y...C3..r.....1..c7..\..M.........N...a.....4.<.G\.Qz......<E.?.e.......A.0..W.].......s.;....:...;..B.J..b. .-pY.2..;.7.l...DZ.\|q...kU..xc..xf..B.6.X^KO..Z..G~.....vl..w..

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	807
Entropy (8bit):	2.722518518658819
Encrypted:	false
SSDEEP:	12:zSbBaxFaXl8e8JR4YNSR8buiuSLAbX87XwMreYaQ04raDFTsWqoDe5lV5+ejZl9x:GGF+ed4RU0T6XneYalTte5l7+ejb9Br
MD5:	AD1C41692C6E63785FF31E7D11F1970C
SHA1:	802B64D5CB7E5F13D53AECC8B7D76F867EB2D79A
SHA-256:	1DAFF9A9C6D7F19DE562A7BFA8B9082C1713C808BC003A206D9C762D13971C66
SHA-512:	FE94ADB6303B0ED52037D5304F9EFF530BFB4E20BF4BE6F612DCBCE7F2A653D5EB066AB9847E08410A242C7AE192C82E5391C1CD8CC835B85B21DFB5747AAB23
Malicious:	false
Reputation:	low
URL:	http://0.ss.508sys.com/image/loading/dot.gif
Preview:	GIF89a..................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...........................................................................................................................!.......,................;

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 44 x 464, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11596
Entropy (8bit):	7.940606915977558
Encrypted:	false
SSDEEP:	192:jvHlDr0nMqIIw40NYpX/7S2Rdv7rhaAg7MQN+/0OfXDPFi9m3OqmmrNulHO:jvlDoMWw4cUX2qv78AVO+80XDP49m3Ow
MD5:	8AE7EB80646C22B37FEC286DB712E2DB
SHA1:	02EE39F4C1B7E7A8389884FFB41F938A6E3921E8
SHA-256:	9EF6E8B15538DE37F6F9A935486C557018EF1B44DABBC34480AF43AC11A6497F
SHA-512:	4E57330E8538504BC039D03B461C40D3D23251C9B57D88BA8D4A801389B1FF890B4229D7481EC2626E7AE826618799C22A3150E760A3D90B275BD18F1511D67E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...,................tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0180117407206811B71BEFA893479FCC" xmpMM:DocumentID="xmp.did:5F55D253175711E1AE49E7AD72699815" xmpMM:InstanceID="xmp.iid:5F55D252175711E1AE49E7AD72699815" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0780117407206811B71BEFA893479FCC" stRef:documentID="xmp.did:0180117407206811B71BEFA893479FCC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>W..G..)\|IDATx..].\|TU..f&eH/.....^B"Hqu....\|.k...

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.612547934030121
Encrypted:	false
SSDEEP:	3:Fttuc/IHNtKXq3WBkp/:XtB8N8s/
MD5:	09DA5E8AC1DAE5C1FC76F7E312A390DB
SHA1:	96B02766DFB5A6DAEB954AA9C5894CFABC062B3F
SHA-256:	DA6E1380172679049DA353BA6A0400B1320AEE5A54C360EBC01FE5E9B3ACCB13
SHA-512:	1B9A1D082F0F175E1C52697E7BEC38F3BE41474AF5E04383AC5D2C8708B97CE1CFADC72B88CA616DB62C5B28E586CC636FF8348115FE8405D3B5C8F04BE64182
Malicious:	false
Reputation:	low
Preview:	...........V.MNN-.V.)M.Q../..,....s.Sk....!...

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	15923
Entropy (8bit):	7.9409009941309625
Encrypted:	false
SSDEEP:	384:wuSlL6XhG/GoioeJm0g5Nf3bc5rU4ddbbhW7gFxOr6FXrQ:ZSUhd5c0gPg5xbE7NH
MD5:	883A5DA6530163DDC993E13ECA79CE4E
SHA1:	75872B3186B2C08B1D3E3C9946A97471010D1722
SHA-256:	28475C0F767E66BD3845703737C28639E76AB0E8DC75DCF5DAEC138AAE47AA47
SHA-512:	0F232A9AF5A81AE6DE1D0BE8408896BE4C8CD18021D385535798A1CCC69F4581177B87E56AEC2911E4BBDB281059CAA6390EB005323B7AF3099131CA7A7CB556
Malicious:	false
Reputation:	low
URL:	http://maponline3.bdimg.com/tile/?qt=vtile&x=24813&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE........................................................y..Dt...........h..j......o...........b.p.........U.w.^......q..f}.afqrx.....G..e............N.x........k.D.. .b.....bKGD.f.\|d....pHYs...........~...<.IDATx..}...6.7...t..9..:.......l.w.m...z."...l.s.k...1...5.y^o...A@..R..s.X..._..e.....q...tM.,...._>..0..........X...G..UY..2..p~O........>(..nF.."C.6.........W..tr.3=...AxU...X\|...#.......%...a..R..'Q.o.;o.?..8........h..<n...$}...g.A1......<....x...9..H..../.......&.......t.M.U...%q..A.fa....~Te.....a.6.._(...f6.".. 6}.ij.'..N.J?............/...~.,.Jq@#...i......s..h)o.....Y...A.<-.@..P..].(..s....!...9B.zP..2..~.U._>...Hk...@o.7......-."o.@.1@X..^.... ....@._.g^3i.&sP.a..VL.(..Qh02......O...2...H.....4...@.._l.......W.&q.....H..4.M$.].ARi.4FL.mR..(`............%.`..26..P.$L...-..wP.(...{.jQ.o..3..DI..;.!.[Gn~.....

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 111
Category:	downloaded
Size (bytes):	115
Entropy (8bit):	6.084760107854261
Encrypted:	false
SSDEEP:	3:FttKEjZZwm1UfF/rHtBhZKhMFLlSfWvW8LheoVtURmeRu7oWl/:XtK6Am1kNBvnufWvPhARtRusy
MD5:	D4D7C22858E0F14D6BB79EEBADB429DE
SHA1:	D1548D138855CB52C846B210096A01A1CFEA5A06
SHA-256:	E6C18E56FE155443A69A03D4400B3477D745F3AC6D8687722708EF22F5D126D1
SHA-512:	BC88D5999045FCFCD03B932E6082484EEF27A39FCD4B73F438B7EA5491FB038DEE6777C14938DC5F55984E69EE66B49A52AA8EAA0D600E4B76AF89D61C671B61
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605599277
Preview:	..........5.A..0....umY.......q.p`.NIC.w..~.D....wfq..K..O...f.Yn.3.}..4.....N.fJ....$...m....q......o...

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1198
Entropy (8bit):	6.619949663304808
Encrypted:	false
SSDEEP:	24:y1hfvWwh82lYSgNek9V0DT3xyJ3VSRgbbERgpGKC+QnztYTJXKKB1ol+M:wAvnteEeD8J3H/7p1C+A66KB15M
MD5:	D63AC2117FE24DDC715A89E55D43FD1C
SHA1:	313031B400E3CA03EF488C9A2BF22296834C4986
SHA-256:	DAB19F818F3D5AB7AC023647103735FF3A5C7319BD5F3E3FC15EC47B2F249B7D
SHA-512:	37ADCF485207F8B1FFEB9F798E68481BEDA780E3BC46462AA0D5B33A6FB2CCAE1395AF7D5CD04FCCA7D9C7657EE0ED66873EFED531C5FA77CF74450BAADF4722
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/image/onlineMap/close.png?v=202104251101
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C1C0FC2CC0A511E8B3D7C46EC7D88036" xmpMM:InstanceID="xmp.iid:C1C0FC2BC0A511E8B3D7C46EC7D88036" xmp:CreatorTool="Adobe Photoshop CC 2017 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0A031052BBDB11E88063BB725C8C80DB" stRef:documentID="xmp.did:0A031053BBDB11E88063BB725C8C80DB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.z......IDATx..[n.0..P..S.XD!...,.R....%.4....V`F..F..8a.+.;9.I&:..RjF9...25.....%.Q...4e...`.r1..c\a.y...b

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1314), with no line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.372289825669748
Encrypted:	false
SSDEEP:	24:m6jI6u6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9OIl6TG8/w3hPGQsm:mUIj6JFMzjet36iotbXrFGh/w3pGQsm
MD5:	DFCA3247CA98F87B79006F259684B276
SHA1:	0D570EB5F78AE517E8F453A2B8804E7053C5FB6C
SHA-256:	259238CA42D3ADE2809730B87EF62A843F3C331BB218F6E7310F5CE3187BE8DD
SHA-512:	319541920A7F71C1AE035CBE3AA272246A100F18FF3883D2FF0F2383DF905FA9ACDB39C3F7F07AAB7AB103611220D05B2A6815326A88D4678DA441F582EB5111
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk87276 && BMap._rd._cbk87276({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703713.02,2560839.99;12704353.11,2561320.07","l":"17","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk8

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	931
Entropy (8bit):	5.802575384591144
Encrypted:	false
SSDEEP:	24:g1hJIwWwjx82lY2T37VUv668yJ3V2vPAFGB89:+kNNn2vyvNvJ3ovYFC89
MD5:	AC10A8D83124EF9163C3B742946194E3
SHA1:	93E5B474266496977E700A6FA3383AE9A59B33C0
SHA-256:	013C9FA0D17DCB0068E095B70842B19482BF5F9B4FE6D9F48147134016295E88
SHA-512:	F4E335AF94CA3EFD931A4241946ECA7F0035278F25B3E46E0E845A0B29762EC915D73D988D17FBB5A48D70C38582D03160C6051BE5652E113C042580B1CC5B38
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............Q.".....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:E503FA083E7611E69EC0AEAB23E3D8E1" xmpMM:DocumentID="xmp.did:E503FA093E7611E69EC0AEAB23E3D8E1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E503FA063E7611E69EC0AEAB23E3D8E1" stRef:documentID="xmp.did:E503FA073E7611E69EC0AEAB23E3D8E1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.+......IDATx.b<....F.. ...<..H......IEND.B`.

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 35
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.80639513982528
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fOw0x4RTE/:XtB8eKmx4Ro/
MD5:	84AAD1B39C33701D2FA0C423DDE7AA23
SHA1:	918FDF533E772ED0196BC558BF0A7261493EFC72
SHA-256:	20AF8756A37D1EF526BC15C29A7D150A242DC06F5A78413604E02A834A42C64D
SHA-512:	8E3CC4D21CFE6677C41A326541CD6007980B8AEAD1AE100D440CEDBC1AD21213664B573BCB5C7A52C75E3BEF7B0767165E9476B3A45E4884879FF8BB68B2DFB3
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz6g....T...t.p#...

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.918780730435345
Encrypted:	false
SSDEEP:	3:UR89KCmH7ltcNmdo8oCmH7ltcN1AvHfeSXiMn:U29ZEdo8fcv/F
MD5:	8BAE368158C016630A8C24EA90B09C3F
SHA1:	B7AA5A931BCBFF9BE91EA8735B53FF4D1028DB35
SHA-256:	93A5B399DD070137744DBC7867481813A7D49E99F98384A795CEABD24558635F
SHA-512:	FB60CF4E8922DA1E198A5A415048C63663F02A3D5A2C88FE9A8CAACBB599207EFEB8CFDCA3025FBD5BE687C637F80806B2F68B70168C200A504C14F9BBFF09D8
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605657349&callback=BMap.logCbk1914489283&sign=d18613173a5c
Preview:	/**/BMap.logCbk1914489283 && BMap.logCbk1914489283({"result":{"error":0}})

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	15150
Entropy (8bit):	7.897183128041113
Encrypted:	false
SSDEEP:	384:qckIVhOwOocSKmdoQ2OYKY2/jN/a47Trd49HX4SA3JBH4:LkIkLna2OjN/a4TrdHZH4
MD5:	27421B0B15F7A4C38688E5C56AF594E6
SHA1:	34730B780B96208D51A7009E513B278FE844167F
SHA-256:	B6DB8DFA6DE06267786BA0511D171949FC7039D0285E78F1763FD7AFAC25DE73
SHA-512:	375538C16A8C23D6E4C83B77C85771BC52AC57D476EF44059C029BAFD269A2BD3D3AC130E6ACD21629AA7DDEA1B1B80079E597C132FACB43A18F0BF85FF31E8B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE.........................................................................n....................y..............D.o....K....1..vvv...y....r........f}.......a.o.U...w.O.M$....bKGD.........pHYs...........~...9.IDATx.].c.8..Nm.-lL...@.;i.{.u6M.n....;......Ww.&..2....Hr..c4....\|..O&S.~:./..g...u]...../M.?o:Y,.#B\|.,G.E..To...'.'.o..\...KB...y.R.{...>.7.......?............v\|..1....."..d>.....n....>.1_.n...O......~.t.o^.F...V..H>....n.y....n..............Xw. .].d......`4n..f}.X..>.B...d....._..8.?xL.;...\|I.P.Xh/.T..P.,...b.j....._.j.....s+........>],.g.?p\|...z'\|]......_..O....P....c.. .......^.#.}M.....=...E..m.Q......<...+~E.....k.&.X..p..#.e.K..<..W.W%...\|.....\|^...............Ex..n.......o..`..x$'=.A.....0...T. ....&...H...v,]a....'..6....&....e... ..o+.F.....C.....q........x0..W.v.<6.....q.._.y..y.....G....%.,`1._....w

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=80032489&code=5054&da_src=5054&pic=6
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	15923
Entropy (8bit):	7.9409009941309625
Encrypted:	false
SSDEEP:	384:wuSlL6XhG/GoioeJm0g5Nf3bc5rU4ddbbhW7gFxOr6FXrQ:ZSUhd5c0gPg5xbE7NH
MD5:	883A5DA6530163DDC993E13ECA79CE4E
SHA1:	75872B3186B2C08B1D3E3C9946A97471010D1722
SHA-256:	28475C0F767E66BD3845703737C28639E76AB0E8DC75DCF5DAEC138AAE47AA47
SHA-512:	0F232A9AF5A81AE6DE1D0BE8408896BE4C8CD18021D385535798A1CCC69F4581177B87E56AEC2911E4BBDB281059CAA6390EB005323B7AF3099131CA7A7CB556
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE........................................................y..Dt...........h..j......o...........b.p.........U.w.^......q..f}.afqrx.....G..e............N.x........k.D.. .b.....bKGD.f.\|d....pHYs...........~...<.IDATx..}...6.7...t..9..:.......l.w.m...z."...l.s.k...1...5.y^o...A@..R..s.X..._..e.....q...tM.,...._>..0..........X...G..UY..2..p~O........>(..nF.."C.6.........W..tr.3=...AxU...X\|...#.......%...a..R..'Q.o.;o.?..8........h..<n...$}...g.A1......<....x...9..H..../.......&.......t.M.U...%q..A.fa....~Te.....a.6.._(...f6.".. 6}.ij.'..N.J?............/...~.,.Jq@#...i......s..h)o.....Y...A.<-.@..P..].(..s....!...9B.zP..2..~.U._>...Hk...@o.7......-."o.@.1@X..^.... ....@._.g^3i.&sP.a..VL.(..Qh02......O...2...H.....4...@.._l.......W.&q.....H..4.M$.].ARi.4FL.mR..(`............%.`..26..P.$L...-..wP.(...{.jQ.o..3..DI..;.!.[Gn~.....

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	downloaded
Size (bytes):	15551
Entropy (8bit):	7.699257860102716
Encrypted:	false
SSDEEP:	192:FXjQukPq2KVVqrksx6aCqyjOtFVvaV2twftCc4J3c2hPnGUSMDsDiFLYc/t7y8Lw:tQTfKVlxXjOtaXftP4J3cZWtt/E
MD5:	6528B6D87CE4DA7BE2DBA90BC880D42A
SHA1:	4DE4D50D6FDA07BBB25690267AD6E27FA1581EB6
SHA-256:	3F6AB45FCE9A572258FE6DEA1F9ACF1EE8F90F49515E654052D4DF4775E142BE
SHA-512:	421D4C18379CADDC288DA9CDB2C6EA60E054EC6A9CC90ABB1200FD6D8FB2F9791273CD58362AB1B61285FA77F41FD7DA5F9104E02A917D16695E60B3F9936273
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/image/loading/loading_2b.gif?v=202104251101
Preview:	GIF89a . ..v.....................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:bb7d30ad-7ace-ef4d-b5e2-f3c10caebc0b" xmpMM:DocumentID="xmp.did:A5708F8A197E11E5B6BBC5468535E3CD" xmpMM:InstanceID="xmp.iid:A570

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=65184113&code=load_mapclick&da_src=load_mapclick
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 8 x 4, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	964
Entropy (8bit):	5.890467283009064
Encrypted:	false
SSDEEP:	24:J1h4SHWwjx82lY2T3/VRXzyJ3VOJeG6aUmSV:XKS2Nn2D/OJ3L9agV
MD5:	EE54DF3BBBE4D6FA26B1C75EDF03CFD0
SHA1:	BB68BFBA9CE95BBDA826B099BA04A934BACA8AEF
SHA-256:	3298A3B99DE5CA0CC63ACF7A78773119B62556CD772A27882ADA32753F1B373E
SHA-512:	F9323908B173DD41B77F8D9155183652D2C5276B8A5FDF4C09D6A229FF7E04C67737B2B6513B76EEB2AD79A479E8A09597E6D639AB890F367FC34A8AA8CD2E1E
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/image/locater/locater_Arrow3.png?v=202104251101
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:4A40B5008FD411E4A4309E08706D44C8" xmpMM:DocumentID="xmp.did:4A40B5018FD411E4A4309E08706D44C8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A40B4FE8FD411E4A4309E08706D44C8" stRef:documentID="xmp.did:4A40B4FF8FD411E4A4309E08706D44C8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>'..F....PLTE(((...........tRNS...0J....IDATx.b`..F...f1... .. ......~D......IEND.B`.

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.959510541412091
Encrypted:	false
SSDEEP:	3:UR8OXBL1RZr4BL1kgUad2+WH8J0Tf4:U2ML1RZrML1vRuH8J0Tf4
MD5:	4D66C42846293F182ED68F01AA6DBDC1
SHA1:	CA54C4B51D6B32C84338A603F0ED0A57C24787E3
SHA-256:	9743C7ADA82E862984EDBCF6DAECB5F1A18935BD3B932251DDC9623D0A55C583
SHA-512:	7D70A3533E4312842370D5ECC7752B04A8183DDB149F0D469022F5502E4D001B7F60A174C20CB36E17D69E426DC6A14462DE4932314901087B77B365EB73881F
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk5925 && BMap._rd._cbk5925({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=88431406&code=load_mapclick&da_src=load_mapclick
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	15840
Entropy (8bit):	7.945457630056714
Encrypted:	false
SSDEEP:	384:IwbD6JjYcvXYHB9QBr8oykoQjU8TxDIWGA3Ehq6ZXTH:I8UBAjqrCkoQfebA3EUkb
MD5:	7AA80F72884B9C48A495B26DF1011B39
SHA1:	41885735127701F59135ED49EE6BA5CACF1A1517
SHA-256:	88F69548AB36E9B845C4017A0E898BFF221D08BDCD20B23533056272C1AB3E1C
SHA-512:	A752D0CF0CBB47DC04626DBE28986451AAB9791504740C135DA7687DF87504966FDF0A9139BCB5FCF971729D8D5A90CF6CDA9C30F838399B023EAA3CFE989143
Malicious:	false
Reputation:	low
URL:	http://maponline0.bdimg.com/tile/?qt=vtile&x=24811&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE..........................................l...................-.u...h........>..........es..........\|...q.....k{..............`hv.........n.........y........vm..l....a..Ix.>o...H5....bKGD.f.\|d....pHYs...........~...<pIDATx.}.c...$.l,7......&..+.....6.....3..o.$.j.&<5...H..!...RZ..c.....F..{mh....W..W..E....q...:.;.HL...1\|..$.L}A_..q..~N...\\|..!......xyy.>].....R..@..p.$..I..T.....+....,...4.w~O.^....>^hU.a..pQ..)?..?./`\|....~.@.?^.O.?..0...3.B bT...3LL2.._M<....e...dj..g.....}!.>....c......?.....O..x...17....`dx..@..l..I...V......A..dC...0b.......X9.......c.~.............B.jQ. 3r.....,I.....,........?....=t.D@.r4..\....a....%..D...................p.,..........A..F..?...3..)=y...r..]9......}....,?....J_\j.?+.@...$..qi.eL..\........C...../$.O.......,.[9c98..Z..dd..n....*A...."...XS..C.u...GV.../.s..y..Y...u.....rp..\|.,.........J

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2904
Category:	downloaded
Size (bytes):	1230
Entropy (8bit):	7.835060758396019
Encrypted:	false
SSDEEP:	24:XQnJjX9RVW2uh+dvV394mFdcthlBstwMagzOpjziiEeDo51xAb/0c2BS/iZx8unP:XQJL9RVW2fVOmFdcthlBs+MuzJESsxuU
MD5:	CED6B41069D1AFE25DF8AC0E9913F2B4
SHA1:	17B391C6CE49141A36888355865B25B2EF31F17D
SHA-256:	4F392E36BC2D02402822E3D219E9CEEAD622A527B4EDD1F23DE0CEEAF9AAF952
SHA-512:	DBB9E85A9300D16820C71244A80786FF4253DFAA26C50CFEC1C1935F064D92B01F63ECF6F2FDB1F2AC0A185F66C1B6DB49C787EDA6F49E3EF9943396CF83A0B8
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/comm/jquery/jquery-mousewheel.min.js?v=202307101206
Preview:	...........Vmo.6..+...d.pv6..]......,].....`..."5..Kc...)....l......Y..'..}vO....}..U.&;....&......[.......I..p.\..#.;..P.:.....~{I`...U..9......4.x.E..[..B.I..zd..2.1..<]4C......\|.V1.Ydn. qh.IT....~.0....n...Q..MZ)`;.....?.".&].)}...(....2z...(.rSYh'o//...)....%.>.GP;.v<2...z....A.......vpaRX..f..M.....MY..~_.U2...H......w..mifJ.......v....C.....z.."..Tso]t.[@".b}....J.5.E?.)..E..W.Q.......L..o..{i.h(....6@..X.0JX.&>..9(...3z....,.N...z....n@.7.....t..]..4..l..>....=.:v ..<.>s5......?..Q..R.K....B....;L.S.+Z......q<.a..[F&..S.)..`.^.KgQ..V..wt.w..n.Fo.I."..DZ8.h.XK..hw%...0.......O!.~....-}..I.`....zmg."....T.[PN...$...5.CR(..y...E...Aj<.M.a}.,.J.Q../.xJc.'..O.g...m...5.>.Y.(e...>.....,..c.....RO..!..\|.p...An.cn.@.-H6K.4..........c..?..u..7.?..>.j...:..Qj!g.3.....] .A.;.u.\|..4.xv&x.........K.{Jn.../..:7.x.+.#....>....K(%.......jtg..p...G.......n.."'.vk_.t<.'......?b-.$...2..Fg....57.(S.....Y!<.x.[... =@u...@y@...a.}.....6./.or...$..

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 71 x 71, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.186742506840038
Encrypted:	false
SSDEEP:	24:n1h4SHWwjx82lY2T3/Vs6aRolyJ3V6A/oKGg/XSkbcmofxz691RYXCP1ba6iz:1KS2Nn2D90J3NvSkQmo5z6TRuCPAnz
MD5:	3C9396000E56EB1C0EF4CE9269252F7A
SHA1:	649861918C42A427086D30B86BB4CCFDC5B819CD
SHA-256:	844A37ABFC88508B74DF5921C4A97B8265D89F4ECED2E8DC2A2661B308249B40
SHA-512:	C89E7E7199ECBE3B8EC565170BEE3BA19F258D911BE78C1B6E8EA311E87C2DC0AAC8B51032B4FE755A0ECF455AB56E04008EB9F54825886A38003263C734FE5C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...G...G.....U.Z.....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:C05A2478C5F011E390AA8612195784C7" xmpMM:DocumentID="xmp.did:C05A2479C5F011E390AA8612195784C7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C05A2476C5F011E390AA8612195784C7" stRef:documentID="xmp.did:C05A2477C5F011E390AA8612195784C7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.[.{....IDATx..]h.a....QV6+..@..v...Q8P6.,s0........D..."2...Ds"....@..H..J..G....z.W.......]..~.t.........d......P.

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.891261571423757
Encrypted:	false
SSDEEP:	3:UR8OXBL1Sdd4BL1SXH0ad2jRbrUWAqOLc5MWvQPmh:U2ML1SddML1SBGRbrPgLc5XIPU
MD5:	3B86BFFA27DD4755B5FDE36931627766
SHA1:	BBFC7992F85A0FDC5B3B7EB72C4325FA6DC9C1E2
SHA-256:	6A99CFAE83BFA770FD1663B5A32A8FA4682A96628F7D8A40B210C02E61921BFF
SHA-512:	13E41764C2FF139404020CC9333399463CF972F33C70D7E6229A896083E7DA658184E56B1A4AB89715A907702FE7EF91FAD820C160C55D33C234B4879EF932E7
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk394 && BMap._rd._cbk394({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	689
Entropy (8bit):	5.31969505433691
Encrypted:	false
SSDEEP:	12:2ruHna7Wgh0RPTUoDl619efhVnNwQ0uX9YSbSaGG/aGOBGuuLh20DRWZJU:2ruHalS/ZRDnNwXM3zC7+Lh7RWZJU
MD5:	28CF6173DD2BB092D3271A4721CE25B4
SHA1:	191BFD02A4C43550EAECC694DD92F62B044F949A
SHA-256:	312153B3D16B128B8A751F9020C36409B731CA0AE8861DA9C6106F899F222FAA
SHA-512:	D9051EBFD7D7BECA0967421F5E49D2FCCD229938DF89E80E0FDFB384332A61AE618279503444D3ABECE754D340588CF4B1618E1F3173E919F19779980DFE21A3
Malicious:	false
Reputation:	low
Preview:	(function() { .var fs = document.createElement("script"); .fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; .fs.id = "faiHawkEye"; .window.FAI_HAWK_EYE = {}; .window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; .window.FAI_HAWK_EYE.jssdk_report_url = "//datareport.webportal.top/js/report"; .window.FAI_HAWK_EYE.jssdk_appid = 3008; .window.FAI_HAWK_EYE.fai_is_oem = 1; .window.FAI_HAWK_EYE.fai_aid = 28088389; .window.FAI_HAWK_EYE.fai_bs_aid = 28088389; .window.FAI_HAWK_EYE.fai_bs_id = 0; .window.FAI_HAWK_EYE.fai_bs_wid = 0; .window.FAI_HAWK_EYE.fai_web_name = "site"; .var s = document.getElementsByTagName("script")[0]; .s.parentNode.insertBefore(fs, s);.})()

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x432, components 3
Category:	downloaded
Size (bytes):	122466
Entropy (8bit):	7.9799058926481905
Encrypted:	false
SSDEEP:	3072:cVhbNBkQW0KLGhLmEKbMXgtimuthD1JmYqwgJYVCgnmo7SFpKR:SXW0KLNoXg0BmjwgiV7nao
MD5:	5DD5248BA6FCE85038825214DC61A2C0
SHA1:	3CD20CD51F5136C9AD52F275371C1D0AFC975E0F
SHA-256:	BDBBF484043E17A139320022A237E9F66D095DB9617B4F0EC8CB35FB2DB0D901
SHA-512:	B1A6FBEA181F94F915F8A9A7C3BDEBCCE85599C40F4EAC358F5E8627B52DC5DFB60404A81C375D8A59F0C80BFC589425A14CA4AE308F9D2F2E12F7C3E8603755
Malicious:	false
Reputation:	low
URL:	http://20228233.s61i.faiusr.com/2/AD0IidHSCRACGAAg_Ovz6gUo67PL4AIwoAY4sAM.jpg
Preview:	......Exif..II*.................Ducky.......P...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:2C7DF338C3E711E9931DCFC8BEE002E6" xmpMM:DocumentID="xmp.did:2C7DF339C3E711E9931DCFC8BEE002E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C7DF336C3E711E9931DCFC8BEE002E6" stRef:documentID="xmp.did:2C7DF337C3E711E9931DCFC8BEE002E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 71 x 71, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1613
Entropy (8bit):	7.186742506840038
Encrypted:	false
SSDEEP:	24:n1h4SHWwjx82lY2T3/Vs6aRolyJ3V6A/oKGg/XSkbcmofxz691RYXCP1ba6iz:1KS2Nn2D90J3NvSkQmo5z6TRuCPAnz
MD5:	3C9396000E56EB1C0EF4CE9269252F7A
SHA1:	649861918C42A427086D30B86BB4CCFDC5B819CD
SHA-256:	844A37ABFC88508B74DF5921C4A97B8265D89F4ECED2E8DC2A2661B308249B40
SHA-512:	C89E7E7199ECBE3B8EC565170BEE3BA19F258D911BE78C1B6E8EA311E87C2DC0AAC8B51032B4FE755A0ECF455AB56E04008EB9F54825886A38003263C734FE5C
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/image/site/left.png?v=202104251101
Preview:	.PNG........IHDR...G...G.....U.Z.....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:C05A2478C5F011E390AA8612195784C7" xmpMM:DocumentID="xmp.did:C05A2479C5F011E390AA8612195784C7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C05A2476C5F011E390AA8612195784C7" stRef:documentID="xmp.did:C05A2477C5F011E390AA8612195784C7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.[.{....IDATx..]h.a....QV6+..@..v...Q8P6.,s0........D..."2...Ds"....@..H..J..G....z.W.......]..~.t.........d......P.

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	17366
Entropy (8bit):	7.922082606186133
Encrypted:	false
SSDEEP:	384:KxhDUSMF3ZpG19bMD0HHWVg5G57cL4u+SStXjUGnCbKWkRE/+gqB6smqxz:CDUSMlZpixMwHR5GC+SSRjUGQUREvsDP
MD5:	3F505B7FF61FB59B0800D8A1D720FF20
SHA1:	B494CEB1859E619D86E9A30AE0E5BA9B66BF5CF6
SHA-256:	D7BB96B842D60789805D1DB3831A1508968FF37C7D317F4D1A082313EB87B376
SHA-512:	3F3CC612D423DAA195C87B86B663030D0D47FC985F96D26282816DE3182F078C8948700A595FE3AFEB18BC49A1D9D356E3259EDC93312FDBFF4A8DE596FECC8E
Malicious:	false
Reputation:	low
URL:	http://maponline3.bdimg.com/tile/?qt=vtile&x=49623&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE......................................K...1.o........................................^m..4sss........k.o.U.........z...1..a....s..&...{.....e....e..e}.7..?.\|E.~>..1.w........bKGD...L.....pHYs...........~...BfIDATx.}.c.H..F.B.1.Nl..........7....... .._..A....:.....d........L.0....xH....KF...P.?....8..._.>.L.k...M...\.........d........x..cjq..#...b/.-...x.d^>..\\.._W.H.......Ul.$.../<.....@.URX.F.i.5.V$I.1.../.'0......X.._..h....a.9c.)\.\,o.nf..t.d7....X.J=Xd<9...?.......(.....M..;W..>'.`..........c...p.E....L.P.pI.O15..=.`9.Y..7.%.M......i....r2.....umq..~..3`..ch.j..J<\|.l............+._a..o......y.G..uP.$...a....H.n......L.......L&..0`..L@%f..\.0V.#....A.U$&...u..........D.\.........^P..\|x....#n..#....^.....L.O.@.V...l........j..oc..pq\|.D.{Z.x.3........'..A..\..j..}..u..@R .....r.,.p...ci...&i.X.,'........O......*f.%.....

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	121
Entropy (8bit):	4.939069284095431
Encrypted:	false
SSDEEP:	3:UR8OXBL1ZNno84BL1Zaad2jRbrUWAqOLc5MWvQPmh:U2ML1c8ML1dGRbrPgLc5XIPU
MD5:	C764559A45DC62982F6BD6A5BEDD4081
SHA1:	F820A00779E1B5DFC116FCB5D584FA6EC506B8CF
SHA-256:	2CF3423E09DDD3975CBD3E93BEB1F04D028C99743C747570FE525ECC6F2FF2A6
SHA-512:	3DF0FCDDBB6A1514E47D7897AC688D9B9E3C67CA06FE65DE656FCC19EA94B3ECB47B083DAFD3EC0ED1F3C2F048FC6734934D0EEB88F21EC8499A16CEF87BE31A
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk71768 && BMap._rd._cbk71768({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 22960
Category:	dropped
Size (bytes):	6794
Entropy (8bit):	7.974366462601837
Encrypted:	false
SSDEEP:	192:0JMD86AQp3uMPeHJAI0MfR4Lyxhx9ybII7qz6a/KX11e8YzjN5em:rD87Qt/NYRiSlyc1SsN5em
MD5:	F0991CD26EAF28B86F9F9586E5C8DF45
SHA1:	1858FF8947F231727CE1182968A3207403A48C39
SHA-256:	644FA435BCD2080191FE5A1033AF288E166FB962C023023CB21C0C93DA7A0654
SHA-512:	4420411EADAA5B5AD5F973BD2346545C44FD60539E3DEF264508CAC370D24285FE888D9B3F2C3B9D341FC01AA802AC6B1A93AC94E127BCFCC79F569B5B1E659E
Malicious:	false
Reputation:	low
Preview:	...........<.w.6..Efo.2.h.m..i......Mn......IHDB.\...X..7....(.N......_......e.V<K.d...gaeQZ}.Y6...<+...p.f.E....W...v<K...Gl.Svx(..`...G..~...?....k.\^.$.].8S.n.D.gWf...^.o.Ypi%..<......u.]8...yI....}..e....UP..K..FR.......vU..i.....7Y..,.C....+.+...;T....>w.W.a..U...oJi]~....l`.3=7....6.Kc\s\|f.W..G........`..^w.X.T.@d.tg...../;..Z.u.....R.J.%.0+.E.H.0.A..}..`....m.1mh..s.F.d.(..G4t. ...e.Cf.KF...h.......6...7....s.1.E...2.wa...b.\..U.........I+x.v=.z.....I..Y.N...XY..i...-...v....;X..E...u...`.APUl.W...y..h.f.Hl.M......!s.+.H.Y...Ao.F... ...$......q.b.`...3X.."...$)..o#aP....i.&,.W....h...`.rC.Q\.$V.g~..\|8t.%....W......)L.m..t.)..?..<.8or.Y..o....wY......m.R....d.G..N.$.V.d%.k.Z$.....{..%.8.\5.%.5..`.........].W..xCB..y..aE.\|n.Ji.he[_XCnL."r\....W.U.[..t....(...6..<gXw...G.Y...u-.=..IP...\|;=9.....g....u#....>. VK.g.n....].#X......U...1i..A1Z.S..}%.#.....~DW..[..a...6*..........W.X..6#.Z5..n.U.J.&../I"s..Q.. .X.Z.._,.`VmZ.8....n

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 114
Category:	downloaded
Size (bytes):	117
Entropy (8bit):	6.258710678477952
Encrypted:	false
SSDEEP:	3:FttKyVVZw4GdjmsLO0FPUzyvAgd1AgZ0zTqll:XtKui4gFPUmnXKzTel
MD5:	DE0361FEF0BA34F966B12A3E918BE937
SHA1:	0FC49C7D6B5168B7813CADCFCF64A80531B71E32
SHA-256:	066E3616B6254EB0486A00DFB7F5C8B17EFB9F0B7982B851B55315DC0D351EFB
SHA-512:	A4C85A9FA11CF7E11AA928408AC15E8EB3F356F1669CA06F7D67BAB13D00D50BFBF6E58026FB98616E1D32FE38DA6E6C07725194D4031A31018B3FA416203C47
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605652387
Preview:	..........5.1..0....9$..r.Xz.....Q.*B..S.1..Fm.!.wfq...K..w...f.U..+..E2h....g..Q.....{.}....D.-IN...^......6r...

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 35
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.80639513982528
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fOw0x4RTE/:XtB8eKmx4Ro/
MD5:	84AAD1B39C33701D2FA0C423DDE7AA23
SHA1:	918FDF533E772ED0196BC558BF0A7261493EFC72
SHA-256:	20AF8756A37D1EF526BC15C29A7D150A242DC06F5A78413604E02A834A42C64D
SHA-512:	8E3CC4D21CFE6677C41A326541CD6007980B8AEAD1AE100D440CEDBC1AD21213664B573BCB5C7A52C75E3BEF7B0767165E9476B3A45E4884879FF8BB68B2DFB3
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz6g....T...t.p#...

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	97494
Entropy (8bit):	7.997903000495766
Encrypted:	true
SSDEEP:	1536:InAuD5nFAX0OW0l3NpcXohZc6Zn117x4Ifg3eEkusZtEem+1ctODArk8brmci9nw:InT5F+4+DcR+n/x4wguEkZnEepEODArb
MD5:	E162AE45642EA3948D0602A1B20854CA
SHA1:	F671AD5C27205A5A41E26FCA74FF2755C247E308
SHA-256:	F0268C0A34C626E06ABF530E684CF9A159F2D91AE39094CE01CD7D3E651A4F03
SHA-512:	B4B20CB48DD6B44533C6FF4FF27C320428220B26F7EE3305935D228E8A93F47347917FD04F099AC3E83BB78F2D155A2BF1CE55E4F660E7CFF487C12FDF373D44
Malicious:	false
Reputation:	low
Preview:	RIFF.\|..WEBPVP8 .\|.........X.>m6.H."..$......gns.Y........X........?..............g.o.X,_.......1..ox....G......#....aO...=s3...m~\|..>9x...0.....L.........\|'..{..z....-...o._.o....z..........K...G.....}......5...........w.w._.O..2..................X?..........o..D.....o...~y.6.....q.O.g..........o......x..........D.o.......O....].+.W\.Y.O.o..p.e~..3..................#.....'...............?...............o.?.?u..._...g.o......g......._.............%"..E.Oj..=.d#.6..jL..........Z.K....5..E.OiZ:...K...^..O3..y.....WZ;.D..?_f\|....6..m...:J..1r2......=x..Y\!..\j.>.s.+e..I..w.P~.....Za].^.}.v.../J.C..z.........)a...k..]...}R.~{?.1k..V].t.{....+.'.Z.......Np.......3..,.8.#]..\|N.uO/.............sR.4..{x..I.)..............x..N....K{.W..U_.2..D.......g.+"?ib.. .MZ..y.uw3.x.x[,@:HN^..pbd...!.]...<.$sR...E.Q.$7J.%...B.....o..;.r.....r~...).._P...!./.E9_ek^.<.$.a..A.x.);..M. I.5m..6...q........"8gn.E)c.p...6.^5.TZK .>...+.e.~.}.B;.nM.d.........d..>.1....

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 45
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.576663559094718
Encrypted:	false
SSDEEP:	3:FttuMXXwLo8xWwkGxvpfY/n:XtRMxWkZY
MD5:	646789679CF9D69394C7FBC78E7FE634
SHA1:	C7095DE77233A8331035E058A29B227746E8E57D
SHA-256:	054FC8AA63E0E126EA2DA0C85C225599FFDF23B25627A444874CDD69279A7D87
SHA-512:	6B0D605FFB057211D8051A1CB6BC5C8AA90B9DC32A3902A74B6224D75CD06079846C7F422992BA17E676E442D4F1B8F72AEEA3D9703A157E297748E799467601
Malicious:	false
Reputation:	low
Preview:	...........V*Q.2.Q.MNN-.V.)M.Q.-NW.RJ-*R.QJI,I.r.j.....-...

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 570x455, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	21142
Entropy (8bit):	7.992172962267607
Encrypted:	true
SSDEEP:	384:ROxUT3iRHAY3eFfE32muBqvLTidID0qEzmn+BFCniy9bn0h8VQbCONla8QaDpgw:goSRHT3s+RuBqjTic2S081WaQ5
MD5:	3831FB04D8FB7812709C84975401EF58
SHA1:	6A5F126EA8E095A55D25D0661768910CFE66D25E
SHA-256:	4AB6389173F0DBAFA1BD57AD297273A31DCE901C4296012E9A5AB044C301B2A6
SHA-512:	7EF9155D1268BFFC8C890A3C91D7DA57458F42AEF5C994F5F257C2B3CC4D766F81A0CB6E71D52DBCA05FBE4646D28ADC1BBB2CA5C1CCA1CC55D4E741BE5251FF
Malicious:	false
Reputation:	low
URL:	http://20228233.s61i.faiusr.com/2/AD0IidHSCRACGAAg1_Hz6gUos_moVjC6BDjHAw.jpg.webp
Preview:	RIFF.R..WEBPVP8 .R.......:...>m4.H$#").S.0..gn-.:...rC....b.....?.t.1W4.\|.T...2.rn}..:..........O.7.......?.z..J.W...............t,G..._.lv......^.....Nh#....>.>P.;.?.....p....g.?...^........{..7..H.#n./_...lF.K..}!=.o.l8M.~!..!.i.0.&..r..1..].....y...!/..c[,."!..2.....u..l...E........f...xX.......c\|.oZ.p../.........3.\|.1.r4...a..Y\.;.2.....4.s.Z#j$n........../...a..<............_.....W..e...8.....L.E........q...=....V8.NR8.(.)..&@[..G._.jF.v.....O..I5......m...Nu.k.i\|P......H.f..u?...#...^p.-........D..:I.x...dj.T.1x.PZKb;..n}..c.Mu....F... .GQ..2..=........b..A.Y.F._._.........{...=.l..D.p.?.>.,.F.......Sv.6h...s&..=z.{..O/.suKm.u%.9...u8..Y..js]?.-.;..LL....t D.....~..../..b1q..x".m..I.%.96....g.n....E..N..Dl2.7..L..6.FR&......[Z...U...iNv.~.l...I.w.f.B...+8(..Q.....Q3 ).P..n...".g..;vKtwQ.....Gt..E...r....N\|..l^.$....).q?.I.h1?...-.O......o>zb..[....\...Bn....v.I.......m`?..`2.5-.w.C,...>....vo.9....s..wu...j.G...s......I3.

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows cursor resource - 1 icon, 32x32, 2 colors, hotspot @8x8
Category:	downloaded
Size (bytes):	326
Entropy (8bit):	2.5620714588910247
Encrypted:	false
SSDEEP:	6:Gl/0puls6M94pTiI+mBURd8EOJlZa8BBL:C0pqs6M94pTJyOZ77
MD5:	FEFF9159F56CB2069041D660B484EB07
SHA1:	0D0A08CF25A258511957F357B89D3908F3C5E6E3
SHA-256:	7342F390B12F636D14E25F698FC5E38CF6240994DC0C07FEFBBB4E78EC4D03C7
SHA-512:	F850277F48AC14FA363265469776E6F7F07F7DD743AA1D1AD7CF2329EEE6D323DA3422CF6BAAC066C84ECD24800A02088053EF3FC0488D170E7FC942AC8FFA99
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/openhand.cur
Preview:	...... ......0.......(... ...@...............................................................................................................................?...w...g...............................................................................................................................................................

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:H+uZYn:euZYn
MD5:	46DF3E5E2D15256CA16616EBFDA5427F
SHA1:	BE8F9B307E458075DA0D43585A05F1D451469182
SHA-256:	AF3248D0B278571EFF9A22F8ED1CEB54B70D202B44FD70ECA4CA13A5771CECC3
SHA-512:	88FBCC0A92317A0BADE7D4B72C023A16792F3728443075BF4B1767C8A55258836B54D56B24EABE36AE4EF240F796B58B8F1EA10C7E3C146BDE89882FC9ADE302
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkUKb5CC4Y-FBIFDZFhlU4=?alt=proto
Preview:	CgkKBw2RYZVOGgA=

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.924055859159171
Encrypted:	false
SSDEEP:	3:UR89KCmH+RVTcXWcWroCmH+RVTcXWcbXAvHfeSXiMn:U29ZVRUWckfVRUWcz8/F
MD5:	649F489F9A085131E9CD81CB60F24F1A
SHA1:	0E03242E1E87F7FAB0FD89A731AA309C7B0DFD10
SHA-256:	A2197830C3A4681F57D5DC48B12949BCC7D487D963FAB0760293E963E45861AF
SHA-512:	C56D83C6EC14CF6B07BD481F37DC6EFEAA98A9F480D14BB243B05556C196A4944BEDD95D86B38B7EA383BD62F866C95BAD5FEA819B01BF5BFA3EE7DD4EAB582C
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk4406923950 && BMap.logCbk4406923950({"result":{"error":0}})

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	16612
Entropy (8bit):	7.878695350092861
Encrypted:	false
SSDEEP:	384:h8DQv875avB/91/Rq+RWZHawww12yFgCzCDp44IhAs5E4jWwUrGh:mI8N4VZYtPww/yhVjIhASjUrO
MD5:	419F06CE9C167C5636798605538B9D67
SHA1:	27F3E7111A76F03BCE6060FBDA35BF25E656C52F
SHA-256:	89D85A604AB8ACEF435618BB0C2FCCC817D94F0B13B7C2AD79743F9CA63123CB
SHA-512:	1110E2D355F86BA4BA9AB410C39AEA649B2D1B10631C173D75E7BD484AD2F69E766E4B59B9365AB94993EC5C5C9BAE4771E858819CBA5E52DFB5F883A5265162
Malicious:	false
Reputation:	low
URL:	http://maponline1.bdimg.com/tile/?qt=vtile&x=49625&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE.........................................................................................b.p...........i.S........U.............w..t.....k{.egl..v..V..2x..=@C$'P.^.....pHYs...........~...?.IDATx.}.c.8.ls..^...ccC..._6.Ls.!m....7..-.q.].M...h..E#..B,.v.>c0.Uc8..-...?R=oS..1..Dy..t8.......1.?6....'./.0$...A/.-k.~..p...\..j.7.C..\............(............2....6..c%....#}.a....&........l.~...1I...J...?..?.NG.!4 ..,._..[..@...M.....M..K.,.?.....s.h...g:Au.Ik.2.2m..O.@..:...u.dk..N.c.U.6%K.5.`,8...hZ@...qi....p`...3.Uue..&t..8n~.h...A.$.#,........G.60.(`...&....W..S...@8.'U.i.%...`#l.@,.@..........T.:.W.D...".X....v..X....d&.`8.c.`..2q...0.@S....g..T.].......,@..la...D....{$.n.r..... g.a3...g..C$`........+....+.2~Q......t.......\|...0Y......_. tn)S.g......`..u?......d..@....P...G...ww.....7...7.....=4...{.P1..=......d..

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.935606575000703
Encrypted:	false
SSDEEP:	3:UR89KCmH+cf9CoCmH+cf9pXzgHfeSXiMn:U29ZVPfV6X8/F
MD5:	A22D0EF809FC0987D72624E1977475F8
SHA1:	A426F72CFE75BC61E1D28FCDBE9E778173457F67
SHA-256:	155512A68E2F0B189443A0D0836C0E55B869A6E8A818ECAB9D14DA1B987AE799
SHA-512:	39832CD5FA488437BAF8B8491BEA7B0179FDBC5E07FC212A8A4294788BFC4A4644C1F937CDE96708DC0C96B4193A661B1B828295AB796F7DE923C74F50FC7BD2
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605644762&callback=BMap.logCbk4966028254&sign=dc2c45f39f3d
Preview:	/**/BMap.logCbk4966028254 && BMap.logCbk4966028254({"result":{"error":0}})

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.989660629054757
Encrypted:	false
SSDEEP:	3:UR89KCmH/5TNJoCmH/5ToHXzgHfeSXiMn:U29ZWxJfWY8/F
MD5:	165B4852E235717B9CF6EC99AE725D14
SHA1:	BCDF8D4F1AF8F29723FA9E01BCD66AF6694DAFB1
SHA-256:	646DF7F2F5DDD683BAD26380D18F2C87CD6EF6A81DD1954858D22701388D78B1
SHA-512:	819639B52F39E45DF85532A6F51637A0E0B8712B67241C871B75D155B8A58BA3F62C209028CDE57D6C53D386A760C155F317179787942D9CB60E5E58C3423D90
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk5542380316 && BMap.logCbk5542380316({"result":{"error":0}})

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 91749
Category:	downloaded
Size (bytes):	29754
Entropy (8bit):	7.991541618752925
Encrypted:	true
SSDEEP:	768:2PM00Xo98UJf5xNrDP3KkJ856cBjmzt8feIiHKgB:2CqJf5xNrDPLJ8JBjKt7r
MD5:	301B3E16BE8B7938340F630A08BF2E79
SHA1:	3701B3A2087CF5872E588C67DD4D7F6B20E72EA8
SHA-256:	66D3757879320F26F60672025856F23E5809C96A833D5AB660CE0FB9AC3BF191
SHA-512:	68306CAEA09D6CAB0AF8F39AF6AE19E093CA1E3E25B0516039A8DFC08CD20E8FF626A7FBEC0DF9EE780ECC72D4A3A3B4DD8AD1DF7FEF18689194508956777C5E
Malicious:	false
Reputation:	low
URL:	http://jzfe.faisys.com/dist/jz/locale/1033.min.js?v=202411131400
Preview:	............k.$gv&.W...8...a7.....f....j.pd!.......d\.:{..``oX{....X.......k..!K.?.h...I...9....Y.....+"2.......u.r./~5.......u^l.M......y..{.\|=...&.W..p.o......o.......r.2..O...........w.>>.yZ.&U..~~....O.........}.9..o....w......./....C.".Q.......o......~p.?........G...../..3.....?.......{~..............p.....\|......o........w.._.3.'.....[.w.w.\|..q.A}L..\|C.S..q.N\|..'....:O........j...u...7..'.~...$..e.1z..yV.<x...NI.tM......u.$..}rE/.L......\.E...zx08..}V......-.d..,...\6...<i.I.?9>......L.js../.U..........6m.N.i^t5=.Nmn..X\......7j.d.%.4_$.\|^.f...=.E.$..?....,..7...&+..n.d..uFw...7.Mn.j.m.&...-..N........\t..k..=...p...ou......s..nV.....^.....>I.yV..]`'..^.6..2i....:8.7......dya...'i...2zgz.S..&.C#..,./.j......j..v~#ms.=j...o...&.K..2j.dQq;.q........I..0..dr6I.0..y..U...4.>....}..E..lxW~oV.U..Nn.U...0m3.1.W...I..7H...]t,Md..F{.6GK...;...5G.....N.V.eMp.UF.@..t.Z..._..c..r.R.8..r,)p0..t.'.N.f.p...7...Z..

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	15551
Entropy (8bit):	7.699257860102716
Encrypted:	false
SSDEEP:	192:FXjQukPq2KVVqrksx6aCqyjOtFVvaV2twftCc4J3c2hPnGUSMDsDiFLYc/t7y8Lw:tQTfKVlxXjOtaXftP4J3cZWtt/E
MD5:	6528B6D87CE4DA7BE2DBA90BC880D42A
SHA1:	4DE4D50D6FDA07BBB25690267AD6E27FA1581EB6
SHA-256:	3F6AB45FCE9A572258FE6DEA1F9ACF1EE8F90F49515E654052D4DF4775E142BE
SHA-512:	421D4C18379CADDC288DA9CDB2C6EA60E054EC6A9CC90ABB1200FD6D8FB2F9791273CD58362AB1B61285FA77F41FD7DA5F9104E02A917D16695E60B3F9936273
Malicious:	false
Reputation:	low
Preview:	GIF89a . ..v.....................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:bb7d30ad-7ace-ef4d-b5e2-f3c10caebc0b" xmpMM:DocumentID="xmp.did:A5708F8A197E11E5B6BBC5468535E3CD" xmpMM:InstanceID="xmp.iid:A570

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1371), with no line terminators
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.263707911086819
Encrypted:	false
SSDEEP:	24:W+s54RWMuHKFmOthmk9++35E5TJIlGhjXgfIS7sa4/M63psI8S:W+vw8hm6++3SlIGhrfeS
MD5:	45C2502C0C844F83851E96738CC3F137
SHA1:	0436484F3540E9E71084338C2E3E5FFABCA2FA8D
SHA-256:	024D32BB3E91D14AB21AF92D1A4426AD6228E0CF54C332111C3C22D4224C1CC2
SHA-512:	7D1AAE37E22FA4AD5ECBBC8EADF4B2F86BC6110283BAF4360BB8AC90A2E1D7D54988660A817E8C5B71A1EF34658C576D3789C92136911CDB91B3C62ADBC1130C
Malicious:	false
Reputation:	low
Preview:	window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo+PUw4NxtSRAoXvcJIup1wY=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,e(a,o),a.onload\|\|t(a,o),r.appendChild(a)}function t(n,t){n.onload=function(){this.onerror=this.onload=null,t(null,n)},n.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),n)}}function i(n,t){var i="onreadystatechange",o="readyState";n[i]=function(){("complete"==this[o]\|\|"loaded"==this[o])&&(this[i]=null,t(null,n))}}function o(){for(;v.length;){var n=v.shift();n&&n(m)}}function r(t){if(s)return void t(m);if(f)return void v.push(t);var i=function(n){return d[h]===w\|\|n};f=!0,n(l,function(t){return i(t)?void n(l,function(n){s=!0,i(n)&&(m=n\|\|new Error("Load error")),o()}):(s=!0,o())})}function a(n,t){return function(){var i=this,o=arguments;r(function(r){return r?void(t&&t(o,r)):void d[h][n].apply(i,o)}

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.261229666895294
Encrypted:	false
SSDEEP:	3:CUXPQlG9h/:1Ql2/
MD5:	969FD31015EC5344C2CEF54101E23A56
SHA1:	6A38854F2E704BCAF53712A65C79EF68CF11E06A
SHA-256:	52B2C9CE5BB6933E1397DE740690260FE656C88970409B04BEAE1E098886C81B
SHA-512:	DD2F89935F7B17FAB8D7A0D72C1D646DF889D748E95D7C47219F54DA0A510555582734CE08FCD49F997CBE34DF0B518C5B5304703EC897F44BEE943533BD0E2B
Malicious:	false
Reputation:	low
URL:	http://static.tieba.baidu.com/tb/pms/img/st.gif?ts=1&t=pageview&sid=m3y4odhwass&ver=5&pid=241&px=1280*1024&ref=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&page=18_1&p=18&dv=6&cmd=open
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 292 x 151, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29451
Entropy (8bit):	7.981257141174357
Encrypted:	false
SSDEEP:	768:vFmMnHAFT7oo90APz71MgAVpD6d/NjxV94YcG1yOf:9mQ27oQPz7agAHD4jf9jcif
MD5:	7DB727BBC3B12173A978942FFA7D99A7
SHA1:	0DB60EAAAC29A1080CF55400B830286AA4E4C639
SHA-256:	02AC5A746991066CB8B9CF84D44B5EE3AD9DA81E0C1604205B8B031328FF1B79
SHA-512:	7EAC71EF01DA85094CEC7F6C762D72DE863C293A91B3CE210EF74E3A001EB0E6B342188E5A9D456AEC3E5C9730F6C300004F38C75F286F7E8AA0E0E5E67BE5F9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...$...........&.....sRGB.........gAMA......a.....pHYs...%...%.IR$...r.IDATx^.}.@UK..{.[^.EE...EQPBD.n%...;.[......](.tw....f.........tqv.={...X.. C...?.dB.!C.....d...@&$.2d.0..I...?.dB.!C.....d...@&$.2d.0..I...?.dB..?.."..LH2...JF2).x..I.........e>...7E2.C&$......8./. ..........x.KW....K8v."..z.7.\......4.-....d..P....g"...?!>!.Q....ERr..?}....S.......(\|....'.p...._.......@t.n.a...a.^<y..11q.2.E...d.0Pj6y.CZ.GDG'...W8y......g. ...).y...Tx.D........M].n.c.....n..z(S...j4D.....o0..<...`..~..$....)%%...Q.......n..`...w."n.{..W.b..p.....;...4......QI...5L.P...t.G_...=a..o.{._ &V&...2!..aPPBZ.z..w.B..z.......&rY....`....j..\.=.....+..>j6..Fa..U..$.^.......O.Yx KO&...2!....3.F... l.u.m.mPY...+4.z..(WY....Q....4...z.QF..h....T......~DB..MDbR..?.3..LH?.dB....Y....0,..h7...ix..=....F.P.^[4o...{...Q.1k.6....f...w..h...s.oF`h.h.f.Q.....2!..q!.(..(.......sR...!.?.7o=..).0h..._....\....p...u.a...%..{.8t.b.>>.J....@&$..._].....}L....B.).

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.924055859159171
Encrypted:	false
SSDEEP:	3:UR89KCmHyWX5VAJDDdroCmHyWX5VABewWgHfeSXiMn:U29ZZQ5VARdfZQ5VAoM/F
MD5:	844951819AD23466CCE9EB998C21F94A
SHA1:	85DEFF5D5D346EC0FDB314CF9D687821AC7278F1
SHA-256:	8F9EDCA4048F6F0B919EF855802538C5B6EAE98DBEC6350AAC79BB9276239AFF
SHA-512:	40FED4DA3A627E4AFA76D9690B4C7DF7E4E4C36D9030FBE765E5680765221A0FDB449AE079E87176D2B6E34FF1A94859AEFF849169B663C2F1F9AF4FE5D635EE
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605666827&callback=BMap.logCbk8321850506&sign=0f11f3707dae
Preview:	/**/BMap.logCbk8321850506 && BMap.logCbk8321850506({"result":{"error":0}})

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 46666
Category:	downloaded
Size (bytes):	13745
Entropy (8bit):	7.985839666606708
Encrypted:	false
SSDEEP:	192:w7ZNW/mdI3bP219J15IH8IU8okmWw3WIfkeF9Vbr/y8hRqBGJ4W97LXii1xlgdg:w7bQaj19LiHNXmPseF9py8hCf27miOdg
MD5:	C38B49BC7F1AB04879E9887DFBC5CF90
SHA1:	1049BE905A301FD9E2F5D6E79074A28B4FB95B50
SHA-256:	86D06AD59DDA87D9F37D516EC34970913C051793CBC77281853DD4B1E37E8B4A
SHA-512:	AAD5C46D7602CA1E7EAC2E3BB8291170A245727756EF16D476161FA9165E53DAFA2951DA0855650EAFBA2BD0C50DE3D8665DCA589A3C744CCA82924178C02601
Malicious:	false
Reputation:	low
URL:	http://fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700
Preview:	...........}k...v._Q.k..b....{W.N[-.....H......b.DjEJ.d$..87v..6.8p....?...'.....7...rN=."EJ.A....:u.T.S.z.M.g..'.R.4..S.P.vv.G.q..e6":...:3c.....ba.C....&..R$...4..Z..9o..(.[.qN..=q;..0.a....N.T)..[k0..}.5G.=u...}....7.p,=cfv..yo...k..K...w.[.K...i~...Qdf......%...;.......e.N.C.~..<f_...'.F%W..y.Z\|./.[.Z.G...r).....b......&...V..y.B..E~!.t..V.w...%..Us...R3..g..V#.S...v^..../..Y.C.i.....IQu..$%P-...........%V_..c.M ]...Q....#X...N.#.E2\Jh.e..I.8.."u\B..k...2I.T..IR;.@H...y.....F.c:.i.$(.T.<.)...R5...p.f...~...&........?..F.y../1...._.F....8.,..5.).zc.J.#..&.r.:....7.g..b.).Hg.q.}..C.\|...R.Ur..!.u{].U.e..rYD...Z.U...!.,.....E....+.h.....EZ..&.....~ .9...2..ABc._i.J.P'....L......0,....A..d6.b..h.v...z.. ...0..Wi....9`h.0o+/.....y...cI_.#....!z...6.\.Y..w.R.j...sB.I..%......(........Z.f..1....<......z.R...F...T.O:.\..:_7..[..7....'.o..st.%x..I..J,.t=).gC......IX.O.b.$R.O#.#&.?x2.....l...~..J..#@...~....rZ*......H4.[H...b..{S......

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 76186
Category:	dropped
Size (bytes):	24686
Entropy (8bit):	7.988995846983692
Encrypted:	false
SSDEEP:	768:RsGZw6vW+RIPoh+L+l0CagTqTINPozZags0CD:il6v1IgxahTINPofhI
MD5:	C1F003207EFE84957B62F5487097E936
SHA1:	2579898B2EBF0358CA344AEA9DC430E5D9B01A3C
SHA-256:	2D6289C480DD06119D038BC8E044804537D722FBCA0678FC0F9FB8D7261E27DD
SHA-512:	634B9693D6FFD1AED6CA8F03AA80B9CCE73BC9319235523C2C265110CF0A2D21D29FD8E03D2B34C1C3BF7A016BCA8A6389D1715F52BDC1049AEB877D623DB6DB
Malicious:	false
Reputation:	low
Preview:	............{..u(..4!....f._$..;.%Y.H#y...&9..n....h.h>..\|.o.;.I.\|....I.....;.wo^~.1.........4I....Ol..T.S...c.p...?.t.L.s-<..7H4.I.^xX.N.a.....I8...>...\|N...&..2..C?..o....S.^....^.........@.....zV...=9F.\\..M9.~..A..C,h....M=...<.Y.T..c7.x.ywmm}.VG..\|30C3...{i5.S2.;g..p.#..G>..'^.&a...K+..2.K.a\|/i... N....v.'._...i.&!.....A..5...]m.{...... ...O4..9M.s>..a.....A...^T..7O.Y.=...B.....E.{Q....\|ti..+..._..\|\|i..+.O/-o5..`\|y.Vy...R..X.oP:i.{.F~.kX.kp...irg...~...n..0..'~0.O.{......#/H..>9.....{....'...4....."..Qz.N#c..c/qT..9.....$.._.......U..Z5..c..F...... ....`.....l5..ns..f..A......j...6..<9.pgy...........=.`p......'FU.....5..z.....C......g;@}...r.3.9.nr..4....p...$..d9N....."..5cn...2d..a..8...........$..\.EB.4`...h3......:Q50...A.:........E oS..c.5zP...G..S..h&..e.....p.p..c.U.=.H..7...'.N*w...%.e.....f./...m{..$....4@.yZ..8........F.C........J1.....4.3z..5..dyYO.L.a.....g.W.1..12'..........]#]...%.. .9eD ...'^...0..y.........;X.'^

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.842409318889354
Encrypted:	false
SSDEEP:	3:UR89KCmH8QVVHFtroCmH8QVVHNYsHfeSXiMn:U29ZX+Vl1fX+VtYs/F
MD5:	775C34D0997B31DB0507414D72CCD1FB
SHA1:	0A3FB70C310D883E59AC6638CA7782056E299B1B
SHA-256:	76618ADCCB843D84FFBCC1250F791C9C77A0C7131E757EF0C3326036A07C5AE9
SHA-512:	24DCB6DBEAE10A538126F65A698B448DEF780EC7FC62B8E82A51D4055F31BB34AEFE946A1418F74D9900C3771B16690F8532DB0FF1B9377912EA2D85C0D78118
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk6527070280 && BMap.logCbk6527070280({"result":{"error":0}})

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	16186
Entropy (8bit):	7.895174058613172
Encrypted:	false
SSDEEP:	384:ezRv7YateIxqH9XqT/xNqEDQB2Vc7z9IxpqCvGl2npljdpxX1n/Cl:wqeqH9aTJNq+u7ZQPv+2npl5Z/W
MD5:	65F636703C763621973D766725FDA43F
SHA1:	67A4B19260557D0CB9DF93A1074B48991C4B6997
SHA-256:	4ED810D8ED5906C81E55B639AB49BC6912195C276373D3F0342A7D70BDCC2777
SHA-512:	BCD098F9F572021AD3663C01F6C339B779223B8B938BB6E9D5BDDCE3CF01491F12C0ABB5D4CDCB682D4DB9807D9F3C0C230F3FED7B2F89582D180C6B4ECCF957
Malicious:	false
Reputation:	low
URL:	http://maponline1.bdimg.com/tile/?qt=vtile&x=49626&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE............f}.k..u.........................................x..........................{................................._.........d.o......v.^........U..`m...dab....Q..\|...x.....bKGD.h..V....pHYs...........~...=.IDATx.].c.6..n.H.v...7...Hf..Wo....>.$%J..d...I\|Ix.. .Z.i.3..O0~..gg..a.....6\.T.v....~...ZA./F.Z..zm.yn}.....'.;{...;.W..8z?...,.....z5I.Y.il...!<...i..-.\;$..[X........;(~B.~...\|q...h..W...y.hl.......t..S_..].X.."@.s:..'...k..Z..p.Fq..=5..i.3...6.77.0F......G....v9.......D... ..Tr....(...2...8.......o.S.q\..S)A.v......pa..._..4P7.....3...?..?....._iA.Ba.-.6.@P..d....@.M..D..?K.a.......Z0.,..K............G..OQ/..t.4.l._C.K% l.>...h:.%...L. G...:.J......<...............,.($.4........$...#.y...).4..3.M...&..p..p......&y..d...."....J1.Tl0VsxpY.s.B.l.^.1<..M.....<..l...~.B..:.w&.n....Ch. =W....i..6.....u.On6........

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	15730
Entropy (8bit):	7.893355080220368
Encrypted:	false
SSDEEP:	384:z1ssjR07gT8whGMyUgw7PyhV2g/DIB4g6b/mGl05qzCcPNTm:ps80gyUgCyhV2KIB4Zb/mToW
MD5:	B35A99605CF4BC2E60C9E17A2BA8EA43
SHA1:	5B520EF63AA35B98A641C5DFBEDF835FF4EB52B4
SHA-256:	6A2732F5DBF27DBDA4CA146131C20731499E5364A2198AEA3A96C6E7AACEA79F
SHA-512:	E65BE325876AD0B22E9A125FF413BFAB8B6B75BF25D20EFC9B2808723825AE96017DC9FC3936AB009925D1894837B1D9E2906998A2ABB6D0FE1BCF3BA7398260
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE....................................^..U...p.d............v..........................i.....U.........l..F\|....-G.mdab.....p.J.1.............k...y..e~............u....bKGD..o......pHYs...........~...<.IDATx.].c.F...@.l...P....$[R.4......9v...'..M....ww.Jd;#"Wx><.[Md...W.........M........:_.....E..}1_-.?....b..czw....(.%.T......7.....[....(^..b.Z..J..\|#Yy+Ox.E4..M.0?f.F.........x#...v.N.g.......b..E..F...V.b!...XO....\...T..X..s....Y..\|.F..s..U....x.....j.8%.. l....X.r..@ ..V?W;f.j../W.........0.R.`..i.......I....8...9..r;...4Z.G.x....S.....i#[......V....I(..s5c&.6I."`tA7...OV.GD.D.E...WI$....}..V.$Z...K..gq.hM..#.dk...'.9\|...z.2[............0(.........X........$.p...{I...........JG....5!.......(.R..."..[.&....X...P...x..EZ .H1...g...UQ.....o.....z....\|........F.....O..L$B.\"<2.H...Jb..m./...n. @.r...... ..n......S./.

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.8983783655120074
Encrypted:	false
SSDEEP:	3:UR89KCmH9hQaGTF1oCmH9hQaGTNCgHfeSXiMn:U29Z+BGJ1f+BGBr/F
MD5:	C97C6CD4A0B06AC7C16DA2103D74F91C
SHA1:	19D5600EA31115958AE2B8E573AE759928D52974
SHA-256:	5E47774E6FC6A7FC53CBBFB67829FA17275D2C21CA6278D0573BF5255C125D2C
SHA-512:	2CF2D8102CF15EC163EEBAA3A09A90765647F5058DE5CC8291DE9BAEC25F39DAB64710ADE9E20976900BE505F81E5A29E8BC19E41250837D432DB7BBCB69A4B4
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605666438&callback=BMap.logCbk7242563566&sign=08745cff6d53
Preview:	/**/BMap.logCbk7242563566 && BMap.logCbk7242563566({"result":{"error":0}})

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 570x455, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	21142
Entropy (8bit):	7.992172962267607
Encrypted:	true
SSDEEP:	384:ROxUT3iRHAY3eFfE32muBqvLTidID0qEzmn+BFCniy9bn0h8VQbCONla8QaDpgw:goSRHT3s+RuBqjTic2S081WaQ5
MD5:	3831FB04D8FB7812709C84975401EF58
SHA1:	6A5F126EA8E095A55D25D0661768910CFE66D25E
SHA-256:	4AB6389173F0DBAFA1BD57AD297273A31DCE901C4296012E9A5AB044C301B2A6
SHA-512:	7EF9155D1268BFFC8C890A3C91D7DA57458F42AEF5C994F5F257C2B3CC4D766F81A0CB6E71D52DBCA05FBE4646D28ADC1BBB2CA5C1CCA1CC55D4E741BE5251FF
Malicious:	false
Reputation:	low
Preview:	RIFF.R..WEBPVP8 .R.......:...>m4.H$#").S.0..gn-.:...rC....b.....?.t.1W4.\|.T...2.rn}..:..........O.7.......?.z..J.W...............t,G..._.lv......^.....Nh#....>.>P.;.?.....p....g.?...^........{..7..H.#n./_...lF.K..}!=.o.l8M.~!..!.i.0.&..r..1..].....y...!/..c[,."!..2.....u..l...E........f...xX.......c\|.oZ.p../.........3.\|.1.r4...a..Y\.;.2.....4.s.Z#j$n........../...a..<............_.....W..e...8.....L.E........q...=....V8.NR8.(.)..&@[..G._.jF.v.....O..I5......m...Nu.k.i\|P......H.f..u?...#...^p.-........D..:I.x...dj.T.1x.PZKb;..n}..c.Mu....F... .GQ..2..=........b..A.Y.F._._.........{...=.l..D.p.?.>.,.F.......Sv.6h...s&..=z.{..O/.suKm.u%.9...u8..Y..js]?.-.;..LL....t D.....~..../..b1q..x".m..I.%.96....g.n....E..N..Dl2.7..L..6.FR&......[Z...U...iNv.~.l...I.w.f.B...+8(..Q.....Q3 ).P..n...".g..;vKtwQ.....Gt..E...r....N\|..l^.$....).q?.I.h1?...-.O......o>zb..[....\...Bn....v.I.......m`?..`2.5-.w.C,...>....vo.9....s..wu...j.G...s......I3.

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 80310
Category:	downloaded
Size (bytes):	13301
Entropy (8bit):	7.9868945786147245
Encrypted:	false
SSDEEP:	192:3HdU33wWVzarLEOUMt8K4k8g4vekzDGsrtbre3X8RWKrIY7X2/s9iLSQqvxYAepH:X4gWVzarLEW85mk9pHSWImX1JZTAzP
MD5:	E1EB6EF513D41B001E57D13FD1ABA179
SHA1:	2F686426DE5C5FF0D1030400CC2B3C64B443D464
SHA-256:	11E70AEB833CE6564874BA662DC88A6E1B86669935655560080D97EF82AC100A
SHA-512:	FE7DBE415F1A783FB24D0F05B878EFB238BDE0D9E3B7443D9DA94B350F04C754B23A17940EC08C4D93873054E383142E1C048932A16FFAF033135A52CBE66B4B
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/dist/styles/siteBase2.min.css?v=202408051114
Preview:	...........}k.$.q._)...AWoU.c...]..V.=..+>.#.....u[.........a.e.0d../..}.H......kx<.~..].....Y...P{]U...........v./._^....k.x=.~p..y.,....b;...t...wW7...0..%.'.T)Pf..y..>..m...[0...M._$.Ip.w..].\&...bw.....$..E....K...._'..I...\&...+..y\&.$x.Km.+..M.,...hw.....P.W..$..r2...;q..I...;/.A\|..e.l.d.m....[.+..?^~./.I....\|.(.Sp.....I..J........t.._......Q\|....3../...._.......?.7_...~.?.........?....E..~..........?../.........~......./............g.....w.o..W....d...............M.^O....I.;.f..e.-.$....y...'.W..t..Y>....T...A._...W.o....W7.V...7....Y..F#..(sP......eR.@....W...W..[.vXQ...MB<y9.....`.Kx*...y..9h5.i.xm.9.F.\|.Kt..8.#.....j1..;..W...}Ygp..6.Kt......`Q.....\^.D...%:U.....R..j...K..T.. 3..b.1....<]..oJ..d{^....?Z...<..D...>..z+`...#.A.. ^......$[.."..qzO.y..Q../...E.vw..u..(.....0..z~..An...!.w..9.....>8B...P..x..K.........a....j...0......)$.q..p$.[. .\|..;.g.zZ..`J.E0E"...8.VY.)<...4.HxH.-Yd.,.v.......?...........$.<+.U.]..vGe.....5..

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=36261355&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11657
Category:	downloaded
Size (bytes):	1573
Entropy (8bit):	7.865430863135281
Encrypted:	false
SSDEEP:	48:XS2U+M8SofuYCiW2RXPqCxVCPzCTi3Ps9:fmoWYCiFFPqEC5y
MD5:	814C15973825D52085B4CD6B32CB674C
SHA1:	F2A15653D59A617ED662B27524821694E112C643
SHA-256:	3D5FFED66B1B3FB60FAA5C3CC96BB5EE028314637DC15E09CC78E5793D8EA8DC
SHA-512:	2E42B5C0AB4CC3129E94D8AEACFDC9BE5DC0247B13ACBCA0C41EC07BC6CDEF5BF098F4688B6D5F5057E9A08596068F92F43A401F0F38522B83AC66A8D209427D
Malicious:	false
Reputation:	low
URL:	http://jzs.508sys.com/3115/fkNav.min.css?v=20240808102706&aid=28088389&wid=0
Preview:	...........Z..4...)..!..t.3..B ...]....#7..q........w..@.6H.[..Ij'.s...j.ir..>.....M.A..<x..w..g........&.._\E....'...z.H..f.g...F.G.J.x..S......L......d.....x.(...\.....~....Oe..Z_...+O....C....f.....=HP..$Z)= i1.......I.r./.eP.ZUZ.7r.$$[7...@.......?.0.1e........../..B... .2.(.....O........../...u.....lU~..{.A.}..fuOx..@.....&}......cVjW.&.G.o..R78.1..\p`F[9.]...}..............A.U.A......<8<..o...-.R.)zZ.,%B...sZ..;........@k...!.[Q....O\|...l.4ge.....lW......`"ui#.1...M..ssh. (%.lQ..P..'.........x3Ss9.....G.3zqW...h.7.M...4.B..//.2..uZ..e.fu&....`.......1h...a...*..1.....%.m.D...lI.........MR.....I.E1N.f....7i..j.....WkB.g1'z..c:..1.2..hnuL`...`.0.PBv."...q.5(Zm.lB..NI.N[.....p.J1..3..TB.Cn.$&.7,..2..t..UN=.IuN/p....x..t'.V.u.....Z../..'.......lTc._..7..~..r...!...a.\.[w&.m..Q1lzN.$..D.-U.-}.j..>6.....p.....s..dA.....w....... ...K.Abc.rKk1.C.......C.).v.q(...a}...Q.o.U5Ga..t.Eso...~...Q..WI?.W..?.....\..Mg...h....gbwg%.....

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	93
Entropy (8bit):	4.959655015521138
Encrypted:	false
SSDEEP:	3:UR8OXBL16F14BL16NYAUad2+WH8J0Tf4:U2ML16LML16GARuH8J0Tf4
MD5:	63992B08F81DF18978CDBD5AEFC24A9E
SHA1:	B4D2B45DE7DFEBB9B03B7A794A624A89E1F0764C
SHA-256:	6EEA2045BBD122DDD9D4A28D6E8039FE149DA900D1774FC0BECAAD906BC94B45
SHA-512:	25F4C208C1CC234B09C16C64A1BFEACF5D7B4C6D946E269D8D2273655AB32EB5803EE9847B074F7CDE7F8CCFFA630F3A6EDCEFA52B3C25D00D4F8C3BF537598F
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk86802&v=2.1&seckey=-1%2C-1&timeStamp=1732605606170&sign=8c783803c2fb
Preview:	/**/BMap._rd._cbk86802 && BMap._rd._cbk86802({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1198
Entropy (8bit):	6.619949663304808
Encrypted:	false
SSDEEP:	24:y1hfvWwh82lYSgNek9V0DT3xyJ3VSRgbbERgpGKC+QnztYTJXKKB1ol+M:wAvnteEeD8J3H/7p1C+A66KB15M
MD5:	D63AC2117FE24DDC715A89E55D43FD1C
SHA1:	313031B400E3CA03EF488C9A2BF22296834C4986
SHA-256:	DAB19F818F3D5AB7AC023647103735FF3A5C7319BD5F3E3FC15EC47B2F249B7D
SHA-512:	37ADCF485207F8B1FFEB9F798E68481BEDA780E3BC46462AA0D5B33A6FB2CCAE1395AF7D5CD04FCCA7D9C7657EE0ED66873EFED531C5FA77CF74450BAADF4722
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C1C0FC2CC0A511E8B3D7C46EC7D88036" xmpMM:InstanceID="xmp.iid:C1C0FC2BC0A511E8B3D7C46EC7D88036" xmp:CreatorTool="Adobe Photoshop CC 2017 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0A031052BBDB11E88063BB725C8C80DB" stRef:documentID="xmp.did:0A031053BBDB11E88063BB725C8C80DB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.z......IDATx..[n.0..P..S.XD!...,.R....%.4....V`F..F..8a.+.;9.I&:..RjF9...25.....%.Q...4e...`.r1..c\a.y...b

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 71 x 71, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1633
Entropy (8bit):	7.19908796295723
Encrypted:	false
SSDEEP:	24:n1h4SHWwh82lYSgLbIVL3T3XyJ3VG/qnu8GqUIJdHern12ymeeCsr3xwDVxzq:1KS2vnoReJ3gi3FUcdm2RV9hqzq
MD5:	E1D65A6BF0F151BF0A671C79B7943659
SHA1:	5F6D9F2839F597310D195B9F84E9833AAB13F0C2
SHA-256:	C6E2964DF8E5416A527467B0E0461D05A4959D1D8B4550A0C46DA62F85A7C1AC
SHA-512:	875F7DBE88F8642D70B32D31C35DFB0EAF88813988C5769DE9DDF93BBB69E11F30C7F07545FC55E75106C2B4A38A33DDE54E447CE0F305BC7A3DE873A602483F
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/image/site/right.png?v=202104251101
Preview:	.PNG........IHDR...G...G.....U.Z.....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:41DEBE66001A11E494DCE9E6A4A189DB" xmpMM:InstanceID="xmp.iid:41DEBE65001A11E494DCE9E6A4A189DB" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:66397EC4FC3A11E39614E69FBAB86579" stRef:documentID="xmp.did:66397EC5FC3A11E39614E69FBAB86579"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...q....IDATx..M..a...+.(_...,da. _K)cn.HJJ...Vb..X.(5QJ.....!M.BH).M...R.d...=.:.....;...ng6....9.5....c..P..P.

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	17665
Entropy (8bit):	7.941680201158753
Encrypted:	false
SSDEEP:	384:AtbcJ7So5qedFz0UI98joSepB36SJSDwuFRRQ29SsF19VCx+JMM+V9Gtg:Gbc7S/ed5OujoSeplJGwuFnX9SsZVcKO
MD5:	6A125029438194F8C88CA690DB1BA9A3
SHA1:	11B4011A62004450CD0AB0F703B6DAC394ECC610
SHA-256:	5420679044A20EE41D05B3A2062A26ACA3ECEA93F037784E66E689BEDDF2B915
SHA-512:	FBCE01489012068407DADFFA4FFC01C49059DEAEAFDA948C757EF625C3448F0EFC271A10826A595283C4BF8017B55A1244FE44D7FAF8EC2FD2A3ACFCFC681CE9
Malicious:	false
Reputation:	low
URL:	http://maponline1.bdimg.com/tile/?qt=vtile&x=24811&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE.........................................................h..........................................w....[9.`Z.................6....-..N..j..%...":.jwedi.z......c.[.....4.x>..?.\|E.~N.......bKGD...-.....pHYs...........~...C.IDATx.}.c.....Yl....H....6IO...;{......H.d.t...-I.....43..!......8.8.,..g..Q.....w_.7..Q..p6...o.........ZJ5./?\|....e..uA.."O..<.9.$...P.mMA_.N.....A.\|.......#..7......QT..E...@._.5.C21..o1.<..J...G.h......#.Y.}...(p2......0.\|.I..k....D.X>....\| ...... .2.f...0e.2.z..,.........@..J...O....P...8j....HY...(D........(....<+.'....h&..D..o......F...D'9`....bs.k.(.:.nd......S.1.i.m.-...I6.........P*.<.Q].w%..).(.a.5.(....K.....B.....z.EQ.u.TQ...&..!b...Qg'_....~..o.`..G..pb....r<.>\|...@.[..\|#.H{..A.......PuE..E..Y..T...#.. 5.TMS...I._T...+PR$.HF.A.u..U.y....8...u=.....Ec4.zK1....Q...z...$.j.X,.N.}...,V...=.....p.

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 85865
Category:	downloaded
Size (bytes):	30188
Entropy (8bit):	7.991132314432467
Encrypted:	true
SSDEEP:	768:HBdbFLszbJOMbHQ1CzjIZUnFuFL2sYeQBp/G:HFWbLbw1UI+nFuJOW
MD5:	8715F87016CFEAD2F3C6424FBE055E01
SHA1:	8DCCC7AE55EEF7473B3193BFA40681BE172448B4
SHA-256:	27BFCAC72763F815E82432278C5FADED98B5629FBFAD213F8F528C9C8419A6C9
SHA-512:	D3940BD86C4CDC4E9B630A55C083AD268FB853F4A1EE0EF1DAAF17F2ACBA7F3FB4B5697D638733B4FE3CFB38A4F865F304B98862C9D24ACB67EF41E35B596A2E
Malicious:	false
Reputation:	low
URL:	http://jzfe.faisys.com/dist/jz/locale/2052.min.js?v=202411131400
Preview:	............ys.W./.Uh".wf.2.{.{.L..6.....{n."U...TU.kA...!...IH..A...`6-H..3.._...g=yNV...=...\N..Y...9.w\|..........]=^!.....O...\.R.tgg..Y+..U.3A1...p~ls...?...:.s...s_.D........bogP.........k....<-...]~.n....k.[...V/Y...._.u.....2.w.i...a.9.........9......w..D.....#.....[...J...n.\J>Y....1;..L^,.mz2/K........c....>.......mx.g.u!..p_9....._.{}A....../..J^.._ ..x..N...I.F.._..?(.....K..W..k./.s.........:....[.b...;.AA\|..G.R.{w........^9.[...X.e.B.....+;...b.....]_W.*...e..tg}v.1.`sm.>.d'...U.A.....#.._...v%...]....oE3......Bt.ac.>.V...~.....C7.../..\}G?..A.....+.\|.=(......[.k.....=(..x........{....\|..z.\|g....v.2..l...'.F.S.+.........j......_..e..N_.g..;..{..... ...K.Y... .V..U//c....WNG..).i..?......N^......R.._.W...."\|8\|>\|4\.p.>sZ..c9X...C...-..U..w..+........i\|....<Cw.'.\|....Uy.@......A....j}.n}.t.q./...a.'.........;w.2......{._\|.^.V/....pGt.I../.h.~.../..Z.n.].'.6W..o..k..J......b...._R.............j.xis...w.is..J...

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 166618
Category:	dropped
Size (bytes):	46117
Entropy (8bit):	7.994024737440357
Encrypted:	true
SSDEEP:	768:sHqsstM3xYhzEWRwJaJgTtcrIjJXmUDl9d87RPCF8d/it/n6rvn4EC41rM22:WqssM3xYJEWHevjp9Dl9i7RPhP1Z1g22
MD5:	041F941CBF1701668F5DE4B20C586BF7
SHA1:	32191BFED8942E812081265E61BD5A0073B97ED7
SHA-256:	36C0C376365D9B29EA7DA8DCCB76820F0A2B1F0A26CBF3AD591B97A55C05002C
SHA-512:	187C474D094BF6B8CC5C54885312D24391F46C90B989239448728B2022210C2BC38A0E92B4DB84088BEF3351671414905D45BD8D9B2C8EC548DBA59C3580B354
Malicious:	false
Reputation:	low
Preview:	............w$Gr.....@...".=h.KV......K`0.`....~...F.TW5...1..;..>\|>.NgK>...'K..,..I.Jg.3......"......p...o9............Fk.~k....w..i.gQ...0..I..>s..]Oh:\.W.4c..J-g...1.?-Y.`nF..F.u.V..Eq~.....5.......r1......D...........p<.O....H...v...Y...<.....DK...@h..zs.&b@.gY.!.....<.[.mF.4K..D.F}/1.........D$....)..O....:..'.......d..;.....I~J.8(Z.,e)..u.....,..]..a..).....$:]Y.&......G.#X.....(Y..;5....t.Ir.....[.WVb.N..F..[.y4d..zs>..fN...>'.........MN.'.....:.D.`Rp.....r..L.f>..J.+.F..@...<.....E.<k..\!.!..z.e.n.....A._++7.~.l.....9O1....\.......J0..^.4p..g3...4}..'.d:qH.w..p4..b.$.......q8.."zI3.<.Q.N..:..... .._.U\|....p....V....y..$}p....d5......&.5.l'...?.>.G..1l.8J^.&....?.....E9......I......e..A.A.....o6.T2Ez.P...uL.sJq...VF...........B.&.lz.y...Y1.im.........g..2.a1.~FCF.h..:C.P`..[.....+v...BiB.,.....pP`j.w..D2.c..'...z0...s...)..R.....Q2r\|Y.p....0..._-..l...#..`.....A......4y...Ugi.F1..>O\g5_u<..D?..D.ho..?...ln..m...l;./.....h..

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 241 x 348, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15879
Entropy (8bit):	7.956293721480794
Encrypted:	false
SSDEEP:	384:Fe0YTqka8zR9Bnh+CQd2UKka3fLU1BfJxJzaELE2D76psy1k:fYGM+taUrx3LfDy1k
MD5:	8B00DD90D1585757483ECD1733AE3837
SHA1:	EDE97C29872B9304A4BD3BFB469103BCC2726AB1
SHA-256:	CDCB20E3209B45A4854F24E68784C9EE90D00894442782965084E00E63EDD374
SHA-512:	BCAD80A9DFB5540D822989F52C6BF8DAE168118624EBE21F53D75C33FB6298980155C4B97E4B12CFA10EBC8000E6AFD53139F3DC642DC1D0F8A262D0429100F7
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/image/locater/national_text.png?v=202410141113
Preview:	.PNG........IHDR.......\......>X.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C22A46CA440A11EFB9D3B9225EEAF4C1" xmpMM:DocumentID="xmp.did:5997F33E852111EFB840B5172A7050BE" xmpMM:InstanceID="xmp.iid:5997F33D852111EFB840B5172A7050BE" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2b340e22-2aed-a941-8f0a-692beb4e46ae" stRef:documentID="adobe:docid:photoshop:5516a084-cfd1-184e-a047-7a26fe51f1ef"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.i....:.IDATx...\TU...@.

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 59030
Category:	dropped
Size (bytes):	21781
Entropy (8bit):	7.987954642142
Encrypted:	false
SSDEEP:	384:9Ljjkfac1gOYHKOAlI+F2NmmmWqvyhUvTIQr3EvmBHIM2WeVDE6N:9wfac9kNmmmtKhIF3EvmqlqC
MD5:	07F9E5E007EDE4A40B91FC1CE6072CC4
SHA1:	9672B92A822D75EE689E28F462FDE70F15917660
SHA-256:	4306A8A4F5EBBD057F249396703B7D44F8F4A42054E30517DF4A3D74BAA0EDBA
SHA-512:	0E3490E14FBD6293E09AF2C3BFDE2BD6A134177280868F989A41A8D215B3DC608545756FF56AEA14CBF4533418BF7ED3AD5F7FF323C175E7350654257D5229BC
Malicious:	false
Reputation:	low
Preview:	...........ks....]......$.h>f.V3... ..x....=Puw6PDwU..x...m.d[..;VZo.".a9..{..vH...F..x.....sNfVeU.@.... .UY....\...j....Y.;.Q...?.l........ .8O.."....4.....`(F~ .V]....t,:....v\KW..$K7...M...h'.k.^...8.{..S?....b1.9....T...9.....l@0.4..8.\|.Q[........K.m.....N....D$...^.NE.\.\M..8.."~[..&i4.G.?NDd.}.v#..QP..bC..&aD}l. ......q..4.i\|..........y6....A.r\|.v..N.. ..c..$..`iI.$H..:.rt.^.\|q........5-v.....6...12.\.v......@w./.0..r.U._.P..B7.......j..:....pp.z..\|..f=...%.........Hx.H..nG.[..6.-.. .......9.....9..$.b..77k.aK.(%.......T.P.P..H...lVo..{6.OR....so...vp.4/"?Q..V.j.......p.w4..@O....v..U..M5%.:..,...2..._.<...&=.E..}cu...4..E.U........i...Y.@...k(w.. .7../....N.z.-.Q.N...f.B.F.g!..N..ot....H3..f..P.......f<.....-.....i..J`....BJ3.&..[....f...+.F..4.REV~.;.?.r..............L...P%wV....;p.#-.s..F.E-...C..f......#.X.DL.I-.k.4.....2-.@O..y.@4?.[...PD..._T.F.<.QM..6I.v..W[Xy.MDr..........6..,.l.<.j.:0.......f@.`h.Xa.a.

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 478662
Category:	downloaded
Size (bytes):	74009
Entropy (8bit):	7.994869164859142
Encrypted:	true
SSDEEP:	1536:ILsPH6M8xgA5p5Gbf2Kqzrzr38/Z/kTbMWnR4XULeqg:wEH6M8xH5sfOrPoN9WR4XiPg
MD5:	EB778ABEFAA97CAAA7FD2A9FA922D598
SHA1:	E0AB5117F4A5F6C5EFD6E63365B78D3E2432A007
SHA-256:	6DD4BF6FCEC7CB74A72B0CF45ADE539329305F7B9355209C18A19714472C5A03
SHA-512:	040EC7EA75A09EF7A28B2F9FE0A2E3599048135D782C8A1FEEA8317DA8061A999A8CDDD853D0D9959BC28168BDEA13CF876296B574226FF265EEAFA780D72114
Malicious:	false
Reputation:	low
URL:	http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713
Preview:	.............G. .+9..Ld.`>.x.cU="%..#R4.....5X.H.."........f.v.s.7..uM..j...mz3.p....G&pXT..J<@f..G.....?........G....0+...iY.v...U.]..?_..W.yqs[].......`Sl.o.eu{..C....V.l].l.........tr....v0X..Z.Yu..J.R ...X...iQ.......Z..*..Bs.6...................G.....q<...F..g.. .w.@...q...;.9.8.7E......R.=C.9.._..t].uY....}V....<[......._....d7..M.........:...3\c........a...8..0........].U..B....^...F..zD...D;..{..sbK...}_.98..J.{J..UGI...Q...<}1.....l...1.......vLFl_e..lc}2.".....-kx........,%.aN.s....b.-.y..z.w..5.`}.#.1..#..y..k..>.d.G}C.\|...m."..Gt......-.....]p..o.R. ..9..RW..f..j.....:.1m..HO.;.:q.QG.0........Q..1.#.B...wd...hl......q[.p....]....$.].<n..h...I.H.}o=.{..qk.@.zG.b.AL:2....N\|....&......E..3..DdS..O.HO.2.].}u..a.7GS. O......!..\|.l.Y..:.q.=....w..N..W...pE.%N..=._.K'.:.}.S....D'b.....5e....J...WU..UF]...[.....:t.........XF7.e.Uk...-#/.e..\.............B.....l....5.y&\....6.z....@2..G.H.5Q...O...-.r....}.,..+......f.-.

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 45
Category:	downloaded
Size (bytes):	63
Entropy (8bit):	4.576663559094718
Encrypted:	false
SSDEEP:	3:FttuMXXwLo8xWwkGxvpfY/n:XtRMxWkZY
MD5:	646789679CF9D69394C7FBC78E7FE634
SHA1:	C7095DE77233A8331035E058A29B227746E8E57D
SHA-256:	054FC8AA63E0E126EA2DA0C85C225599FFDF23B25627A444874CDD69279A7D87
SHA-512:	6B0D605FFB057211D8051A1CB6BC5C8AA90B9DC32A3902A74B6224D75CD06079846C7F422992BA17E676E442D4F1B8F72AEEA3D9703A157E297748E799467601
Malicious:	false
Reputation:	low
URL:	http://www.wheel-done.com/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie
Preview:	...........V*Q.2.Q.MNN-.V.)M.Q.-NW.RJ-*R.QJI,I.r.j.....-...

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 38
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.905297485303413
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fKPjy2DkIzxD:XtB8eKK9fd
MD5:	7103024B5D34569D2CEB1FEF0820039B
SHA1:	0DBB781F60DBE03EE5ED84DB310B01E601DE5BF1
SHA-256:	769CE690671A0B7CB3F924A3249A6E90D9D643A33CD51286262E05CC3E3EC1EA
SHA-512:	83760630526B04D9723342D4B35455F3050753AD0D4D1DC848F03A8C0A5B0CA3E3E3A41D58B35A4F0D4ADBFA23D0F411E2DCF89CFB859D7F955890F2410FC9F7
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz...l.Sf.X.^...N..w&...

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1296), with no line terminators
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	5.398466139281809
Encrypted:	false
SSDEEP:	24:moS6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9i9zeJ6IlGN19Ns/hoMGQs+:moS6JFMzjet36iotbXriYfS+FGQs+
MD5:	38150B4C90CD778187629686F15FEA01
SHA1:	7C910AB53335567B39788C95A62678C7336A6C66
SHA-256:	3DEACB0829E6153385A5B681ED899946F5D00A53A629E7138CD53E1435D9C55C
SHA-512:	865F92DAB4A41249179DE9D98ABE0D9091FD937084D45386DE18CC3B1FFDD9997CC535E849F11995CD909F89B77E8334FB3689BCD31314CE58B2301F297BC5B6
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk66656 && BMap._rd._cbk66656({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk66

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.8983783655120074
Encrypted:	false
SSDEEP:	3:UR89KCmH9hQaGTF1oCmH9hQaGTNCgHfeSXiMn:U29Z+BGJ1f+BGBr/F
MD5:	C97C6CD4A0B06AC7C16DA2103D74F91C
SHA1:	19D5600EA31115958AE2B8E573AE759928D52974
SHA-256:	5E47774E6FC6A7FC53CBBFB67829FA17275D2C21CA6278D0573BF5255C125D2C
SHA-512:	2CF2D8102CF15EC163EEBAA3A09A90765647F5058DE5CC8291DE9BAEC25F39DAB64710ADE9E20976900BE505F81E5A29E8BC19E41250837D432DB7BBCB69A4B4
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk7242563566 && BMap.logCbk7242563566({"result":{"error":0}})

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 77 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2586
Entropy (8bit):	7.9069706050837585
Encrypted:	false
SSDEEP:	48:08b3v3may6jQ4RJlmj5WjSNz9RCyYsf4tPrX0oTf3kK4IGTl1pXK3:0mPyO8j1z9IV70or3QrTlbK3
MD5:	5671641007DA542BDE236C087B3B4FE5
SHA1:	84A20702683B0CDE936C68FAEF2910D90BD107F9
SHA-256:	5F6A79338E876608D39F03C28E637CBD9158C57DCA823C76864E975249F5F2DA
SHA-512:	380C1D14E68417CF974B572A0939590D438EA693E2431C6A06EA6D52C4CDC875D7F779DA4EBC7A6039ECE0CE50402D1210675FBC53B3A7CAD2E4F6E81F712C58
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/copyright_logo.png
Preview:	.PNG........IHDR...M... .....Wc.4....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z{PT..?......yXV...(B)I...6.i....N.iF.t.L..QRB..$....Nk;.<tZkp:.mt..H........A......~..9..wq1....\|s.=..s..;.........a.I:"y...7f.#.)..M.e .%.#...M...;EW...M...z..@....'.....n....c?\|...z.$..2.....`.@._.H?.)...%~.....;::n{.....7.......;.......={.FGGgS."..a6dy....Ak"..jjj%X.c....~.p8&v..utbb..QP___.-[~Ic....q..Zf-*...\|m..o}.....)q..{...\|~a....bYAs....g.tb.&.8...=[%A....Y\|.38...U.......K..9..m.S..s.....8..)........v..CCnv.q.}Q7...e..]..~~MLLL.K..w.}.\.f!N:}......#.c.5..1.....~mW...5>>..n.HW.J.\|..C..&.....@jj.2."&&...EF....."....,Y...k.."......8h..~.../.0.....[leV..U?........XD..o...E.....#.^......Z.n]..0Eu..5A/T<B\|<V.0...'..@..(.}...........t.xF..B.K.:.}.a.`........}#K.j\|.@.f.>'J.\.;..&..2,..{"cw.zQ.=)........... wu../Izcw........B.Y..!........,5-..:u.hnn.....L..DE.V.."..H.s...(.Z...^(..~.........;w.t...4.9r..C..Qs/..)J...0kmm.....,.S:r%.\.J.S.U.......{w......

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 288896
Category:	dropped
Size (bytes):	60474
Entropy (8bit):	7.9955892447018355
Encrypted:	true
SSDEEP:	768:K0dpiAsMoASAmniAm2lOIy3djP5+bAxHMxdP6SF+QPr92jjbEeK7Mc2:KczoHAmiWONRkmHkPKY92j7KV2
MD5:	03822497706A3BCC2011F1BE276B7CD9
SHA1:	C2DBAB4FDFB09FEE003B32C4D5A4F1B80520F2DD
SHA-256:	11656776C03C68252DA01BED16D7DD90B16111C962880588BFE2F2294156FEC6
SHA-512:	1626758FCC5D0BF47E2572FB29736F3E6ABF6E3C5A0AD6937966304C5910F9B02288C4FDB654A3D936775577562AD4596ACA0BE351CCEAFAD0300B719AD8C014
Malicious:	false
Reputation:	low
Preview:	...........ks.Xv .W.h..4..LJ.!..U..b.^.YU...d...$$$.. .(27v.....=..{f6v=..<"&..l.zwz.3....'..=.......$.RW...CL..=....v8.Gy..v.2..J.^.Qn.~~>e.a..M.4...k9.d<....r>.S..Y.2...\|..a..9..7....q.2..C.:.0..,.5..T.....ZVa..Q...._U..,9.b.cv..l}.............?..p8..=....xMp........v..Q......zB./).#.B.5..M.8........._>.......}....g....>....G.ao....]P`...%.z.s..\|..-.%..,c.,OCX..I....Sv0.F..\|2.L..[=OGw7t....f...OkM.....5..Z&&.>M.!.3..v......1.O,.".<.mEA.y.d8..<...p.......{K..a.1,.....WqK.gm`.>...7.......l.R.....vU.d2I....a\|.I.,~1~...z..,..$.s..D,>..K.....r...E.L3.".c.~...'.\j...c...c}0>...+.vg.F.a8.p=p.a.....'!l.U.a.......t...)..N..IV..5;.bwa_.P....J7........../e..`..CX~....1..<..IJ.H.-[.5.\.0.C...>...%?@.<.....#.2..... ?..0.#..u.rZ......C.Mb.b.....gj6..1.e....hKr.....)U."...HU..%.VZ.b...'rb\.bM..48.]`FTY5..O....+..p.qrj..0@v......uG.j....m1.$......n:s.q..&.....$h...Y.. ......B.G..Q...$vy.... }.r..j..f..CV.y..$CZ.;a...'HV3..[.4e...ext.."e. ^..h.R.j=..

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.959655015521138
Encrypted:	false
SSDEEP:	3:UR8OXBL16F14BL16NYAUad2+WH8J0Tf4:U2ML16LML16GARuH8J0Tf4
MD5:	63992B08F81DF18978CDBD5AEFC24A9E
SHA1:	B4D2B45DE7DFEBB9B03B7A794A624A89E1F0764C
SHA-256:	6EEA2045BBD122DDD9D4A28D6E8039FE149DA900D1774FC0BECAAD906BC94B45
SHA-512:	25F4C208C1CC234B09C16C64A1BFEACF5D7B4C6D946E269D8D2273655AB32EB5803EE9847B074F7CDE7F8CCFFA630F3A6EDCEFA52B3C25D00D4F8C3BF537598F
Malicious:	false
Reputation:	low
Preview:	/**/BMap._rd._cbk86802 && BMap._rd._cbk86802({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	17366
Entropy (8bit):	7.922082606186133
Encrypted:	false
SSDEEP:	384:KxhDUSMF3ZpG19bMD0HHWVg5G57cL4u+SStXjUGnCbKWkRE/+gqB6smqxz:CDUSMlZpixMwHR5GC+SSRjUGQUREvsDP
MD5:	3F505B7FF61FB59B0800D8A1D720FF20
SHA1:	B494CEB1859E619D86E9A30AE0E5BA9B66BF5CF6
SHA-256:	D7BB96B842D60789805D1DB3831A1508968FF37C7D317F4D1A082313EB87B376
SHA-512:	3F3CC612D423DAA195C87B86B663030D0D47FC985F96D26282816DE3182F078C8948700A595FE3AFEB18BC49A1D9D356E3259EDC93312FDBFF4A8DE596FECC8E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE......................................K...1.o........................................^m..4sss........k.o.U.........z...1..a....s..&...{.....e....e..e}.7..?.\|E.~>..1.w........bKGD...L.....pHYs...........~...BfIDATx.}.c.H..F.B.1.Nl..........7....... .._..A....:.....d........L.0....xH....KF...P.?....8..._.>.L.k...M...\.........d........x..cjq..#...b/.-...x.d^>..\\.._W.H.......Ul.$.../<.....@.URX.F.i.5.V$I.1.../.'0......X.._..h....a.9c.)\.\,o.nf..t.d7....X.J=Xd<9...?.......(.....M..;W..>'.`..........c...p.E....L.P.pI.O15..=.`9.Y..7.%.M......i....r2.....umq..~..3`..ch.j..J<\|.l............+._a..o......y.G..uP.$...a....H.n......L.......L&..0`..L@%f..\.0V.#....A.U$&...u..........D.\.........^P..\|x....#n..#....^.....L.O.@.V...l........j..oc..pq\|.D.{Z.x.3........'..A..\..j..}..u..@R .....r.,.p...ci...&i.X.,'........O......*f.%.....

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	74
Entropy (8bit):	4.989660629054757
Encrypted:	false
SSDEEP:	3:UR89KCmH/5TNJoCmH/5ToHXzgHfeSXiMn:U29ZWxJfWY8/F
MD5:	165B4852E235717B9CF6EC99AE725D14
SHA1:	BCDF8D4F1AF8F29723FA9E01BCD66AF6694DAFB1
SHA-256:	646DF7F2F5DDD683BAD26380D18F2C87CD6EF6A81DD1954858D22701388D78B1
SHA-512:	819639B52F39E45DF85532A6F51637A0E0B8712B67241C871B75D155B8A58BA3F62C209028CDE57D6C53D386A760C155F317179787942D9CB60E5E58C3423D90
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605609176&callback=BMap.logCbk5542380316&sign=498e4551a420
Preview:	/**/BMap.logCbk5542380316 && BMap.logCbk5542380316({"result":{"error":0}})

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (398), with no line terminators
Category:	downloaded
Size (bytes):	398
Entropy (8bit):	5.37100634826418
Encrypted:	false
SSDEEP:	6:2LGXRNGYKfP2A5fnv5piKrN21WcMR2vVWV8mgO9l3smwEDga7Y08pfRjSYUDQp1i:2QSp2CnhpiKrOW9SWGu3smwE0Z08nfni
MD5:	F8D51CE52A42E6C44101FD6B4587B2B6
SHA1:	DD2D139576F649CA785418FFAA6D78DF43565304
SHA-256:	E6636166B3784840E2B1B8C5F2B16E671003F4B01B34A45D581AFAB9CE12307F
SHA-512:	65F9E83D96B5D9172A196B3D7688CF57FBA8869DCDA36C01FDE5C55D3461FC0733C7D47BB2F81C310D878838B01CCFCD95DE972BA1926A9BA2D68836FEBF9047
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/api?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=onlineMapCallBack
Preview:	(function(){ window.BMap_loadScriptTime = (new Date).getTime(); window.BMap=window.BMap\|\|{};window.BMap.apiLoad=function(){delete window.BMap.apiLoad;if(typeof onlineMapCallBack=="function"){onlineMapCallBack()}};var s=document.createElement('script');s.src='http://api.map.baidu.com/getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958';document.body.appendChild(s);})();

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 211932
Category:	downloaded
Size (bytes):	75209
Entropy (8bit):	7.996788640454085
Encrypted:	true
SSDEEP:	1536:/WT6nU7ok/GXDYldoVdLnxctLs5/idZ46C7rbiEjQ+qfHL8g2u7:/46uR+szirxcds5oZ46ujQ/frB
MD5:	44ABD25EA9D5E3E272E09FB2CDB4B10D
SHA1:	2C27A283F9C42683B24E1D8728849E9DCF126C4A
SHA-256:	8D717C6F9420FB409B5553C689645A9614D0F5D04E5CD75A6820D9D68D22C168
SHA-512:	A8BA293A7995052DDB8B384476701989A5E7F452DEB5CACA0DE5AA83469F7A0F748A01285743B329A47D9BB33C02A075A35F27DA9382C51DD5F2FD182CCDBAEA
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958
Preview:	...........}yW...Wqt.x.F.I..(<..!@.M8..`#...f...~U.%..{.].}.n.X]]]SOwQ7...{.....O.>..OZ...Z.I......m8.F..V.jU3.q?..p..G.c9E.j....j.#..B.+.dC...lF.l{....B..k.;...$[......h.....Z(...o.?..f..J.Q...D.Oe......Q.^.R.w..^(...G........E=p^k^...).7>i.I..8X?.X.z.a..to....OW..<<......k..??tOn....}..V...........P^...9!.B..].zw9..A...EA.2z.....q.m.o.FRj...h<..R.N&I......QK..L..^..I.....W...w.)..p..P_.^.%...j?.QC.Z.N....T..1.l!.Z...{%....'5..?f.,j....W{........F.b.....R.w..q.......~.v.$:.N:..<......9O..K1.\|.=....`.......8..7...oh.....`.d.M..wY...Q........9..,..p$.>}.p.Z...{f+.m.C.n<..............v].}....k.O}M....[@......5...).6.f^.....5.9.=.C3....xp._.....W......\...AA...gr T....rd...G.2G=.h...FQ..6n.!.W@~...\..q.b.1t%qp..f.n<l..pH.!.&.F...u.}).....!W.............>M@..d.9.-.D.K......].M.8lm...Z...~.um.[...=...eD."..m.V...l.....9...\|p.:7..v..E..E...M.Z}B...z.wr...G.......p}........x.z4....y...N_..-....0R.s..3..D.`.\...0...,.2...j$.

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	689
Entropy (8bit):	5.31969505433691
Encrypted:	false
SSDEEP:	12:2ruHna7Wgh0RPTUoDl619efhVnNwQ0uX9YSbSaGG/aGOBGuuLh20DRWZJU:2ruHalS/ZRDnNwXM3zC7+Lh7RWZJU
MD5:	28CF6173DD2BB092D3271A4721CE25B4
SHA1:	191BFD02A4C43550EAECC694DD92F62B044F949A
SHA-256:	312153B3D16B128B8A751F9020C36409B731CA0AE8861DA9C6106F899F222FAA
SHA-512:	D9051EBFD7D7BECA0967421F5E49D2FCCD229938DF89E80E0FDFB384332A61AE618279503444D3ABECE754D340588CF4B1618E1F3173E919F19779980DFE21A3
Malicious:	false
Reputation:	low
URL:	https://fe.faisco.cn/hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=0&isOem=true&webName=site
Preview:	(function() { .var fs = document.createElement("script"); .fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; .fs.id = "faiHawkEye"; .window.FAI_HAWK_EYE = {}; .window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; .window.FAI_HAWK_EYE.jssdk_report_url = "//datareport.webportal.top/js/report"; .window.FAI_HAWK_EYE.jssdk_appid = 3008; .window.FAI_HAWK_EYE.fai_is_oem = 1; .window.FAI_HAWK_EYE.fai_aid = 28088389; .window.FAI_HAWK_EYE.fai_bs_aid = 28088389; .window.FAI_HAWK_EYE.fai_bs_id = 0; .window.FAI_HAWK_EYE.fai_bs_wid = 0; .window.FAI_HAWK_EYE.fai_web_name = "site"; .var s = document.getElementsByTagName("script")[0]; .s.parentNode.insertBefore(fs, s);.})()

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	93
Entropy (8bit):	4.920841677086334
Encrypted:	false
SSDEEP:	3:UR8OXBL1DZno84BL1GNad2+WH8J0Tf4:U2ML1tno8ML1GwuH8J0Tf4
MD5:	0F31E1A59966548CACB9FC69777D31D4
SHA1:	A239FE0A092FCE63E2C7604113967B58655D4C9C
SHA-256:	12FB5966508A3FEB8B5B140C6E3D4BFD546B945A635DAB2CC6C480C89D4AD834
SHA-512:	37ED31F285507AD97102B18920EC50244C0CC4A91F72AA20DE507CADE8E1A799380B549A5E098E0E7B3C2B2B7C7777BAA618B53D3A74A9042E8F7AD718D35616
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk13991&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605662820&sign=9c0b3cebc48d
Preview:	/**/BMap._rd._cbk13991 && BMap._rd._cbk13991({"error":0,"content":{"business":1,"unauth":0}})

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x432, components 3
Category:	dropped
Size (bytes):	122466
Entropy (8bit):	7.9799058926481905
Encrypted:	false
SSDEEP:	3072:cVhbNBkQW0KLGhLmEKbMXgtimuthD1JmYqwgJYVCgnmo7SFpKR:SXW0KLNoXg0BmjwgiV7nao
MD5:	5DD5248BA6FCE85038825214DC61A2C0
SHA1:	3CD20CD51F5136C9AD52F275371C1D0AFC975E0F
SHA-256:	BDBBF484043E17A139320022A237E9F66D095DB9617B4F0EC8CB35FB2DB0D901
SHA-512:	B1A6FBEA181F94F915F8A9A7C3BDEBCCE85599C40F4EAC358F5E8627B52DC5DFB60404A81C375D8A59F0C80BFC589425A14CA4AE308F9D2F2E12F7C3E8603755
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......P...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:2C7DF338C3E711E9931DCFC8BEE002E6" xmpMM:DocumentID="xmp.did:2C7DF339C3E711E9931DCFC8BEE002E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C7DF336C3E711E9931DCFC8BEE002E6" stRef:documentID="xmp.did:2C7DF337C3E711E9931DCFC8BEE002E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 38
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.905297485303413
Encrypted:	false
SSDEEP:	3:Fttuc/IH/mAv1fKPjy2DkIzxD:XtB8eKK9fd
MD5:	7103024B5D34569D2CEB1FEF0820039B
SHA1:	0DBB781F60DBE03EE5ED84DB310B01E601DE5BF1
SHA-256:	769CE690671A0B7CB3F924A3249A6E90D9D643A33CD51286262E05CC3E3EC1EA
SHA-512:	83760630526B04D9723342D4B35455F3050753AD0D4D1DC848F03A8C0A5B0CA3E3E3A41D58B35A4F0D4ADBFA23D0F411E2DCF89CFB859D7F955890F2410FC9F7
Malicious:	false
Reputation:	low
Preview:	...........V*.MNN-.V.JK.)N.Q.-NW.Rz...l.Sf.X.^...N..w&...

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 44 x 464, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11596
Entropy (8bit):	7.940606915977558
Encrypted:	false
SSDEEP:	192:jvHlDr0nMqIIw40NYpX/7S2Rdv7rhaAg7MQN+/0OfXDPFi9m3OqmmrNulHO:jvlDoMWw4cUX2qv78AVO+80XDP49m3Ow
MD5:	8AE7EB80646C22B37FEC286DB712E2DB
SHA1:	02EE39F4C1B7E7A8389884FFB41F938A6E3921E8
SHA-256:	9EF6E8B15538DE37F6F9A935486C557018EF1B44DABBC34480AF43AC11A6497F
SHA-512:	4E57330E8538504BC039D03B461C40D3D23251C9B57D88BA8D4A801389B1FF890B4229D7481EC2626E7AE826618799C22A3150E760A3D90B275BD18F1511D67E
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/mapctrls2d0.png
Preview:	.PNG........IHDR...,................tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0180117407206811B71BEFA893479FCC" xmpMM:DocumentID="xmp.did:5F55D253175711E1AE49E7AD72699815" xmpMM:InstanceID="xmp.iid:5F55D252175711E1AE49E7AD72699815" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0780117407206811B71BEFA893479FCC" stRef:documentID="xmp.did:0180117407206811B71BEFA893479FCC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>W..G..)\|IDATx..].\|TU..f&eH/.....^B"Hqu....\|.k...

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 41031
Category:	dropped
Size (bytes):	10870
Entropy (8bit):	7.982682767743254
Encrypted:	false
SSDEEP:	192:9+o12Lnie0sZHTl0c3wk+Su2zsTUt42iJngP1dGVYu5Ajb7GLS8iVeuYSrrF1rRI:neH0sZHTunk+S8TIygzu5A6SbvT/rRI
MD5:	1FDAB41EC43EB6FEC201B05DC45BB2F5
SHA1:	108FDA83943A714CDE62258D9D484F40EDCE1B7E
SHA-256:	AF758E8702ACDE0F1BDBE3D80A86E1BA9B4BD7C5C29042C235CDF8C000575CD8
SHA-512:	F4278201413A6A97241C009262FD5C87E8267836016C8E1AF1D9A8A4CA3FA5C0436F26447D101B51B9B8B90D4D10A2EAB0DFD11C54D0319411CBA228841A2CFE
Malicious:	false
Reputation:	low
Preview:	...........}.s.H...a.......9-...Y..r4....P7....8..%..g.\|q.O..W.\|q8\|.....l.._8.U.(t.)Q...{.3"........G..tR.Y:(.tx+go..MJy<.o...B.._gyY<~..s.M.I.....8..Gr]f.x.].i..1...................e...m.b....,..A)...ww.KE...%....r...i..6..y.JB.".r\|k..7..I..e.d!.</".(....\|......JF?.8z.m.^..}..e.........$..V...r.....C.jL/..zs.\|.6W..`.6ejJ......Ee..x[.m.T..."W..[U.\|.]d..p2....6UN.$#.<M...].W....4...@-...~..u. ..I.=?.1.(.j...>.x#.mr\|.^F;D.O._%.P..z.D.. I.zj.d.#}8..5HR.L.e.t\|[...v.T.@...R.........4{...F})2.r..z.(.x..O.e.8..........f.....M.J.x....S.(.}t......4~.Bz.L..IBe......2-..R...<.o..`...wz..o.f...IM..>..#m.d`E. ...~.$$...M.H.9..S.$.D.aM"Q.)GJ...`...4<..:....A4..T=...F.A..QA....%!.j..b6..4,...1..x..m)..V..6.)..^....P).PA(_....6...4U.6....5.n,.\.;g.4...b1.*.x.....}...(Z.......[Z..@X.>.f.'...U.\#..w.H\|1x.Z..].%QzY.1..,..I`0..<...E.....MH.,.'S.M$... .A]....(...L.8.).J-...Iw.f...2...P......~....F.ix..dboi!+.<.......{.N{giY~.c...(/.

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	935
Entropy (8bit):	5.836309213842877
Encrypted:	false
SSDEEP:	24:g1hJIwWwjx82lY2T37Vkx6QeyJ3VqxPubG+zg:+kNNn2v+V1J3MAbfg
MD5:	A3C5FD99A28F0E1665B067F040023DB3
SHA1:	79FE5841F09F4D32824BA4801135AB516B5F6526
SHA-256:	506FAECFCD0DCFA482778C5E0B07251921E548FFB04652D6F7355DB36CD0B86A
SHA-512:	12573DE983B8E49C9DB42C827067210D93D75A61DB5E7FB146A15598AE59E99F07A7DAD8C2186772CFAEADEE854F0E3D37FA3C4546A8027B8D12B5FB43C2A658
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............Q.".....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1C5084813E7711E69D37E03DE81AE9D8" xmpMM:DocumentID="xmp.did:1C5084823E7711E69D37E03DE81AE9D8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1C50847F3E7711E69D37E03DE81AE9D8" stRef:documentID="xmp.did:1C5084803E7711E69D37E03DE81AE9D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^%......IDATx.b...f@.L..`..........C.~....IEND.B`.

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	82150
Entropy (8bit):	7.997509366694478
Encrypted:	true
SSDEEP:	1536:xpMuM3nfstpq/9ID2sQ6VUXuf4xo/+FxEHcP9Vrf9i41l03kE5ibwJQTwO:5M3nopqVPsQoUXufUg+XE8PPbI0hMQl
MD5:	70EB7BC64E3550BDD9F660CDF45C1FE5
SHA1:	CDB624B0CDC3B27A74325FB2C85374D839040DBA
SHA-256:	96CD875AC3E8CF69C0AACAABAD16532523077052BAD2F9DE3A32478AC6443B95
SHA-512:	00F8C2DCE3A629830F564747DAC46F348BE583033B1212EB3EA3633E45E264B2E5B938F7CDCFAB852C3899D6910A88B3B6036244C227771BC1D539C63B29E56C
Malicious:	false
Reputation:	low
Preview:	RIFF.@..WEBPVP8 .@...@.....X.>m4.I$".........gm~..U.:.....:.?...}.y..dr....{..7....,?4.....G.......p...l...h.F...@.....d..._.....p.9..]..\|.....S=k..D.q.k......Q......{.....7..........z..v.....7............G...~.....9.._.W......c......?...m..?....V~......?.~'.....K.._...\|.~a...O.....&}..c..~.{.{..o....z...l....V...u...................~...?....1.O........n~.}m...........?.{t.2.......}..l]g.>m-....'& ............'1$GDWa..;+P./[.A~.v...wC/.uN.{.b.y[p.".f,^...s=H.r.^H......g..=.(.Q...../..bF..i..qM........3{....#%3.t#..sw.......C.x{s.V..L='....j.%.w..&.T.e.~s....?XP..... .;_.i....s.T6N..n...)?...\|.=,B.`..~...]...E{....x.Gz.e}....;.....7.T.[._.z...w.@.A...`=.....d..H#.md.....V.[k#..^.E.:..9J}m.Q{.%..w..JgLD..KG.?...9..-]^<.l...F..(..f.r.H...r...~6.........cP~b..C...w1f.:j...d.6.V.z~.i....hA.+..CCs..n.S..#..yY_....L%EJ...}../....\|...k\|..P.. ....!}.t7(.z.@.rT.s....l.z..#O6..=.~.....^U.#..z`!1..#..Wg..P..=j..>M...9lt.t.1..G...Q.n:....V...._.<X8.7wn..

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.918780730435345
Encrypted:	false
SSDEEP:	3:UR89KCmH8XugAZo8oCmH8XugFwvHfeSXiMn:U29ZXXug0o8fXXugFwv/F
MD5:	94AE4D3AA93DF1E815230BC8743FE0B3
SHA1:	9341BFDBE23A37455E80A63844306CE004A31843
SHA-256:	ACEB79EDEF5BEA00AB9FCC71741C87903D55F97C694F279F7E34951A495AE779
SHA-512:	CE811629C1B0FB00DA7BB3BEC980F6C967DD50CC3B2169463FAE8A5EFDE9581CF48A0300F9938644E08044F5FEEB42F97D72C8F0DFA9396E60A9C0A32DBD2168
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk6219177233 && BMap.logCbk6219177233({"result":{"error":0}})

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 22960
Category:	downloaded
Size (bytes):	6794
Entropy (8bit):	7.974366462601837
Encrypted:	false
SSDEEP:	192:0JMD86AQp3uMPeHJAI0MfR4Lyxhx9ybII7qz6a/KX11e8YzjN5em:rD87Qt/NYRiSlyc1SsN5em
MD5:	F0991CD26EAF28B86F9F9586E5C8DF45
SHA1:	1858FF8947F231727CE1182968A3207403A48C39
SHA-256:	644FA435BCD2080191FE5A1033AF288E166FB962C023023CB21C0C93DA7A0654
SHA-512:	4420411EADAA5B5AD5F973BD2346545C44FD60539E3DEF264508CAC370D24285FE888D9B3F2C3B9D341FC01AA802AC6B1A93AC94E127BCFCC79F569B5B1E659E
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/dist/libs/photoSlide.min.js?v=202408061027
Preview:	...........<.w.6..Efo.2.h.m..i......Mn......IHDB.\...X..7....(.N......_......e.V<K.d...gaeQZ}.Y6...<+...p.f.E....W...v<K...Gl.Svx(..`...G..~...?....k.\^.$.].8S.n.D.gWf...^.o.Ypi%..<......u.]8...yI....}..e....UP..K..FR.......vU..i.....7Y..,.C....+.+...;T....>w.W.a..U...oJi]~....l`.3=7....6.Kc\s\|f.W..G........`..^w.X.T.@d.tg...../;..Z.u.....R.J.%.0+.E.H.0.A..}..`....m.1mh..s.F.d.(..G4t. ...e.Cf.KF...h.......6...7....s.1.E...2.wa...b.\..U.........I+x.v=.z.....I..Y.N...XY..i...-...v....;X..E...u...`.APUl.W...y..h.f.Hl.M......!s.+.H.Y...Ao.F... ...$......q.b.`...3X.."...$)..o#aP....i.&,.W....h...`.rC.Q\.$V.g~..\|8t.%....W......)L.m..t.)..?..<.8or.Y..o....wY......m.R....d.G..N.$.V.d%.k.Z$.....{..%.8.\5.%.5..`.........].W..xCB..y..aE.\|n.Ji.he[_XCnL."r\....W.U.[..t....(...6..<gXw...G.Y...u-.=..IP...\|;=9.....g....u#....>. VK.g.n....].#X......U...1i..A1Z.S..}%.#.....~DW..[..a...6*..........W.X..6#.Z5..n.U.J.&../I"s..Q.. .X.Z.._,.`VmZ.8....n

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 411839
Category:	dropped
Size (bytes):	97269
Entropy (8bit):	7.995796962382695
Encrypted:	true
SSDEEP:	1536:v5d8V2aPCiprqc0BWF9wtZD6W4WrdKroCpxSvYTonpopdNKZem2/5TH+Bgp0Sm9B:R2V2aPVmBkwtZDTdKrnxxTonpoH6E5Tg
MD5:	63F14930DD3B34E3AE1636407A0F25FC
SHA1:	0D9ECB8E7644367A50DC5D96A7FD01C62A2467A5
SHA-256:	A7CF3317A1D38DC15105DA4B0C93967BA23F400080138EFBE6937681615051E7
SHA-512:	C2F762542975767ADDE33D52D97A5111A89A4AD43546C62A9AAD4B5958EB6326E4CB5B849144F7362F33C5DAD16839747F309770DE6AB99736B1BA47EA0E0E06
Malicious:	false
Reputation:	low
Preview:	...........iw.8.0.....g.#.i..N).O.Nw.N..vr..t.E.....oU..H.P..y...E.`.P(..x../..N..i..{{.U..8...;7/bc6....Yf$.$.Fa.u...&..N....q.0.....Q.._..l.Zv........wz..!...:w..Y.......{#2.^]._cy.../...Q..!..O..S...GF...N...I.Xf.l.........M..O........8.>\|X......O.-B.k..h...W..S=..5..gl......"[.=........z...xX....02~O.==..a..Y..X...8......_r..L2#..-$...HV.9..SR,/.d.f......]r+.,....n.M.qFdp.....y..x..Zo....V4a2;.v..:1....x...io...T.8..f.........Nf...N...g&.B...<....[\...a.........H..v].(.;..]..M..R.T..8J...!......r?.F3..$..C....]M.!..X......,.....z;...K..q.D.;WW....O5{\fB.J....y.X..v.`Q.-.Wq.gyv+.....\|....p.3G......@.<M..x S[..d7..%..^d..b.-.cR&].+%..d.i.%..:...J...%....n....j(..._.}-.&...3c4..k...W.r_.h.I.,.g...^.......Rq1*...k...Y6....N.c....uwY.!.,5.K....l..#....bt.p..u.vM..!...c.H..g.q....e.z....v.v/.y.....y1YF.(.O...y.\...Dp......r<k....CH/..L.......Aj\|./...)Q...k.-..M..k.rN.T.. .P.E....Yp.....Y.%.......".......l..........=^{$`cSw.....z.K..M..r=..

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1314), with no line terminators
Category:	downloaded
Size (bytes):	1314
Entropy (8bit):	5.3902130153760925
Encrypted:	false
SSDEEP:	24:m6jI6u6JhVlTKWsKMzsMX/WsKtUU163uXxoQCbXd9OIl6TGizshX5GQse:mUIj6JFMzjet36iotbXrFG54Z5GQse
MD5:	AFF67D07BA289EC069F4B6E88ECE771A
SHA1:	89F6851958AD77E6712D2D34B5E6B8CEFE11D7F6
SHA-256:	35978C1D4731814946EF045BE7C1F998CC55A5556C7A15BB3963E840AE1F9E71
SHA-512:	3E4276165B102E8C15478D1FB5DEDE3CBE890D579811E7361F9D8E16C31843078E82E9E4AD99AEC11F13D3CE330C880B1CC82278646CF906549878A51BCA8594
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/?qt=cen&b=12703713.02%2C2560839.99%3B12704353.11%2C2561320.07&l=17&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk87276&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=-1%2C-1&timeStamp=1732605610224&sign=6e8c8dfcda44
Preview:	/**/BMap._rd._cbk87276 && BMap._rd._cbk87276({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"","time":0,"type":4,"qt":"cen","b":"12703713.02,2560839.99;12704353.11,2561320.07","l":"17","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk8

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 336914
Category:	dropped
Size (bytes):	80402
Entropy (8bit):	7.99624506493903
Encrypted:	true
SSDEEP:	1536:hc8l77MZXBJQ6VLzqYQTXNUY6TzyntddVoKohA2NRQFGpQVKdwJq5:D7MzJQolQTXN/6TuLdVobW230GpQYdw0
MD5:	F5F278BF1506BC20E9550A00E57BB65B
SHA1:	2A4F97C113FFB61744BAD6F9E516C6360E880839
SHA-256:	7C0C607BED68DBA312D80BD753A861F0873B29984C50E9980AD9C50B12472B9E
SHA-512:	616561F825539AED5E4978FB07196211BE73A1C36E6D44FBB0F5EC095261B36EE217C73D5C3A34BB258E8E48CD3A1F5AA133A2CD5BEDD4E9E4DF9E5FC269B6DA
Malicious:	false
Reputation:	low
Preview:	...........y.$.q .U....".....U=5.9IPsy0$%c..W.n.LuU......~..lQ.d...Z...z....~.D..y.p.....2.h...Z..<..;####"#"......Qh....h..K..I..^4..v.Q.&....Q..^....r.g..W&~.F}..A......6.'.d.=.s.......(1,R^.S.$.....Q.&..$.....-....F...~.-,..uw.......Wo_.v..N.....K...g..0A`.......)Q..z0......r..7m..f..'.H..~..+....7..r.{...Wo..v...n...Z.8.D..jv..~.8...Z..n<...x.c....2...o.Z...$.4.$.\..>,i;..g...7=.?..5/........x..tj..7..M..E"'...o.E.8+..V..4.%...........,......}....k..Z.UO........z..}7u......5...:.S...LI.[.=o9Z...M.N.fY..mF.....g.aN..FqG.(o..L.vY&.Y.]Z.E!.v..av2}^....(..ZG......T.2b...:0..`^.cw..'./.Yb......N$q.B'.......mc.2..7...X.i.. ]7......!`;.N..IDb..Y. .3. .g..N.=.m..........z.)..O's..3..N!.I..iN......f{....wb.H........>.$[._.v....x.0............."'....}>.y.8....`l@..mZ.......1hhb.[q.3.M.\|M....A............7..&k..0.."n.z.q:.F@..bMbo....]..............4q...&..".Vp.S....&I:..n{s.\a.Mkn.[Q.n..TP...g..........<ti.6.<...

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (398), with no line terminators
Category:	dropped
Size (bytes):	398
Entropy (8bit):	5.37100634826418
Encrypted:	false
SSDEEP:	6:2LGXRNGYKfP2A5fnv5piKrN21WcMR2vVWV8mgO9l3smwEDga7Y08pfRjSYUDQp1i:2QSp2CnhpiKrOW9SWGu3smwE0Z08nfni
MD5:	F8D51CE52A42E6C44101FD6B4587B2B6
SHA1:	DD2D139576F649CA785418FFAA6D78DF43565304
SHA-256:	E6636166B3784840E2B1B8C5F2B16E671003F4B01B34A45D581AFAB9CE12307F
SHA-512:	65F9E83D96B5D9172A196B3D7688CF57FBA8869DCDA36C01FDE5C55D3461FC0733C7D47BB2F81C310D878838B01CCFCD95DE972BA1926A9BA2D68836FEBF9047
Malicious:	false
Reputation:	low
Preview:	(function(){ window.BMap_loadScriptTime = (new Date).getTime(); window.BMap=window.BMap\|\|{};window.BMap.apiLoad=function(){delete window.BMap.apiLoad;if(typeof onlineMapCallBack=="function"){onlineMapCallBack()}};var s=document.createElement('script');s.src='http://api.map.baidu.com/getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958';document.body.appendChild(s);})();

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1930x600, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	270234
Entropy (8bit):	7.999275216744395
Encrypted:	true
SSDEEP:	6144:jXorsbPVsQ/oetFbq5gE8obKQotchF4oBSiAzLZIoUcETVJDR:joobPVsogfoehu5V2oU5LF
MD5:	9B1C2E08FEC6E7D14EEAAF5E6B247F7E
SHA1:	C6F26D193FC59ED831704C538956AAE0C2243A89
SHA-256:	B3E53F9DDD96B8C708F40C9BC1C63F71C5303DB3365B515972269B774C02F17B
SHA-512:	65816F39266B905A2D4517A3A944C77764BCC06E341053FE18395F10C1EB02147DC2E57327793CF8EA760C41A9DBF5F76E468C4FBD0E14076786C1B947C5F209
Malicious:	false
Reputation:	low
URL:	http://28088389.s21i.faiusr.com/2/ABUIABACGAAgloiFjAYokPLbwgcwig842AQ.jpg.webp
Preview:	RIFF....WEBPVP8 .....9.....X.>m,.F."..,.l....bl...T...zm....5.9.q....2................\.m.Og.....w....~%...>.\............{l.O.>i...G.i...p}..n.y.!...g.G.W...o...?...`...................................>........#.w..._.?.?.{............'..........{...........<n........m...W............S...^ ...O........'.7.....;..._........._....._...~..........o....??_.g....@<...._...=......_.?....a.O.....{s.g._......}..=.....................?..O..?....]...........~..`.o...g._..........Y.s........_..y.....u.....a.....k....E.......x..W...'G.q,.......\.......8.A....u..^..._..B.gC8WZ...k.C..........t{..o....ZXw"M.z...^q...W.zJ.C.MMgf..l..CfE...i.R0..U..P..0...w>x.W.@6.-O..%..........d...fH<p..........O\.2;.......6*.......>..'..$.A;..T2....m,PN.C.?bO.y......m........q.kTM.^.k..a.....(I....>....F...P>...n.-GBA&...++.....O2.ROh...]`.....e.5.-K.O.q.;...C.......p<D%..$.}4:Y..i.N....z.%..U....c...........v.+^..z._..V..>Z....K..h7=Q......s.i..D..Wo.....l

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.952432419566062
Encrypted:	false
SSDEEP:	3:UR89KCmH7bzhLFroCmH7bzhmgHfeSXiMn:U29ZghLFrfghf/F
MD5:	613FDF43A71FE351C1931BDC0BB038BA
SHA1:	9F6EB82684AD797BD1097A26FA1EB65FA00722FF
SHA-256:	0B241DD491B30E89E8FB7E542DB9CA35F9247862FF5C7C75FF4F3067EBD31861
SHA-512:	9B43BF417DFAF05D36ADE8379532BCAD6114F715A5AD2BD18B181A90D3457E458948BD82D7253D7A29BD55812B3CA3007FC8C999D7C36E944DB2676507578E6C
Malicious:	false
Reputation:	low
Preview:	/**/BMap.logCbk1399821954 && BMap.logCbk1399821954({"result":{"error":0}})

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 411839
Category:	downloaded
Size (bytes):	97269
Entropy (8bit):	7.995796962382695
Encrypted:	true
SSDEEP:	1536:v5d8V2aPCiprqc0BWF9wtZD6W4WrdKroCpxSvYTonpopdNKZem2/5TH+Bgp0Sm9B:R2V2aPVmBkwtZDTdKrnxxTonpoH6E5Tg
MD5:	63F14930DD3B34E3AE1636407A0F25FC
SHA1:	0D9ECB8E7644367A50DC5D96A7FD01C62A2467A5
SHA-256:	A7CF3317A1D38DC15105DA4B0C93967BA23F400080138EFBE6937681615051E7
SHA-512:	C2F762542975767ADDE33D52D97A5111A89A4AD43546C62A9AAD4B5958EB6326E4CB5B849144F7362F33C5DAD16839747F309770DE6AB99736B1BA47EA0E0E06
Malicious:	false
Reputation:	low
URL:	"http://api.map.baidu.com/getmodules?v=2.0&t=20140707&mod=map_5t4s3f,scommon_qzcf2k,mapclick_u1fb2e,oppc_dwynzr,navictrl_cgpeke,canvablepath_4aihkt,common_qliwoy,symbol_1t1tgb,marker_doq5jl,vectordrawlib_wqglq1,style_exrf4k,tile_znc1s3&seckey=-1%2C-1&timeStamp=1732605606185&sign=8cfb777cfc75"
Preview:	...........iw.8.0.....g.#.i..N).O.Nw.N..vr..t.E.....oU..H.P..y...E.`.P(..x../..N..i..{{.U..8...;7/bc6....Yf$.$.Fa.u...&..N....q.0.....Q.._..l.Zv........wz..!...:w..Y.......{#2.^]._cy.../...Q..!..O..S...GF...N...I.Xf.l.........M..O........8.>\|X......O.-B.k..h...W..S=..5..gl......"[.=........z...xX....02~O.==..a..Y..X...8......_r..L2#..-$...HV.9..SR,/.d.f......]r+.,....n.M.qFdp.....y..x..Zo....V4a2;.v..:1....x...io...T.8..f.........Nf...N...g&.B...<....[\...a.........H..v].(.;..]..M..R.T..8J...!......r?.F3..$..C....]M.!..X......,.....z;...K..q.D.;WW....O5{\fB.J....y.X..v.`Q.-.Wq.gyv+.....\|....p.3G......@.<M..x S[..d7..%..^d..b.-.cR&].+%..d.i.%..:...J...%....n....j(..._.}-.&...3c4..k...W.r_.h.I.,.g...^.......Rq1*...k...Y6....N.c....uwY.!.,5.K....l..#....bt.p..u.vM..!...c.H..g.q....e.z....v.v/.y.....y1YF.(.O...y.\...Dp......r<k....CH/..L.......Aj\|./...)Q...k.-..M..k.rN.T.. .P.E....Yp.....Y.%.......".......l..........=^{$`cSw.....z.K..M..r=..

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	17665
Entropy (8bit):	7.941680201158753
Encrypted:	false
SSDEEP:	384:AtbcJ7So5qedFz0UI98joSepB36SJSDwuFRRQ29SsF19VCx+JMM+V9Gtg:Gbc7S/ed5OujoSeplJGwuFnX9SsZVcKO
MD5:	6A125029438194F8C88CA690DB1BA9A3
SHA1:	11B4011A62004450CD0AB0F703B6DAC394ECC610
SHA-256:	5420679044A20EE41D05B3A2062A26ACA3ECEA93F037784E66E689BEDDF2B915
SHA-512:	FBCE01489012068407DADFFA4FFC01C49059DEAEAFDA948C757EF625C3448F0EFC271A10826A595283C4BF8017B55A1244FE44D7FAF8EC2FD2A3ACFCFC681CE9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE.........................................................h..........................................w....[9.`Z.................6....-..N..j..%...":.jwedi.z......c.[.....4.x>..?.\|E.~N.......bKGD...-.....pHYs...........~...C.IDATx.}.c.....Yl....H....6IO...;{......H.d.t...-I.....43..!......8.8.,..g..Q.....w_.7..Q..p6...o.........ZJ5./?\|....e..uA.."O..<.9.$...P.mMA_.N.....A.\|.......#..7......QT..E...@._.5.C21..o1.<..J...G.h......#.Y.}...(p2......0.\|.I..k....D.X>....\| ...... .2.f...0e.2.z..,.........@..J...O....P...8j....HY...(D........(....<+.'....h&..D..o......F...D'9`....bs.k.(.:.nd......S.1.i.m.-...I6.........P*.<.Q].w%..).(.a.5.(....K.....B.....z.EQ.u.TQ...&..!b...Qg'_....~..o.`..G..pb....r<.>\|...@.[..\|#.H{..A.......PuE..E..Y..T...#.. 5.TMS...I._T...+PR$.HF.A.u..U.y....8...u=.....Ec4.zK1....Q...z...$.j.X,.N.}...,V...=.....p.

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 570x455, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	68702
Entropy (8bit):	7.997415907732691
Encrypted:	true
SSDEEP:	1536:qELdHkyIwxVfZqi+LoucLKw7Xf54S1l0aCJgSVe+:dLtkyDGRoucLb548CJg5+
MD5:	6C14E42449CC766E7412D9EC2A857BBC
SHA1:	2BCAF1A44973563D25D38681CCC637BCAC3FFB13
SHA-256:	548963069F8ABFBCCA49F5D53B394937C6F62AEF3914F40A6550C5DAF798AC24
SHA-512:	80C62F47C18DED77C9637AA2C43484F9266E9F90E28962E9F36AF8E237B04B3C2BDD0015BFA9F7C1DB27A02E48797531326040B9C52C5CC9C64836486811EDB2
Malicious:	false
Reputation:	low
URL:	http://20228233.s61i.faiusr.com/2/AD0IidHSCRACGAAg1_Hz6gUopJONngIwugQ4xwM.jpg.webp
Preview:	RIFFV...WEBPVP8 J.......:...>m,.E."....\@......#`P..?...dQ.... ....A..`\.8..'v.d.J....y...-..........G....`?..\..?x.K~.................[_...?.........z..........c....\|.......u.K./._......9.....a......R?.......n?....I..............?S...G..........?.=.}...._.?.q>.>.....T.W...3.............T\|........?......K.........?..w...........?........g...........}......E..............._=z..=.#.\.....df...Z......]=~.\.. .peFP 1^..z.p.e~....SBT}..j.k'U%.JoA{.C&...Re.q..j?...]S..o..W\|....S.....~%..pa.v..fr..Nn...G..}..]..<.z........\|.......D.^\|o.........8/....A?./.....>...U..,}dS.t$.Sj...?....FY...-...j.)..&=..g......3....Y.[......Z..C........2.....qIR[..b -P..e+..e)...Z...@....(....p4...3mH.Epy..q...a[..#R.=..dR.h......\N~...u.w.x.pt.A......U.&...fG)..=T.a.g...Y.\|...I....l=:o.>....e9j.....hN....{.'.q...R.U..)...wr....@Ol..d..kP:a..QC..(5#.Hj17W.=.e.xh..jLC....G.KWLT%...P..i...h]3........ab..z;..\..P.z..hI8..k..%]..#.\.;..n.5.....n.Z&.[.gw..u..J..?~gQ..

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 14599
Category:	dropped
Size (bytes):	4598
Entropy (8bit):	7.962792344648021
Encrypted:	false
SSDEEP:	96:ruHEA1FYM274iRbH+kTepfYRkbXlKIa5rE1F2Adp5OvSS:ru1FYvPT+kq0kR9arE171QP
MD5:	AC98167050AE3671275A2DBF5A871E7E
SHA1:	BAFD78DB1F903B548F4A649EA52982E82BA8744C
SHA-256:	55133FC190826C6B6A98D5F9C962F7F150A02BEF84DA0319008967A01B5DDCEB
SHA-512:	4CC35C2B9FCBACFBA6AB2C28B609985C0D091C9B924B7BB03E2A8E5C43DEABC6C354CCC86995AEA3D85D6E004A024A1FC4CC55A95A4077317DE32B5D5126D54F
Malicious:	false
Reputation:	low
Preview:	...........;.s.H...+w....p..+2.#.;N....W{..j.#.FH.$.X._.C....S..J..{f.{z...s.xa.S...-..E.D.8y....Y.%q.^.L.....cJ<...k..#.z....I...x.5.......mk.....6...f>..SuD}Y..+...i.7..zS2.}.e..5...L...8.ED.y......h;..%:..\....t.. ..?..L/..I...B..d}eU.A.[.....q...X.c.....,...M.Y.....@3<...I[R@..8...\==.=..X......fsCL...Ix.yS/...}..>......mph:.......B.~...m..nA..$..k.}....~......_.V..<Nj..,.. ......0]..y..$.........!..&..C)..t.+...u.E.5..........~..3.%.\....."....C.Z{M.'.z.y...y.\|^.....1L...n@..\...@g}.......i.tZB7.....aO.rQ.&S.k.F.C..I....`\S_...%......g-].{.O......W..}.....8.i....N.....gW...M...+:...f..vLTX.{~....niLy...Y...?Nor`7...:.=?./.7../......>......^.s`P.u..N9....^>m..`.QaZ....av../H..7........K2..Hl....;..u.r..jF....{~.....M.Ry.p..`....1..<N..<...a..:]..)VN>.x.._..?..:..........z.b:~r{../....._no......~...../....#._.......$..h....T4.#...[.?.......i.L.....tg......W.......[....}.}/./.=%q.D.6..~6q.0....y>.........@N'...9O....\q..p.B....o

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, truncated
Category:	downloaded
Size (bytes):	23
Entropy (8bit):	1.5342190211803406
Encrypted:	false
SSDEEP:	3:FttTt:XtTt
MD5:	F0D79988B7772C003D04A28BD7417A62
SHA1:	58423A999EEC2997BCFFFB247E9ECD3DFD0ABF44
SHA-256:	30E6FA98FB48C2B132824D1AC5E2243C0BE9E9082FF32598D34D7687CA7F6C7F
SHA-512:	1D497009F3AABD230BCD055EF09FD180E63E330C47F4C1AFDFC36172E5421A220B78E3E3CE30C9AE533C516ACCFA8976FD3F1198BD15FF79373D5FE87FC64CD2
Malicious:	false
Reputation:	low
URL:	http://api.share.baidu.com/s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/
Preview:	.......................

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	2.7169220271182604
Encrypted:	false
SSDEEP:	3:CU+V68zlHh/:Yf/
MD5:	21AB56428956FA0823BBF6DF5F556247
SHA1:	1788A399030F630679895F9510D7712A70E401D2
SHA-256:	E8D53268D4346841C6A057CE97739A8D27EDEB858132C57B6EB2865ACC5609E4
SHA-512:	C2C3429C8277E238495EDB4AE55BCB7D09DB75978F4C94309E84B44FA88747CF87E8E606D1A69EE8A319E88E2DB2C09DCE4B986B1447C57249720C6058A938BB
Malicious:	false
Reputation:	low
URL:	http://api.map.baidu.com/images/blank.gif
Preview:	GIF89a...................!.......,...........D..;

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 94694
Category:	downloaded
Size (bytes):	33775
Entropy (8bit):	7.99179971956738
Encrypted:	true
SSDEEP:	768:sXGBtx6HNCNFyw5yw4O6sA8EXVIUHgIQrRBHv69/Jz9YcFv:fTwCWOtnA822IQTwd7
MD5:	36583E3506A4E6E7B8A4165899811A52
SHA1:	86E10FA4B98321690610489642224AB0ABB4F335
SHA-256:	D1EAECE17A9981BE8D89C1B46BBE40CEE00334CFA86F855EB448A5C7F70B57AD
SHA-512:	99A19B40136C0D18B5BC3A34C7AB8B7C6DFCB544DF6BDC76CE9F9A5DC259ADB54610D486BA544F8A134240239FFB990F431C3CA7D151260D2974080E0C8319E1
Malicious:	false
Reputation:	low
URL:	http://1.ss.508sys.com/js/comm/jquery/jquery-core.min.js?v=202307101206
Preview:	.............z.F.(."..f."...4(..k.xI..I(..D.%. ...%Y`?.}..d.,........t,...N.:.Yn.y......f-./..BV."...[.2^....y...z%.h..$.,./&.....r..QHB.....y..U..C_Q...=.{....j.=..t.@G.n._....S\.$.&Z...\|..Y%$<..<.B...,..\..D.O.....(..=.G.."......R\|.y]..\.x.}.-...(.....y.\|...H....~....W."_.........d%>........Jg..^....!...#.yt<=;..&.$<[.?......S.l._....e.)`J.....X<.?e.X......l.....g...~.z.w\|!.P..}....}.dzvu.n...L.?..W...7G.....X\B.........'........a..;....L....j.........Z.8..5....5.........YQ....l..-..=..~....Ut.M.c..,...j.9Y/.u.I.........oa`G...X....\|.....$..'..U........O.R..).l.g~p{3...g..V.H.Jf...7.B..O......~.$.\|......3.....P>^..A.z.\|.Ne%..E7....+8...BV......<..%~._......m...v;&.._...sv..R .YTPe.....B$.d..d...eR..9..\|.._.-T..a:.E...NevQ]F#..{%....1.i.....5j..$SS.A...2.8pD4.,.~...1.......N......_D...<....G.?...>l..j*G#...I..'S.G!........s.rP.b:...Vj.~...j....&.;..X...U.........6..'.\|X......W.T..a.#..L.A~...T!S.3..............a...0...J..wuxH..&..

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 52
Category:	dropped
Size (bytes):	72
Entropy (8bit):	5.043906976252533
Encrypted:	false
SSDEEP:	3:Fttuc/IHxnLAUXnTV8c0S6Fd3p/l:XtB8xUOnZp6zT
MD5:	860E06B1C62729C812D6F6B7EF744892
SHA1:	A7A35CAE7650D7C03C2274E4155E818A77116EFA
SHA-256:	9272CD767AD0096B4AEA993463A8A40BD7259B5357C11032309EBF450050F4C5
SHA-512:	CA95745DC7BE2F922FF0D1B2597E5B7A52FCD7776CBD56D89ED5EA23FEDF5C2429FAECA6BD3FEA6C9E48E3863AC6BF73089BB6D383E8CA81C613EF6C13513CBC
Malicious:	false
Reputation:	low
Preview:	...........V.MNN-.V.)*M.QJI,IT..VJ...LQ.Rr6pIt,q2Jw.J.w5.P.......j4...

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 570x455, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	14146
Entropy (8bit):	7.984742125054151
Encrypted:	false
SSDEEP:	384:UreODUIQMxCmK57gLvcLNSUd5S9DmVHgzK9opJpWtlUYaOq9rR:USOab5CMSi5SIHyiQotly
MD5:	0AB8F31CFF6C9BC7DC3C39D9E8041323
SHA1:	972F9FAF0ABB10213743674C0BE0E11B7C84C732
SHA-256:	65368BFF57982B4DC994D624A7C2E718AF3FAEDE3566BAB0D36B11DE96D15D81
SHA-512:	98B8796A1056E2F0CD03CAD64F3F08E0281E53EE107AE9851CA4E01FAFFF4513C05A5453E6944495CFF21C0DF579EC6059702558EE88E939179BCE2158D1E8D8
Malicious:	false
Reputation:	low
URL:	http://20228233.s61i.faiusr.com/2/AD0IidHSCRACGAAg1_Hz6gUo4NKP5wQwugQ4xwM.jpg.webp
Preview:	RIFF:7..WEBPVP8 .7..Pc...:...>m4.G.#'.U..P..gns.:c..:.".3..p.6....3.{l4j(.F\|{.......p.._..o..<.......z.tNz........]....%.?.97.;........3.k..}..W.......G.....#..7......0_U..f.~.T...#...`..3k....J.c...-P=P<..k...9...k...-Aq...u(..U../.`F.G.B,...K......(.........X..._H..TK......Q.;>......q.s.HM.$.V.u/NI;c....J..1;./#).B....UK.&$........~O.6..%t.}."v.........9.E.K...!d$.........}.+K...&...Hk.....M.B.i.Bq. F..l.=..g........o..t....}uM2....^.1.........x.E..KjM....p...../1?..].\.L..3~r@hV.w]...W...p.0.....l.r=....J.z....&.]4.?h9..u..s.8..?.x%....D.....m.=K.0.~85.x.f.s..V..n..t\|.o..?..."VM....K.8.;:.K..i.=...#Z....:0..N.fa)!e..xV.u^..)81E..(......Ggc..N...6o..A.)...C..$.....Y...8.9.3yT..........>...G5.....'L.}^ ...K.....+-....;.......Z].O"..}.]$....].%....EQ..A.....).;...s....NB,.g..X...w..A..X.O.u......L...g....V....v.%...<2.h.$s.[.f..Y2.Dl ..W.......5.,...A..]\|...m.]..0Sf.....#=....m......z~..`\RNX..pn..t2..z.?{..K.g..t...Wr.x#8.b.0.t..*.

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	17410
Entropy (8bit):	7.931527871261676
Encrypted:	false
SSDEEP:	384:FEUSfom1/EZR0q5Z22FUvecBPv3ncFUNf20LGJg7VkVbE0WWfeNzKv:FEhgC/EMx5GG3ncFo20yqOMKv
MD5:	714C626FFFCBE5754295A1BA5ECB946C
SHA1:	B4A6E72D608C10A5BBDFE76466EFE89C38AD27D2
SHA-256:	ABE7B0CE368409E80EF74A6E36BAEE0E4FA3E910E227640D130B2C8857D032A4
SHA-512:	C44D2232C1F422A5148C34627CF97827D410B54DBF6A6318735376F1765C8372C09816B9ED84226F7EDB7F27E214CD570342819A7A62C7CA5BF5F6A06E8CAD3E
Malicious:	false
Reputation:	low
URL:	http://maponline2.bdimg.com/tile/?qt=vtile&x=24813&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....PLTE.........g}.k..{...................................j.....................u..............v.y............d.........................S=....\|.w.....rx.bdk......f..".P......R..D..&.......bKGD...z....pHYs...........~...B.IDATx.]...6.....>....v.Kp.9..6...W.....>..fc..<....#......x..F.#.0.....T..H.'...LJ.4Jb......Y...O......o.kJ.....I9..n-.5.ysm..'....K...G.rn!.6B.b44.$~)5H.A..a.t..L.t...Z....\|X..#...z-..h..Fr..a.?..l..6.5..'._.7...4..&)tM.>.....l.x...Y..."..Q..Z. C.....:.........Z....~...<...............5..'..I.?\|^....+.=>=>..n.._....o..[.fB......r...........I.`......o>l.....x.~..<i.X.7..z.?p.Gr............q.t..;..yD...j.....c..7....H..^/...-k..g.@.^..m7r...x....@.....n...),...8`......)p.v-.!w[M.v....zn;k.D...[..~...~./..X..p..,...H.Y..@.aU.-,........5\;...5`..<.)A.1.N7.(4.\..{.. .....]...-F.Z.D@S.l..;....... .P_L...c.\|.

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1371), with no line terminators
Category:	downloaded
Size (bytes):	1371
Entropy (8bit):	5.266841489895874
Encrypted:	false
SSDEEP:	24:WC54RWMuHKFmOthmk9++35E5TJIlGhjXgfIS7sa4/M63psI8S:Wxw8hm6++3SlIGhrfeS
MD5:	777098723090D9EE49C04195A6F77AC5
SHA1:	8E211980F03F64FED70074982B98923A48674F7A
SHA-256:	5F3D3A12DEA7A21D4483981E9E086690D24C610BB8665AF63AD4593C91E213FA
SHA-512:	36AEA87FB677F2C808660D45444E93D83EE285109AA9E7CF00870D5B477EC9B6246BD4F94D24894517CFEAC1DE7B1EE18A3FE5982324CE738A09CB54C22A4AE6
Malicious:	false
Reputation:	low
URL:	https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1732605632363
Preview:	window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,e(a,o),a.onload\|\|t(a,o),r.appendChild(a)}function t(n,t){n.onload=function(){this.onerror=this.onload=null,t(null,n)},n.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),n)}}function i(n,t){var i="onreadystatechange",o="readyState";n[i]=function(){("complete"==this[o]\|\|"loaded"==this[o])&&(this[i]=null,t(null,n))}}function o(){for(;v.length;){var n=v.shift();n&&n(m)}}function r(t){if(s)return void t(m);if(f)return void v.push(t);var i=function(n){return d[h]===w\|\|n};f=!0,n(l,function(t){return i(t)?void n(l,function(n){s=!0,i(n)&&(m=n\|\|new Error("Load error")),o()}):(s=!0,o())})}function a(n,t){return function(){var i=this,o=arguments;r(function(r){return r?void(t&&t(o,r)):void d[h][n].apply(i,o)}

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:19:39.584714890 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.584794044 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.584989071 CET	49701	443	192.168.2.6	20.190.177.148
Nov 26, 2024 08:19:39.588862896 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.588979959 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.589065075 CET	49701	443	192.168.2.6	20.190.177.148
Nov 26, 2024 08:19:39.597667933 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.597712994 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.597764015 CET	49701	443	192.168.2.6	20.190.177.148
Nov 26, 2024 08:19:39.605828047 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.605969906 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.606023073 CET	49701	443	192.168.2.6	20.190.177.148
Nov 26, 2024 08:19:39.614650965 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.614829063 CET	443	49701	20.190.177.148	192.168.2.6
Nov 26, 2024 08:19:39.614880085 CET	49701	443	192.168.2.6	20.190.177.148
Nov 26, 2024 08:19:39.774748087 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:39.774800062 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:39.774889946 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:39.775607109 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:39.775624037 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:41.077128887 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.077393055 CET	49705	443	192.168.2.6	20.190.147.5
Nov 26, 2024 08:19:41.100554943 CET	49705	443	192.168.2.6	20.190.147.5
Nov 26, 2024 08:19:41.100579023 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.100917101 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.101617098 CET	49705	443	192.168.2.6	20.190.147.5
Nov 26, 2024 08:19:41.101672888 CET	49705	443	192.168.2.6	20.190.147.5
Nov 26, 2024 08:19:41.101691008 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.347372055 CET	49673	443	192.168.2.6	173.222.162.64
Nov 26, 2024 08:19:41.347379923 CET	49674	443	192.168.2.6	173.222.162.64
Nov 26, 2024 08:19:41.675550938 CET	49672	443	192.168.2.6	173.222.162.64
Nov 26, 2024 08:19:41.815857887 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.815888882 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.815929890 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.816066980 CET	49705	443	192.168.2.6	20.190.147.5
Nov 26, 2024 08:19:41.816096067 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.816111088 CET	49705	443	192.168.2.6	20.190.147.5
Nov 26, 2024 08:19:41.817948103 CET	49705	443	192.168.2.6	20.190.147.5
Nov 26, 2024 08:19:41.817971945 CET	49705	443	192.168.2.6	20.190.147.5
Nov 26, 2024 08:19:41.818109035 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.818141937 CET	443	49705	20.190.147.5	192.168.2.6
Nov 26, 2024 08:19:41.818186998 CET	49705	443	192.168.2.6	20.190.147.5
Nov 26, 2024 08:19:42.067008018 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:42.067101002 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:42.071737051 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:42.071768045 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:42.072081089 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:42.073533058 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:42.073621988 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:42.073631048 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:42.073884010 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:42.119330883 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:42.628499031 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:42.628807068 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:42.628950119 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:42.650068998 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:42.650098085 CET	443	49706	20.198.119.143	192.168.2.6
Nov 26, 2024 08:19:42.650120974 CET	49706	443	192.168.2.6	20.198.119.143
Nov 26, 2024 08:19:50.563812017 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:50.563863993 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:50.563927889 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:50.565056086 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:50.565068007 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:50.707880020 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:50.707932949 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:50.707992077 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:50.708965063 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:50.708978891 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:50.954982996 CET	49673	443	192.168.2.6	173.222.162.64
Nov 26, 2024 08:19:51.001820087 CET	49674	443	192.168.2.6	173.222.162.64
Nov 26, 2024 08:19:51.410104990 CET	49672	443	192.168.2.6	173.222.162.64
Nov 26, 2024 08:19:52.826873064 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:52.827383041 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:52.839519978 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:52.839585066 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:52.842803001 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:52.842811108 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:52.843046904 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:52.844784021 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:52.844866037 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:52.844871044 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:52.845133066 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:52.891329050 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:52.947128057 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:52.947278976 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:52.947442055 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:52.947490931 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:52.947559118 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:53.006846905 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.006922007 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.008780956 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.008802891 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.009047985 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.010448933 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.010601044 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.010615110 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.010806084 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.055336952 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.067543983 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:53.615537882 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.616552114 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.616585016 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.616604090 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.616641998 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.685147047 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.685230017 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.685302973 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.689342022 CET	49715	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:19:53.689388037 CET	443	49715	20.198.119.84	192.168.2.6
Nov 26, 2024 08:19:53.749710083 CET	443	49702	173.222.162.64	192.168.2.6
Nov 26, 2024 08:19:53.749831915 CET	49702	443	192.168.2.6	173.222.162.64
Nov 26, 2024 08:19:53.854021072 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:53.854068041 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:53.854152918 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:53.854460955 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:53.854475021 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:54.289972067 CET	49721	443	192.168.2.6	142.250.181.100
Nov 26, 2024 08:19:54.290033102 CET	443	49721	142.250.181.100	192.168.2.6
Nov 26, 2024 08:19:54.290090084 CET	49721	443	192.168.2.6	142.250.181.100
Nov 26, 2024 08:19:54.290321112 CET	49721	443	192.168.2.6	142.250.181.100
Nov 26, 2024 08:19:54.290332079 CET	443	49721	142.250.181.100	192.168.2.6
Nov 26, 2024 08:19:54.970614910 CET	49722	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:54.970660925 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:54.970763922 CET	49722	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:54.972610950 CET	49722	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:54.972620010 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:55.009850025 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.009871960 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.009886980 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.009902000 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.009932041 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.009984970 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.009999037 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.010015011 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.010030985 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.010050058 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.010052919 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.010066032 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.010081053 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.010102034 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.010113955 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.047597885 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.129981995 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.130079031 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.130253077 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.167560101 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.251590967 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.251677036 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.251914978 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.253999949 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.254122019 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.254251003 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.262511015 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.262628078 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.262972116 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.270924091 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.271055937 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.271188021 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.279350996 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.279481888 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.279546976 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.287791967 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.287950993 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.288060904 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.296225071 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.296253920 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.296607018 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.414232969 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:55.414290905 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:55.414491892 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:55.414685011 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:55.414695978 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:55.576024055 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:55.576220989 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:55.579418898 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:55.579431057 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:55.579674006 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:55.588346004 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:55.635338068 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:55.824474096 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:55.824862003 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:55.824881077 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:55.825350046 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:55.825726986 CET	49728	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:55.875613928 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.875669956 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.875699043 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.875718117 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.875734091 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.875749111 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.875751972 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:19:55.876405954 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:19:55.944545031 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:55.944762945 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:55.944806099 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:55.945035934 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:55.945035934 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:55.945043087 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:55.945188046 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:55.945581913 CET	80	49728	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:55.945666075 CET	49728	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:55.945666075 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:56.022104979 CET	49728	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:56.022227049 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:56.022227049 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:56.022344112 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:56.022453070 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:56.042217016 CET	443	49721	142.250.181.100	192.168.2.6
Nov 26, 2024 08:19:56.042927980 CET	49721	443	192.168.2.6	142.250.181.100
Nov 26, 2024 08:19:56.042959929 CET	443	49721	142.250.181.100	192.168.2.6
Nov 26, 2024 08:19:56.044169903 CET	443	49721	142.250.181.100	192.168.2.6
Nov 26, 2024 08:19:56.045710087 CET	49721	443	192.168.2.6	142.250.181.100
Nov 26, 2024 08:19:56.053988934 CET	49721	443	192.168.2.6	142.250.181.100
Nov 26, 2024 08:19:56.054064989 CET	443	49721	142.250.181.100	192.168.2.6
Nov 26, 2024 08:19:56.059160948 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.059190989 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.059207916 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.059448957 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.059472084 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.059623003 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.113497972 CET	49721	443	192.168.2.6	142.250.181.100
Nov 26, 2024 08:19:56.113534927 CET	443	49721	142.250.181.100	192.168.2.6
Nov 26, 2024 08:19:56.142493010 CET	80	49728	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:56.142585993 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:56.142601013 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:56.142671108 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:56.142817974 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:56.161283970 CET	49721	443	192.168.2.6	142.250.181.100
Nov 26, 2024 08:19:56.233625889 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.233664036 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.233772993 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.233772993 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.233793974 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.234110117 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.276829958 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.276849985 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.276911020 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.276938915 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.276973963 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.406181097 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.406209946 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.406260014 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.406285048 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.406318903 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.406336069 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.443167925 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.443187952 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.443258047 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.443280935 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.443330050 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.453612089 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:56.453695059 CET	49722	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:56.456918001 CET	49722	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:56.456929922 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:56.457190990 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:56.464303970 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.464330912 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.464399099 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.464411974 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.464463949 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.484102964 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.484129906 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.484177113 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.484224081 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.484236956 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.484277964 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.500349045 CET	49722	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:56.543339968 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:56.589231014 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.589263916 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.589312077 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.589334965 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.589361906 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.589382887 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.607525110 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.607548952 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.607593060 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.607606888 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.607650995 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.607676029 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.623060942 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.623090029 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.623131037 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.623142004 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.623187065 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.638199091 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.638222933 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.638271093 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.638283014 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.638317108 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.638335943 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.651325941 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.651395082 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.651423931 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.651433945 CET	443	49720	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.651458025 CET	49720	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.692200899 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.692248106 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.692311049 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.698399067 CET	49730	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.698450089 CET	443	49730	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.698503971 CET	49730	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.699883938 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.699906111 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.699954987 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.700469971 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.700483084 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.701617956 CET	49730	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.701628923 CET	443	49730	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.701967001 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.701975107 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.701987982 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.702001095 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.702055931 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.702151060 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.702158928 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.702697039 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.702735901 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.702791929 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.702918053 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:56.702927113 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:56.775759935 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.775899887 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.776017904 CET	49736	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.776108980 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.776199102 CET	49738	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.776290894 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.778212070 CET	49740	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.778316975 CET	49741	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.778414965 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.778507948 CET	49743	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.778717041 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.778845072 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.779103994 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.779305935 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.779405117 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.779500961 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.848561049 CET	49750	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.895797014 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.895819902 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.895874977 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.895895958 CET	80	49736	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.895901918 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.895946980 CET	49736	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.896054029 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.896089077 CET	80	49738	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.896100044 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.896105051 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.896136045 CET	49738	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.896159887 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.896382093 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.896446943 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.896825075 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.896879911 CET	49738	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.896919012 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.896965981 CET	49736	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898060083 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.898117065 CET	49740	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898214102 CET	80	49741	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.898222923 CET	49740	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898272991 CET	49741	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898313999 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.898360968 CET	49741	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898396969 CET	80	49743	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.898406029 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898444891 CET	49743	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898505926 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898555994 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.898591042 CET	49743	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898610115 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898684978 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.898736000 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898788929 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.898943901 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.901896000 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.901954889 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.902080059 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.902287006 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.902302980 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.902316093 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.902338982 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.902373075 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.902374029 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.902465105 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.902574062 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.902621031 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.968590975 CET	80	49750	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:56.968667984 CET	49750	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:56.988900900 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:56.988982916 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:56.989032030 CET	49722	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:56.989125967 CET	49722	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:56.989144087 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:56.989157915 CET	49722	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:56.989164114 CET	443	49722	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:57.016422987 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.016515017 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.016732931 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.016782045 CET	80	49738	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.016908884 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.016947031 CET	80	49736	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.018079996 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.018254042 CET	80	49741	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.018385887 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.018497944 CET	80	49743	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.018703938 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.018841982 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.021907091 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.022414923 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.022468090 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.022592068 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.026382923 CET	49751	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:57.026431084 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:57.026509047 CET	49751	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:57.026851892 CET	49751	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:57.026869059 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:57.196691036 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196713924 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196728945 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196744919 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196760893 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196775913 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196778059 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.196793079 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196805000 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.196810007 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196820021 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.196831942 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196846962 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.196850061 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.196883917 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.197154045 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197205067 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197221041 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197252035 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.197356939 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197362900 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197381020 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197396994 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197410107 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.197415113 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197422981 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.197462082 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197465897 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.197530985 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.197576046 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.242089033 CET	80	49728	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.242134094 CET	80	49728	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.242150068 CET	80	49728	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.242177010 CET	80	49728	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.242183924 CET	49728	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.242193937 CET	80	49728	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.242212057 CET	80	49728	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.242238998 CET	49728	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.242264986 CET	49728	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.254790068 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:57.255017042 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:57.255048037 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:57.256053925 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:57.256119013 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:57.257379055 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:57.257441998 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:57.257553101 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:57.257559061 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:57.301670074 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301706076 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301711082 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:57.301731110 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301745892 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301762104 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301784039 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301800013 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301812887 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.301815033 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301831007 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301842928 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.301846981 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301862955 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.301873922 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301888943 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301902056 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.301903009 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301919937 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301934958 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301948071 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.301949978 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301966906 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301966906 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.301980972 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.301995993 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.301997900 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.302020073 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.302027941 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.302141905 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.317104101 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.317140102 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.317229986 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.317439079 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.317455053 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.317635059 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.321048021 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.363953114 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.388345003 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.388361931 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.388477087 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.389379978 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.389456987 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.389787912 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.392307043 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.392409086 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.393062115 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.393570900 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.393718958 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.393933058 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.400783062 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.400897980 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.401612043 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.402024984 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.402148008 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.402623892 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.409171104 CET	80	49727	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.410454035 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.410552979 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.411051035 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.419333935 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.419388056 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.422118902 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.422164917 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.422203064 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.422213078 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.422244072 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.422286987 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.425831079 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.427385092 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.427453041 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.428286076 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.435781956 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.435847998 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.435920000 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.444236994 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.444324970 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.444796085 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.452836990 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.452898979 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.453475952 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.461143017 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.461179972 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.461874008 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.464606047 CET	49727	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.469547033 CET	80	49725	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.510219097 CET	49725	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.511789083 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.512042999 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.512217045 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.512227058 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.512311935 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.512342930 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.515990019 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.516109943 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.516498089 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.516556025 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.516638994 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.516829967 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.524493933 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.524559021 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.524688959 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.524895906 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.524966955 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.525345087 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.532493114 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.532624006 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.532866955 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.533297062 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.533382893 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.533531904 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.540955067 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.541055918 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.541397095 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.541727066 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.541843891 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.542215109 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.549367905 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.549483061 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.549932003 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.550165892 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.550327063 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.550510883 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.557835102 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.557930946 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.558262110 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.558618069 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.558706999 CET	80	49724	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.558877945 CET	49724	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.561877012 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.562201023 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.563589096 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.566272974 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.566365004 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.566838026 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.574769020 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.574875116 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.575166941 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.583178997 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.583287954 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.583384991 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.591638088 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.591727972 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.592236996 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.632327080 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.632409096 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.633940935 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.678289890 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.681840897 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.681991100 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.682104111 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.682116032 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.682218075 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.682389021 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.683476925 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.683728933 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.684072018 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.722227097 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.722264051 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.722520113 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.724714994 CET	80	49726	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:57.730838060 CET	49756	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.769145012 CET	49726	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:57.798487902 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.798764944 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.799911976 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.802347898 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.802786112 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.804506063 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.851157904 CET	80	49756	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:57.851397038 CET	49756	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:57.919903040 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.149647951 CET	80	49743	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.149668932 CET	80	49743	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.149678946 CET	80	49743	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.149692059 CET	80	49743	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.149696112 CET	80	49743	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.149698019 CET	80	49743	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.149703026 CET	80	49743	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.149787903 CET	49743	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.149878025 CET	49743	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.153949022 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.153985977 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.153992891 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.154252052 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.155606031 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.155669928 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.155677080 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.155745983 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.155751944 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.155765057 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.155771971 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.155781031 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.155805111 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.155941010 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.155952930 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.155960083 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.156023979 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.156024933 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.158900023 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.158998966 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.159256935 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.159348965 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.159354925 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.159409046 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.159409046 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.159455061 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.159456968 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.159466028 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.159471035 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.159478903 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.159543037 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.159543037 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.167521000 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167540073 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167545080 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167613029 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.167692900 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167697906 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167709112 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167715073 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167743921 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167785883 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.167794943 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167802095 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.167828083 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.167861938 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.191891909 CET	80	49738	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.198437929 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.198472023 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.198973894 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.199270010 CET	80	49736	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199343920 CET	80	49736	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199352026 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199474096 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199482918 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199490070 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199523926 CET	49736	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.199542999 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.199543953 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.199609041 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199686050 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199692011 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199759007 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199764967 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199776888 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199796915 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.199836969 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.199862957 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199868917 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199878931 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199884892 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199961901 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199966908 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199975967 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199981928 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.199990034 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.199994087 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200006008 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200012922 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200021982 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.200042009 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.200061083 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.200151920 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.200182915 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200189114 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200200081 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200205088 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200210094 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200215101 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200227022 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200232029 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200237036 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.200242996 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.200263977 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.200270891 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.200289965 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.200767040 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.201929092 CET	80	49741	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.202003002 CET	80	49741	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.202122927 CET	49741	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.204968929 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.204984903 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.205019951 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.205054045 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.205110073 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.205218077 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.238682985 CET	49738	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.249689102 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251216888 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:58.251306057 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:58.251570940 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.251672983 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:58.251679897 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251737118 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251755953 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251806974 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251825094 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251876116 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251898050 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251919031 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.251941919 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251960039 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251975060 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.251977921 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.251996994 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.252057076 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.253391981 CET	49723	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:58.253422022 CET	443	49723	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:58.275772095 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.275825977 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.275922060 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.279417992 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.279476881 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.279629946 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.283674002 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.287585974 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.287628889 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.287812948 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.291934013 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.319628000 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.319677114 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.319701910 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.319710016 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.319720030 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.319766998 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.320075035 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.320087910 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.320128918 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.320637941 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.323790073 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.323806047 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.323859930 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.324050903 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.330804110 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.347212076 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.347604990 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.347723007 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.349889994 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.351166964 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.351253986 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.351644993 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.351744890 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.351862907 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.351911068 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.354948044 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.355212927 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.355370045 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356194019 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356225967 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356237888 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356277943 CET	49740	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.356318951 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356331110 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356342077 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356353998 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356354952 CET	49740	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.356401920 CET	49740	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.356411934 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356422901 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356434107 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356446028 CET	49740	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.356476068 CET	49740	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.356839895 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.356894016 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.356971025 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.359530926 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.359620094 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.359659910 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.360294104 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.360306025 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.360373020 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.363791943 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.363897085 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.364079952 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.364590883 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.365385056 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.365431070 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.365531921 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.368643045 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.368761063 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.368803978 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.371810913 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.372070074 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.372261047 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.372273922 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.372311115 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.372361898 CET	80	49742	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.372400999 CET	49742	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.373795033 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.373857021 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.373934984 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.377023935 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.377038956 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.377151966 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.382337093 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.382392883 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.382411957 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.385463953 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.385941029 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.386003017 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.391022921 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.391037941 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.391097069 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.393832922 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.393953085 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.394004107 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.399198055 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.399281025 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.399307013 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.401225090 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.401268005 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.401281118 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.401320934 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.401385069 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.401442051 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.402141094 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.402256966 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.402297020 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.405505896 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.405519009 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.405533075 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.405558109 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.406168938 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.407735109 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.407773972 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.407810926 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.408154011 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:58.408205032 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:58.408327103 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:58.410913944 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.410927057 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.411137104 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.413387060 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:58.413450003 CET	49751	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:58.414243937 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.414272070 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.414314032 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.414707899 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:19:58.414727926 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:19:58.416186094 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.416233063 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.416903019 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.417951107 CET	49751	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:58.417964935 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:58.418222904 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:58.419388056 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.419401884 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.419456959 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.419796944 CET	49751	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:58.422122002 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.422151089 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.422218084 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.422259092 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.427421093 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.430682898 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.430697918 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.430741072 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.436973095 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.438994884 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.439035892 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.439165115 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.447380066 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.447412014 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.447547913 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.455661058 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.455765009 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.455806017 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.459711075 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.462451935 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.462585926 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.462647915 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.463336945 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:58.464108944 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.464226007 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.464281082 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.466670036 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.466736078 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.467681885 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.472450018 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.472609997 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.472978115 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.475255966 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.475317955 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.475331068 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.475364923 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.475394011 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.475408077 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.475589991 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.476213932 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.476227045 CET	80	49740	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.476280928 CET	49740	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.478550911 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.480531931 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.480690002 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.483434916 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.483520985 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.483567953 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.484491110 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.484579086 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.484781981 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.486320972 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.489183903 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.489531040 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.490400076 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.490413904 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.490731001 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.490971088 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.490974903 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.491864920 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.491971016 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.492011070 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.493092060 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.493124008 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.493763924 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.493771076 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.497292042 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.497805119 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.500272989 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.500416040 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.500469923 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.505789995 CET	443	49730	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.506158113 CET	49730	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.506177902 CET	443	49730	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.506783962 CET	49730	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.506789923 CET	443	49730	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.508658886 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.508790970 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.509012938 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.517149925 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.517246008 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.517283916 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.525557995 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.525644064 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.525723934 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.533957958 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.534037113 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.534049988 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.534092903 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.537066936 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.542159081 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.542442083 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.542454004 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.542521000 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.544296980 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.551726103 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.551768064 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.552438021 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.552444935 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.557079077 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.598534107 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.598608017 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.598787069 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.600462914 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.600563049 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.602099895 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.602124929 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.602670908 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.604664087 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.605535984 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.605596066 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.605777979 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.607081890 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.607148886 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.607157946 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.607217073 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.607217073 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.607228994 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.607243061 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.607254028 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.607258081 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.607283115 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.607362032 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.607402086 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.607469082 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.609405994 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.609570980 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.609735966 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.610697031 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.610774040 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.610800982 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.615807056 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.615842104 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.615853071 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.615854979 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.615920067 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.615951061 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.617177963 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.617255926 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.617376089 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.617650032 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.617726088 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.620963097 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.621026993 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.621027946 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.624411106 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.624497890 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.626033068 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.626077890 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.626184940 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.631223917 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.631242990 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.631282091 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.636286020 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.636324883 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.636416912 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.641419888 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.641473055 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.641532898 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.646490097 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.646547079 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.646572113 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.651626110 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.651684046 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.651684046 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.656696081 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.656783104 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.656832933 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.661825895 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.661875010 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.661891937 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671224117 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671334982 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671344995 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671381950 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671386957 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.671394110 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671401024 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671415091 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671420097 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.671459913 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.671520948 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671531916 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671544075 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.671551943 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.671588898 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.673463106 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.673631907 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.673755884 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.676237106 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.677185059 CET	80	49747	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.677233934 CET	49747	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.679804087 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.685159922 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.705262899 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.718871117 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.720762014 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.727186918 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.727308989 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.727360010 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.730484962 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.737323999 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.791408062 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.791434050 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.791490078 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.805217981 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.809453011 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.809643984 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.809695005 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.811855078 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.811985016 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.812057018 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.819935083 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.819977999 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.820023060 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.823112011 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.823282003 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.823324919 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.825613022 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.826550961 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.826608896 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.826630116 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.827835083 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.827948093 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.827985048 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.829742908 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.829752922 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.829819918 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.829864025 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.829906940 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.829916954 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.829952955 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.829957008 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.829991102 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.831756115 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.831938028 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.831964970 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.835923910 CET	80	49748	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.836632013 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.836677074 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.836683989 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.838521957 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.838712931 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.838800907 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.839672089 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.841130972 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.841274977 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.841337919 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.841707945 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.841720104 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.841732979 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.841744900 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.841749907 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.841766119 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.846187115 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.846271992 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.846308947 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.846628904 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.846669912 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.846685886 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.850235939 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.850277901 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.850338936 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.851201057 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.851243019 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.851334095 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.851670027 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.851747036 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.851788998 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.856169939 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.856292009 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.856545925 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.856761932 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.856782913 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.856825113 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.858856916 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.858901978 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.858951092 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.861215115 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.861326933 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.861368895 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.861752987 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.861814022 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.861841917 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.866436005 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.866518021 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.866780043 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.867034912 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.867109060 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.867140055 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.867650986 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.867741108 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.867779016 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.871187925 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.871294975 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.871335983 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.871777058 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.871833086 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.871911049 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.876260996 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.876310110 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.876425982 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.876815081 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.876863003 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.876883984 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.879182100 CET	49748	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.882178068 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.882236958 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.882281065 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.882304907 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.882316113 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.882489920 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.882497072 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.882524967 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.882663965 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.885693073 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.886219025 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.886317015 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.886389017 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.886887074 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.887027025 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.887033939 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.887181997 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.887301922 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.887346983 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.891392946 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.891489029 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.891525984 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.891926050 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.891971111 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.892127991 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.895909071 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.895952940 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.895958900 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.896420002 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.896492958 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.896605015 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.896929979 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.896996021 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.897156000 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.901362896 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.901484013 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.901556969 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.902004004 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.902055025 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.902097940 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.904028893 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.904078960 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.904232025 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.906322956 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.906450987 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.906497002 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.907006025 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.907052040 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.907061100 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.911329031 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.911413908 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.911451101 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.912494898 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.912543058 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.912628889 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.916367054 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.916409969 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.916446924 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.922049999 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.922070980 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.922094107 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.922491074 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.922601938 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.922643900 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.926346064 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.926397085 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.926486015 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.929209948 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.929230928 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.929255962 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.935642004 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.935663939 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.935722113 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.935734034 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.935925961 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:58.935980082 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:58.936044931 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.936058044 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.936065912 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.936081886 CET	49751	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:58.936172009 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.936196089 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.936235905 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.936547041 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.937402964 CET	49751	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:58.937417984 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:58.937429905 CET	49751	443	192.168.2.6	69.192.160.109
Nov 26, 2024 08:19:58.937433958 CET	443	49751	69.192.160.109	192.168.2.6
Nov 26, 2024 08:19:58.937604904 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.937654018 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.937702894 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.939150095 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.939209938 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.940227032 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940285921 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940305948 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940315962 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940327883 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940347910 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940347910 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.940387011 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.940421104 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940432072 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940443993 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940455914 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.940465927 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.940495968 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.940967083 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.940996885 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.941071987 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.941303015 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.941313028 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.941761017 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.941771030 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.941783905 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.941787958 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.944987059 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.945012093 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.945204973 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.945437908 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.945446014 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.946044922 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.946118116 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.946146011 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.949733019 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.949743986 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.949793100 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.949800014 CET	443	49730	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.949853897 CET	443	49730	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.949894905 CET	49730	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.950179100 CET	49730	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.950187922 CET	443	49730	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.950201988 CET	49730	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.950207949 CET	443	49730	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.953665018 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.953699112 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.953753948 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.954091072 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:58.954101086 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:58.954399109 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.954457998 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.954636097 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.957951069 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.959583998 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.959697962 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.959742069 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.962059975 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.962812901 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.962857962 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.962933064 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.994869947 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.994918108 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.994926929 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.994960070 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.995011091 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995023012 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995054960 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995063066 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.995066881 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995079994 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995093107 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995102882 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.995105028 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995131016 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.995146036 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.995254040 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995328903 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995338917 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995352030 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995379925 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.995399952 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.995454073 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995595932 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995662928 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.995724916 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995735884 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995773077 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:58.995928049 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995939970 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:58.995970011 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.002566099 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.002624989 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.002635956 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.004286051 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.009816885 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:59.009845972 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:59.009898901 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:59.009912014 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:59.009924889 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:59.009946108 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:59.009973049 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:59.010188103 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:59.010199070 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:59.010207891 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:59.010211945 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:59.012744904 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:59.012769938 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:59.012836933 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:59.012972116 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:19:59.012981892 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 08:19:59.015100002 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.015192986 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.015228987 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.017201900 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.017422915 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.017467022 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.021604061 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.023209095 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.023247004 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.023307085 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.027628899 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.027673960 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.027734995 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.030651093 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.030708075 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.030783892 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.030849934 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.030946016 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.030978918 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.031857014 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.031903982 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.031985998 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.032829046 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.032869101 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.032924891 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.034516096 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.035890102 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.035938025 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.035970926 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.035983086 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.035995007 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.036019087 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.037214041 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.037322998 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.037354946 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.039926052 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.039963961 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.039968967 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.041620016 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.041760921 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.041863918 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.043232918 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.043276072 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.043351889 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.043917894 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.043971062 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.044003010 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.045845985 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.045929909 CET	80	49744	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.045973063 CET	49744	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.047976017 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.048079967 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.048135042 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.049005032 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049124002 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049166918 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049179077 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049186945 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.049209118 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049211979 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049225092 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.049248934 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049261093 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.049262047 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049273968 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049287081 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.049304008 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.049330950 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.050556898 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.050615072 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.050652981 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.050723076 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.051810026 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.051927090 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.051980019 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.056828976 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.056852102 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.056906939 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.058077097 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.058123112 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.058131933 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.059732914 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.059787035 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.059830904 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.060275078 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.060312033 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.060385942 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.063761950 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.063813925 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.063878059 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.065541983 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.065659046 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.065937042 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.067888021 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.067954063 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.067964077 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.071660042 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.071739912 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.071753025 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.072770119 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.072807074 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.072873116 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.076009989 CET	49770	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.080127954 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.080213070 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.080241919 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.087734938 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.087749004 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.087791920 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.092075109 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.092236042 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.092449903 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.093102932 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.093159914 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.093377113 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.094769001 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.094861984 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.094902039 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.098692894 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.098812103 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.098845005 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.100267887 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.100368023 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.100480080 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.104305983 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.104408979 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.104449987 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.105659962 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.105815887 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.105906963 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.109877110 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.109955072 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.110028028 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.111212969 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.111330032 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.111562967 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.111881971 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.114872932 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.114907026 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.114958048 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.115259886 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.115385056 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.115417004 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.115492105 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.115504980 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.115536928 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.116652966 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.116676092 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.116722107 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.119129896 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.119256020 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.119309902 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.119479895 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.121160030 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.121176004 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.121212006 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.122009993 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.122091055 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.122160912 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.126712084 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.126791000 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.127456903 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.132322073 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.132400990 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.132498026 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.136508942 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.136624098 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.136658907 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.144921064 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.145039082 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.145097971 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.153393984 CET	80	49752	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.158792973 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.169173002 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.169280052 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.169322968 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.174146891 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.195892096 CET	80	49770	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.195956945 CET	49770	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.196156979 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.196170092 CET	49770	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.196197033 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.196240902 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.196423054 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.196461916 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.196537018 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.200407982 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.200512886 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.200612068 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.200617075 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.200700998 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.200866938 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.205140114 CET	49752	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.208818913 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.208924055 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.209079981 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.209132910 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.209175110 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.209295988 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.217241049 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.217418909 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.217469931 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.217556000 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.217569113 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.217608929 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.225692987 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.225732088 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.225841999 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.225960970 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.226063967 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.226098061 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.232004881 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.232105017 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.232358932 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.234080076 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.234190941 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.234204054 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.234265089 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.234273911 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.234309912 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.234378099 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.234529018 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.234568119 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.238518953 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.240076065 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.240119934 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.240159035 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.240916014 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.240963936 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.241022110 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.242475033 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.242604017 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.242667913 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.242912054 CET	80	49754	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.244677067 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.244714975 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.244813919 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.245493889 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.247062922 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.247117043 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.247239113 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.248929024 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.248959064 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.248977900 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.250902891 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.251061916 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.251108885 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.252715111 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.252752066 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.252851963 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.255012035 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.255064011 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.255127907 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.256683111 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.256750107 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.256766081 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.259310961 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.259531975 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.259588957 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.260574102 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.260608912 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.260648966 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.263472080 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.263541937 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.263551950 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.264410973 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.264458895 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.264520884 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.267261028 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.267332077 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.267385006 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.268284082 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.268345118 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.268378019 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.271888971 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.271939039 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.272059917 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.272188902 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.272234917 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.272368908 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.275634050 CET	80	49753	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.276894093 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.276949883 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.276954889 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.279921055 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.279964924 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.280004978 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.280324936 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.280369997 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.280420065 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.283217907 CET	49754	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.283771038 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.283830881 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.283886909 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.287681103 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.287728071 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.287760019 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.288826942 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.288868904 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.289052963 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.291738987 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.291784048 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.291837931 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.295521021 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.295598030 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.295623064 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.297173977 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.297214985 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.297235966 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.299288034 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.299331903 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.299361944 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.303231955 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.303304911 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.303304911 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.305574894 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.305619955 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.305679083 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.307003975 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.307065964 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.307140112 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.310885906 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.310992002 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.311005116 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.314043045 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.314091921 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.314119101 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.314815044 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.314893961 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.314925909 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.316011906 CET	80	49770	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.318624020 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.318742037 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.318773031 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.322415113 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.322468042 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.322509050 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.322520971 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.322546005 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.326514006 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.326528072 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.326562881 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.330420017 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.330490112 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.330518961 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.332453012 CET	49753	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.360980034 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.361035109 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.363698006 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.378993034 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.432877064 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.432971001 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.433170080 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.433227062 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.433291912 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.433337927 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.434756041 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.434873104 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.434921980 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.435512066 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.435666084 CET	80	49755	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.436022043 CET	49755	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.437773943 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.438919067 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.438956976 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.438966036 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.441998005 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.442055941 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.442120075 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.445149899 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.445192099 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.445234060 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.448014975 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.448079109 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.448108912 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.452100039 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.452169895 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.453202963 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.455156088 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.455202103 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.455275059 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.456459999 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.456513882 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.456588984 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.459255934 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.459355116 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.459410906 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.461987972 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.462054968 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.462186098 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.464731932 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.464833021 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.464876890 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.467448950 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.467524052 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.467552900 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.470207930 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.470263958 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.470366001 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.473131895 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.473164082 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.473207951 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.476290941 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.476303101 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.476342916 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.478425980 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.478559971 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.478589058 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.481168985 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.481220007 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.481280088 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.483911991 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.483959913 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.484002113 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.486666918 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.486713886 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.486756086 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.489427090 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.489485025 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.489497900 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.492182970 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.492232084 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.492258072 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.494982004 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.495182037 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.495230913 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.497669935 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.497726917 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.497765064 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.501091957 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.501178026 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.501219034 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.503345013 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.503369093 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.503434896 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.505870104 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.505928040 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.505984068 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.508976936 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.509111881 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.509159088 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.511332035 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.511369944 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.511409998 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.514105082 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.514153957 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.514192104 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.516824007 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.516896963 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.516897917 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.521938086 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.521955967 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.521981955 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.524703979 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.524852037 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.525053978 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.526947975 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.526961088 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.526993036 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.529037952 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.529079914 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.529207945 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.531824112 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.531868935 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.532006025 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.534610987 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.534655094 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.534792900 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.537446022 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.537456989 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.537492037 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.539716959 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.539729118 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.539755106 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.541510105 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.541553974 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.541582108 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.544331074 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.544385910 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.544434071 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.547024965 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.547070980 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.547081947 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.549935102 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.549978018 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.550149918 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.552618027 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.552649975 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.552661896 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.555174112 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.555217028 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.555289984 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.557920933 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.558013916 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.558028936 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.560652018 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.560697079 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.634546995 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.634601116 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.634869099 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.635503054 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.635633945 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.635683060 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.637630939 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.637741089 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.637800932 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.640352964 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.640430927 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.640480995 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.642005920 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.642107964 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.642155886 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.644093037 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.644222975 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.644268036 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.646169901 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.646317005 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.646361113 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.648238897 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.648353100 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.648469925 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.650336027 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.650363922 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.650465965 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.652355909 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.652430058 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.652765989 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.654324055 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.654432058 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.654747963 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.656280041 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.656387091 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.656440020 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.658238888 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.658345938 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.658503056 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.660155058 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.660269976 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.660306931 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.662081003 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.662195921 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.662530899 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.663959026 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.664068937 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.664362907 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.665843010 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.665935993 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.665975094 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.667682886 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.667793036 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.667886972 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.669568062 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.669671059 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.669718027 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.671402931 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.671549082 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.671665907 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.673161030 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.673281908 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.673732996 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.674981117 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.675054073 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.675153971 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.676781893 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.676897049 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.676938057 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.678530931 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.678608894 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.678940058 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.680315018 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.680423975 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.680766106 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.682045937 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.682162046 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.682310104 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.683820963 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.683927059 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.683967113 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.685637951 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.685729980 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.685843945 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.686465025 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.686579943 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.686629057 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.687433958 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.687568903 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.687613964 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.688427925 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.688543081 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.688868046 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.689423084 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.689541101 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.689573050 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.690382957 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.690512896 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.690696001 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.691346884 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.691463947 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.691535950 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.692342997 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.692468882 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.692504883 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.693322897 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.693420887 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.693722010 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.694281101 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.694401026 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.694444895 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.695285082 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.695388079 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.695466995 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.696263075 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.696369886 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.696475029 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.697246075 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.697463036 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.697654009 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.698240995 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.738526106 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.743453979 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.744187117 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:59.759584904 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.760175943 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.778907061 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.780855894 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.817545891 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.817564964 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.817642927 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.818933010 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.863687038 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.864284039 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:59.864391088 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:59.864609957 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:19:59.867603064 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.867615938 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.867631912 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.867671967 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.867786884 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.867799044 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.867810011 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.867820978 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.867832899 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.867841005 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.867875099 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.867949963 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.867964029 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868009090 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.868426085 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868576050 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868588924 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868601084 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868612051 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868623018 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.868624926 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868638039 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868654013 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868659019 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.868676901 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.868689060 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.868716955 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.868729115 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.870726109 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.879832029 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.880297899 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.901046038 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.901951075 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.902111053 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.902127028 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.902141094 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.902153015 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.902200937 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.903892040 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.938847065 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967356920 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967442036 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967454910 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967467070 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967483997 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967504025 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967516899 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967529058 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967539072 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967552900 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.967552900 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.967552900 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.967588902 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.967588902 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.984639883 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:19:59.987649918 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.987693071 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.987734079 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.988607883 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.988725901 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:19:59.988795042 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:19:59.991748095 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.024174929 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.032536983 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.059726000 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.059767008 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.059856892 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.060165882 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.060296059 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.060668945 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.063781023 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.063976049 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.064018965 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.064271927 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.064397097 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.064659119 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.072129011 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.072236061 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.072562933 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.072798014 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.072994947 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.073124886 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.080499887 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.080665112 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.080705881 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.080791950 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.080938101 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.081470966 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.087557077 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.087645054 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.088051081 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.088907003 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.089019060 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.089243889 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.089396954 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.089535952 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.089782953 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.097493887 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.097538948 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.097573042 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.097803116 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.097870111 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.097919941 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.105694056 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.105762959 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.106090069 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.106151104 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.106247902 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.106292963 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.114058018 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.114171982 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.114320040 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.114593029 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.114703894 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.114928007 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.122675896 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.122725964 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.123023987 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.123091936 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.123898983 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.130883932 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.131104946 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.131679058 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.139235020 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.140127897 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.153635025 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.153697968 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.153789997 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.155906916 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.156022072 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.156063080 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.160460949 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.160599947 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.160645008 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.165070057 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.165179014 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.165220022 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.169775009 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.169955015 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.170229912 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.170239925 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.170283079 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.170466900 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.170492887 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.170602083 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.171684027 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.172597885 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.172748089 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.172785044 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.177562952 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.177675009 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.177885056 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.177938938 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.177999973 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.178041935 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.182110071 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.182214975 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.182409048 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.185919046 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.186022997 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.186281919 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.190479994 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190510988 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190521002 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190592051 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.190612078 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190709114 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190720081 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190761089 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190773964 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190778971 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.190784931 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.190813065 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.190875053 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190886974 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190898895 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.190928936 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.193330050 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.193396091 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.193413019 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.194304943 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.194385052 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.195686102 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.198947906 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.199230909 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.200078964 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.202709913 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.202845097 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.203675985 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.207287073 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.207393885 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.207802057 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.211227894 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.211292028 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.211674929 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.215648890 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.215775967 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.219460964 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.219646931 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.223819971 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.224208117 CET	49736	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.224302053 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.224443913 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.224519968 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.230669022 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.232506990 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.232621908 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.232675076 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.234821081 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.235198021 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.235248089 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.235259056 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.235308886 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.235336065 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.235400915 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.235414028 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.235438108 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.235460997 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.235518932 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.235531092 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.235543013 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.235564947 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.237864971 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.240864038 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.240981102 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.241206884 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.243797064 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.243822098 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.243833065 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.243875027 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.244231939 CET	49772	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.245273113 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.249279022 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.249409914 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.249454021 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.252197027 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.252266884 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.257940054 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.258140087 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.258188963 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.260176897 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.268178940 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.268245935 CET	49738	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.298077106 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.311311007 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.311459064 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.311510086 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.314760923 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.314860106 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.314872980 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.314898968 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.314969063 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.314980030 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.314990997 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.315001965 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.315009117 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.315046072 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.319222927 CET	49773	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.319636106 CET	49774	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.320144892 CET	49775	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.323116064 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.323208094 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.323246956 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.331521034 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.331592083 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.331631899 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.337290049 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.337353945 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.337384939 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.343821049 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.344127893 CET	80	49736	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.345542908 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.345647097 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.345927954 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.348702908 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.350604057 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.354897022 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.355185986 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.355232000 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.355273008 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.360553026 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.364119053 CET	80	49772	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.364180088 CET	49772	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.364880085 CET	49772	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.365196943 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.386885881 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:20:00.388075113 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.388142109 CET	80	49738	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.388303041 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.388411999 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.388449907 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.390934944 CET	80	49765	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.391545057 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.391566992 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.391606092 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.399686098 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.399698019 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.399710894 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.399739981 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.407680988 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.407692909 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.407720089 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.415689945 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.415708065 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.415734053 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.423691034 CET	80	49760	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.423741102 CET	49760	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.427540064 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:20:00.427563906 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:20:00.428697109 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:20:00.428752899 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:20:00.434894085 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.434906006 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.435029030 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.439688921 CET	80	49773	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.439698935 CET	80	49774	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.439762115 CET	49773	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.439773083 CET	49774	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.441414118 CET	49765	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.443682909 CET	80	49775	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.443743944 CET	49775	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.447694063 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.447705030 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.447752953 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.448033094 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.448046923 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.448174000 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.455924034 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.456058025 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.456099987 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.457743883 CET	80	49770	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.457914114 CET	80	49770	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.457972050 CET	49770	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.463151932 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.463166952 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.463270903 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.470082998 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.470745087 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.470796108 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.479043961 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.479058981 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.479126930 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.484903097 CET	80	49772	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.486062050 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.486332893 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.486392021 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.494155884 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.494209051 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.494256973 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.501205921 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.501291037 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.501341105 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.508137941 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.508238077 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.508302927 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.515081882 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.515372992 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.515419960 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.516299963 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.516401052 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.516450882 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.519964933 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.520088911 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.520147085 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.522104979 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.522198915 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.522244930 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.524297953 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.524352074 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.524401903 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.525767088 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.525881052 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.525954962 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.527513027 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.527571917 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.527623892 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.529194117 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.529228926 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.529264927 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.529278040 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.529316902 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.529359102 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.534991980 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.535027981 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.535092115 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.535128117 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.535200119 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.535254002 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.538176060 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.538228989 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.538296938 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.539418936 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.539583921 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.539638996 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.540235996 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.540333033 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.540380001 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.543116093 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.543284893 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.543329954 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.544949055 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.545001984 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.545059919 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.546605110 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.546792984 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.546843052 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.549802065 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.549920082 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.549972057 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.551044941 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.551080942 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.551129103 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.551647902 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.551712036 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.551759005 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.554028034 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.554075956 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.554137945 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.556967020 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.557086945 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.557132959 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.557765961 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.557931900 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.557982922 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.558659077 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.558712006 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.558764935 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.562680960 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.562804937 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.562850952 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.563396931 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.563431978 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.563481092 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.565351009 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.565515041 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.565562010 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.567672968 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.568108082 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.568201065 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.568234921 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.568244934 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.568286896 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.568332911 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.572964907 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.573072910 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.573106050 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.573117018 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.573141098 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.573190928 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.573626995 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.573728085 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.573776007 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.577781916 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.577891111 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.577944994 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.578938007 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.579099894 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.579154968 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.579230070 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.579267979 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.579319954 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.582592010 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.582726002 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.582782984 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.584750891 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.584861994 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.584904909 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.584975958 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.585011005 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.585057974 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.587373972 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.587517977 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.587574005 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.590405941 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.590503931 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.590544939 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.590863943 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.591137886 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.591177940 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.592171907 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.592283010 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.592334032 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.595880985 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.595956087 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.596009970 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.597093105 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.597126961 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.597162008 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.597172976 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.597196102 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.597265959 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.601449966 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.601553917 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.601608992 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.601730108 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.601856947 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.601908922 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.602956057 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.603091002 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.603136063 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.606549025 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.606699944 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.606759071 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.607037067 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.607186079 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.607228994 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.608872890 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.609087944 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.609137058 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.611411095 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.611601114 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.611654997 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.612554073 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.612693071 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.612739086 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.616249084 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.616501093 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.616555929 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.617315054 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.621484041 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.621532917 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.621587992 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.625869989 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.625938892 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.626000881 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.631100893 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.631139040 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.631201029 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.634576082 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.634757996 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.634792089 CET	80	49736	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.634824991 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.634828091 CET	80	49736	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.634871960 CET	49736	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.636639118 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.636674881 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.636710882 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.636724949 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.641252995 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.641415119 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.641472101 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.644640923 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.644840956 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.644890070 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.645987988 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.646023035 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.646069050 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.647533894 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.651072025 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.651108980 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.651155949 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.655193090 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.656316042 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.656349897 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.656398058 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.656405926 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.656460047 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.656503916 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.658620119 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.658653021 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.658689022 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.658704042 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.658723116 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.658762932 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.660206079 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.660240889 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.660295010 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.661269903 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.662306070 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.662445068 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.662497997 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.667195082 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.667408943 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.667442083 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.667462111 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.667478085 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.667540073 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.673080921 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.673131943 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.673175097 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.674155951 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.674341917 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.674395084 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.675117970 CET	80	49738	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.675168991 CET	80	49738	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.675214052 CET	49738	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.675961018 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:00.676300049 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.676532984 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.676585913 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.678271055 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.678541899 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.678595066 CET	80	49739	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.678642988 CET	49739	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.680951118 CET	80	49759	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.681303978 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.681457043 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.681507111 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.690170050 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.690205097 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.690259933 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.695852995 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.695974112 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.696031094 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.696544886 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.699668884 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.703233957 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.703270912 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.703335047 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.710279942 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.710371971 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.710443974 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.711987019 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.716535091 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.716634035 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.716737986 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.717487097 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.717613935 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.717664003 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.717814922 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.717941999 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.717989922 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.718806028 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.718839884 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.718884945 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.720194101 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.720288038 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.720330954 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.722183943 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.722410917 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.722457886 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.723189116 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:00.723666906 CET	49759	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.724730968 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.724777937 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.724823952 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.724839926 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.724874973 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.724942923 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.726854086 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.726886988 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.726939917 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.728996038 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.729031086 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.729077101 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.730777025 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.730848074 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.730921984 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.731414080 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.731462002 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.731507063 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.732306957 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.732342958 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.732383966 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.732767105 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.733052969 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.733119965 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.733258009 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.733292103 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.733336926 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.735512018 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.735564947 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.735613108 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.736993074 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.737026930 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.737092972 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.737396002 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.737504005 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.737545013 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.739841938 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.740106106 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.740151882 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.741487026 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.741573095 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.741626024 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.742240906 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.742275000 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.742331982 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.745021105 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.745204926 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.745260000 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.745346069 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:20:00.745521069 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:20:00.745862961 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.745897055 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.745958090 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.749002934 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.749037981 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.749090910 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.749484062 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:00.749648094 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.749836922 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.749891043 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.752829075 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.752863884 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.752923965 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.753695965 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.753798008 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.753845930 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.756494999 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.756599903 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.756652117 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.757755041 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:00.758805990 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:00.760085106 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.760140896 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.760165930 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:20:00.760184050 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:20:00.760194063 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.760360003 CET	49773	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.760449886 CET	49774	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.760561943 CET	49775	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.763706923 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.763808966 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.763859987 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.767271996 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.767307043 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.767354012 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.771023035 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.771078110 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.771136045 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.774285078 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.774483919 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.774534941 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.777908087 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.777976990 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.778028965 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.781327963 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.781476021 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.781528950 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.784902096 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.785021067 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.785068989 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.786356926 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:00.788486958 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.788558006 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.788613081 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.790604115 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.790724993 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.790802956 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.792571068 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.792809963 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.792861938 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.793993950 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.794619083 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.794656992 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.794713974 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.795227051 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:00.795250893 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:00.795655012 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:00.795661926 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:00.795716047 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:00.795739889 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:00.796092033 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:00.796097994 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:00.796525955 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.796660900 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:00.796696901 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.796755075 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.797224045 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:00.797255993 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:00.797678947 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:00.797689915 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:00.798588991 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.798717976 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.798774958 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.800038099 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.800566912 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.800663948 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.800715923 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.802578926 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.802683115 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.802737951 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.803208113 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.804696083 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.804730892 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.804781914 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.806605101 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.806715012 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.806771040 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.807244062 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.808609962 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.808789015 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.808842897 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.810681105 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.810827971 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.810899019 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.812654972 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.812839031 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.812922955 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.814666986 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.814807892 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.814860106 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.814898014 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:20:00.816665888 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.816832066 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.816905975 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.818834066 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.818938017 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.818991899 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.820926905 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.821023941 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.821079969 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.822735071 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.822824001 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.822894096 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.824765921 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.824867010 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.824915886 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.826885939 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.826937914 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.826982021 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.828788996 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.828876972 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.828923941 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.835150003 CET	80	49734	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.835211039 CET	80	49736	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.842216015 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.842333078 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.842390060 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.846230984 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.846402884 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.846457958 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.854484081 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.856931925 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.856966972 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.857024908 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.859972954 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.860007048 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.860064983 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.863606930 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.865488052 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.865652084 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.865703106 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.869416952 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:00.869488955 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:00.869636059 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:00.871283054 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.871475935 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.871525049 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.872046947 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.872102022 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.872137070 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.872148991 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.872188091 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.872236013 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.877160072 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.877243042 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.877290010 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.877707958 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:00.877775908 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:00.878163099 CET	49736	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.878215075 CET	49734	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.878748894 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:00.878817081 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:00.879637957 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:00.880470991 CET	80	49773	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.880584955 CET	80	49774	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.880619049 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.880712032 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.880742073 CET	80	49775	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.880768061 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.882627964 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:00.882988930 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.883057117 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.883104086 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.889023066 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.889144897 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.889199972 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.894372940 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.894469023 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.894517899 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.900249958 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.900284052 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.900331974 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.905885935 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.905941010 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.905988932 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.911596060 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.911716938 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.911794901 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.914009094 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.917346001 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.917365074 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.917423964 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.922620058 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.922858953 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.922907114 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.923058987 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.923108101 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.923154116 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.923576117 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.923683882 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.923743010 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.925628901 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.925750017 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.925796986 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.927639008 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.927755117 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.927805901 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.928987026 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.929166079 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.929214001 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.930000067 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.930047035 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.930088997 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.932003021 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.932174921 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.932215929 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.933820009 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.933862925 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.933907032 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.934669971 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.934681892 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.934729099 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.935517073 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.935679913 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.935731888 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.937596083 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.937680960 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.937728882 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.939169884 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.939308882 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.939357042 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.940395117 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.940447092 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.940480947 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.941087008 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.941247940 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.941307068 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.942862988 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.942981005 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.943023920 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.944508076 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.944595098 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.944644928 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.946086884 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.946166039 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.946177959 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.946207047 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.946310997 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.946352959 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.948049068 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.948061943 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.948111057 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.949712992 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.949726105 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.949775934 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.951190948 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.951370955 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.951416016 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.951822996 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.951987982 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.952033043 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.952795982 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.952913046 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.952955961 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.954375029 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.954513073 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.954551935 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.956000090 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.956101894 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.956144094 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.957544088 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.957601070 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.957614899 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.957643986 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.957704067 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.957771063 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.959189892 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.959336042 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.959373951 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.960784912 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.960916996 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.960952044 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.962349892 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.962430954 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.962475061 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.963391066 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.963490009 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.963530064 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.964021921 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.964185953 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.964232922 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.965620041 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.965673923 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.965713978 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.967144966 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.967206001 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.967256069 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.968688965 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.968791008 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.968837023 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.969136000 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.969288111 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.969342947 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.970294952 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.970523119 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.970561981 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.971857071 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.971987009 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.972028017 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.973473072 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.973550081 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.973588943 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.974886894 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.975023031 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.975066900 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.975152016 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.975163937 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.975207090 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.976845026 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.976851940 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.976891994 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.978223085 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.978341103 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.978384018 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.980264902 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.980406046 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.980446100 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.981409073 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.981870890 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.982002020 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.982052088 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.983081102 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.983127117 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.983166933 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.984630108 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.984733105 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.984747887 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:00.984771013 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.986175060 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.986216068 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.986255884 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.987763882 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.987903118 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.987976074 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.989406109 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.989450932 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.989490032 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.990422964 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:00.991090059 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.991102934 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.991134882 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.992624998 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.992700100 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.992742062 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.994132042 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.994256973 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.994303942 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.995680094 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.995799065 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.995840073 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.997337103 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.997359991 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.997404099 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:00.998939037 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.999064922 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:00.999109030 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.000284910 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.000490904 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.000591993 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.000636101 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.002100945 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.002177000 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.002226114 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.003361940 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.003635883 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.003745079 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.003787994 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.005247116 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.005336046 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.005381107 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.007038116 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.007200003 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.007256031 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.033114910 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.055968046 CET	49780	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.056116104 CET	49781	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.056284904 CET	49782	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.056426048 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.058260918 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.058372974 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.058413982 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.060735941 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.060753107 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.060905933 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.065187931 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.067009926 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.067061901 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.067068100 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.071396112 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.071445942 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.071527958 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.076009035 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.076057911 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.076134920 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.080281019 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.080322027 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.080393076 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.084603071 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.084657907 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.084661961 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.088772058 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.088816881 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.088855982 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.092912912 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.092958927 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.093116999 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.096879959 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.096926928 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.096929073 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.100872040 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.100919008 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.100991964 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.104696989 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.104741096 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.104814053 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.109282017 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.109333038 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.109371901 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.112277985 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.112298965 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.112327099 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.112984896 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.113059998 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.113116980 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.113502979 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.113523960 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.114537954 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.114672899 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.114726067 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.115536928 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.115550041 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.115597010 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.116111994 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.116156101 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.116261959 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.116274118 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.116287947 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.116329908 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.117619991 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.117695093 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.117750883 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.118918896 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.119012117 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.119049072 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.119227886 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.119271040 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.119324923 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.119888067 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.119930983 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.120079994 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.120091915 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.120722055 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.120737076 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.120749950 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.120800972 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.121597052 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.122431993 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.122477055 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.123188972 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.123205900 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.123255968 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.123672962 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.123728037 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.123768091 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.124233961 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.124248981 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.124288082 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.125722885 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.125735044 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.125771046 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.127043962 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.127058983 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.127103090 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.127365112 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.127405882 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.127904892 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.127917051 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.127935886 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.127975941 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.129014015 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.129103899 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.129154921 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.130183935 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.130197048 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.130239964 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.131360054 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.131416082 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.131529093 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.131541014 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.131547928 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.131608009 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.132690907 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.132704973 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.132752895 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.133737087 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.133838892 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.133882999 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.135011911 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.135024071 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.135039091 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.135061026 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.135099888 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.135137081 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.136236906 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.136250973 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.136301041 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.137312889 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.137434959 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.137473106 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.138497114 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.138756990 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.138768911 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.138798952 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.138818979 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.138935089 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.139789104 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.139858007 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.139894962 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.140954971 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.141060114 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.141098022 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.142316103 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.142330885 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.142402887 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.142533064 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.142587900 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.142631054 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.143354893 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.143368006 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.143407106 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.144592047 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.144613028 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.144716978 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.145776033 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.146398067 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.146441936 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.146444082 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.150386095 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.150407076 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.150444031 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.153961897 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.154010057 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.154264927 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.158054113 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.158067942 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.158106089 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.161545992 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.161632061 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.161674023 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.162919044 CET	49785	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.165337086 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.165402889 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.165405035 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.169199944 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.169235945 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.169262886 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.172990084 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.173038006 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.173237085 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.176035881 CET	80	49780	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.176110029 CET	49780	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.176160097 CET	80	49781	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.176212072 CET	49781	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.176217079 CET	80	49782	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.176265001 CET	49782	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.176342010 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.176388025 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.176656008 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.176702976 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.176774025 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.176991940 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.177057028 CET	49782	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.177102089 CET	49781	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.177155972 CET	49780	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.180579901 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.180594921 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.180645943 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.184329987 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.184400082 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.184426069 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.188054085 CET	49786	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.188582897 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.188606024 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.188646078 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.191838980 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.191905022 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.191926956 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.192013025 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195163965 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195230961 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195244074 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195257902 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195271015 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195275068 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.195297956 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.195310116 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195332050 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195348978 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195360899 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.195390940 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.195712090 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.195760012 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.203603983 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.203757048 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.203805923 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.212014914 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.212182045 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.212230921 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.214256048 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214366913 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214378119 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214385033 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214396954 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214433908 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.214472055 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.214488029 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214499950 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214510918 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214526892 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214536905 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.214539051 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.214551926 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.214584112 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.220371962 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.241127014 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.241305113 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.241381884 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.241923094 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.241990089 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.242042065 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.245852947 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.245877028 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.245892048 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.245898008 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.245986938 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.246011019 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.246023893 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.246030092 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.250134945 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.250175953 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.250245094 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.250380039 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.250394106 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.250483990 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.250521898 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.250574112 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.250715971 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.250726938 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.259449005 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.259557962 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.259603977 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.260802031 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.260907888 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.260970116 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.263509035 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.264396906 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.264448881 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.264509916 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.267091036 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.267143011 CET	49789	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.267189980 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.267189980 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.267421007 CET	49790	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.268589973 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.269778967 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.269828081 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.269905090 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.272397041 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.272491932 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.272566080 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.274970055 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.275027990 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.275031090 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.277460098 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.277651072 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.277726889 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.279997110 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.280059099 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.280092955 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.282418013 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.282536030 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.282604933 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.282937050 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.283016920 CET	49785	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.284965038 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.285018921 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.285031080 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.287278891 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.287336111 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.287400007 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.289652109 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.289707899 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.289769888 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.292026043 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.292073965 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.292152882 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.294306040 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.294361115 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.294390917 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.296569109 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.296616077 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.296677113 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.296900988 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.296911001 CET	80	49782	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.297020912 CET	49791	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.297084093 CET	80	49781	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.297094107 CET	80	49780	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.298845053 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.298978090 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.299042940 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.301114082 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.301165104 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.301232100 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.303360939 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.303463936 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.303474903 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.303668022 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.305675030 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.305730104 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.306144953 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.307885885 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.307909012 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.307933092 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.308060884 CET	80	49786	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.308177948 CET	49786	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.308444977 CET	49786	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.311369896 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.311383963 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.311415911 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.313391924 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.313412905 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.313443899 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.315392017 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.315404892 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.315448999 CET	80	49737	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.315460920 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.315687895 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.315699100 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.315747023 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.317915916 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.317928076 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.317996025 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.319382906 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.319395065 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.319441080 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.321222067 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.321233988 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.321245909 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.321257114 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.321285009 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.321317911 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.323374033 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.323385954 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.323436975 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.324877024 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.324887991 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.324942112 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.325232983 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.325295925 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.325337887 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.327374935 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.327387094 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.327420950 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.327903986 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.327959061 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.330168962 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.330174923 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.330185890 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.330225945 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.330677032 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.330688953 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.331387043 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.333365917 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.333378077 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.333384991 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.333395004 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.333446026 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.334830046 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.334836006 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.334847927 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.334904909 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.335356951 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.335643053 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.337476015 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.337481976 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.337492943 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.337497950 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.337543011 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.339373112 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.339379072 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.339390993 CET	80	49771	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.339446068 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.341563940 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.341577053 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.341583967 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.341589928 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.341643095 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.343369007 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.343375921 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.343426943 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.345643044 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.345648050 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.345659971 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.345665932 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.345714092 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.347372055 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.347378016 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.347440004 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.351373911 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.351380110 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.351396084 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.351458073 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.364464045 CET	49737	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.367867947 CET	49785	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.380387068 CET	49771	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.387094975 CET	80	49789	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.387192965 CET	49789	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.387351990 CET	80	49790	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.387375116 CET	49789	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.387733936 CET	49790	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.387820005 CET	49790	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.417038918 CET	80	49791	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.417246103 CET	49791	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.423557997 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.423650980 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.428320885 CET	80	49786	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.460877895 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.461015940 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.461100101 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.461396933 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.461493015 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.461548090 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.462629080 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.462635994 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.462708950 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.463747025 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.463844061 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.463918924 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.464978933 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.464987040 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.465060949 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.466206074 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.466321945 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.466366053 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.467231989 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.467276096 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.467360020 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.468487024 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.468616009 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.468667030 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.469590902 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.469827890 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.469875097 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.471477032 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.471854925 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.471940994 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.473542929 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.473550081 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.473612070 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.474520922 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.474669933 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.474745989 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.475357056 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.475502014 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.475568056 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.475899935 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.476001978 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.476181984 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.476600885 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.476671934 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.476733923 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.477406025 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.477488995 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.477560043 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.478302956 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.478348017 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.478394032 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.479324102 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.479435921 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.479481936 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.480500937 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.480505943 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.480596066 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.481513977 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.481654882 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.481698990 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.482621908 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.482738972 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.482834101 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.483686924 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.483783960 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.483877897 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.484872103 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.484939098 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.485028982 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.485891104 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.486063004 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.486118078 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.486881971 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.487063885 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.487112045 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.487117052 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.487122059 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.487229109 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.487770081 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.488132954 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.488280058 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.488377094 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.489217043 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.489336014 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.489383936 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.490237951 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.490376949 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.490452051 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.490947962 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.491044044 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.491091967 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.491328955 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.491405964 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.491455078 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.492443085 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.492547035 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.492611885 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.493582010 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.493722916 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.493774891 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.494622946 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.494755030 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.494846106 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.495663881 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.495814085 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.495877028 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.496537924 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.496618032 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.496720076 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.496783018 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.496843100 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.496928930 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.497901917 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.497946024 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.497992039 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.499005079 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.499074936 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.499208927 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.499267101 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.500036001 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.500150919 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.500206947 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.500719070 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.500833035 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.500880957 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.501148939 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.501209974 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.501286983 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.502233028 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.502290964 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.502368927 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.503164053 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.503345013 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.503436089 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.503513098 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.504475117 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.504517078 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.504631996 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.505587101 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.505611897 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.505673885 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.506633043 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.506659985 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.506720066 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.507334948 CET	80	49789	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.507649899 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.507680893 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.507728100 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.507755041 CET	80	49790	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.508817911 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.508889914 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.509023905 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.509111881 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.509812117 CET	49793	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.509880066 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.509954929 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.510054111 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.510998011 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.511050940 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.511136055 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.512020111 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.512132883 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.512187004 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.513140917 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.513200998 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.513267994 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.514333010 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.514341116 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.514525890 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.514616966 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.515305996 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.515397072 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.515430927 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.516395092 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.516494989 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.516551018 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.517472029 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.517549038 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.517656088 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.518560886 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.522003889 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.524460077 CET	49794	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.563869953 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.590207100 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:20:01.590405941 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:20:01.591363907 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:20:01.591587067 CET	49761	443	192.168.2.6	107.150.104.134
Nov 26, 2024 08:20:01.591603994 CET	443	49761	107.150.104.134	192.168.2.6
Nov 26, 2024 08:20:01.623199940 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.629816055 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.629894018 CET	49793	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.630055904 CET	49793	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:01.634669065 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.642023087 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.644434929 CET	80	49794	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.644527912 CET	49794	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.644871950 CET	49794	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:01.662074089 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.662200928 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.662623882 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.663424015 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.663434982 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.663491964 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.663686991 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.663786888 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.663842916 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.664927959 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.664937973 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.664975882 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.665924072 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.666016102 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.666261911 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.666975975 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.667067051 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.667339087 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.669045925 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.669056892 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.669106960 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.669151068 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.669226885 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.669284105 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.670506001 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.670520067 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.670648098 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.671324968 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.671403885 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.671530008 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.672427893 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.672501087 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.672755957 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.673496008 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.673553944 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.673824072 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.674562931 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.674654961 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.674856901 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.675720930 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.675837040 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.675990105 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.676713943 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.676843882 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.677011013 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.677809954 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.677930117 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.678102970 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.678900003 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.679033995 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.679183006 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.679994106 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.680066109 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.680260897 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.681107998 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.681256056 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.681348085 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.682163954 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.682287931 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.682342052 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.683298111 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.683500051 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.683556080 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.684370041 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.684519053 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.684585094 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.685436964 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.685544968 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.685743093 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.686517000 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.686570883 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.686698914 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.687597990 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.687747955 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.687882900 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.688702106 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.688786030 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.689021111 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.689793110 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.689905882 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.690350056 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.690937042 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.691220045 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.691272974 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.691998005 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.692080975 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.692318916 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.693128109 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.693289042 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.693388939 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.694189072 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.694333076 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.694474936 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.695250988 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.695419073 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.695544958 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.696350098 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.696485996 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.696733952 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.697468996 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.697545052 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.697787046 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.698565006 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.698662996 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.699172020 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.699593067 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.699693918 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.699887037 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.700695038 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.700824976 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.701337099 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.701852083 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.701896906 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.702147961 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.702896118 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.702990055 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.703197002 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.703974962 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.704096079 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.704216957 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.705084085 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.705209970 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.705696106 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.706204891 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.706248045 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.706444025 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.707221031 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.707336903 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.707659006 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:01.707694054 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:01.707699060 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.707964897 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:01.708412886 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.708420038 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.708488941 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.709301949 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:01.709312916 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:01.709405899 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.709516048 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.709747076 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.710489035 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.710537910 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.710623026 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.711652994 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.711724043 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.711976051 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.712672949 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.712848902 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.712904930 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.713743925 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.713882923 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.713954926 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.714862108 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.714982033 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.715172052 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.715939045 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.715996027 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.716240883 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.716850042 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.717021942 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.717173100 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.717236042 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.717690945 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.717720985 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.718116045 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:01.718121052 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:01.718135118 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.718225002 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.718290091 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.719162941 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.750157118 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:01.764966011 CET	80	49794	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:01.767898083 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.863807917 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.863821983 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.863888025 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.863976955 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.864258051 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.864334106 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.865056992 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.865320921 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.865408897 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.866118908 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.866262913 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.866460085 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.867275953 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.867283106 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.867351055 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.868385077 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.868392944 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.868446112 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.869375944 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.869584084 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.869791031 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.870599985 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.870605946 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.870656967 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.871551037 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.871684074 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.871889114 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.872632027 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.872777939 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.872881889 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.873846054 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.873853922 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.873912096 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.874898911 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.875268936 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.875334024 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.875958920 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.876326084 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.876410961 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.877019882 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.877392054 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.877978086 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.878081083 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.878451109 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.878624916 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.879277945 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.879285097 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.879333973 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.880378962 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.880388021 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.880429029 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.881474972 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.881483078 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.881557941 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.882545948 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.882754087 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.882951021 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.883639097 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.883883953 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.883991957 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.884668112 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.884943962 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.885073900 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.885734081 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.886012077 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.886075020 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.886873960 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.887074947 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.887373924 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.887861967 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.888681889 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.888741970 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.889059067 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.889100075 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.889256001 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.890160084 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.890211105 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.890319109 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.891221046 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.891302109 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.891546011 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.892333031 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.892551899 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.892688990 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.893347025 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.893546104 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.893764973 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.894588947 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.894594908 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.894659996 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.895529032 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.895683050 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.895797968 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.896578074 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.896804094 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.897382975 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.897717953 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.897836924 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.898138046 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.898775101 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.898942947 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.899523973 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.899969101 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.899976015 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.900033951 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.901066065 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.901073933 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.901130915 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.902102947 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.902168036 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.902637005 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.903240919 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.903248072 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.903296947 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.904334068 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.904341936 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.904401064 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.905302048 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.905317068 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:01.905371904 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:01.933628082 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.029032946 CET	80	49775	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.029055119 CET	80	49775	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.029062033 CET	80	49775	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.029074907 CET	80	49775	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.029117107 CET	80	49775	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.029145956 CET	49775	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.029184103 CET	49775	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.053711891 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.054033041 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.054339886 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.077619076 CET	80	49774	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.077626944 CET	80	49774	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.077641010 CET	80	49774	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.077713013 CET	49774	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.077752113 CET	80	49774	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.077756882 CET	80	49774	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.078068972 CET	49774	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.080143929 CET	80	49772	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.080149889 CET	80	49772	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.080200911 CET	49772	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.080240965 CET	80	49772	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.080248117 CET	80	49772	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.080282927 CET	49772	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.081513882 CET	80	49772	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.088305950 CET	49797	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.088809013 CET	49798	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.095053911 CET	80	49773	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.095062017 CET	80	49773	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.095073938 CET	80	49773	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.095141888 CET	49773	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.095179081 CET	80	49773	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.095185995 CET	80	49773	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.095263004 CET	49773	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.105015039 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.105022907 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.105873108 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.109061003 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.109194994 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.109735966 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.117269039 CET	80	49718	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.127912998 CET	49772	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.154941082 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.154948950 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.155030966 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.158374071 CET	49718	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.159077883 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.159141064 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.159415007 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.167402983 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.169873953 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:02.169939041 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:02.170018911 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:02.170948982 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:02.170963049 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:02.170975924 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:02.170981884 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:02.172038078 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.174231052 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.174530029 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:02.174554110 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:02.174629927 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:02.174798965 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:02.174806118 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:02.176506042 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176512003 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176525116 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176558018 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176589012 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176603079 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176615000 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176620960 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.176620960 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.176629066 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176646948 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.176676035 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.176744938 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176754951 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.176799059 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.208722115 CET	80	49797	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.208729029 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.208815098 CET	49797	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.208854914 CET	49798	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.209007978 CET	49798	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.209079027 CET	49797	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.220827103 CET	80	49775	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.221138000 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221143007 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221155882 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221182108 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221187115 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221194029 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.221237898 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.221287966 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221299887 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221306086 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221312046 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221323013 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.221334934 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.221353054 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.221369982 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.262474060 CET	49775	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.292138100 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.296998978 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.297004938 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.297487020 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.300998926 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.328973055 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.329036951 CET	80	49797	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.341530085 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.341542959 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.341619968 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.345809937 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.355045080 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.377711058 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.377728939 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.377814054 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.382008076 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.382019997 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.382097960 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.390444994 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.390456915 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.390507936 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.398478031 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.398489952 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.398544073 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.400927067 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.406794071 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.406887054 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.407695055 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.415477991 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.415519953 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.415580988 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.423680067 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.431771040 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.431844950 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.431905031 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.435949087 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.436038971 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.436090946 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.444412947 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.444478989 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.444535971 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.452943087 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.452986956 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.453042030 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.461317062 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.461349010 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.461429119 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.469726086 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.469784975 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.469855070 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.470530033 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.478184938 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.478281975 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.478332043 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.478455067 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478559971 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478570938 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478611946 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.478693962 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478708982 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478719950 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478732109 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.478732109 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478781939 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.478796959 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478806973 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478816986 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478828907 CET	80	49781	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478835106 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.478840113 CET	80	49781	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.478853941 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.478884935 CET	49781	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.485567093 CET	80	49780	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.485610008 CET	80	49780	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.485658884 CET	49780	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.486542940 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.486653090 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.486699104 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.495031118 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.495131016 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.495218992 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.503433943 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.503505945 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.503674984 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.520843983 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.520994902 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.521042109 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.525729895 CET	80	49782	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.525790930 CET	80	49782	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.525836945 CET	49782	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.580810070 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.598519087 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.598627090 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.598673105 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.641058922 CET	49802	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:20:02.641110897 CET	443	49802	20.198.119.84	192.168.2.6
Nov 26, 2024 08:20:02.641191006 CET	49802	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:20:02.641827106 CET	49802	443	192.168.2.6	20.198.119.84
Nov 26, 2024 08:20:02.641844034 CET	443	49802	20.198.119.84	192.168.2.6
Nov 26, 2024 08:20:02.642297983 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.642374039 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.642554998 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.644968033 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.645061970 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.645108938 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.650415897 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.650441885 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.650494099 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.658524036 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.658545017 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.658560038 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658571005 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658582926 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658593893 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658607960 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658612013 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.658620119 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658632040 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658643961 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658652067 CET	49785	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.658655882 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658668041 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.658677101 CET	49785	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.658690929 CET	49785	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.658708096 CET	49785	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.658838034 CET	80	49786	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.658849001 CET	80	49786	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.658900976 CET	49786	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.662758112 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.662770987 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.662816048 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.668054104 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.668067932 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.668108940 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.673039913 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.675673008 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.675673008 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.681134939 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.681148052 CET	80	49783	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.681191921 CET	49783	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.681907892 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.700902939 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.700985909 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.701200008 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.778691053 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.778733969 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.778795004 CET	49785	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.792264938 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.792424917 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.792545080 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.793019056 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.795531988 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.795649052 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.795712948 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.795927048 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.796457052 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.796547890 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.796710968 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.802373886 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.802436113 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.804842949 CET	80	49719	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:02.810172081 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.810717106 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.811089993 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.821079016 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.838114023 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:02.842873096 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:02.842900038 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:02.843307018 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:02.843317032 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:02.847601891 CET	49719	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:02.857717037 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.857768059 CET	80	49785	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.857827902 CET	49785	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:02.915899038 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926757097 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926786900 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926800013 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926815033 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926827908 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926840067 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926847935 CET	49793	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.926852942 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926866055 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926879883 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926893950 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.926897049 CET	49793	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.926915884 CET	49793	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.926939964 CET	49793	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:02.930407047 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:02.930646896 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:02.931417942 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.046900034 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.047003031 CET	80	49793	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.047065973 CET	49793	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.048388958 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.054296970 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.067274094 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.067306042 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.067327023 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.067369938 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.067431927 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.067441940 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.067478895 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.083537102 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.083631992 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.083688021 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.083884001 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.083973885 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.084013939 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.084471941 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.084583044 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.085453033 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.085510969 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.085624933 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.086451054 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.086498976 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.086529016 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.086571932 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.087400913 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.087515116 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.087685108 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.088448048 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.088591099 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.089392900 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.089442968 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.089520931 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.090368032 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.090416908 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.090529919 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.090590954 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.091350079 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.091520071 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.091564894 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.092293024 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.092461109 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.092513084 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.093272924 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.093425035 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.093468904 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.094266891 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.094393969 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.094433069 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.094769001 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.094858885 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.095285892 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.095335007 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.095401049 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.095441103 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.096385002 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.096484900 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.096540928 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.096760988 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.097490072 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.097600937 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.097690105 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.097703934 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.097853899 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.097868919 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.097871065 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.097875118 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.098356009 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.098438025 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.098488092 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.099224091 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.099292994 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.099397898 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.100183964 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.100284100 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.100334883 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.101177931 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.101222038 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.101267099 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.101294994 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.101341963 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.101941109 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.102045059 CET	80	49745	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.102083921 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.102132082 CET	49745	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.102212906 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.102256060 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.103075981 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.103168011 CET	80	49746	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.103219032 CET	49746	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.211328983 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.211349010 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.211421967 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.212953091 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.212990046 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.213042021 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.217058897 CET	80	49749	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.218580961 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.218663931 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.219702005 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.223017931 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.224407911 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.224565983 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.224622011 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.229186058 CET	80	49794	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.229204893 CET	80	49794	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.229218960 CET	80	49794	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.229270935 CET	49794	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.229311943 CET	80	49794	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.229326010 CET	80	49794	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.229367018 CET	49794	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.230088949 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.230190039 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.230240107 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.232880116 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.232943058 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.233002901 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.233253956 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.233952045 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.233998060 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.234338999 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.239247084 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.239310980 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.239372969 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.241513968 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.241525888 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.241578102 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.244633913 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.247657061 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.247670889 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.247693062 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.247729063 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.249699116 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.249747992 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.249753952 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.251924038 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.252033949 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.252095938 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.259351969 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.259365082 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.259377956 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.259392023 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.259423018 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.259452105 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.262872934 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.263008118 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.263071060 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.266835928 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.266849041 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.266901970 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.268129110 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.268141985 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.268150091 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.268197060 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.272109032 CET	49749	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.273669958 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.273683071 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.273725033 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.273760080 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.273849964 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.274935007 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.275209904 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.275249004 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.275383949 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.279115915 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.279262066 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.279306889 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.283651114 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.283711910 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.283773899 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.284600019 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.284615040 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.284655094 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.289932966 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.290081024 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.290126085 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.292046070 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.292098045 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.292226076 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.295284986 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.295419931 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.295459986 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.300405979 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.300477982 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.300689936 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.300888062 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.300899029 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.300940990 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.306278944 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.306293964 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.306344986 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.309111118 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.309132099 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.309164047 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.309695005 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.311644077 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.311657906 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.311716080 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.316993952 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.317172050 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.317212105 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.317580938 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.317594051 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.317625999 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.322536945 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.322715998 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.322757959 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.325859070 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.325905085 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.325932980 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.327790022 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.327951908 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.328000069 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.333484888 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.333497047 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.333544970 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.334268093 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.334315062 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.334434986 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.336538076 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.336563110 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.338711977 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.338725090 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.338771105 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.340395927 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.340408087 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.342861891 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.342920065 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.342933893 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.343936920 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.343955994 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.343983889 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.344330072 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.344336033 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.351355076 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.351368904 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.351382017 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351392984 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351398945 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.351439953 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.351511002 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351524115 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351535082 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351562023 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.351685047 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351696014 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351706028 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351715088 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351718903 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.351726055 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.351758003 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.351778030 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.359834909 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.359846115 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.359896898 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.372082949 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.372108936 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.372123003 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.372128010 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.379241943 CET	49805	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.379293919 CET	443	49805	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.379358053 CET	49805	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.393471956 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.402627945 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.403858900 CET	49794	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.407015085 CET	49806	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.407479048 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.409110069 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.419007063 CET	49807	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.419816017 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.419939995 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.419982910 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.423190117 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.423294067 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.423331022 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.429944038 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.432426929 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.432470083 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.432485104 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.438898087 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.438924074 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.438942909 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.440568924 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.440654993 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.440702915 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.442924976 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.443052053 CET	49805	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.443061113 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.443072081 CET	443	49805	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.443104982 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.445233107 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.445281982 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.445314884 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.446590900 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.448076010 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.448123932 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.448142052 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.451489925 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.451535940 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.451541901 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.452068090 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.452112913 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.452198029 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.456147909 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.456192970 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.456305981 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.457403898 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.457451105 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.457490921 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.460024118 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.460089922 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.460108995 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.463193893 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.463254929 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.463293076 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.463742971 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.463800907 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.463831902 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.466778994 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.467504025 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.467551947 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.467638969 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.468277931 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.468875885 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.468920946 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.468964100 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.470105886 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.471136093 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.471189022 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.471221924 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.471597910 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.471631050 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.471678972 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.474416018 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.474462986 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.474479914 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.474709034 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:03.474729061 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.474790096 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:03.474838018 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.474860907 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.477375031 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:03.477384090 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:03.477895975 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:03.478379011 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.478435040 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.478492022 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.479717016 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.479758978 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.479801893 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.482069016 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.482115984 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.482203007 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.485135078 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.485182047 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.485219002 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.485641956 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.485681057 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.485804081 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.489319086 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.489363909 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.489439964 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.490309000 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.490351915 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.490436077 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.492949963 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.493001938 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.493004084 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.495472908 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.495523930 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.495609045 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.496558905 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.496606112 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.496695995 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.498373985 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.498430967 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.498519897 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.500247002 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.500292063 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.500401974 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.501254082 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.501303911 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.501346111 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.503854036 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.503899097 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.503926992 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.504169941 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.504213095 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.504242897 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.507086039 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.507128954 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.507169962 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.507471085 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.507515907 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.507549047 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.509984970 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.510031939 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.510087013 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.511095047 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.511142015 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.511213064 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.512896061 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.512942076 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.513115883 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.514760017 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.514811039 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.514889956 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.515564919 CET	49808	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.515682936 CET	49809	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.515919924 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.515983105 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.516021967 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.519015074 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.519064903 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.519083023 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.519274950 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.519330025 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.519341946 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.519449949 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:03.520967960 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.522672892 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.522721052 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.522803068 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.523047924 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.524286985 CET	80	49794	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.525702953 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.525749922 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.525763988 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.526947975 CET	80	49806	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.527007103 CET	49806	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.527189970 CET	49806	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.527633905 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.529342890 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.529392958 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.529483080 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.533019066 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.533061028 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.533097982 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.536928892 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.536974907 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.537017107 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.539068937 CET	80	49807	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.539129019 CET	49807	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.540225983 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.540268898 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.540321112 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.543869972 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.543915987 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.543984890 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.547554016 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.547595024 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.547660112 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.551147938 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.551196098 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.551201105 CET	80	49776	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.552405119 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.552546024 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.552602053 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.555217981 CET	49810	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.556638002 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.556771040 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.556833029 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.565042019 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.565140963 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.565191031 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.573080063 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.573167086 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.573211908 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.581501961 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.581620932 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.581671953 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.586754084 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.588221073 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.589972019 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.590024948 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.590035915 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.590181112 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.597788095 CET	49776	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.598328114 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.598479986 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.598531961 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.605516911 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.606892109 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.607062101 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.607110023 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.615211964 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.615329027 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.615395069 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.619544029 CET	49811	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.621511936 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.621567965 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.622236967 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.622250080 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.623658895 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.623744965 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.623785019 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.632062912 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.632136106 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.632185936 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.635487080 CET	80	49808	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.635562897 CET	49808	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.635602951 CET	80	49809	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.635687113 CET	49809	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.635790110 CET	49808	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.636010885 CET	49809	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.640872002 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.642659903 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:03.647044897 CET	80	49806	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.665713072 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.665900946 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.665955067 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.666306973 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.666330099 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.666342974 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.666348934 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.669121027 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.669205904 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.669258118 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.669886112 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.669904947 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.670460939 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.670501947 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.670561075 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.672396898 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.672411919 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.675101995 CET	80	49810	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.675158978 CET	49810	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.675338984 CET	49810	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.675791025 CET	49813	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.675823927 CET	443	49813	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.675869942 CET	49813	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.676412106 CET	49813	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.676424980 CET	443	49813	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.687325954 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:03.704210997 CET	49814	80	192.168.2.6	180.76.11.161
Nov 26, 2024 08:20:03.708029032 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.710921049 CET	49815	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.739542007 CET	80	49811	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.739623070 CET	49811	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.753827095 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.753839970 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.753885984 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.755660057 CET	80	49808	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.755892992 CET	80	49809	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.756262064 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.756342888 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.756387949 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.761353970 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.761444092 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.761492014 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.766438007 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.766568899 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.766612053 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.771559954 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.771622896 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.771667004 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.776647091 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.776735067 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.776779890 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.777230978 CET	49816	80	192.168.2.6	180.76.11.161
Nov 26, 2024 08:20:03.781773090 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.781852007 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.781894922 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.786870956 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.786935091 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.787003040 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.788566113 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.788613081 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.788625002 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.788651943 CET	49798	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.788727999 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.788738012 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.788775921 CET	49798	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.790440083 CET	49798	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.792069912 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.792114019 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.792151928 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.795227051 CET	80	49810	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.797058105 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.797179937 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.797235012 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.802268028 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.802342892 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.802664995 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.807360888 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.807442904 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.807516098 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.812491894 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.812681913 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.812725067 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.817589998 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.817735910 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.817779064 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.822666883 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.822757959 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.822798014 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.823962927 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824043989 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824057102 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824093103 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.824115992 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824127913 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824140072 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824151993 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.824170113 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824177980 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.824182987 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824194908 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824208021 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.824214935 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.824224949 CET	80	49814	180.76.11.161	192.168.2.6
Nov 26, 2024 08:20:03.824242115 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.824285030 CET	49814	80	192.168.2.6	180.76.11.161
Nov 26, 2024 08:20:03.827703953 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.827831984 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.827877998 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.827883959 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.829062939 CET	49814	80	192.168.2.6	180.76.11.161
Nov 26, 2024 08:20:03.830945969 CET	80	49815	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.831007957 CET	49815	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.832839966 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.832930088 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.832979918 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.836826086 CET	80	49797	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.836875916 CET	80	49797	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.836889029 CET	80	49797	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.836915970 CET	49797	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.836973906 CET	80	49797	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.836986065 CET	80	49797	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.837008953 CET	49797	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.837917089 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.837943077 CET	49815	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.838037014 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.838077068 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.843067884 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.861520052 CET	49797	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.863930941 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.864022017 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.864062071 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.864499092 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.864579916 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.864615917 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.865690947 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.865809917 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.865854979 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.866866112 CET	80	49764	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.870328903 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.870450020 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.870488882 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.871490955 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.871584892 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.871620893 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.873836994 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.874674082 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.874687910 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.874706984 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.876956940 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.877010107 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.877048969 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.878004074 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.878143072 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.878195047 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.879304886 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.879359961 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.880013943 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.880079031 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.880136013 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.880194902 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.880208015 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.880237103 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.882524967 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.882646084 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.882680893 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.883881092 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.884901047 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.885015011 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.885056973 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.887255907 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.887370110 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.887408018 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.889683008 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.889734983 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.889780998 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.892000914 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.892117023 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.892154932 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.893836975 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.894373894 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.894481897 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.894520998 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.895627975 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.895675898 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.896723032 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.896811962 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.897032022 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.897383928 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:03.897402048 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:03.897758007 CET	80	49816	180.76.11.161	192.168.2.6
Nov 26, 2024 08:20:03.897818089 CET	49816	80	192.168.2.6	180.76.11.161
Nov 26, 2024 08:20:03.898132086 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.899097919 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.899214029 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.899244070 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.901470900 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.901561022 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.901599884 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.903862000 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.904057980 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.904095888 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.906193972 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.906311035 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.906343937 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.908523083 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.908597946 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.908636093 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.910367966 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.910892010 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.910994053 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.911030054 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.913269997 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.913374901 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.913412094 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.914134979 CET	49764	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.915623903 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.915728092 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.915767908 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.917993069 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.918040991 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.918087006 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.930468082 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.944330931 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.944498062 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.944561005 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.945857048 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.945957899 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.946007967 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.947072983 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.947125912 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.947166920 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.948940039 CET	80	49814	180.76.11.161	192.168.2.6
Nov 26, 2024 08:20:03.949575901 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.949616909 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.949657917 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.951976061 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.952034950 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.952080011 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.954446077 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.954547882 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.954596043 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.954816103 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.955020905 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.955055952 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.956882000 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.956955910 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.956967115 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.957000017 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.957077026 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.957122087 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.957860947 CET	80	49815	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.959430933 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.959454060 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.959495068 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.961018085 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.961155891 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.961395025 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.961766005 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.961857080 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.961900949 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.964221001 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.964293003 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.964332104 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.965126991 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.965158939 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.965193033 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.966691971 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.966799021 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.967186928 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.969177008 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.969240904 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.969253063 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.969264984 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.969276905 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.969300985 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.971878052 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.972021103 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.972054958 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.973295927 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.973361015 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.973395109 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.974040031 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.974153042 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.974231958 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.976506948 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.976661921 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.976696014 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.977197886 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.977296114 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.977335930 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.978976965 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.979115963 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.979156017 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.981152058 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.981288910 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.981326103 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.981380939 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.981487989 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.981524944 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.981977940 CET	80	49797	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.983880043 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.983980894 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.984025955 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.985130072 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.985258102 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.985297918 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.986280918 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.986412048 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.986453056 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.988763094 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.988867998 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.988904953 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.989085913 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.989181042 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.989219904 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.991185904 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.991344929 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.991380930 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.993077993 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.993180990 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.993228912 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.993634939 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.993724108 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.993762016 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.995002031 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.995048046 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.995059967 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.995085001 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.995131969 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:03.995165110 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:03.996140957 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.996354103 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.996404886 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:03.997056961 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.997175932 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:03.997215986 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:03.998544931 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.998656034 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:03.998697996 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.001033068 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.001122952 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.001135111 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.001162052 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.001185894 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.001225948 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.003448963 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.003524065 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.003885031 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.003932953 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.005045891 CET	49792	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:04.005295038 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.005402088 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.005448103 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.006020069 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.006127119 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.006169081 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.008436918 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.008541107 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.008589029 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.008965015 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.009109020 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.009149075 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.010838985 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.010950089 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.011045933 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.012974024 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.013092995 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.013128996 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.013237953 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.013325930 CET	80	49777	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.013360977 CET	49777	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.016968966 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.017066002 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.017102957 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.018635035 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.020977974 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.021094084 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.021142960 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.021636009 CET	49817	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.024851084 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.024981022 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.025016069 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.025283098 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.025396109 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.025434971 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.028815031 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.028911114 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.028948069 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.029453993 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.029582024 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.029622078 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.032872915 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.032887936 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.032922983 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.036818027 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.036901951 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.036936045 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.037981033 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.038022995 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.038058996 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.040767908 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.040860891 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.040904999 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.044702053 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.044811010 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.044852972 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.046390057 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.046541929 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.046586037 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.048707008 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.048943996 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.048988104 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.052074909 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052086115 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052098989 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052123070 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.052155018 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052166939 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052192926 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.052198887 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052212954 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052239895 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.052356005 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052366972 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052377939 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.052400112 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.052423000 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.052629948 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.052757978 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.052802086 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.053250074 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053308964 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053320885 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053348064 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.053365946 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053379059 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053390026 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053402901 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.053407907 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053431988 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.053476095 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053487062 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053498983 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.053509951 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.053534985 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.054738045 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.054852962 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.054893970 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.056637049 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.056745052 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.056794882 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.060559988 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.060585022 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.060684919 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.060728073 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.060729027 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.060837984 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.060852051 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.060889006 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.061831951 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.061852932 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.061891079 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.062158108 CET	80	49763	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.063196898 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.063257933 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.063296080 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.064559937 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.064690113 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.064730883 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.067475080 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.067507029 CET	443	49731	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.067603111 CET	49731	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.068809032 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.068877935 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.068917990 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.071981907 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.072057009 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.072094917 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.072789907 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.076236963 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.076276064 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.076332092 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.076555967 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.076565981 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.079432964 CET	80	49762	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.080341101 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.080460072 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.080502987 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.088537931 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.088624954 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.088674068 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.096932888 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.096968889 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.097022057 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.105356932 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.105477095 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.105529070 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.112842083 CET	49763	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.112910032 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.114484072 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114533901 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114547014 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114576101 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.114593029 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114609957 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114620924 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114625931 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.114633083 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114665031 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.114675999 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114701033 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114711046 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.114712000 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.114744902 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.124963045 CET	80	49792	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.128484011 CET	49762	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.138590097 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.141498089 CET	80	49817	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.141561031 CET	49817	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.141772032 CET	49817	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.145433903 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.145495892 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.145530939 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.156116962 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.156303883 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.156344891 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.157723904 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.157867908 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.157903910 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.160835028 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.160985947 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.161024094 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.164112091 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.164133072 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.164186001 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.167181015 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.167277098 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.167323112 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.170269966 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.170352936 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.170389891 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.173135996 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.173255920 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.173268080 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.173278093 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.173294067 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.173319101 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.174238920 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.174355984 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.174428940 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.176259041 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.176342964 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.176400900 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.179116011 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.179184914 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.179224014 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.181925058 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.182075024 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.182110071 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.184763908 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.184946060 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.184986115 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.187557936 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.187588930 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.187630892 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.190309048 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.190407038 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.190447092 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.192914009 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.193031073 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.193077087 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.195586920 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.195688963 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.195733070 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.198230028 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.198354959 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.198399067 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.200856924 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.200968027 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.201004982 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.203479052 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.203597069 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.203640938 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.206168890 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.206188917 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.206226110 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.208802938 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.208879948 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.208929062 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.211441994 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.211502075 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.211538076 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.214020014 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.214143991 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.214183092 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.216651917 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.216907978 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.216948032 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.219337940 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.219465017 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.219520092 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.221882105 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.222012997 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.222075939 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.224519968 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.224642992 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.224689960 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.227080107 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.227152109 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.227174044 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.227225065 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:04.227226973 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.227241993 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:04.227257013 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.227276087 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.227293015 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:04.227303028 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:04.227320910 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:04.227387905 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.227430105 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.227489948 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.227610111 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.227672100 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.227708101 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.229377985 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.229516029 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.229554892 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.229787111 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.229883909 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.229924917 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.232467890 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.232609987 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.232656956 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.234652042 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.234695911 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.234709978 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.234740019 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.234764099 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.234807014 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.235037088 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.235162973 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.235213041 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.237684011 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.237811089 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.237855911 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.239630938 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.239753962 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.239789009 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.240405083 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.240513086 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.240556002 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.243006945 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.243026018 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.243066072 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.244067907 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.244136095 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:04.244152069 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.244760990 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.244844913 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.244891882 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.245157003 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.245214939 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.245246887 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.245570898 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.245686054 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.245724916 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.245798111 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:04.245811939 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.245822906 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:04.246175051 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.246268988 CET	443	49795	20.109.210.53	192.168.2.6
Nov 26, 2024 08:20:04.246309996 CET	49795	443	192.168.2.6	20.109.210.53
Nov 26, 2024 08:20:04.247694969 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.247813940 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.247855902 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.248189926 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.248327017 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.248372078 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.249887943 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.250003099 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.250036955 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.250880957 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.250992060 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.251033068 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.253623962 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.253721952 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.253948927 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.255027056 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.255145073 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.255182981 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.256081104 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.256131887 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.256145000 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.256175041 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.256217003 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.256257057 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.258856058 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.258974075 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.259015083 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.260157108 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.260235071 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.260271072 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.261401892 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.261487007 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.261533976 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.262510061 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.262681007 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.262692928 CET	80	49817	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.262797117 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.264034033 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.264148951 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.264188051 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.264462948 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.264585018 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.264627934 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.265278101 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.265345097 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.265425920 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.266694069 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.266827106 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.266839027 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.266850948 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.266865969 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.266896963 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.269284964 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.269433975 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.269479036 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.270399094 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.270528078 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.270561934 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.271959066 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.272166014 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.272198915 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.272933960 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.273113012 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.273153067 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.274643898 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.274827003 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.274862051 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.275177956 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.275190115 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.275228024 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.275501966 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.275696039 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.275768995 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.277138948 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.277245045 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.277343035 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.279791117 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.279896021 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.280630112 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.280783892 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.280817986 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.280848980 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.281306982 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.281466007 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.281524897 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.282388926 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.282531977 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.282617092 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.283551931 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.283663034 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.283814907 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.284674883 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.284686089 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.284780025 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.285018921 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.285156012 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.285259962 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.287684917 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.287781954 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.288043022 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.288283110 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.288389921 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.289709091 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.289779902 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.289807081 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.289932013 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.290330887 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.290451050 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.291834116 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.291934967 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.292062044 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.292114019 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.292124987 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.292141914 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.292361975 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.292913914 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.295949936 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.295988083 CET	80	49778	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.298121929 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.298166037 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.298192024 CET	49778	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.298254967 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.300385952 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.300520897 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.303895950 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.306494951 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.306619883 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.308720112 CET	80	49801	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.308752060 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.315180063 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.315293074 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.315433979 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.315773964 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.315843105 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.319835901 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.320010900 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.320092916 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.320220947 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.323383093 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.323421001 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.323671103 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.327617884 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.327697039 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.328403950 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.328495026 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.328526974 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.330660105 CET	80	49790	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.330688953 CET	80	49790	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.330701113 CET	80	49790	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.330727100 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.330760002 CET	49790	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:04.330805063 CET	80	49790	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.330816031 CET	80	49790	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.330916882 CET	49790	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:04.335692883 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.336836100 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.336962938 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.339857101 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.345237017 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.345330954 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.347574949 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.352569103 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.352586985 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.352616072 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.352628946 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.353672981 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.353791952 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.353926897 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.357441902 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.357614994 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.358051062 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.358361006 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.358478069 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.358767986 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.359105110 CET	49819	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.359132051 CET	443	49819	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.359224081 CET	49819	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.359446049 CET	49819	443	192.168.2.6	13.107.246.63
Nov 26, 2024 08:20:04.359453917 CET	443	49819	13.107.246.63	192.168.2.6
Nov 26, 2024 08:20:04.360305071 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.360403061 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.360625982 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.362123013 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.362207890 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.362242937 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.362253904 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.362330914 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.362333059 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.364173889 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.364243031 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.364517927 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.365123034 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.365269899 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.365400076 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.365989923 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.366115093 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.366482973 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.366523981 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.367887020 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.368022919 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.368346930 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.369347095 CET	80	49803	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.369817972 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.369852066 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.369975090 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.370506048 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.370619059 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.371120930 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.371416092 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.371520996 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.371699095 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.373229980 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.373265028 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.373426914 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.375017881 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.375178099 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.375468016 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.376709938 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.376779079 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.376827002 CET	49801	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.377013922 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.378420115 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.378519058 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.378525972 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.378546953 CET	49790	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:04.378618956 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.378624916 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.378635883 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.378640890 CET	80	49798	107.150.119.147	192.168.2.6
Nov 26, 2024 08:20:04.378659964 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.378659964 CET	49798	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:04.378717899 CET	49798	80	192.168.2.6	107.150.119.147
Nov 26, 2024 08:20:04.378942013 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.379033089 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.379658937 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.380148888 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.380217075 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.380584955 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.381814957 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.381921053 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.382097960 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.383517981 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.383625031 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.383925915 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.385200024 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.385303020 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.385679960 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.386838913 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.386966944 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.387171984 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.387279987 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.387396097 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.387515068 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.388478994 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.388619900 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.388938904 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.390115023 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.390232086 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.390513897 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.391752958 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.391866922 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.391928911 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.393389940 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.393470049 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.393985033 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.394994020 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.395040035 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.395697117 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.395764112 CET	80	49804	154.85.69.9	192.168.2.6
Nov 26, 2024 08:20:04.395795107 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.396569967 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.396595955 CET	49804	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.396670103 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.398174047 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.398287058 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.399060965 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.399477005 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.399740934 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.399831057 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.400369883 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.401278973 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.401355028 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.401527882 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.403003931 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.403171062 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.403291941 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.404421091 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.404442072 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.404511929 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.405989885 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.406065941 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.406532049 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.406893015 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.406999111 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.407134056 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.407839060 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.408019066 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.408765078 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.408874035 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.408881903 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.409759045 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.409822941 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.410064936 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.410661936 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.410783052 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.411027908 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.411583900 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.411631107 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.411832094 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.412533998 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.412575006 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.412751913 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.412751913 CET	49803	80	192.168.2.6	154.85.69.9
Nov 26, 2024 08:20:04.413475990 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.413575888 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.414211988 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.414406061 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.414519072 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.414664984 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.415353060 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.415472984 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.415885925 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.416289091 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.416357994 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.416999102 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.417314053 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.417407036 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.418207884 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.418283939 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.418308973 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.418536901 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.419224024 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.419358969 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.419997931 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.420078993 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.420192003 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.421117067 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.421230078 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.421267033 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.421968937 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.422050953 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.422122955 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.422240019 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.422920942 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.422981024 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.423352003 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.423820019 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.423933983 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.424241066 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.424767971 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.424904108 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.425736904 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.425821066 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.425965071 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.425965071 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.426698923 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.426786900 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.427150965 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.427602053 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.427942038 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.428716898 CET	80	49796	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.428925991 CET	49796	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.429610968 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.429625988 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.429708958 CET	49735	80	192.168.2.6	154.85.69.10
Nov 26, 2024 08:20:04.429848909 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.429958105 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.430994987 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.431106091 CET	80	49735	154.85.69.10	192.168.2.6
Nov 26, 2024 08:20:04.431296110 CET	49735	80	192.168.2.6	154.85.69.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 08:19:51.257757902 CET	192.168.2.6	1.1.1.1	0x2e42	Standard query (0)	www.wheel-done.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:51.259391069 CET	192.168.2.6	1.1.1.1	0xbf29	Standard query (0)	www.wheel-done.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:52.269714117 CET	192.168.2.6	1.1.1.1	0xd3cd	Standard query (0)	www.wheel-done.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:52.272245884 CET	192.168.2.6	1.1.1.1	0x7220	Standard query (0)	www.wheel-done.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:54.143652916 CET	192.168.2.6	1.1.1.1	0x6dcb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:54.144018888 CET	192.168.2.6	1.1.1.1	0xdbc8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:55.042987108 CET	192.168.2.6	1.1.1.1	0x4142	Standard query (0)	fe.faisco.cn	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:55.043121099 CET	192.168.2.6	1.1.1.1	0x7df3	Standard query (0)	fe.faisco.cn	65	IN (0x0001)	false
Nov 26, 2024 08:19:55.043652058 CET	192.168.2.6	1.1.1.1	0x1548	Standard query (0)	2.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:55.044089079 CET	192.168.2.6	1.1.1.1	0x39c5	Standard query (0)	2.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:55.044986010 CET	192.168.2.6	1.1.1.1	0x8d9a	Standard query (0)	jzs.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:55.045141935 CET	192.168.2.6	1.1.1.1	0xe18e	Standard query (0)	jzs.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:55.047264099 CET	192.168.2.6	1.1.1.1	0xbc1d	Standard query (0)	1.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:55.047487020 CET	192.168.2.6	1.1.1.1	0xaadc	Standard query (0)	1.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:55.048383951 CET	192.168.2.6	1.1.1.1	0xc8c6	Standard query (0)	jzfe.faisys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:55.048516035 CET	192.168.2.6	1.1.1.1	0xbde4	Standard query (0)	jzfe.faisys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:55.074943066 CET	192.168.2.6	1.1.1.1	0xeba3	Standard query (0)	0.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:55.075089931 CET	192.168.2.6	1.1.1.1	0xc264	Standard query (0)	0.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:56.060064077 CET	192.168.2.6	1.1.1.1	0xd216	Standard query (0)	2.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.060355902 CET	192.168.2.6	1.1.1.1	0x2ef	Standard query (0)	2.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:56.060355902 CET	192.168.2.6	1.1.1.1	0x2360	Standard query (0)	jzs.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.060863018 CET	192.168.2.6	1.1.1.1	0x8c3c	Standard query (0)	jzs.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:56.060863018 CET	192.168.2.6	1.1.1.1	0x3b3d	Standard query (0)	1.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.061114073 CET	192.168.2.6	1.1.1.1	0x4986	Standard query (0)	1.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:56.097453117 CET	192.168.2.6	1.1.1.1	0x9d62	Standard query (0)	0.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.097621918 CET	192.168.2.6	1.1.1.1	0xab74	Standard query (0)	0.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:56.777470112 CET	192.168.2.6	1.1.1.1	0xabdb	Standard query (0)	fe.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.777578115 CET	192.168.2.6	1.1.1.1	0x937a	Standard query (0)	fe.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:57.417571068 CET	192.168.2.6	1.1.1.1	0x222f	Standard query (0)	jzfe.faisys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:57.417571068 CET	192.168.2.6	1.1.1.1	0x5646	Standard query (0)	jzfe.faisys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:58.210092068 CET	192.168.2.6	1.1.1.1	0xcb7d	Standard query (0)	1.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:58.210092068 CET	192.168.2.6	1.1.1.1	0x9b57	Standard query (0)	1.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:19:58.264183044 CET	192.168.2.6	1.1.1.1	0xccc3	Standard query (0)	fe.faisco.cn	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:58.264450073 CET	192.168.2.6	1.1.1.1	0x2a95	Standard query (0)	fe.faisco.cn	65	IN (0x0001)	false
Nov 26, 2024 08:19:59.075284004 CET	192.168.2.6	1.1.1.1	0x3b04	Standard query (0)	28088389.s21i.faiusr.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:59.075424910 CET	192.168.2.6	1.1.1.1	0x2f85	Standard query (0)	28088389.s21i.faiusr.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:00.911786079 CET	192.168.2.6	1.1.1.1	0x55f	Standard query (0)	2.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:00.912031889 CET	192.168.2.6	1.1.1.1	0x2b33	Standard query (0)	2.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:01.044796944 CET	192.168.2.6	1.1.1.1	0x8d7d	Standard query (0)	0.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.045175076 CET	192.168.2.6	1.1.1.1	0x338a	Standard query (0)	0.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:01.052012920 CET	192.168.2.6	1.1.1.1	0xbdfe	Standard query (0)	www.wheel-done.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.052154064 CET	192.168.2.6	1.1.1.1	0x14d8	Standard query (0)	www.wheel-done.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:01.368494987 CET	192.168.2.6	1.1.1.1	0xc4af	Standard query (0)	fe.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.368700981 CET	192.168.2.6	1.1.1.1	0x6be2	Standard query (0)	fe.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:02.430305004 CET	192.168.2.6	1.1.1.1	0x96b4	Standard query (0)	20228233.s61i.faiusr.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:02.430352926 CET	192.168.2.6	1.1.1.1	0x2fbf	Standard query (0)	20228233.s61i.faiusr.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:02.431262016 CET	192.168.2.6	1.1.1.1	0x53e7	Standard query (0)	28088389.s21i.faiusr.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:02.431371927 CET	192.168.2.6	1.1.1.1	0x4faa	Standard query (0)	28088389.s21i.faiusr.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:02.671797991 CET	192.168.2.6	1.1.1.1	0x18c0	Standard query (0)	1.s60i.faiusr.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:02.671991110 CET	192.168.2.6	1.1.1.1	0x4011	Standard query (0)	1.s60i.faiusr.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:03.523153067 CET	192.168.2.6	1.1.1.1	0x128f	Standard query (0)	api.map.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:03.523294926 CET	192.168.2.6	1.1.1.1	0x424	Standard query (0)	api.map.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:04.353581905 CET	192.168.2.6	1.1.1.1	0x62af	Standard query (0)	push.zhanzhang.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:04.353818893 CET	192.168.2.6	1.1.1.1	0x3019	Standard query (0)	push.zhanzhang.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:04.417296886 CET	192.168.2.6	1.1.1.1	0xe71f	Standard query (0)	1.s60i.faiusr.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.248567104 CET	192.168.2.6	1.1.1.1	0x4094	Standard query (0)	datareport.webportal.top	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.249058962 CET	192.168.2.6	1.1.1.1	0x64ad	Standard query (0)	datareport.webportal.top	65	IN (0x0001)	false
Nov 26, 2024 08:20:05.249773979 CET	192.168.2.6	1.1.1.1	0x69c3	Standard query (0)	20228233.s61i.faiusr.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.249774933 CET	192.168.2.6	1.1.1.1	0x8fcc	Standard query (0)	20228233.s61i.faiusr.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:06.237183094 CET	192.168.2.6	1.1.1.1	0x377e	Standard query (0)	api.map.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:06.237474918 CET	192.168.2.6	1.1.1.1	0x3ac	Standard query (0)	api.map.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:06.291141987 CET	192.168.2.6	1.1.1.1	0xae6	Standard query (0)	1.s60i.faiusr.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:06.291296959 CET	192.168.2.6	1.1.1.1	0x6dae	Standard query (0)	1.s60i.faiusr.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:06.879343033 CET	192.168.2.6	1.1.1.1	0x123a	Standard query (0)	api.share.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:06.879898071 CET	192.168.2.6	1.1.1.1	0x331	Standard query (0)	api.share.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:06.882395983 CET	192.168.2.6	1.1.1.1	0xe635	Standard query (0)	push.zhanzhang.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:06.882550955 CET	192.168.2.6	1.1.1.1	0x203e	Standard query (0)	push.zhanzhang.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:06.992270947 CET	192.168.2.6	1.1.1.1	0x8046	Standard query (0)	datareport.webportal.top	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:06.992556095 CET	192.168.2.6	1.1.1.1	0x1cdb	Standard query (0)	datareport.webportal.top	65	IN (0x0001)	false
Nov 26, 2024 08:20:07.732552052 CET	192.168.2.6	1.1.1.1	0x12da	Standard query (0)	maponline2.bdimg.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.732707024 CET	192.168.2.6	1.1.1.1	0x41d8	Standard query (0)	maponline2.bdimg.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:07.733572006 CET	192.168.2.6	1.1.1.1	0x57bb	Standard query (0)	maponline1.bdimg.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.733572006 CET	192.168.2.6	1.1.1.1	0xeaf0	Standard query (0)	maponline1.bdimg.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:07.873658895 CET	192.168.2.6	1.1.1.1	0x5a7e	Standard query (0)	maponline3.bdimg.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.873785973 CET	192.168.2.6	1.1.1.1	0x39bb	Standard query (0)	maponline3.bdimg.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:07.940166950 CET	192.168.2.6	1.1.1.1	0x31d7	Standard query (0)	maponline0.bdimg.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.940166950 CET	192.168.2.6	1.1.1.1	0x3d9c	Standard query (0)	maponline0.bdimg.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:09.432292938 CET	192.168.2.6	1.1.1.1	0xf9ad	Standard query (0)	datareport.webportal.top	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:09.444168091 CET	192.168.2.6	1.1.1.1	0x7e1e	Standard query (0)	datareport.webportal.top	65	IN (0x0001)	false
Nov 26, 2024 08:20:10.009854078 CET	192.168.2.6	1.1.1.1	0xa6ba	Standard query (0)	dlswbr.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.010059118 CET	192.168.2.6	1.1.1.1	0x3e4	Standard query (0)	dlswbr.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:10.014883995 CET	192.168.2.6	1.1.1.1	0x9808	Standard query (0)	api.share.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.014986038 CET	192.168.2.6	1.1.1.1	0xf012	Standard query (0)	api.share.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:10.500610113 CET	192.168.2.6	1.1.1.1	0xc147	Standard query (0)	maponline0.bdimg.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.500741005 CET	192.168.2.6	1.1.1.1	0xf3f9	Standard query (0)	maponline0.bdimg.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:10.505140066 CET	192.168.2.6	1.1.1.1	0x55f3	Standard query (0)	maponline2.bdimg.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.505295038 CET	192.168.2.6	1.1.1.1	0x5d8c	Standard query (0)	maponline2.bdimg.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:10.516253948 CET	192.168.2.6	1.1.1.1	0x4fb5	Standard query (0)	maponline3.bdimg.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.516416073 CET	192.168.2.6	1.1.1.1	0xbead	Standard query (0)	maponline3.bdimg.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:10.547125101 CET	192.168.2.6	1.1.1.1	0x4a0d	Standard query (0)	maponline1.bdimg.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.547271967 CET	192.168.2.6	1.1.1.1	0x2daf	Standard query (0)	maponline1.bdimg.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:13.932285070 CET	192.168.2.6	1.1.1.1	0xa0a	Standard query (0)	dlswbr.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:13.932660103 CET	192.168.2.6	1.1.1.1	0x76c2	Standard query (0)	dlswbr.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:17.537273884 CET	192.168.2.6	1.1.1.1	0x41a6	Standard query (0)	miao.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:17.537506104 CET	192.168.2.6	1.1.1.1	0xc138	Standard query (0)	miao.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:17.549936056 CET	192.168.2.6	1.1.1.1	0x3d94	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:17.550256968 CET	192.168.2.6	1.1.1.1	0x9bc0	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:18.477273941 CET	192.168.2.6	1.1.1.1	0x9138	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:18.486105919 CET	192.168.2.6	1.1.1.1	0xc6ae	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:18.616846085 CET	192.168.2.6	1.1.1.1	0xed01	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:18.627331972 CET	192.168.2.6	1.1.1.1	0xd995	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:21.572746992 CET	192.168.2.6	1.1.1.1	0xf374	Standard query (0)	miao.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:21.572879076 CET	192.168.2.6	1.1.1.1	0xcbe6	Standard query (0)	miao.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:33.515609026 CET	192.168.2.6	1.1.1.1	0x11f4	Standard query (0)	static.tieba.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:33.515875101 CET	192.168.2.6	1.1.1.1	0xac3c	Standard query (0)	static.tieba.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:36.250364065 CET	192.168.2.6	1.1.1.1	0x7449	Standard query (0)	static.tieba.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:36.250539064 CET	192.168.2.6	1.1.1.1	0x8d41	Standard query (0)	static.tieba.baidu.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:37.067395926 CET	192.168.2.6	1.1.1.1	0xf2d0	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:37.068043947 CET	192.168.2.6	1.1.1.1	0xb46d	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:37.210386038 CET	192.168.2.6	1.1.1.1	0x2c63	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:37.210680008 CET	192.168.2.6	1.1.1.1	0xe399	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:37.357716084 CET	192.168.2.6	1.1.1.1	0x57ec	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:37.357753038 CET	192.168.2.6	1.1.1.1	0x5e04	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:48.290765047 CET	192.168.2.6	1.1.1.1	0x1278	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:48.291004896 CET	192.168.2.6	1.1.1.1	0x2bd1	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:48.438133001 CET	192.168.2.6	1.1.1.1	0xb588	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:48.438311100 CET	192.168.2.6	1.1.1.1	0x1c8a	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:48.582043886 CET	192.168.2.6	1.1.1.1	0xd3c8	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:48.585427046 CET	192.168.2.6	1.1.1.1	0xff7c	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:57.707391977 CET	192.168.2.6	1.1.1.1	0x5ce1	Standard query (0)	www.wheel-done.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:57.707521915 CET	192.168.2.6	1.1.1.1	0xc73e	Standard query (0)	www.wheel-done.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:58.587137938 CET	192.168.2.6	1.1.1.1	0xe78b	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:58.587400913 CET	192.168.2.6	1.1.1.1	0xd597	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:58.730422020 CET	192.168.2.6	1.1.1.1	0x38	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:58.731861115 CET	192.168.2.6	1.1.1.1	0x1909	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:58.880275965 CET	192.168.2.6	1.1.1.1	0x85fe	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:58.880625010 CET	192.168.2.6	1.1.1.1	0x5867	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:20:59.097385883 CET	192.168.2.6	1.1.1.1	0xb905	Standard query (0)	fe.faisco.cn	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.097520113 CET	192.168.2.6	1.1.1.1	0x66fc	Standard query (0)	fe.faisco.cn	65	IN (0x0001)	false
Nov 26, 2024 08:20:59.097810984 CET	192.168.2.6	1.1.1.1	0xa708	Standard query (0)	1.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.097930908 CET	192.168.2.6	1.1.1.1	0x73c3	Standard query (0)	1.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:59.100720882 CET	192.168.2.6	1.1.1.1	0x8755	Standard query (0)	jzfe.faisys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.100856066 CET	192.168.2.6	1.1.1.1	0x6a0a	Standard query (0)	jzfe.faisys.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:59.421561956 CET	192.168.2.6	1.1.1.1	0x7ea4	Standard query (0)	2.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.421678066 CET	192.168.2.6	1.1.1.1	0x69f6	Standard query (0)	2.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:20:59.528621912 CET	192.168.2.6	1.1.1.1	0xd7b0	Standard query (0)	jzs.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.528736115 CET	192.168.2.6	1.1.1.1	0xc457	Standard query (0)	jzs.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:21:00.339658976 CET	192.168.2.6	1.1.1.1	0x1832	Standard query (0)	0.ss.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:00.339961052 CET	192.168.2.6	1.1.1.1	0x6fda	Standard query (0)	0.ss.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:21:00.342761993 CET	192.168.2.6	1.1.1.1	0x10a1	Standard query (0)	fe.508sys.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:00.342912912 CET	192.168.2.6	1.1.1.1	0x23d0	Standard query (0)	fe.508sys.com	65	IN (0x0001)	false
Nov 26, 2024 08:21:02.057852030 CET	192.168.2.6	1.1.1.1	0x87b7	Standard query (0)	fe.faisco.cn	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:02.057981968 CET	192.168.2.6	1.1.1.1	0x3808	Standard query (0)	fe.faisco.cn	65	IN (0x0001)	false
Nov 26, 2024 08:21:07.702409983 CET	192.168.2.6	1.1.1.1	0x8cec	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:07.702838898 CET	192.168.2.6	1.1.1.1	0x4af6	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:21:07.842055082 CET	192.168.2.6	1.1.1.1	0x3b8c	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:08.662950993 CET	192.168.2.6	1.1.1.1	0x1cef	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:21:08.792423964 CET	192.168.2.6	1.1.1.1	0xbc6a	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:08.803612947 CET	192.168.2.6	1.1.1.1	0x9421	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Nov 26, 2024 08:21:12.657497883 CET	192.168.2.6	1.1.1.1	0xc0ef	Standard query (0)	dlswbr.baidu.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:12.657659054 CET	192.168.2.6	1.1.1.1	0x94e3	Standard query (0)	dlswbr.baidu.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 08:19:52.825467110 CET	1.1.1.1	192.168.2.6	0x2e42	No error (0)	www.wheel-done.com	wheel-done.com.lo1325.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:52.825467110 CET	1.1.1.1	192.168.2.6	0x2e42	No error (0)	wheel-done.com.lo1325.faipod.com	fap-76fc5a00.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:52.825467110 CET	1.1.1.1	192.168.2.6	0x2e42	No error (0)	fap-76fc5a00.faipod.com		107.150.119.147	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:52.825494051 CET	1.1.1.1	192.168.2.6	0xd3cd	No error (0)	www.wheel-done.com	wheel-done.com.lo1325.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:52.825494051 CET	1.1.1.1	192.168.2.6	0xd3cd	No error (0)	wheel-done.com.lo1325.faipod.com	fap-76fc5a00.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:52.825494051 CET	1.1.1.1	192.168.2.6	0xd3cd	No error (0)	fap-76fc5a00.faipod.com		107.150.119.147	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:52.826139927 CET	1.1.1.1	192.168.2.6	0x7220	No error (0)	www.wheel-done.com	wheel-done.com.lo1325.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:52.826139927 CET	1.1.1.1	192.168.2.6	0x7220	No error (0)	wheel-done.com.lo1325.faipod.com	fap-76fc5a00.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:52.826412916 CET	1.1.1.1	192.168.2.6	0xbf29	No error (0)	www.wheel-done.com	wheel-done.com.lo1325.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:52.826412916 CET	1.1.1.1	192.168.2.6	0xbf29	No error (0)	wheel-done.com.lo1325.faipod.com	fap-76fc5a00.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:54.289011002 CET	1.1.1.1	192.168.2.6	0x6dcb	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:54.289020061 CET	1.1.1.1	192.168.2.6	0xdbc8	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 08:19:55.347343922 CET	1.1.1.1	192.168.2.6	0x4142	No error (0)	fe.faisco.cn	us-kt0.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:55.347343922 CET	1.1.1.1	192.168.2.6	0x4142	No error (0)	us-kt0.faipod.com		107.150.104.134	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:55.533265114 CET	1.1.1.1	192.168.2.6	0x7df3	No error (0)	fe.faisco.cn	us-kt0.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:55.819123983 CET	1.1.1.1	192.168.2.6	0xbde4	No error (0)	jzfe.faisys.com	jzfe.faisys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:55.819123983 CET	1.1.1.1	192.168.2.6	0xbde4	No error (0)	jzfe.faisys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:55.820483923 CET	1.1.1.1	192.168.2.6	0xc8c6	No error (0)	jzfe.faisys.com	jzfe.faisys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:55.820483923 CET	1.1.1.1	192.168.2.6	0xc8c6	No error (0)	jzfe.faisys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:55.820483923 CET	1.1.1.1	192.168.2.6	0xc8c6	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:55.820483923 CET	1.1.1.1	192.168.2.6	0xc8c6	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775197029 CET	1.1.1.1	192.168.2.6	0xd216	No error (0)	2.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775197029 CET	1.1.1.1	192.168.2.6	0xd216	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775197029 CET	1.1.1.1	192.168.2.6	0xd216	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775197029 CET	1.1.1.1	192.168.2.6	0xd216	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775266886 CET	1.1.1.1	192.168.2.6	0x1548	No error (0)	2.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775266886 CET	1.1.1.1	192.168.2.6	0x1548	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775266886 CET	1.1.1.1	192.168.2.6	0x1548	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775266886 CET	1.1.1.1	192.168.2.6	0x1548	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775295019 CET	1.1.1.1	192.168.2.6	0x8c3c	No error (0)	jzs.508sys.com	jzs.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775295019 CET	1.1.1.1	192.168.2.6	0x8c3c	No error (0)	jzs.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775432110 CET	1.1.1.1	192.168.2.6	0x2360	No error (0)	jzs.508sys.com	jzs.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775432110 CET	1.1.1.1	192.168.2.6	0x2360	No error (0)	jzs.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775432110 CET	1.1.1.1	192.168.2.6	0x2360	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775432110 CET	1.1.1.1	192.168.2.6	0x2360	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775515079 CET	1.1.1.1	192.168.2.6	0x9d62	No error (0)	0.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775515079 CET	1.1.1.1	192.168.2.6	0x9d62	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775515079 CET	1.1.1.1	192.168.2.6	0x9d62	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775515079 CET	1.1.1.1	192.168.2.6	0x9d62	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775648117 CET	1.1.1.1	192.168.2.6	0xbc1d	No error (0)	1.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775648117 CET	1.1.1.1	192.168.2.6	0xbc1d	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775648117 CET	1.1.1.1	192.168.2.6	0xbc1d	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775648117 CET	1.1.1.1	192.168.2.6	0xbc1d	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775707960 CET	1.1.1.1	192.168.2.6	0xe18e	No error (0)	jzs.508sys.com	jzs.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.775707960 CET	1.1.1.1	192.168.2.6	0xe18e	No error (0)	jzs.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.776247025 CET	1.1.1.1	192.168.2.6	0x8d9a	No error (0)	jzs.508sys.com	jzs.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.776247025 CET	1.1.1.1	192.168.2.6	0x8d9a	No error (0)	jzs.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.776247025 CET	1.1.1.1	192.168.2.6	0x8d9a	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.776247025 CET	1.1.1.1	192.168.2.6	0x8d9a	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.776530027 CET	1.1.1.1	192.168.2.6	0xeba3	No error (0)	0.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.776530027 CET	1.1.1.1	192.168.2.6	0xeba3	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:56.776530027 CET	1.1.1.1	192.168.2.6	0xeba3	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:56.776530027 CET	1.1.1.1	192.168.2.6	0xeba3	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:57.428226948 CET	1.1.1.1	192.168.2.6	0x3b3d	No error (0)	1.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:57.428226948 CET	1.1.1.1	192.168.2.6	0x3b3d	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:57.428226948 CET	1.1.1.1	192.168.2.6	0x3b3d	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:57.428226948 CET	1.1.1.1	192.168.2.6	0x3b3d	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:57.536618948 CET	1.1.1.1	192.168.2.6	0xabdb	No error (0)	fe.508sys.com	fe.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:57.536618948 CET	1.1.1.1	192.168.2.6	0xabdb	No error (0)	fe.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:57.536618948 CET	1.1.1.1	192.168.2.6	0xabdb	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:57.536618948 CET	1.1.1.1	192.168.2.6	0xabdb	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:57.558190107 CET	1.1.1.1	192.168.2.6	0x222f	No error (0)	jzfe.faisys.com	jzfe.faisys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:57.558190107 CET	1.1.1.1	192.168.2.6	0x222f	No error (0)	jzfe.faisys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:57.558190107 CET	1.1.1.1	192.168.2.6	0x222f	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:57.558190107 CET	1.1.1.1	192.168.2.6	0x222f	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:57.561311960 CET	1.1.1.1	192.168.2.6	0x5646	No error (0)	jzfe.faisys.com	jzfe.faisys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:57.561311960 CET	1.1.1.1	192.168.2.6	0x5646	No error (0)	jzfe.faisys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:57.574290991 CET	1.1.1.1	192.168.2.6	0x937a	No error (0)	fe.508sys.com	fe.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:57.574290991 CET	1.1.1.1	192.168.2.6	0x937a	No error (0)	fe.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:58.352210045 CET	1.1.1.1	192.168.2.6	0xcb7d	No error (0)	1.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:58.352210045 CET	1.1.1.1	192.168.2.6	0xcb7d	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:58.352210045 CET	1.1.1.1	192.168.2.6	0xcb7d	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:58.352210045 CET	1.1.1.1	192.168.2.6	0xcb7d	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:58.406157970 CET	1.1.1.1	192.168.2.6	0xccc3	No error (0)	fe.faisco.cn	us-kt0.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:19:58.406157970 CET	1.1.1.1	192.168.2.6	0xccc3	No error (0)	us-kt0.faipod.com		107.150.104.134	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:19:58.406472921 CET	1.1.1.1	192.168.2.6	0x2a95	No error (0)	fe.faisco.cn	us-kt0.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:00.434880972 CET	1.1.1.1	192.168.2.6	0x3b04	No error (0)	28088389.s21i.faiusr.com	wildcard.s21i.faiusr.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:00.434880972 CET	1.1.1.1	192.168.2.6	0x3b04	No error (0)	wildcard.s21i.faiusr.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:00.434880972 CET	1.1.1.1	192.168.2.6	0x3b04	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:00.434880972 CET	1.1.1.1	192.168.2.6	0x3b04	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.053796053 CET	1.1.1.1	192.168.2.6	0x55f	No error (0)	2.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.053796053 CET	1.1.1.1	192.168.2.6	0x55f	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.053796053 CET	1.1.1.1	192.168.2.6	0x55f	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.053796053 CET	1.1.1.1	192.168.2.6	0x55f	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.187639952 CET	1.1.1.1	192.168.2.6	0x8d7d	No error (0)	0.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.187639952 CET	1.1.1.1	192.168.2.6	0x8d7d	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.187639952 CET	1.1.1.1	192.168.2.6	0x8d7d	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.187639952 CET	1.1.1.1	192.168.2.6	0x8d7d	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.193442106 CET	1.1.1.1	192.168.2.6	0x14d8	No error (0)	www.wheel-done.com	wheel-done.com.lo1325.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.193442106 CET	1.1.1.1	192.168.2.6	0x14d8	No error (0)	wheel-done.com.lo1325.faipod.com	fap-76fc5a00.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.266602039 CET	1.1.1.1	192.168.2.6	0xbdfe	No error (0)	www.wheel-done.com	wheel-done.com.lo1325.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.266602039 CET	1.1.1.1	192.168.2.6	0xbdfe	No error (0)	wheel-done.com.lo1325.faipod.com	fap-76fc5a00.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.266602039 CET	1.1.1.1	192.168.2.6	0xbdfe	No error (0)	fap-76fc5a00.faipod.com		107.150.119.147	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.508898973 CET	1.1.1.1	192.168.2.6	0x6be2	No error (0)	fe.508sys.com	fe.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.508898973 CET	1.1.1.1	192.168.2.6	0x6be2	No error (0)	fe.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.509463072 CET	1.1.1.1	192.168.2.6	0xc4af	No error (0)	fe.508sys.com	fe.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.509463072 CET	1.1.1.1	192.168.2.6	0xc4af	No error (0)	fe.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:01.509463072 CET	1.1.1.1	192.168.2.6	0xc4af	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:01.509463072 CET	1.1.1.1	192.168.2.6	0xc4af	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:02.580050945 CET	1.1.1.1	192.168.2.6	0x53e7	No error (0)	28088389.s21i.faiusr.com	wildcard.s21i.faiusr.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:02.580050945 CET	1.1.1.1	192.168.2.6	0x53e7	No error (0)	wildcard.s21i.faiusr.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:02.580050945 CET	1.1.1.1	192.168.2.6	0x53e7	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:02.580050945 CET	1.1.1.1	192.168.2.6	0x53e7	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:03.514966965 CET	1.1.1.1	192.168.2.6	0x96b4	No error (0)	20228233.s61i.faiusr.com	wildcard.s61i.faiusr.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:03.514966965 CET	1.1.1.1	192.168.2.6	0x96b4	No error (0)	wildcard.s61i.faiusr.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:03.514966965 CET	1.1.1.1	192.168.2.6	0x96b4	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:03.514966965 CET	1.1.1.1	192.168.2.6	0x96b4	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:03.664022923 CET	1.1.1.1	192.168.2.6	0x128f	No error (0)	api.map.baidu.com	api.map.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:03.664022923 CET	1.1.1.1	192.168.2.6	0x128f	No error (0)	api.map.n.shifen.com		180.76.11.161	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:03.664022923 CET	1.1.1.1	192.168.2.6	0x128f	No error (0)	api.map.n.shifen.com		180.76.11.230	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:03.664022923 CET	1.1.1.1	192.168.2.6	0x128f	No error (0)	api.map.n.shifen.com		180.76.11.208	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:03.977969885 CET	1.1.1.1	192.168.2.6	0x424	No error (0)	api.map.baidu.com	api.map.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:04.511975050 CET	1.1.1.1	192.168.2.6	0x18c0	No error (0)	1.s60i.faiusr.com	wsall.s60i.faiusr.com.wswebcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:04.511975050 CET	1.1.1.1	192.168.2.6	0x18c0	No error (0)	wsall.s60i.faiusr.com.wswebcdn.com		111.180.138.108	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:04.556407928 CET	1.1.1.1	192.168.2.6	0xe71f	No error (0)	1.s60i.faiusr.com	wsall.s60i.faiusr.com.wswebcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:04.556407928 CET	1.1.1.1	192.168.2.6	0xe71f	No error (0)	wsall.s60i.faiusr.com.wswebcdn.com		111.180.138.108	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.038814068 CET	1.1.1.1	192.168.2.6	0x62af	No error (0)	share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.395559072 CET	1.1.1.1	192.168.2.6	0x69c3	No error (0)	20228233.s61i.faiusr.com	wildcard.s61i.faiusr.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:05.395559072 CET	1.1.1.1	192.168.2.6	0x69c3	No error (0)	wildcard.s61i.faiusr.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:05.395559072 CET	1.1.1.1	192.168.2.6	0x69c3	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.395559072 CET	1.1.1.1	192.168.2.6	0x69c3	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:05.778721094 CET	1.1.1.1	192.168.2.6	0x3019	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:05.778721094 CET	1.1.1.1	192.168.2.6	0x3019	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:06.377654076 CET	1.1.1.1	192.168.2.6	0x377e	No error (0)	api.map.baidu.com	api.map.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:06.377654076 CET	1.1.1.1	192.168.2.6	0x377e	No error (0)	api.map.n.shifen.com		180.76.11.230	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:06.377654076 CET	1.1.1.1	192.168.2.6	0x377e	No error (0)	api.map.n.shifen.com		180.76.11.208	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:06.377654076 CET	1.1.1.1	192.168.2.6	0x377e	No error (0)	api.map.n.shifen.com		180.76.11.161	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:06.379945993 CET	1.1.1.1	192.168.2.6	0x3ac	No error (0)	api.map.baidu.com	api.map.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:06.431334972 CET	1.1.1.1	192.168.2.6	0xae6	No error (0)	1.s60i.faiusr.com	wsall.s60i.faiusr.com.wswebcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:06.431334972 CET	1.1.1.1	192.168.2.6	0xae6	No error (0)	wsall.s60i.faiusr.com.wswebcdn.com		111.180.138.108	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.027832031 CET	1.1.1.1	192.168.2.6	0x203e	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.027832031 CET	1.1.1.1	192.168.2.6	0x203e	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.029345989 CET	1.1.1.1	192.168.2.6	0xe635	No error (0)	share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.734659910 CET	1.1.1.1	192.168.2.6	0x64ad	No error (0)	datareport.webportal.top	datareport.webportal.top.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.734659910 CET	1.1.1.1	192.168.2.6	0x64ad	No error (0)	datareport.webportal.top.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.735162020 CET	1.1.1.1	192.168.2.6	0x4094	No error (0)	datareport.webportal.top	datareport.webportal.top.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.735162020 CET	1.1.1.1	192.168.2.6	0x4094	No error (0)	datareport.webportal.top.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.735162020 CET	1.1.1.1	192.168.2.6	0x4094	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.735162020 CET	1.1.1.1	192.168.2.6	0x4094	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.735259056 CET	1.1.1.1	192.168.2.6	0x8046	No error (0)	datareport.webportal.top	datareport.webportal.top.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.735259056 CET	1.1.1.1	192.168.2.6	0x8046	No error (0)	datareport.webportal.top.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:07.735259056 CET	1.1.1.1	192.168.2.6	0x8046	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:07.735259056 CET	1.1.1.1	192.168.2.6	0x8046	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.203264952 CET	1.1.1.1	192.168.2.6	0x123a	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.203264952 CET	1.1.1.1	192.168.2.6	0x123a	No error (0)	api.share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.203264952 CET	1.1.1.1	192.168.2.6	0x123a	No error (0)	api.share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.203264952 CET	1.1.1.1	192.168.2.6	0x123a	No error (0)	api.share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.203264952 CET	1.1.1.1	192.168.2.6	0x123a	No error (0)	api.share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.203264952 CET	1.1.1.1	192.168.2.6	0x123a	No error (0)	api.share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.203264952 CET	1.1.1.1	192.168.2.6	0x123a	No error (0)	api.share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.203264952 CET	1.1.1.1	192.168.2.6	0x123a	No error (0)	api.share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.203264952 CET	1.1.1.1	192.168.2.6	0x123a	No error (0)	api.share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.215796947 CET	1.1.1.1	192.168.2.6	0x331	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726053953 CET	1.1.1.1	192.168.2.6	0x57bb	No error (0)	maponline1.bdimg.com	maponline1.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726053953 CET	1.1.1.1	192.168.2.6	0x57bb	No error (0)	maponline1.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726053953 CET	1.1.1.1	192.168.2.6	0x57bb	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726053953 CET	1.1.1.1	192.168.2.6	0x57bb	No error (0)	opencdnbdglobal.gshifen.com		185.10.104.124	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726222038 CET	1.1.1.1	192.168.2.6	0x5a7e	No error (0)	maponline3.bdimg.com	maponline3.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726222038 CET	1.1.1.1	192.168.2.6	0x5a7e	No error (0)	maponline3.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726222038 CET	1.1.1.1	192.168.2.6	0x5a7e	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726222038 CET	1.1.1.1	192.168.2.6	0x5a7e	No error (0)	opencdnbdglobal.gshifen.com		185.10.104.124	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726556063 CET	1.1.1.1	192.168.2.6	0x31d7	No error (0)	maponline0.bdimg.com	maponline0.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726556063 CET	1.1.1.1	192.168.2.6	0x31d7	No error (0)	maponline0.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726556063 CET	1.1.1.1	192.168.2.6	0x31d7	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.726556063 CET	1.1.1.1	192.168.2.6	0x31d7	No error (0)	opencdnbdglobal.gshifen.com		185.10.104.124	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.727000952 CET	1.1.1.1	192.168.2.6	0x12da	No error (0)	maponline2.bdimg.com	maponline2.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.727000952 CET	1.1.1.1	192.168.2.6	0x12da	No error (0)	maponline2.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.727000952 CET	1.1.1.1	192.168.2.6	0x12da	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.727000952 CET	1.1.1.1	192.168.2.6	0x12da	No error (0)	opencdnbdglobal.gshifen.com		185.10.104.124	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:08.752986908 CET	1.1.1.1	192.168.2.6	0x1cdb	No error (0)	datareport.webportal.top	datareport.webportal.top.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.752986908 CET	1.1.1.1	192.168.2.6	0x1cdb	No error (0)	datareport.webportal.top.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.764987946 CET	1.1.1.1	192.168.2.6	0x3d9c	No error (0)	maponline0.bdimg.com	maponline0.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.764987946 CET	1.1.1.1	192.168.2.6	0x3d9c	No error (0)	maponline0.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.764987946 CET	1.1.1.1	192.168.2.6	0x3d9c	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.765079975 CET	1.1.1.1	192.168.2.6	0x41d8	No error (0)	maponline2.bdimg.com	maponline2.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.765079975 CET	1.1.1.1	192.168.2.6	0x41d8	No error (0)	maponline2.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.765079975 CET	1.1.1.1	192.168.2.6	0x41d8	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.765371084 CET	1.1.1.1	192.168.2.6	0xeaf0	No error (0)	maponline1.bdimg.com	maponline1.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.765371084 CET	1.1.1.1	192.168.2.6	0xeaf0	No error (0)	maponline1.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.765371084 CET	1.1.1.1	192.168.2.6	0xeaf0	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.766758919 CET	1.1.1.1	192.168.2.6	0x39bb	No error (0)	maponline3.bdimg.com	maponline3.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.766758919 CET	1.1.1.1	192.168.2.6	0x39bb	No error (0)	maponline3.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:08.766758919 CET	1.1.1.1	192.168.2.6	0x39bb	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:09.575326920 CET	1.1.1.1	192.168.2.6	0xf9ad	No error (0)	datareport.webportal.top	datareport.webportal.top.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:09.575326920 CET	1.1.1.1	192.168.2.6	0xf9ad	No error (0)	datareport.webportal.top.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:09.575326920 CET	1.1.1.1	192.168.2.6	0xf9ad	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:09.575326920 CET	1.1.1.1	192.168.2.6	0xf9ad	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:09.584295988 CET	1.1.1.1	192.168.2.6	0x7e1e	No error (0)	datareport.webportal.top	datareport.webportal.top.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:09.584295988 CET	1.1.1.1	192.168.2.6	0x7e1e	No error (0)	datareport.webportal.top.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155575037 CET	1.1.1.1	192.168.2.6	0x9808	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155575037 CET	1.1.1.1	192.168.2.6	0x9808	No error (0)	api.share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155575037 CET	1.1.1.1	192.168.2.6	0x9808	No error (0)	api.share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155575037 CET	1.1.1.1	192.168.2.6	0x9808	No error (0)	api.share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155575037 CET	1.1.1.1	192.168.2.6	0x9808	No error (0)	api.share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155575037 CET	1.1.1.1	192.168.2.6	0x9808	No error (0)	api.share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155575037 CET	1.1.1.1	192.168.2.6	0x9808	No error (0)	api.share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155575037 CET	1.1.1.1	192.168.2.6	0x9808	No error (0)	api.share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155575037 CET	1.1.1.1	192.168.2.6	0x9808	No error (0)	api.share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.155653000 CET	1.1.1.1	192.168.2.6	0xf012	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.642544031 CET	1.1.1.1	192.168.2.6	0xf3f9	No error (0)	maponline0.bdimg.com	maponline0.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.642544031 CET	1.1.1.1	192.168.2.6	0xf3f9	No error (0)	maponline0.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.642544031 CET	1.1.1.1	192.168.2.6	0xf3f9	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.645145893 CET	1.1.1.1	192.168.2.6	0xc147	No error (0)	maponline0.bdimg.com	maponline0.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.645145893 CET	1.1.1.1	192.168.2.6	0xc147	No error (0)	maponline0.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.645145893 CET	1.1.1.1	192.168.2.6	0xc147	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.645145893 CET	1.1.1.1	192.168.2.6	0xc147	No error (0)	opencdnbdglobal.gshifen.com		185.10.104.124	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.645550013 CET	1.1.1.1	192.168.2.6	0x55f3	No error (0)	maponline2.bdimg.com	maponline2.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.645550013 CET	1.1.1.1	192.168.2.6	0x55f3	No error (0)	maponline2.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.645550013 CET	1.1.1.1	192.168.2.6	0x55f3	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.645550013 CET	1.1.1.1	192.168.2.6	0x55f3	No error (0)	opencdnbdglobal.gshifen.com		185.10.104.124	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.646781921 CET	1.1.1.1	192.168.2.6	0x5d8c	No error (0)	maponline2.bdimg.com	maponline2.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.646781921 CET	1.1.1.1	192.168.2.6	0x5d8c	No error (0)	maponline2.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.646781921 CET	1.1.1.1	192.168.2.6	0x5d8c	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.656250954 CET	1.1.1.1	192.168.2.6	0x4fb5	No error (0)	maponline3.bdimg.com	maponline3.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.656250954 CET	1.1.1.1	192.168.2.6	0x4fb5	No error (0)	maponline3.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.656250954 CET	1.1.1.1	192.168.2.6	0x4fb5	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.656250954 CET	1.1.1.1	192.168.2.6	0x4fb5	No error (0)	opencdnbdglobal.gshifen.com		185.10.104.124	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.657051086 CET	1.1.1.1	192.168.2.6	0xbead	No error (0)	maponline3.bdimg.com	maponline3.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.657051086 CET	1.1.1.1	192.168.2.6	0xbead	No error (0)	maponline3.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.657051086 CET	1.1.1.1	192.168.2.6	0xbead	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.686774015 CET	1.1.1.1	192.168.2.6	0x2daf	No error (0)	maponline1.bdimg.com	maponline1.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.686774015 CET	1.1.1.1	192.168.2.6	0x2daf	No error (0)	maponline1.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.686774015 CET	1.1.1.1	192.168.2.6	0x2daf	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.687150002 CET	1.1.1.1	192.168.2.6	0x4a0d	No error (0)	maponline1.bdimg.com	maponline1.bdimg.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.687150002 CET	1.1.1.1	192.168.2.6	0x4a0d	No error (0)	maponline1.bdimg.com.a.bdydns.com	opencdnbdglobalv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.687150002 CET	1.1.1.1	192.168.2.6	0x4a0d	No error (0)	opencdnbdglobalv6.jomodns.com	opencdnbdglobal.gshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.687150002 CET	1.1.1.1	192.168.2.6	0x4a0d	No error (0)	opencdnbdglobal.gshifen.com		185.10.104.124	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.756817102 CET	1.1.1.1	192.168.2.6	0xa6ba	No error (0)	dlswbr.baidu.com	dlswbr.baidu.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.756817102 CET	1.1.1.1	192.168.2.6	0xa6ba	No error (0)	dlswbr.baidu.com.a.bdydns.com	opencdnbdsslv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.756817102 CET	1.1.1.1	192.168.2.6	0xa6ba	No error (0)	opencdnbdsslv6.jomodns.com		182.61.128.141	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:10.770148993 CET	1.1.1.1	192.168.2.6	0x3e4	No error (0)	dlswbr.baidu.com	dlswbr.baidu.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:10.770148993 CET	1.1.1.1	192.168.2.6	0x3e4	No error (0)	dlswbr.baidu.com.a.bdydns.com	opencdnbdsslv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:14.072244883 CET	1.1.1.1	192.168.2.6	0xa0a	No error (0)	dlswbr.baidu.com	dlswbr.baidu.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:14.072244883 CET	1.1.1.1	192.168.2.6	0xa0a	No error (0)	dlswbr.baidu.com.a.bdydns.com	opencdnbdsslv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:14.072244883 CET	1.1.1.1	192.168.2.6	0xa0a	No error (0)	opencdnbdsslv6.jomodns.com		182.61.128.141	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:14.072578907 CET	1.1.1.1	192.168.2.6	0x76c2	No error (0)	dlswbr.baidu.com	dlswbr.baidu.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:14.072578907 CET	1.1.1.1	192.168.2.6	0x76c2	No error (0)	dlswbr.baidu.com.a.bdydns.com	opencdnbdsslv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:17.963578939 CET	1.1.1.1	192.168.2.6	0x41a6	No error (0)	miao.baidu.com	anti-bot.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:17.963578939 CET	1.1.1.1	192.168.2.6	0x41a6	No error (0)	anti-bot.n.shifen.com		163.177.18.92	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:17.963578939 CET	1.1.1.1	192.168.2.6	0x41a6	No error (0)	anti-bot.n.shifen.com		153.3.237.19	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:17.981456041 CET	1.1.1.1	192.168.2.6	0xc138	No error (0)	miao.baidu.com	anti-bot.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:18.476712942 CET	1.1.1.1	192.168.2.6	0x9bc0	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:18.485747099 CET	1.1.1.1	192.168.2.6	0x3d94	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:18.616106033 CET	1.1.1.1	192.168.2.6	0x9138	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:18.626696110 CET	1.1.1.1	192.168.2.6	0xc6ae	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:18.760201931 CET	1.1.1.1	192.168.2.6	0xed01	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:18.770143986 CET	1.1.1.1	192.168.2.6	0xd995	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:21.713841915 CET	1.1.1.1	192.168.2.6	0xf374	No error (0)	miao.baidu.com	anti-bot.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:21.713841915 CET	1.1.1.1	192.168.2.6	0xf374	No error (0)	anti-bot.n.shifen.com		153.3.237.19	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:21.713841915 CET	1.1.1.1	192.168.2.6	0xf374	No error (0)	anti-bot.n.shifen.com		163.177.18.92	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:21.713943005 CET	1.1.1.1	192.168.2.6	0xcbe6	No error (0)	miao.baidu.com	anti-bot.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:34.526225090 CET	1.1.1.1	192.168.2.6	0xac3c	No error (0)	static.tieba.baidu.com	post.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:34.526659966 CET	1.1.1.1	192.168.2.6	0x11f4	No error (0)	static.tieba.baidu.com	post.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:34.526659966 CET	1.1.1.1	192.168.2.6	0x11f4	No error (0)	post.n.shifen.com		45.113.194.211	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:36.398179054 CET	1.1.1.1	192.168.2.6	0x7449	No error (0)	static.tieba.baidu.com	post.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:36.398179054 CET	1.1.1.1	192.168.2.6	0x7449	No error (0)	post.n.shifen.com		45.113.194.211	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:36.398194075 CET	1.1.1.1	192.168.2.6	0x8d41	No error (0)	static.tieba.baidu.com	post.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:37.209949970 CET	1.1.1.1	192.168.2.6	0xb46d	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:37.210344076 CET	1.1.1.1	192.168.2.6	0xf2d0	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:37.356863976 CET	1.1.1.1	192.168.2.6	0x2c63	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:37.357007027 CET	1.1.1.1	192.168.2.6	0xe399	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:37.504834890 CET	1.1.1.1	192.168.2.6	0x5e04	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:37.505268097 CET	1.1.1.1	192.168.2.6	0x57ec	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:48.437695026 CET	1.1.1.1	192.168.2.6	0x1278	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:48.437711000 CET	1.1.1.1	192.168.2.6	0x2bd1	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:48.580766916 CET	1.1.1.1	192.168.2.6	0x1c8a	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:48.584541082 CET	1.1.1.1	192.168.2.6	0xb588	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:48.727782011 CET	1.1.1.1	192.168.2.6	0xd3c8	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:48.730385065 CET	1.1.1.1	192.168.2.6	0xff7c	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:58.132304907 CET	1.1.1.1	192.168.2.6	0xc73e	No error (0)	www.wheel-done.com	wheel-done.com.lo1325.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:58.132304907 CET	1.1.1.1	192.168.2.6	0xc73e	No error (0)	wheel-done.com.lo1325.faipod.com	fap-76fc5a00.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:58.144279957 CET	1.1.1.1	192.168.2.6	0x5ce1	No error (0)	www.wheel-done.com	wheel-done.com.lo1325.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:58.144279957 CET	1.1.1.1	192.168.2.6	0x5ce1	No error (0)	wheel-done.com.lo1325.faipod.com	fap-76fc5a00.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:58.144279957 CET	1.1.1.1	192.168.2.6	0x5ce1	No error (0)	fap-76fc5a00.faipod.com		107.150.119.147	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:58.729944944 CET	1.1.1.1	192.168.2.6	0xd597	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:58.731630087 CET	1.1.1.1	192.168.2.6	0xe78b	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:58.877188921 CET	1.1.1.1	192.168.2.6	0x38	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:58.878041029 CET	1.1.1.1	192.168.2.6	0x1909	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.027017117 CET	1.1.1.1	192.168.2.6	0x85fe	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.027802944 CET	1.1.1.1	192.168.2.6	0x5867	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:20:59.240104914 CET	1.1.1.1	192.168.2.6	0x6a0a	No error (0)	jzfe.faisys.com	jzfe.faisys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.240104914 CET	1.1.1.1	192.168.2.6	0x6a0a	No error (0)	jzfe.faisys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.240406990 CET	1.1.1.1	192.168.2.6	0x66fc	No error (0)	fe.faisco.cn	us-kt0.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.419348001 CET	1.1.1.1	192.168.2.6	0xb905	No error (0)	fe.faisco.cn	us-kt0.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.419348001 CET	1.1.1.1	192.168.2.6	0xb905	No error (0)	us-kt0.faipod.com		107.150.104.134	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.525934935 CET	1.1.1.1	192.168.2.6	0x8755	No error (0)	jzfe.faisys.com	jzfe.faisys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.525934935 CET	1.1.1.1	192.168.2.6	0x8755	No error (0)	jzfe.faisys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.525934935 CET	1.1.1.1	192.168.2.6	0x8755	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.525934935 CET	1.1.1.1	192.168.2.6	0x8755	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.547246933 CET	1.1.1.1	192.168.2.6	0xa708	No error (0)	1.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.547246933 CET	1.1.1.1	192.168.2.6	0xa708	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.547246933 CET	1.1.1.1	192.168.2.6	0xa708	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.547246933 CET	1.1.1.1	192.168.2.6	0xa708	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.671765089 CET	1.1.1.1	192.168.2.6	0xc457	No error (0)	jzs.508sys.com	jzs.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.671765089 CET	1.1.1.1	192.168.2.6	0xc457	No error (0)	jzs.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.846560955 CET	1.1.1.1	192.168.2.6	0x7ea4	No error (0)	2.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.846560955 CET	1.1.1.1	192.168.2.6	0x7ea4	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.846560955 CET	1.1.1.1	192.168.2.6	0x7ea4	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.846560955 CET	1.1.1.1	192.168.2.6	0x7ea4	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.846980095 CET	1.1.1.1	192.168.2.6	0xd7b0	No error (0)	jzs.508sys.com	jzs.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.846980095 CET	1.1.1.1	192.168.2.6	0xd7b0	No error (0)	jzs.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:20:59.846980095 CET	1.1.1.1	192.168.2.6	0xd7b0	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:20:59.846980095 CET	1.1.1.1	192.168.2.6	0xd7b0	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:00.489784956 CET	1.1.1.1	192.168.2.6	0x23d0	No error (0)	fe.508sys.com	fe.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:00.489784956 CET	1.1.1.1	192.168.2.6	0x23d0	No error (0)	fe.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:00.754971981 CET	1.1.1.1	192.168.2.6	0x10a1	No error (0)	fe.508sys.com	fe.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:00.754971981 CET	1.1.1.1	192.168.2.6	0x10a1	No error (0)	fe.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:00.754971981 CET	1.1.1.1	192.168.2.6	0x10a1	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:00.754971981 CET	1.1.1.1	192.168.2.6	0x10a1	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:00.755307913 CET	1.1.1.1	192.168.2.6	0x1832	No error (0)	0.ss.508sys.com	wildcard.ss.508sys.com.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:00.755307913 CET	1.1.1.1	192.168.2.6	0x1832	No error (0)	wildcard.ss.508sys.com.bsclink.cn	zcmgbipv6.v.bsclink.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:00.755307913 CET	1.1.1.1	192.168.2.6	0x1832	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:00.755307913 CET	1.1.1.1	192.168.2.6	0x1832	No error (0)	zcmgbipv6.v.bsclink.cn		154.85.69.9	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:02.198231936 CET	1.1.1.1	192.168.2.6	0x3808	No error (0)	fe.faisco.cn	us-kt0.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:02.198386908 CET	1.1.1.1	192.168.2.6	0x87b7	No error (0)	fe.faisco.cn	us-kt0.faipod.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:02.198386908 CET	1.1.1.1	192.168.2.6	0x87b7	No error (0)	us-kt0.faipod.com		107.150.104.134	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:07.841536045 CET	1.1.1.1	192.168.2.6	0x8cec	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:08.662534952 CET	1.1.1.1	192.168.2.6	0x4af6	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:21:08.791773081 CET	1.1.1.1	192.168.2.6	0x3b8c	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:08.803045034 CET	1.1.1.1	192.168.2.6	0x1cef	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:21:08.932029009 CET	1.1.1.1	192.168.2.6	0xbc6a	Server failure (2)	stun.services.mozilla1.com	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:08.943747997 CET	1.1.1.1	192.168.2.6	0x9421	Server failure (2)	stun.services.mozilla1.com	none	none	28	IN (0x0001)	false
Nov 26, 2024 08:21:13.631330013 CET	1.1.1.1	192.168.2.6	0xc0ef	No error (0)	dlswbr.baidu.com	dlswbr.baidu.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:13.631330013 CET	1.1.1.1	192.168.2.6	0xc0ef	No error (0)	dlswbr.baidu.com.a.bdydns.com	opencdnbdsslv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:13.631330013 CET	1.1.1.1	192.168.2.6	0xc0ef	No error (0)	opencdnbdsslv6.jomodns.com		182.61.128.141	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:21:13.686850071 CET	1.1.1.1	192.168.2.6	0x94e3	No error (0)	dlswbr.baidu.com	dlswbr.baidu.com.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:21:13.686850071 CET	1.1.1.1	192.168.2.6	0x94e3	No error (0)	dlswbr.baidu.com.a.bdydns.com	opencdnbdsslv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:52.947442055 CET	433	OUT	GET / HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:55.009850025 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Date: Tue, 26 Nov 2024 07:19:49 GMT Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:19:54 GMT; HttpOnly Set-Cookie: _cliid=C0DaAtB2gDRdoE2X; domain=www.wheel-done.com; path=/; expires=Wed, 26-Nov-2025 07:19:54 GMT; HttpOnly Set-Cookie: _lastEnterDay=2024-11-26; domain=www.wheel-done.com; path=/; expires=Thu, 28-Nov-2024 07:19:54 GMT; HttpOnly FAI-CACHE-STATUS: MISS Content-Encoding: gzip Origin-Agent-Cluster: ?0 X-Frame-Options: SAMEORIGIN X-Download-Options: noopen Cache-Flow: 3509052827 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff FAI-W-FLOW: 1016316014 FAI-W-AGENT-AID: 28088389 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 P3P: CP=CAO PSA OUR X-Permitted-Cross-Domain-Policies: none Server: F-WEB Data Raw: 36 65 63 35 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ec bd eb 73 14 47 b2 38 fa 19 22 f6 7f e8 9d bd 67 07 c7 d5 63 7a 5e 1a 49 a0 f3 13 02 8c 58 5e 46 c2 de 3d eb 8d 89 9e 99 9e 51 8b 9e ee 71 77 8f 84 e0 2a 02 6c 63 c0 cb cb eb 37 e0 07 5e 3f 30 6b 83 bd d8 46 08 30 1f f6 9c af 1b de df 97 b3 e7 9e 2f de 38 9a 91 74 e3 de f0 bf 70 33 ab aa bb ab 7b 7a 5e d2 48 3c 16 61 4f 77 d7 23 ab 2a 2b 2b 2b 2b 2b 2b 6b f3 cf b7 ed 1b 19 ff cd fe ed c2 ce f1 3d bb 87 7e b6 71 f3 cf bb bb 37 4f 58 45 75 68 f3 84 2c e5 86 36 f7 d2 47 46 cf cd c0 07 7b 90 04 dd dd 98 1e 5f 05 55 d2 0a 5b 42 47 26 42 42 56 95 4c 73 4b 28 9d d6 f4 a7 8b 92 a2 09 85 34 a6 08 91 a4 08 e9 67 1b e1 cd 52 2c 55 1e 5a 3a 79 73 e9 fb ef 7f ba 7b aa 7a eb eb ca e5 9b 3f dd 3d 5d b9 74 6f f9 dd 13 8b a7 3f af 7e 7b bc 7a f9 f4 f2 bb 17 2a 27 be a8 9c 9f db dc 4b 73 40 d6 a2 6c 49 82 26 15 e5 2d a1 43 f2 cc b4 6e e4 4c 28 55 d7 2c 59 b3 b6 84 5a 07 19 ea f5 41 cb c9 66 d6 50 4a 96 a2 6b 2b 07 68 83 9c b0 ac 52 b7 fc 42 59 99 da 12 1a a1 b0 ba Data Ascii: 6ec5sG8"gcz^IX^F=Qqwlc7^?0kF0/8tp3{z^H<aOw#++++++k=~q7OXEuh,6GF{_U[BG&BBVLsK(4gR,UZ:ys{z?=]to?~{z*'Ks@lI&-CnL(U,YZAfPJk+hRBY
Nov 26, 2024 08:19:55.009871960 CET	1236	IN	Data Raw: c7 67 4a 32 07 d9 92 0f 5b 04 91 83 42 76 42 32 4c d9 da 52 b6 f2 dd a9 90 40 6a a6 2a da 21 c1 90 55 a8 98 66 76 97 0c 39 2f 5b 59 40 f0 04 bc 6d 09 f5 f6 46 7a 4c b3 27 11 49 99 33 66 4f 56 2f 86 5a c9 13 5d 41 1e 71 05 79 26 8f b4 9d 25 2f b7 Data Ascii: gJ2[BvB2LR@j*!Ufv9/[Y@mFzL'I3fOV/Z]Aqy&%/_Km);!wc7w[y(RuCbI-r HJVwN,YK&o.F/R.g0n4!k99X\|deo%ewzzgzB`S>}
Nov 26, 2024 08:19:55.009886980 CET	1236	IN	Data Raw: c4 84 6e e9 9e e0 28 6d 64 de d0 8b 23 0c b0 d3 2a 53 29 68 c3 65 6b c2 d3 90 a2 a4 41 ce 3d 14 a7 6e b0 2e 17 39 54 62 6b 9f 55 4a 5b 65 60 f0 f2 f6 c3 25 c5 90 b7 49 33 28 4f c7 62 d1 3a 09 76 ea 65 03 53 44 08 bc 82 6c 41 3c fc 07 3d 65 58 e3 Data Ascii: n(md#*S)hekA=n.9TbkUJ[e`%I3(Ob:veSDlA<=eXJQ&8G@ICRv`XSJ\| Hw4!@<1fv>+P?1F+6$!ac\U@;iF0\|TY&<LZk2%U^u/(O0hGr
Nov 26, 2024 08:19:55.009902000 CET	1236	IN	Data Raw: f0 1f 11 d8 0c 61 39 89 04 bc 01 87 87 55 e6 cc 40 06 10 75 08 78 8e 90 b6 75 49 98 1b a4 65 e0 b0 80 20 1b fa 6e a2 bc f6 a3 c8 29 11 62 bb 4b 61 01 9f 5b c2 ee 14 33 30 08 40 94 62 c1 01 03 ab 47 28 8a e1 a2 7a ea b5 c5 8b 2f 2f de 7b 6d f1 4f Data Ascii: a9U@uxuIe n)bKa[30@bG(z//{mOIAdQ=UzN)iAT"le`GozxMh\S C"}77H~zMz@p9k&`&7-Q,JIeK+n#
Nov 26, 2024 08:19:55.009999037 CET	1236	IN	Data Raw: 93 50 80 10 04 75 22 67 19 68 84 e8 99 64 f8 36 50 9d 29 d1 3f 3b b4 e2 9b 33 6b 93 73 db 37 f5 12 02 6e 5c b5 ae 03 99 92 97 48 c8 cb d3 e6 a1 cd 8a 56 2a 5b 41 90 46 31 82 b7 7d 09 0b 45 e9 30 cc 68 05 b2 fb 81 08 41 5a 29 93 8a 0b c0 84 b3 32 Data Ascii: Pu"ghd6P)?;3ks7n\HV*[AF1}E0hAZ)2vow_.c?c4+Mceh)-zLP"T`2Fv\w2jlxtug)Y)V2g4y0<e4k@
Nov 26, 2024 08:19:55.010015011 CET	1236	IN	Data Raw: fa 06 40 72 e2 d2 79 a6 2f e2 d0 ce 27 5c 29 2e 36 f7 96 00 92 53 17 b3 9c a9 57 15 3b 0a f7 32 41 92 13 00 87 0a 52 3a 7e 7b 3e bc b4 11 04 82 74 35 d4 58 2a 1f 86 15 9d 64 cc d0 ca 36 fc 24 50 2b a7 6f 40 1b 96 3f 7a a7 21 78 ac c4 56 72 08 a4 Data Ascii: @ry/'\).6SW;2AR:~{>t5Xd6$P+o@?z!xVrJp@h 2a%i#MziL{r0%RPMU&cCyY5;+u:h$=aBnoe,-jie#HN:;Gz\~iAJ8oj*&\_Qh]
Nov 26, 2024 08:19:55.010030985 CET	1236	IN	Data Raw: cd 47 95 57 af d0 19 a4 b3 8b be 35 60 b7 e2 63 c9 6f c5 7a 0c b7 b6 87 42 43 b5 61 0f 1d 95 25 3c 6c f4 4f ef 54 df 3c 55 b9 ff a7 ea d9 5b 64 02 b8 56 3d f6 59 e5 cc 5b 74 fb af b3 14 97 58 03 8a 4b 3c 96 14 97 a8 c7 2b 1b f6 16 70 c3 86 f1 0f Data Ascii: GW5`cozBCa%<lOT<U[dV=Y[tXK<+p%5>>w"k@q"{D^ot%IjtT^+]^7T[QghDfal+K*[s.]\~sb40]yB+
Nov 26, 2024 08:19:55.010050058 CET	1236	IN	Data Raw: 8d bb ba 8f a4 4e c3 57 9a 20 da d6 e2 ab d2 91 19 bc 13 3e 4d ae 72 07 49 80 70 3a 9a 56 c3 e4 30 98 a1 ba a3 45 64 ff cc 2d bb 6e 28 00 5b 52 c9 6d 7d 78 3d 79 34 16 eb 31 93 35 b7 f5 6d 8b 8c 2a b9 9d 63 23 07 e8 8d 7d b1 f2 af 8f 24 0b 07 f5 Data Ascii: NW >MrIp:V0Ed-n([Rm}x=y415m*c#}$=LR>[)Z7[=%@;p_8'xOMI16)lRkCGeJ=ygF-b"+}~wk$mRL<x\'{}%&[d %&Da,r
Nov 26, 2024 08:19:55.010066032 CET	1236	IN	Data Raw: a7 df b3 c3 57 d7 bf a3 10 96 be f9 0c 4f 3a 10 2d 2d 0f 47 f8 9f 63 2f 32 88 c4 63 15 3d e7 40 bd fc 10 75 46 ad 16 c3 e7 c3 0a cf 5c 7c 76 ba 7a fa fe c2 1d 00 70 0c 4d b3 ce bc e5 88 36 d5 b7 6e 57 af 9c 82 49 11 a2 f8 33 17 18 45 0e 89 2d cc Data Ascii: WO:--Gc/2c=@uF\\|vzpM6nWI3E-W}P9.:Z:ZwPa+?U=aKW> N/}suyj8g0*gNTN1sG\|.rfB\|1K`^9+h9}^[}xw?\|EkV~w
Nov 26, 2024 08:19:55.010081053 CET	1236	IN	Data Raw: 36 64 74 82 0e 9c ca 71 73 ce 8d 07 ce 3e 59 4c 81 84 dc 4d 4b 62 15 22 d5 61 f5 60 7c 38 86 b6 81 75 76 3d 1c 13 a6 54 5c e4 9c 9a 73 be fd b1 82 bc 6f 7f f2 ed 56 6a ab a4 69 8c e2 e9 2b b6 d6 e3 f1 1d c1 93 d3 79 34 86 20 96 de 29 cf 06 44 08 Data Ascii: 6dtqs>YLMKb"a`\|8uv=T\soVji+y4 )Dj23CizVM$X*W$gc{#;nW%(Cj.EIGtwX$8A^;hy\|)rK"^OR\<Y
Nov 26, 2024 08:19:55.129981995 CET	1236	IN	Data Raw: 1f c8 f6 68 df fe 6d 64 e7 68 72 74 ea 40 f2 99 3d 64 7b 74 b8 b0 1e f2 d0 8a ac 6e 92 75 ac 6e 7e b6 71 c3 86 cd d3 19 c3 a6 42 af 75 8a 53 27 92 cc d6 f4 4c cb 99 11 5b 8f 33 8e 26 0e 8e b2 a7 26 06 39 49 4d e0 0e dd d8 ab ef 96 66 f4 b2 15 12 Data Ascii: hmdhrt@=d{tnun~qBuS'L[3&&9IMf6_`1%9=5Y9MF'?n\/h~*0vj(==)~[!VBwj IMFX+,08EW/A0Tr,\[8?Z.jWd7rpm5N/R<`3A
Nov 26, 2024 08:20:00.234821081 CET	711	OUT	POST /ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 132 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26 Data Raw: 26 63 6f 6c 49 64 3d 32 26 70 64 49 64 3d 2d 31 26 6e 64 49 64 3d 2d 31 26 62 72 6f 77 73 65 72 54 79 70 65 3d 32 26 73 63 72 65 65 6e 54 79 70 65 3d 39 26 73 63 3d 30 26 72 66 3d 26 76 69 73 69 74 55 72 6c 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 77 68 65 65 6c 2d 64 6f 6e 65 2e 63 6f 6d 25 32 46 26 76 69 73 69 74 45 71 75 69 70 6d 65 6e 74 3d 70 63 26 73 74 61 74 49 64 3d 2d 31 Data Ascii: &colId=2&pdId=-1&ndId=-1&browserType=2&screenType=9&sc=0&rf=&visitUrl=http%3A%2F%2Fwww.wheel-done.com%2F&visitEquipment=pc&statId=-1
Nov 26, 2024 08:20:00.842216015 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1016847014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:00.863606930 CET	662	OUT	POST /ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605599598 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 81 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26 Data Raw: 61 69 64 3d 32 38 30 38 38 33 38 39 26 73 6f 75 72 63 65 53 69 74 65 49 64 3d 30 26 64 61 74 61 49 64 3d 32 30 32 26 73 6f 75 72 63 65 4d 6f 64 75 6c 65 3d 34 30 30 30 31 26 73 6f 75 72 63 65 43 6f 6e 74 65 6e 74 54 79 70 65 3d 34 30 30 30 34 Data Ascii: aid=28088389&sourceSiteId=0&dataId=202&sourceModule=40001&sourceContentType=40004
Nov 26, 2024 08:20:01.486881971 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 251 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1016918014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:01.503164053 CET	480	OUT	GET /ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605599277 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26
Nov 26, 2024 08:20:02.105015039 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 115 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1016994014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:17.519108057 CET	932	OUT	POST /ajax/module_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 62 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D Data Raw: 63 6d 64 3d 67 65 74 57 61 66 4e 6f 74 43 6b 5f 67 65 74 48 69 64 64 65 6e 4d 6f 64 75 6c 65 4c 69 73 74 26 5f 63 6f 6c 49 64 3d 32 26 5f 6d 61 6e 61 67 65 4d 6f 64 65 3d 66 61 6c 73 65 Data Ascii: cmd=getWafNotCk_getHiddenModuleList&_colId=2&_manageMode=false
Nov 26, 2024 08:20:18.153899908 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1018127014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:27.177654028 CET	1160	OUT	POST /ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 10 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true Data Raw: 26 73 74 61 74 49 64 3d 2d 31 Data Ascii: &statId=-1
Nov 26, 2024 08:20:27.767946005 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1018886014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:28.821399927 CET	1039	OUT	GET /en/jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Nov 26, 2024 08:20:29.649018049 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 6021 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1018988014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:29 GMT; HttpOnly Data Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f [TRUNCATED] Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t_l6)'M&#lj5":5D"K/~
Nov 26, 2024 08:20:32.189013958 CET	1361	OUT	POST /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 220 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true Data Raw: 63 6d 64 3d 67 65 74 57 61 66 4e 6f 74 43 6b 5f 6c 6f 61 64 4d 6f 64 75 6c 65 44 6f 6d 26 5f 63 6f 6c 49 64 3d 32 26 5f 65 78 74 49 64 3d 30 26 61 6a 61 78 4f 70 74 69 6f 6e 49 6e 66 6f 3d 25 37 42 25 32 32 5f 61 6a 61 78 4c 6f 61 64 4d 6f 64 75 6c 65 4c 69 73 74 25 32 32 25 33 41 25 35 42 25 35 44 25 32 43 25 32 32 5f 70 61 72 74 44 6f 6d 49 6e 66 6f 4c 69 73 74 25 32 32 25 33 41 25 35 42 25 35 44 25 32 43 25 32 32 66 75 6c 6c 55 72 6c 25 32 32 25 33 41 25 32 32 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 77 68 65 65 6c 2d 64 6f 6e 65 2e 63 6f 6d 25 32 46 65 6e 25 32 46 64 65 66 61 75 6c 74 2e 6a 73 70 25 32 32 25 37 44 26 61 6e 63 68 6f 72 3d Data Ascii: cmd=getWafNotCk_loadModuleDom&_colId=2&_extId=0&ajaxOptionInfo=%7B%22_ajaxLoadModuleList%22%3A%5B%5D%2C%22_partDomInfoList%22%3A%5B%5D%2C%22fullUrl%22%3A%22http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fdefault.jsp%22%7D&anchor=
Nov 26, 2024 08:20:32.815758944 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1107 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019225014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:43.539278984 CET	1172	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 38 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs= Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 64 6f 67 26 64 6f 67 49 64 3d 32 30 30 31 30 35 26 64 6f 67 53 72 63 3d 31 Data Ascii: cmd=wafNotCk_dog&dogId=200105&dogSrc=1
Nov 26, 2024 08:20:44.127198935 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 55 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020180014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.143929958 CET	1333	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605642413 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:45.023567915 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020264014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:48.820024014 CET	1179	OUT	POST /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 39 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548 Data Raw: 63 6d 64 3d 73 65 74 57 61 66 43 6b 5f 73 65 74 52 65 71 41 72 67 73 43 6f 6f 6b 69 65 26 5f 72 65 71 41 72 67 73 3d Data Ascii: cmd=setWafCk_setReqArgsCookie&_reqArgs=
Nov 26, 2024 08:20:49.538660049 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020625014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:49.904227018 CET	1179	OUT	POST /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 39 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548 Data Raw: 63 6d 64 3d 73 65 74 57 61 66 43 6b 5f 73 65 74 52 65 71 41 72 67 73 43 6f 6f 6b 69 65 26 5f 72 65 71 41 72 67 73 3d Data Ascii: cmd=setWafCk_setReqArgsCookie&_reqArgs=
Nov 26, 2024 08:20:50.493381977 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020724014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:50.510849953 CET	1433	OUT	POST /en/ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 10 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:51.099553108 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020798014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:51.699878931 CET	1316	OUT	GET /en/jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:52.815197945 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:52 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 6021 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020953014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:52 GMT; HttpOnly Data Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f [TRUNCATED] Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t_l6)'M&#lj5":5D"K/~
Nov 26, 2024 08:20:53.453334093 CET	1418	OUT	POST /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 220 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:54.394704103 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1107 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021090014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:21:02.216562033 CET	1447	OUT	POST /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 36 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:03.055322886 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 46 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021911014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.088301897 CET	1093	OUT	POST /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:11.679567099 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022712014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.696415901 CET	1434	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605670273 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 81 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:12.573251009 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 251 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022804014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:21:12.623256922 CET	1388	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605671481 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605672209
Nov 26, 2024 08:21:13.496687889 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022874014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49719	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:55.047597885 CET	463	OUT	GET /jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26
Nov 26, 2024 08:19:55.875613928 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:19:55 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 5955 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1016410014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:19:55 GMT; HttpOnly Data Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d ef 8e db 48 72 ff ae a7 60 6c 1c 70 7b f0 8c 45 91 4d 49 33 08 10 db 1b 9f 7d 59 7b 7d 6b 27 07 24 08 04 8e c4 d1 70 2d 89 82 44 79 ec 1d f8 63 1e 20 9f f3 0e c9 03 04 77 6f 73 40 ee 2d d2 ec 26 a9 6e 76 55 ff a3 74 71 f6 6e d7 a6 54 ff ba bb ba ba 7f d5 a5 e6 df cd ef d2 dd 3e 2b 83 47 87 f2 f6 62 f2 e8 7a 30 08 ea 7f 1e af 8b c5 61 95 91 28 0c 2e 6f 8b dd fa 79 ba d9 64 3b fa f8 10 2c f2 fd 76 95 7e b9 da 14 9b ec 3a f8 da b2 d0 7f 06 1d d6 87 9b 62 b7 c8 76 9c f4 ab 22 f4 4d be 58 b0 47 5b 3a 26 5f f8 e8 45 b6 29 b9 55 7a 01 1f 8a 6d 45 24 59 fe b5 6b 2c 6f 67 51 96 c5 5a 25 c6 6d 12 1f 7f c8 6e 4b 5f de 9f f2 e5 1d c0 3c 68 fb 55 e9 db 74 fe 71 b9 2b 0e 9b 85 59 8f 0b 71 ab 0c ee 68 4b 41 2f 0a ca b1 29 41 96 01 e4 2b 02 6f b7 93 96 b3 bb e2 53 b6 0b d2 60 bf 4d 37 4f 5c b9 5c 19 3c 94 3c dc d2 e6 5e ec f3 5f b2 ab 20 4c b6 9f af d9 f3 6d ba ce 57 5f ae 82 3f ff e9 3f ff e7 8f ff f5 97 ff f8 b7 bf fc f7 bf f3 6f ee b3 6a b4 af 82 9b 62 b5 e0 9f ec cb 2f 2b ca [TRUNCATED] Data Ascii: ]Hr`lp{EMI3}Y{}k'$p-Dyc wos@-&nvUtqnT>+Gbz0a(.oyd;,v~:bv"MXG[:&_E)UzmE$Yk,ogQZ%mnK_<hUtq+YqhKA/)A+oS`M7O\\<<^_ LmW_??ojb/+u}./e^l(*\|bw7G<FO2\|nhvy-}P[jk{"i##' &Yf57b~WxXR&P,2[{If0?^l-yj=WT2U,dh\|hInL{^n(/$Dej;%t5UXOMFtB6
Nov 26, 2024 08:19:55.875669956 CET	1236	IN	Data Raw: c5 2a dd ef 0d 92 bd dc d4 5b a6 76 96 ed 69 bc da 2c 66 ef d2 5d ba 3e 8f 86 f2 2e df 9d 55 c1 6d 71 d8 95 77 67 d5 90 df 9e 57 01 16 a2 cf d3 1a 35 b0 32 3d 27 70 da ed 8e 92 cc cb 97 f9 8a ee c1 de a6 eb 7a 37 76 b6 76 74 c2 cc 79 66 08 dd 7c Data Ascii: [vi,f]>.UmqwgW52='pz7vvtyf\|_eAgj<hz-`T`m"Q=uImv+uYfLLP<qDGzqipW_;r~Ka5!Cd=tuh5F#,Fx;C7
Nov 26, 2024 08:19:55.875699043 CET	1236	IN	Data Raw: 51 a1 96 74 98 cb 9b 04 30 97 1f 6b 5d 7e 2c bb 7c 97 18 b7 49 75 79 3f de da e5 41 2b a1 61 d1 39 9f a2 c7 85 58 e7 f2 ba 82 92 04 4a ef 83 2c 03 a5 2d 26 97 1f bb b9 3c 4e 6e e3 f2 13 d9 e5 27 0e 2e 3f 41 5d 7e 22 f7 f2 c4 96 0e 73 79 93 00 e6 Data Ascii: Qt0k]~,\|Iuy?A+a9XJ,-&<Nn'.?A]~"syOd6.[<h%4,:S\~b-uye7m\^'}Dy/FZa.o\~u]b&xkE\|bL,-&<Nnvh4bjJl K\|/ej
Nov 26, 2024 08:19:55.875718117 CET	1236	IN	Data Raw: a5 2d c7 e3 cb 04 f4 f9 d8 d1 e7 71 fa 5a 11 49 34 3e 4f 64 9f b7 af 16 8d 22 ac 5a 34 92 af 39 aa 84 5a d2 61 3e 6f 12 c0 7c 5e 57 2d 7a 6c 67 ed f3 58 c5 a7 6a 93 ea f3 7e bc b5 cf 5b 55 8b 46 da 1b 86 01 3d 2e c4 3a 9f d7 54 8b 46 e0 e5 70 20 Data Ascii: -qZI4>Od"Z49Za>o\|^W-zlgXj~[UF=.:TFp @i)EYWz8>8\|\|"wsbKID]b&xkE}b'ZXJ[q>}>1M4>/W}aI,vR}\wEsrpvfL}1
Nov 26, 2024 08:19:55.875734091 CET	1236	IN	Data Raw: 1c 51 d3 8f e6 57 3d 6a cb 2e cf 02 89 c9 ce 4e b1 cb fc 6c ee b8 15 66 c4 a0 63 86 41 59 13 19 4d 1d d9 d2 61 cb 94 49 00 5b a6 b4 e7 b4 6d fb eb 65 0a 3d 6b 55 6c 52 97 29 3f de d6 a1 ad 96 29 ed d1 ab aa c7 85 58 b7 4c d9 4c b7 ce 32 65 3c a7 Data Ascii: QW=j.NlfcAYMaI[me=kUlR)?)XLL2e<%9h.S#<s$d}HCGPOj"X_fIQj"W+Mg]?z\u3JWOje!?#&<,RlgdRW>IQ@sD.%r9"gF
Nov 26, 2024 08:19:55.875751972 CET	413	IN	Data Raw: 2b 3d f2 3e db 36 93 38 24 d0 b7 fc a6 53 1d c5 31 16 e7 9b 4a 33 44 81 0f 49 ab 42 4b 22 ae 26 e0 32 0a ca 94 d6 a0 ce b2 6b 22 67 fb 83 e1 93 a0 fe ff 77 2c f2 35 57 3b ec e7 bb 62 b5 0a 86 bf aa fe ff 94 95 54 0b 0e f1 b9 49 79 d2 bf 76 dd a2 Data Ascii: +=>68$S1J3DIBK"&2k"gw,5W;bTIyvz`7iQ!.FJvRkZEp5+nW0qS@Wn'`V!CPA#wH*vyYRM~;o^"M nIZ\JVi9\|d./Lf\Tne^^RuC
Nov 26, 2024 08:20:00.230669022 CET	769	OUT	POST /ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 204 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26 Data Raw: 63 6d 64 3d 67 65 74 57 61 66 4e 6f 74 43 6b 5f 6c 6f 61 64 4d 6f 64 75 6c 65 44 6f 6d 26 5f 63 6f 6c 49 64 3d 32 26 5f 65 78 74 49 64 3d 30 26 61 6a 61 78 4f 70 74 69 6f 6e 49 6e 66 6f 3d 25 37 42 25 32 32 5f 61 6a 61 78 4c 6f 61 64 4d 6f 64 75 6c 65 4c 69 73 74 25 32 32 25 33 41 25 35 42 25 35 44 25 32 43 25 32 32 5f 70 61 72 74 44 6f 6d 49 6e 66 6f 4c 69 73 74 25 32 32 25 33 41 25 35 42 25 35 44 25 32 43 25 32 32 66 75 6c 6c 55 72 6c 25 32 32 25 33 41 25 32 32 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 77 68 65 65 6c 2d 64 6f 6e 65 2e 63 6f 6d 25 32 46 25 32 32 25 37 44 26 61 6e 63 68 6f 72 3d Data Ascii: cmd=getWafNotCk_loadModuleDom&_colId=2&_extId=0&ajaxOptionInfo=%7B%22_ajaxLoadModuleList%22%3A%5B%5D%2C%22_partDomInfoList%22%3A%5B%5D%2C%22fullUrl%22%3A%22http%3A%2F%2Fwww.wheel-done.com%2F%22%7D&anchor=
Nov 26, 2024 08:20:00.872046947 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1163 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1016845014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:00.872102022 CET	1236	IN	Data Raw: 6a 7a 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 Data Ascii: jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com
Nov 26, 2024 08:20:00.872137070 CET	1236	IN	Data Raw: 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f Data Ascii: logo.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://
Nov 26, 2024 08:20:00.872188091 CET	1236	IN	Data Raw: 61 69 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 Data Ascii: aisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw
Nov 26, 2024 08:20:00.880619049 CET	1236	IN	Data Raw: 6c 6c 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f Data Ascii: llfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:00.880712032 CET	165	IN	Data Raw: e9 4c 75 9c b6 a6 ec da 9b 69 61 d9 47 93 84 a6 1b 35 ab e3 e6 f5 bf e6 0b a9 09 a3 f2 d2 41 a6 43 7a fc f9 95 a3 33 29 10 5e c2 e9 eb 22 58 67 50 16 96 7d f9 0a 10 05 0d 56 85 00 8b db 49 a4 b3 d2 24 58 44 24 09 8c 0e b0 33 86 2e 0b cd cb de 6c Data Ascii: LuiaG5ACz3)^"XgP}VI$XD$3.lF[]rK^`j(&rr1 M$5EfZW.~,capF?I
Nov 26, 2024 08:20:00.882627964 CET	470	OUT	GET /ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26
Nov 26, 2024 08:20:01.496537924 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1016920014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:01.514616966 CET	757	OUT	POST /ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605600361 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:02.154941082 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1016998014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:02.172038078 CET	748	OUT	POST /ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605601025 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:02.792264938 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1017053014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:07.322592974 CET	932	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 124 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 6c 6f 67 4a 5a 46 64 70 54 72 61 63 6b 26 65 76 65 6e 74 3d 6a 7a 5f 62 61 69 64 75 5f 6d 61 70 73 26 70 72 6f 70 65 72 74 69 65 73 3d 7b 22 6a 7a 5f 63 6f 6e 74 65 6e 74 5f 74 65 72 6d 69 6e 61 6c 22 3a 22 73 69 74 65 22 2c 22 6a 7a 5f 76 65 72 73 69 6f 6e 22 3a 30 2c 22 6a 7a 5f 66 72 65 65 5f 62 6f 6f 6c 31 22 3a 74 72 75 65 7d Data Ascii: cmd=wafNotCk_logJZFdpTrack&event=jz_baidu_maps&properties={"jz_content_terminal":"site","jz_version":0,"jz_free_bool1":true}
Nov 26, 2024 08:20:07.922857046 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1017419014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:17.513191938 CET	788	OUT	GET /ajax/setCookie_h.jsp?cmd=setWafCk_setCheckSiteLvBrowser HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D
Nov 26, 2024 08:20:18.113244057 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1018125014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:27.195101976 CET	1117	OUT	GET /en/ HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Nov 26, 2024 08:20:28.171300888 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1018887014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:27 GMT; HttpOnly Data Raw: 36 63 34 66 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ec bd 6b 73 e4 c8 71 28 fa 79 26 42 ff 01 6e 5d ab 67 e3 f0 d1 40 3f d8 24 97 d4 e1 63 1e 1c 91 33 b3 43 ce 8e d6 5e 45 07 1a 8d ee 06 89 06 7a 01 34 9b e4 5e 46 58 7e 9c 95 7c 75 ae ad 73 6c c9 92 25 79 a5 6b 4b b2 6c 59 b6 75 6c ad 56 af 08 cb fe aa 58 9d 2f 96 8f bf ac 22 34 b3 da 13 f7 86 ff c2 cd cc 2a 00 85 57 37 48 36 39 9c d1 70 76 49 00 55 95 95 95 95 95 95 95 95 95 f5 e2 af ad df 5d db 79 e5 de 75 e9 d6 ce d6 e6 f2 07 ae be f8 6b d3 d3 2f 76 bd 9e b9 fc 62 57 57 5b cb 2f ce b2 3f 4d bb 75 08 2f fc 0f 65 98 9e c6 fc f8 28 99 aa d5 59 2a e8 56 41 d2 4c d5 75 97 0a 8d 86 65 df ec a9 86 25 75 1a 98 a3 40 59 11 d2 07 ae c2 93 67 78 a6 be fc cb 37 be fd cb 1f fe f0 3f be ff 89 c7 df f9 bb 47 5f f8 f6 7f 7c ff 93 8f fe f4 07 ef 7f ee f7 de fb e4 5f 3e fe 87 8f 3f fe c2 27 df ff dc 1f 3e fa bd bf 7e f4 07 6f bd 38 cb 4a 40 d1 9e ee a9 92 a5 f6 f4 a5 c2 9e 7e 38 b4 9d 96 0b b5 da 96 a7 5b de 52 21 3f c8 c2 6c 0c 5a 4b 77 35 c7 e8 7b 86 6d 9d 1e a0 0f [TRUNCATED] Data Ascii: 6c4fksq(y&Bn]g@?$c3C^Ez4^FX~\|usl%ykKlYulVX/"4W7H69pvIU]yuk/vbWW[/?Mu/e(YVALue%u@Ygx7?G_\|_>?'>~o8J@~8[R!?lZKw5{myiTXcw<"uU$4=M@r=[T-LTwQNQF>Ei'UC(tui6iQ-m;=F(4::0MtObdS:VaXv[-Po}vga
Nov 26, 2024 08:20:32.195938110 CET	1326	OUT	POST /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 171 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true Data Raw: 26 63 6f 6c 49 64 3d 32 26 70 64 49 64 3d 2d 31 26 6e 64 49 64 3d 2d 31 26 62 72 6f 77 73 65 72 54 79 70 65 3d 32 26 73 63 72 65 65 6e 54 79 70 65 3d 39 26 73 63 3d 30 26 72 66 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 77 68 65 65 6c 2d 64 6f 6e 65 2e 63 6f 6d 25 32 46 26 76 69 73 69 74 55 72 6c 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 77 68 65 65 6c 2d 64 6f 6e 65 2e 63 6f 6d 25 32 46 65 6e 25 32 46 26 76 69 73 69 74 45 71 75 69 70 6d 65 6e 74 3d 70 63 26 73 74 61 74 49 64 3d 2d 31 Data Ascii: &colId=2&pdId=-1&ndId=-1&browserType=2&screenType=9&sc=0&rf=http%3A%2F%2Fwww.wheel-done.com%2F&visitUrl=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&visitEquipment=pc&statId=-1
Nov 26, 2024 08:20:32.790683031 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019227014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:32.808448076 CET	1046	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Nov 26, 2024 08:20:33.399050951 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019304014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:40.730635881 CET	1191	OUT	GET /en/ HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:41.578166008 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019897014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:41 GMT; HttpOnly Data Raw: 36 63 34 66 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ec bd 6b 73 e4 c8 71 28 fa 79 26 42 ff 01 6e 5d ab 67 e3 f0 d1 40 3f d8 24 97 d4 e1 63 1e 1c 91 33 b3 43 ce 8e d6 5e 45 07 1a 8d ee 06 89 06 7a 01 34 9b e4 5e 46 58 7e 9c 95 7c 75 ae ad 73 6c c9 92 25 79 a5 6b 4b b2 6c 59 b6 75 6c ad 56 af 08 cb fe aa 58 9d 2f 96 8f bf ac 22 34 b3 da 13 f7 86 ff c2 cd cc 2a 00 85 57 37 48 36 39 9c d1 70 76 49 00 55 95 95 95 95 95 95 95 95 95 f5 e2 af ad df 5d db 79 e5 de 75 e9 d6 ce d6 e6 f2 07 ae be f8 6b d3 d3 2f 76 bd 9e b9 fc 62 57 57 5b cb 2f ce b2 3f 4d bb 75 08 2f fc 0f 65 98 9e c6 fc f8 28 99 aa d5 59 2a e8 56 41 d2 4c d5 75 97 0a 8d 86 65 df ec a9 86 25 75 1a 98 a3 40 59 11 d2 07 ae c2 93 67 78 a6 be fc cb 37 be fd cb 1f fe f0 3f be ff 89 c7 df f9 bb 47 5f f8 f6 7f 7c ff 93 8f fe f4 07 ef 7f ee f7 de fb e4 5f 3e fe 87 8f 3f fe c2 27 df ff dc 1f 3e fa bd bf 7e f4 07 6f bd 38 cb 4a 40 d1 9e ee a9 92 a5 f6 f4 a5 c2 9e 7e 38 b4 9d 96 0b b5 da 96 a7 5b de 52 21 3f c8 c2 6c 0c 5a 4b 77 35 c7 e8 7b 86 6d 9d 1e a0 0f [TRUNCATED] Data Ascii: 6c4fksq(y&Bn]g@?$c3C^Ez4^FX~\|usl%ykKlYulVX/"4W7H69pvIU]yuk/vbWW[/?Mu/e(YVALue%u@Ygx7?G_\|_>?'>~o8J@~8[R!?lZKw5{myiTXcw<"uU$4=M@r=[T-LTwQNQF>Ei'UC(tui6iQ-m;=F(4::0MtObdS:VaXv[-Po}vga
Nov 26, 2024 08:20:43.499991894 CET	1432	OUT	POST /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 176 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:44.338660955 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020194014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.810630083 CET	1434	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605642710 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 81 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:45.678486109 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 251 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020301014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:45.695300102 CET	1388	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605644548 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Nov 26, 2024 08:20:46.574948072 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020376014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:46.592849016 CET	1379	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605645446 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:47.461303949 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020472014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:48.460273027 CET	1438	OUT	POST /en/ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 25 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:49.548975945 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 54 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020636014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:49.919996023 CET	1402	OUT	POST /en/ajax/log_h.jsp?_v=1732605648714 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 195 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:50.750262976 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020757014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:53.472925901 CET	1360	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:54.339898109 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021094014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:02.217324972 CET	1093	OUT	POST /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:02.961577892 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021888014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:02.978625059 CET	1323	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:03.812113047 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021964014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.087527990 CET	1447	OUT	POST /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 36 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:11.967952967 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 46 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022741014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49728	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.022104979 CET	371	OUT	GET /dist/jz/biz-shared/bizShared.min.css?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:57.242089033 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Fri, 08 Nov 2024 03:23:15 GMT Vary: Accept-Encoding ETag: W/"672d8423-11188" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i8967_c7628, i2103129_c25795, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 31 38 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 6f e3 ba 95 df f7 57 78 71 31 40 d2 95 5c 3d 6d c7 c6 02 c5 ed ee a2 17 68 77 81 de 16 9b 6c 51 0c 64 5b 76 74 23 4b 86 2c 4f 26 63 f8 bf 2f 49 51 12 29 f1 a5 87 13 27 11 26 c9 d8 22 79 78 5e 3c e7 f0 75 f4 fb df 8d ac b1 65 8f ad d9 e8 77 bf ff 97 3f e8 cf fe f2 29 48 f5 27 ff 65 93 78 3b ff 30 5a c6 c7 68 e5 ff 12 fd 47 fc 1c 9d 8c 2f da 04 fc 4e dd 2f da 1d f8 3f 8d 4f 79 03 2f 0a 76 5e 1a c4 91 9e 06 bb 20 da ea 1b d0 0c 7e 9f af 8e cb 60 a5 2f fd 1f 81 9f dc 8c 2d d3 d5 c6 13 53 1b db ae ab 99 b7 8b 96 ed ce c6 97 53 bc f7 56 41 fa 32 37 16 39 12 69 e2 45 87 4d 9c ec e6 e8 53 e8 a5 be bd be 31 34 dd 36 0c 63 ff 5d 33 6e 17 f2 2a e7 09 01 db 94 c2 b6 5c 31 60 5c 7e 06 3c 3b 49 f1 34 65 58 e2 0a 67 c0 7d 29 34 09 62 18 2f 42 86 65 cd 28 8e fc 05 fd f5 7c fe c3 a0 14 83 52 d4 94 82 6f 31 fe 1a 6c 1f d3 f7 a9 1d 85 e0 f9 bc 22 ab 34 d2 8e 4c f6 7c c0 45 b9 82 76 60 d1 0b b0 2c 2a 28 68 87 04 b1 02 af 4e 26 63 d0 8a 41 2b f8 36 e3 cf fe e6 9d [TRUNCATED] Data Ascii: 18cc=koWxq1@\=mhwlQd[vt#K,O&c/IQ)'&"yx^<uew?)H'ex;0ZhG/N/?Oy/v^ ~`/-SSVA279iEMS146c]3n\1`\~<;I4eXg})4b/Be(\|Ro1l"4L\|Ev`,(hN&cA+6\7.rtj21R\|z[k?%qT6?uIAL2($%Y(u/Mez;=NmOiw/>LTKgX+)=6a+wHd[+/my=slj,#Ei\|&6y4t);6lFqIj`Y)7u~gTlPG4pvwn=zX#bdB<Xgr2zbmlk[I4&jSV/O(KX6eWni,+K`i'CCdaU! >Nd_+A'zQE\IYFXMaPQ7ww Z
Nov 26, 2024 08:19:57.242134094 CET	1236	IN	Data Raw: c8 6b 94 88 b3 a3 4d 01 36 ba d5 00 f5 bc 72 8f b8 a3 d8 b6 11 c6 66 03 84 71 5d 59 44 22 22 d9 6d c0 1e 54 f7 7c 77 a7 d6 87 10 68 45 c1 07 05 1d 14 f4 ea 14 94 6d 49 61 f0 58 8f 7c 06 8d 1d 34 f6 da 4c ea a0 a9 83 a6 be 2f db fa f7 7d 1e c6 37 Data Ascii: kM6rfq]YD""mT\|whEmIaX\|4L/}7_7kzYChemf^fmo~p4&K%^\~5FB6"_3vcjW>X4{ve`y2OEt<4IQ
Nov 26, 2024 08:19:57.242150068 CET	1236	IN	Data Raw: e5 80 09 e1 cd 66 e0 8f 6d 35 49 da 5d 69 d7 e2 d4 be 62 0e 0d 49 02 0d c6 88 1a 74 7b d0 ed 8f a2 db 3c fb ad 94 91 b8 93 92 37 55 6d bd b9 6e eb 83 72 bf 47 e5 66 98 dc 41 1d 07 75 7c 43 75 e4 59 49 79 c2 f1 37 8a 03 0c cd ad a5 e4 56 6d f1 de Data Ascii: fm5I]ibIt{<7UmnrGfAu\|CuYIy7VmuvvC;h<UyL6\tWjVYx>\|n}`;np-PGm~%Q`KF^\^V0UWt },_EGTd[RUD]V\%Q
Nov 26, 2024 08:19:57.242177010 CET	1236	IN	Data Raw: b2 20 6d a1 db ec 81 5b 2c a2 7c 0b 0e c1 32 24 d6 9b 83 08 cc 36 bc b0 b2 3c 0e 37 1f 18 6b d0 17 e3 01 4b 92 bd b1 80 b7 80 9f 93 ce 58 99 ce 8b f2 a5 fb 65 18 af 9e 6a 8b f6 aa 8b f4 4c b6 55 35 73 e5 25 69 19 20 b3 c3 e2 05 de a3 81 4b 52 c7 Data Ascii: m[,\|2$6<7kKXejLU5s%i KR5Vz6BkRe?-sxWg;j1X/:`P}N\`+hv+TrNh[>g# Y+Y$W,52m6e$dnov^Y%e\|R+h48/!k
Nov 26, 2024 08:19:57.242193937 CET	1236	IN	Data Raw: d9 f4 46 92 08 54 3d cb 88 50 37 ba 21 6e 6a 17 82 6b f4 c8 12 b3 47 50 86 21 b9 f8 50 9e aa 96 5d dd 84 0e a0 ea 2d 9e 83 74 f5 a8 10 f3 95 99 eb cb ef 67 26 30 62 38 eb 89 bf f7 3d 78 44 1f 7f 22 bd 40 31 8e 2a 67 e7 51 06 1d 83 0d 9b 21 63 8d Data Ascii: FT=P7!njkGP!P]-tg&0b8=xD"@1gQ!cY1vyZ* RmrDDcwK??^;o9q'}=`,#@Jyi(>Hk<&j^w,QC]!#Pq:aX!?-\|.y
Nov 26, 2024 08:19:57.242212057 CET	572	IN	Data Raw: a4 b2 79 87 b5 17 61 43 2c fd cc e0 3f 39 6a 1a a1 74 99 c5 ad cc 87 0b 1a 3a 2b 5c 83 8d db 9a da 08 15 44 82 38 09 14 22 05 4f 35 60 7c c1 47 fc 5f 6e ec f2 4c 0d 34 1f 4b d6 43 14 30 6a 87 34 f1 d3 d5 23 c6 ed e0 87 9b e2 51 03 f1 55 7d 2e 3d Data Ascii: yaC,?9jt:+\D8"O5`\|G_nL4KC0j4#QU}.=i,F%$Pf+WA>QXCY[vqlg@KJK(E5 Wq>2GBw8e%qb&^\|D$B;"@}rkZ#NJ<X}tY*
Nov 26, 2024 08:20:42.255553007 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49727	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.022227049 CET	352	OUT	GET /dist/jz/request/jzRequest.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:57.196691036 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:56 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Thu, 16 Nov 2023 07:06:57 GMT Vary: Accept-Encoding ETag: W/"6555bf91-e696" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i34712_c4672, i2103121_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 33 38 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd bd 6b 73 1c c9 96 18 f6 5d bf a2 bb 96 ea ad 1a 24 1a 68 3e 66 e6 56 33 d9 0b 02 20 09 92 78 10 0f be 9a 3d 50 75 77 36 50 44 77 55 b3 1e 78 10 dd 8a 90 6d 85 64 5b bb 0e 3b 56 5a 6f c4 95 22 1c 61 39 d6 0a 7b af 14 76 48 b2 d6 f2 46 f8 b7 78 e6 de fd e4 bf e0 73 4e 66 56 65 55 17 40 ce bd 1b ba 8e 20 d1 55 59 f9 ce 93 e7 95 e7 9c 5c f9 a6 d6 6a b6 9a df d7 be 59 f9 3b f5 51 1a 0c 12 3f 0c 6c c1 12 e7 da 0a fb 1f c5 20 b1 38 4f ae a6 22 1c d5 c4 e5 34 8c 92 b8 d1 b0 d2 60 28 46 7e 20 86 56 5d 7f 9c 84 c3 74 2c 3a f2 a7 a9 b2 f2 c4 76 5c 4b 57 9b d7 24 4b 37 1a f2 b7 e9 4d 86 1d f9 68 27 8e 6b 0b 5e d5 c0 c9 38 ec 7b e3 c3 53 3f ee e4 8f ae 98 cd 62 31 1e 39 cd 8f 9f f7 c5 a7 54 c4 09 b6 39 b7 13 f8 c8 ec 6c 40 30 9a 34 16 b5 38 89 7c 18 51 5b a7 d7 84 1c ea b9 17 d5 02 be 4b e3 6d 9e 89 ab d8 16 4e db 1f d9 2a e5 44 24 bb 17 c1 5e 14 4e 45 94 5c 1d 5c 4d fa e1 38 96 a5 22 7e 5b 1e ac 26 69 34 ec 88 47 cd 91 3f 4e 44 64 e7 7d 82 76 23 91 a4 51 50 ab ac [TRUNCATED] Data Ascii: 38aks]$h>fV3 x=Puw6PDwUxmd[;VZo"a9{vHFxsNfVeU@ UY\jY;Q?l 8O"4`(F~ V]t,:v\KW$K7Mh'k^8{S?b19T9l@048\|Q[KmND$^NE\\M8"~[&i4G?NDd}v#QPbC&aD}l q4i\|y6Ar\|vN c$`iI$H:rt^\|q5-v612\v@w/0rU_PB7j:ppz\|f=%HxHnG[6- 99$b77kaK(%TPPHlVo{6ORsovp4/"?QVjpw4@OvUM5%:,2_<&=E}cu4EUiY@k(w 7/Nz-QNfBFg!NotH3fPf<-iJ`BJ3&[f+F4REV~;
Nov 26, 2024 08:19:57.196713924 CET	84	IN	Data Raw: ee 91 3f db 72 82 04 9e be 9f b5 be 9d dd bb eb c0 e3 fa d8 9b 4c c5 d0 e9 50 25 77 56 9a 09 10 10 3b 70 8a 23 2d cd 96 73 9d 9c 46 e1 45 2d 10 17 b5 43 18 f1 66 14 c1 ce b0 b6 02 80 23 7f 58 f3 92 44 4c a6 49 2d 09 6b f1 34 12 de b0 16 84 c1 32 Data Ascii: ?rLP%wV;p#-sFE-Cf#XDLI-k42
Nov 26, 2024 08:19:57.196728945 CET	1236	IN	Data Raw: 35 31 38 62 0d 0a 2d 08 40 4f cd 87 e1 79 c1 40 34 3f 04 5b 00 b1 d1 50 44 98 b5 0f 5f 54 16 46 05 3c ec 51 4d 92 e0 b8 36 49 e3 a4 76 ea 9d 8b 9a 57 5b 58 79 db a9 4d 44 72 1a 0e 9b 16 f4 d5 d8 b8 b2 fb d7 36 02 06 2c e3 6c 96 3c 12 6a db 3a 30 Data Ascii: 518b-@Oy@4?[PD_TF<QM6IvW[XyMDr6,l<j:0f@`hXaa&`wt-X>PUXp/'~.j+R0`h\|qbI(v-0Pf)pO:t#w95i $,s=q~S
Nov 26, 2024 08:19:57.196744919 CET	1236	IN	Data Raw: 06 e9 70 ca 84 96 c3 93 db 25 6f 35 25 20 e4 e3 46 e6 49 ae 95 61 23 c1 ad e3 e3 41 18 89 e5 8f f1 31 40 40 24 86 c7 c7 16 1b 0b c0 08 23 d1 43 55 a1 3d 82 86 e6 0e 1b 0a 1e 17 15 44 76 ae b5 ac 44 35 63 d1 c5 2a 6c fa e5 89 89 92 81 85 87 3a e7 Data Ascii: p%o5% FIa#A1@@$#CU=DvD5cl:mmn!}\^]Mp-Z0U&wW` 585Ab4Ir'):dE\QsVe+/7w6-i49wl*7ME2BU
Nov 26, 2024 08:19:57.196760893 CET	1236	IN	Data Raw: 2e 8f ec 08 71 52 48 07 45 72 43 26 d9 ec 7c 2e c6 b1 a0 71 8e 13 8e f2 3b 8d 0e 76 9a 97 74 c7 b0 01 40 a8 a9 ea 37 d1 a1 71 f2 55 dd 7e 2a f3 de da 6b 5d 5f 47 60 ab ee cd 3d d7 19 e7 a4 aa 1f c2 92 c3 94 b8 00 87 48 aa 01 16 61 58 2e cc b5 08 Data Ascii: .qRHErC&\|.q;vt@7qU~*k]_G`=HaX.h{(g5?[ukKv5(cG4+8'Vb`"1CH\|J@m`c&eOUoED<@jB@$5o=\|{c~#=_`v+6A&!0R=S
Nov 26, 2024 08:19:57.196775913 CET	1236	IN	Data Raw: ef 9e 6c bd 7c c9 ad 3d 8b dd c1 24 f6 2c 91 b3 f5 fc 86 ad c4 00 6f 30 0f 90 05 d0 47 2f 42 6e 6f 00 8f 92 e8 00 b3 26 a5 13 32 43 e2 83 ce d4 8d 3b 53 d8 fa 74 9c 90 22 a3 eb da f2 fd da d4 de 38 b8 70 11 6e 48 c9 dc fb b0 c5 a2 1e 2c 9f 68 0e Data Ascii: l\|=$,o0G/Bno&2C;St"8pnH,h Y5-;=z.q&&1CP+?B6T7pGe2*)\|'B^)hvE_=]zuVI\M.I:ys 0rC
Nov 26, 2024 08:19:57.196793079 CET	1236	IN	Data Raw: de 1f a8 f7 da 50 be 7f ab df 4f e4 fb 5d 77 3f b0 2f d8 d0 91 c2 76 a9 b6 fb 19 f5 93 b9 bf cb 72 eb 75 ed 2c b7 dc 08 78 d8 4e e8 5e c0 f2 ac 07 fc 5a f9 7e b9 7b 81 0d 5b 7f e2 4d f1 09 f6 9d f4 be c3 97 bb c0 1c 84 13 81 8f f7 60 68 e7 22 ba Data Ascii: PO]w?/vru,xN^Z~{[M`h"''\|=hBl-6K}wv=PV0m;h'7(Ji:)AJ3EZzm1m8:{8c}G!}XMM7V0a
Nov 26, 2024 08:19:57.196810007 CET	1236	IN	Data Raw: 11 bb 8a 08 53 a0 ad 98 94 ba 32 47 16 10 2f 22 6d 04 d1 8f 0c cd ee 45 06 1b c0 34 1a 67 3f b3 99 6d 1d 1f d3 60 8e 8f 2d 3f b8 9e 77 ca ea 08 58 ee 7a 0b ed ed e6 a4 91 13 0b fc ab c1 af 1d da be b0 bf 26 56 06 22 4a d3 3e 6e 5e c1 7a e5 fd 62 Data Ascii: S2G/"mE4g?m`-?wXz&V"J>n^zbd0Cj-QYYP2Q&~mI$M7sgKH:Zwf61!96Q *)64_YN&iLI2nnl0ot0n0OKNcNN){QtHJr
Nov 26, 2024 08:19:57.196831942 CET	776	IN	Data Raw: 1b 21 bb 0a 6f 70 21 be 16 c8 54 a0 1d a3 94 6c d0 82 a6 7c 52 ac f3 ac e6 01 29 60 93 9a 30 d7 0f 17 b9 22 74 66 07 3a 48 7f 2b 3f 66 3e ed 17 21 af f7 21 57 1d 01 ec c6 20 2d 37 c6 49 68 9f 40 d9 93 d0 10 e9 e8 70 2c 64 bb 21 3b 08 d9 66 c8 2e Data Ascii: !op!Tl\|R)`0"tf:H+?f>!!W -7Ih@p,d!;f.Cv%t=D,Hh:Fak!j$OB(t!6yhfokSr(\|Ms@)_aNp@0R={}.`C$gxvB~sp~
Nov 26, 2024 08:19:57.196850061 CET	1236	IN	Data Raw: 9f 0b 86 70 08 63 65 a1 ac 83 38 24 c4 c8 b6 14 2f 4e c0 12 15 13 8a 4e c5 73 db 3a d2 5b a3 a6 7a 55 33 f6 08 a2 95 c8 2f ec 93 13 7b 03 38 90 05 12 04 13 c8 85 72 fb a2 65 ca 18 bc d0 d7 16 52 57 c5 65 05 96 e7 4d d8 14 13 d4 ea 67 1b 74 3f 6f Data Ascii: pce8$/NNs:[zU3/{8reRWeMgt?o_d8?'qanOdCU8-`sdU>#v8>05Oo:#$MtYQdy86+Dh]QMHlVHxe! o2HYG"7
Nov 26, 2024 08:19:57.317104101 CET	1236	IN	Data Raw: 20 51 23 33 42 a9 1f f8 05 b6 5c 4e f1 dd b9 63 4e 03 29 21 37 fd 92 82 03 f6 d3 a2 48 a5 d4 65 f5 8f 7e e6 3f 60 54 94 25 49 28 30 86 8e 8a ac 76 54 dd e9 5b a7 23 a0 01 63 c0 0b 40 58 66 9f 33 94 58 d4 bc 9d 84 4d 15 ae 9e 28 6b ce cf 94 75 6d Data Ascii: Q#3B\NcN)!7He~?`T%I(0vT[#c@Xf3XM(kumN7S cM$u]<F!+ j0ZLZ,A%/}j[Zb1Njg.xk//lx4`,F#}.(x9En/P-\7#lZU9yLT\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49725	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.022227049 CET	348	OUT	GET /dist/jz/utils/jzUtils.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:57.197154045 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:56 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Tue, 30 Jan 2024 06:39:55 GMT Vary: Accept-Encoding ETag: W/"65b899bb-1aef2" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i92702_c22643, i2103125_c25795, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 39 33 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 bd e9 7a e3 46 b2 28 f8 7f 9e 82 c2 a9 a3 0b 14 21 88 8b 56 b0 60 1c b9 4a b6 d5 6d 95 ea 94 64 bb db 24 5b 1f 08 26 49 48 20 40 63 a1 c4 12 78 3f df d9 67 1e 61 fe cc fc 9d 5f f3 0e f7 4d c6 f3 22 13 11 99 89 85 84 aa 54 be 7d ba cb 22 90 c8 35 32 32 b6 8c 8c dc 7f dd 68 1b c7 46 b7 f1 7a ff bf db 99 a4 81 9b 78 61 a0 26 3a d3 9e 94 70 74 c7 dc 44 b1 ac 64 b5 60 e1 a4 c1 1e 17 61 94 c4 bb bb 5b 5f e6 e1 38 f5 99 cd 7f 0c 91 cf 62 aa 66 2a b2 ce 22 f3 98 4d bc 80 ed ee f2 5f c3 99 8f 6d fe a8 f6 87 d0 ae f9 5c bb b6 f8 35 ee 3e fd 94 78 3e af 3f 29 bf ad 55 25 0d 78 5d 63 65 47 16 8f 99 3f b1 f1 8f 99 cc bc 58 57 f3 51 6a 4f 11 4b d2 28 68 14 e3 d6 9e 96 4e d4 60 d6 d3 ba 27 13 1b 91 1a 68 4f de 44 65 fd 60 a8 89 12 f8 2c c7 d9 c3 22 9e 85 49 d6 93 67 06 ba 6f ee b4 75 f1 d1 7c 5a af 7b a2 50 82 85 5c c7 f7 55 4f 96 d5 3d bd 78 8e 34 78 f1 ad 9d 56 91 b6 16 45 23 63 6e 25 7a 64 b8 16 83 bf 63 ab 3c 53 3a 74 2f 32 42 9a b4 2c bb 22 e0 19 1c 0a 1f a2 70 [TRUNCATED] Data Ascii: 93czF(!V`Jmd$[&IH @cx?ga_M"T}"522hFzxa&:ptDd`a[_8bf"M_m\5>x>?)U%x]ceG?XWQjOK(hN`'hODe`,"Igou\|Z{P\UO=x4xVE#cn%zdc<S:t/2B,"pdEXY\|fBSZ[C}U@WQ_#7tw]?erI5-E6YlXUDiB4dJznUNi`skXP)N'&(u:\ '$T`>OrMl6F^0~I4FB;?\5s\1]qaJ(LB1s@,u,,E#plu]XG1k `&{INjMh\|g':;+@X^~v`AfL4=vW]=O4SW5'#q"X~8r\|}qF,sLcS_c FCe0Hg5KluaytBvwG8:C1QDOecXVNI
Nov 26, 2024 08:19:57.197205067 CET	1236	IN	Data Raw: cf f3 15 e5 6b 2e 34 e7 05 29 eb c5 ea 58 f7 61 02 61 38 33 67 9e 65 40 3b 7c 7a 84 9a 42 f8 a6 e0 b3 a2 ef b4 00 a0 d8 21 80 49 a2 7d 71 62 d4 f2 4a 20 78 56 66 5e 62 29 e2 f9 a5 93 cc 2c cb c2 1f 78 5d 97 66 25 52 b7 48 01 87 fe 0d b0 87 dd dd Data Ascii: k.4)Xaa83ge@;\|zB!I}qbJ xVf^b),x]f%RHiMXs.fwfAk>C}'3(Hi/SDjYqCzD[85PLh8a)30Gn.\|D,_Im(C)
Nov 26, 2024 08:19:57.197221041 CET	1236	IN	Data Raw: 4d c3 83 ae 48 4b 94 a2 87 fa 13 9f 76 61 53 7a 39 d7 20 6e 21 2b e2 ec 43 51 8c d8 f7 5c a6 7d 49 56 27 26 71 a2 ef b5 b5 af 54 32 0e 9e 37 2a 48 52 b0 21 e0 bd e9 d8 6a 64 05 20 35 e9 a0 ef 6b 36 20 7e 2e df 99 98 8c 04 2e 19 a2 90 41 02 d4 97 Data Ascii: MHKvaSz9 n!+CQ\}IV'&qT27*HR!jd 5k6 ~..A:Tb;g8{{ytoJj=8W_u1g.^sZ&B1<p7?bxK<>g@Dn>_s,YJ+KYOtV-P@/<`T
Nov 26, 2024 08:19:57.197356939 CET	1236	IN	Data Raw: 09 95 5b a4 0b 46 34 3d 4b 9d 52 68 12 d1 16 05 c2 96 19 59 d0 20 d0 eb f2 0a 8f 4c 20 c2 6a f4 15 66 c6 36 6e 1d 90 d6 2d 18 2a ee 1b a4 40 88 03 b2 b6 7f 51 ab e4 56 cd 4a 27 12 33 b4 53 ca 54 e7 1e 20 f6 7b d8 d7 6c f8 7d be 0f 15 17 0a b5 bd Data Ascii: [F4=KRhY L jf6n-*@QVJ'3ST {l}W&a}EuH8Ko@<Z)a)K,QlwD0@[nBT_mGFT_m/Y]X!JhL,[MpwWOFO~:@?4c
Nov 26, 2024 08:19:57.197362900 CET	1236	IN	Data Raw: 8d 5b 6e 73 c3 1f eb ab f6 a6 db 87 a7 9f 5f c6 cd dc 86 03 6c 81 65 19 fa 79 31 bb 65 22 21 ff 52 23 cf ea 09 c2 e4 f9 62 6a 5e 10 80 fd 7f c9 06 c5 62 1c 18 fb 30 4d 75 ba 69 dc c7 75 9a ab a7 b8 25 32 e1 ac cc 41 3c 46 32 84 23 30 77 76 d0 ab Data Ascii: [ns_ley1e"!R#bj^b0Muiu%2A<F2#0wvhNuBNZPcoSc$b:5\\|n)XwnBCvB<'^[j3iKe[V0AEae[@Ln+I1%T^60dM(y~
Nov 26, 2024 08:19:57.197381020 CET	1236	IN	Data Raw: ae a7 3f e1 a3 e9 ad ff 29 07 1b 69 5f 12 b5 ce cd 03 6c 5b 93 23 64 b3 dd 5d f1 c0 8b 82 fe 17 d8 a9 38 0e 59 b7 f5 99 8a ad cf b0 bc f5 a9 7d e5 06 42 45 7a 55 84 31 03 c5 53 4f 0d a4 6d e3 4b 75 7e f6 44 19 9e 39 2b 94 11 ad ec ac 28 8d 77 6a Data Ascii: ?)i_l[#d]8Y}BEzU1SOmKu~D9+(wjK/'` \rt}.iIc#tQ~hGqe^_Lfxc/hIqpeaByf2*ovq=,^"kUMH3`={4}3!`V&i]k
Nov 26, 2024 08:19:57.197396994 CET	776	IN	Data Raw: f0 b4 a6 c1 72 eb 0f d1 1f 27 6a 94 bc 52 08 df 84 2c 96 6a 4f 5b b8 1f 51 50 b6 c2 7d 53 0f 31 62 18 b3 13 fa 62 46 46 de 90 15 e8 d1 1a e4 fa b2 92 f0 df e4 30 2b a2 8c e9 68 a9 78 81 07 ec 57 44 67 10 e0 f2 e2 f3 c7 84 05 31 1e fe 2a 40 c8 d0 Data Ascii: r'jR,jO[QP}S1bbFF0+hxWDg1*@I\|}7[`H]CV'w,(@eBIiK8NQMogC=~nhd8=jA.&%TEhS%&oMpqwj\XUx3[y
Nov 26, 2024 08:19:57.197415113 CET	1236	IN	Data Raw: 45 bd cd 52 71 33 a0 f1 91 fb b1 b4 33 a2 03 dd 8c fa 04 78 56 a6 c9 28 f4 a5 56 bb 97 be d9 34 4e ee 75 7a 29 00 b2 30 50 a6 c3 b2 1b 08 7a f0 60 52 49 1c 01 88 41 a3 f7 24 48 7a 02 ab 2c c7 f2 79 44 54 a0 2e 2d 68 e6 5e 6e c3 52 e5 7d 75 62 dd Data Ascii: ERq33xV(V4Nuz)0Pz`RIA$Hz,yDT.-h^nR}ubC5B7L`Y@x;@BaH88{m7%nltguwbo:uPMp@[7l$-THR#Wyk,2[T(ozwb
Nov 26, 2024 08:19:57.197462082 CET	1236	IN	Data Raw: 61 cf 6f 5a 1d 20 71 7f 79 6e 76 79 ec f4 02 9f 18 cc 0f 87 2d 3e e5 e0 2d bb 20 b6 7a c1 9b d2 c7 5e c0 99 d0 6f 2a 26 f6 71 a6 72 9f 3d 1b 2d d3 91 1d 9a d1 5a 0a 5b 3c 5b 6d 9e 22 6a 8e fe 57 eb e9 f2 dc 54 0e 8c d3 16 28 63 ef 6f 1a 5d a3 dd Data Ascii: aoZ qynvy->- z^o*&qr=-Z[<[m"jWT(co]VLxmt`(s_(Cg/Nu#9x48[Pr)zqh:1G0s#/<aSz$CHg)a/gkxv=<\|/o}
Nov 26, 2024 08:19:57.197530985 CET	1236	IN	Data Raw: 75 03 2b e5 07 91 99 17 6d 3c 2c 07 c0 4d f8 40 59 dd 4a c1 32 bf b0 d1 cf 1e 7b 90 58 3c 8e 42 6f 6c 34 1b 25 11 4c 82 15 38 02 0a 0b 84 f4 02 af 33 fe 53 ee fc 59 40 55 14 04 83 37 9f 85 f3 c0 03 a6 99 39 c0 7e 9c ac 9f 78 9f 80 ca df 3b 20 36 Data Ascii: u+m<,M@YJ2{X<Bol4%L83SY@U79~x; 6s}\Fw:<`iC_kRH@x]];4Z2{L^uy(Ii26>Rr=.=^m\|Ts=lIX(Y9@r:zhih(
Nov 26, 2024 08:19:57.317439079 CET	1236	IN	Data Raw: ff 00 28 34 a1 dd b9 dd 6f 77 60 98 7b 5d 58 4d 30 5a 5c 3b 68 4c eb bb 7b ab a1 a6 52 b1 1e 88 83 45 67 55 68 49 36 e4 c0 f2 23 44 0d 18 76 6e 81 ea 1d 36 de f0 13 32 44 65 ae ab 95 ba 6d 0f 1e 6c 4d be 52 e6 98 65 68 8e 11 84 2a ef 23 ae 7b bf Data Ascii: (4ow`{]XM0Z\;hL{REgUhI6#Dvn62DemlMReh*#{`\`vNYM4XxmNaUA7\,BQ!i3\$sUN42G<B9V;\HOh\}p1oqeev)gBg4"R9xAv[):8I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49726	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.022344112 CET	355	OUT	GET /dist/jz/biz-shared/bizShared.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:57.301670074 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Fri, 08 Nov 2024 03:23:15 GMT Vary: Accept-Encoding ETag: W/"672d8423-28ada" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i63780_c21843, i2103127_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 33 64 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd fd 77 24 47 72 18 f8 fb fd 15 40 1d 8d ad 22 12 3d 68 cc 90 4b 56 b3 d8 c2 00 18 12 4b 60 30 0b 60 86 cb 05 a1 7e 85 ee ec 46 cd 54 57 35 ab b2 f1 31 e8 d6 3b bd b3 3e 7c 3e 9d 4e 67 4b 3e cb f2 d9 ba 27 4b e7 d3 b3 2c df f3 49 f2 4a 67 fd 33 cb 0f fd e4 7f e1 22 f2 ab b2 aa b2 1a 98 e1 70 bd 92 b5 6f 39 a8 ce ef 8c 8c 8c 8c 88 8c 88 bc f7 f6 d2 46 6b e3 7e 6b e3 bd a5 b7 ef fd 77 cb c3 69 d2 67 51 9a b8 94 30 ef c6 49 cf 9e d3 3e 73 82 80 5d 4f 68 3a 5c a2 57 93 34 63 f9 ca 4a 2d 67 9c 0e a6 31 ed 8a 3f 2d 59 2e 60 6e 46 bf 98 46 19 75 9d 56 eb de 94 45 71 7e ef f9 cb a7 f8 b7 35 8e 92 d6 f3 dc f1 88 2e 72 31 a5 8e e7 f9 8e 1a 44 d1 fa 80 0e a3 84 ae ac 88 bf ad 70 3c e8 8a 4f f7 84 9c c2 48 fd a6 91 76 e5 df d6 59 f4 f2 e8 3c cc e8 e0 f5 c6 44 4b 0d d0 96 ac 40 68 eb d9 94 7a 73 d7 99 26 62 40 03 67 59 0d 21 a7 f1 b0 8b ff f8 ec 3c ca 89 5b 86 6d 46 d9 34 4b 96 8a 44 ef 46 7d 2f 31 17 0a 0c d3 cc bd 08 b3 a5 84 44 24 0b d8 c9 fa 29 09 e1 4f fb [TRUNCATED] Data Ascii: 3da7w$Gr@"=hKVK`0`~FTW51;>\|>NgK>'K,IJg3"po9Fk~kwigQ0I>s]Oh:\W4cJ-g1?-Y.`nFFuVEq~5.r1Dp<OHvY<DK@hzs&b@gY!<[mF4KDF}/1D$)O:'d;I~J8(Z,e)u,]a)$:]Y&G#X(Y;5tIr[WVbNF[y4dzs>fN>'MN':D`RprLf>J+F.@<E<k\!!zenA_++7~l9O1\J0^4pg34}'d:qHwp4b$q8"zI3<QN: _U\|pVy$}pd5&5l'?>G1l8J^&?E9IeAAo6T2EzPuLsJqVFB&lzyY1im.g2a
Nov 26, 2024 08:19:57.301706076 CET	1236	IN	Data Raw: 31 94 7e 46 43 46 e5 68 14 dc 3a 43 9c 50 60 ce 92 0c 5b b8 ed 02 87 d1 2b 76 0f 96 c5 81 42 69 42 b3 2c cd 02 fc 8a d3 70 50 60 6a ca 77 8c a5 44 32 8d 63 e2 e0 27 02 2e e5 8d 7a 30 ae 0e 8d 73 ca a7 98 05 29 80 b2 52 a4 eb 00 ba e6 51 32 72 7c Data Ascii: 1~FCFh:CP`[+vBiB,pP`jwD2c'.z0s)RQ2r\|Yp0_-l#`A4yUgiF1>O\g5_u<D?Dho?lnml;/h 'SFp{&@Z"nGz$q\|EpAH2p'Z&
Nov 26, 2024 08:19:57.301731110 CET	1236	IN	Data Raw: 76 92 9c 76 d2 56 81 fd 81 f9 63 36 5b 6e 93 b4 65 ee 06 1c a2 c3 11 d0 81 ad 85 52 4e da 52 bb 03 f2 9a cf ed 08 0a be a0 d7 1e e2 dd fc b6 dd bb 84 c2 90 4b 8b c3 01 0f 93 84 a7 91 64 01 6f a0 cb c3 11 5b ec d9 f6 dc 7b 53 9b 15 87 e8 4c 73 ba Data Ascii: vvVc6[neRNRKdo[{SLsG4Qy\O@h>DKAP^`CX?M9[WQm1Oxb/Pv/HuRE[o]$ ]hy&(,BB(rRQOP=`P
Nov 26, 2024 08:19:57.301745892 CET	1236	IN	Data Raw: 96 25 8e d3 09 88 32 b7 b5 f3 a3 5b db d9 a3 43 38 3d 27 f5 93 bc 86 ce eb 26 3a af 37 a1 f3 fa a9 0f e7 71 bd 76 db ac dd 6e aa dd 86 da c8 40 2c 1b 5b f4 f1 74 7c 46 33 0f 0e f5 d9 cc 96 5e 52 6e 09 c5 16 de ac 01 bc e1 df f1 34 67 4b 67 40 e0 Data Ascii: %2[C8='&:7qvn@,[t\|F3^Rn4gKg@^,TaE/W8T`fMM)cCrfH9sJlDj*j#kU#YO_V+$.%~(Z(9cY1"\"v
Nov 26, 2024 08:19:57.301762104 CET	1236	IN	Data Raw: 02 8b 63 0d 23 dc 45 2d ab 51 6c ee 11 55 36 fe 25 b9 fd e2 72 36 ab 42 5d d8 62 4a 93 48 d2 6f 96 c9 ba e2 0f de 0a c4 41 5f 0b 62 80 91 bf f0 0b ea 87 43 a6 90 15 e6 d7 49 7f d7 cc 2f a5 38 64 00 85 0c e3 75 5e c4 f8 6d 18 85 0d 2b 66 6d 6f d6 Data Ascii: c#E-QlU6%r6B]bJHoA_bCI/8du^m+fmop[o]ya2Je(5mXbMKg.ltZ6r7#N/J.s$\@b8jC"Iq;$FXp.''~!,Ey90]f$p\N>z\IE48:pO2
Nov 26, 2024 08:19:57.301784039 CET	1236	IN	Data Raw: 10 aa 02 23 a3 4f ce 47 5a f1 0d 53 8c f2 5a ba 45 8f 69 5b ad 8a 56 ac a3 8c a2 19 57 28 06 41 0f 10 a2 de 27 64 c0 c6 30 86 37 9b 31 a1 3e 03 39 1b b6 74 98 bd b0 5d d6 2c bc 2e c9 2b 37 1e e4 c0 f3 5d e3 6a 04 60 8d a9 76 18 a0 3d 7a 13 cb bb Data Ascii: #OGZSZEi[VW(A'd071>9t],.+7]j`v=zp>@vcS?t?lcp]bJY@nC"UX!G1kc>MT]_U &H%%y=uj9iD1@h^RprhR
Nov 26, 2024 08:19:57.301800013 CET	1236	IN	Data Raw: 97 aa e0 08 93 8a cf 48 88 c6 1e 51 e7 3d b7 1e c4 66 40 24 28 ae 70 79 e8 d8 34 a0 73 c9 88 dc c8 21 2e f7 15 49 48 4a 8a fb d0 fc ed 2a 7b 4c 37 c4 b1 ea f8 a5 ba 31 8c c1 a1 ae 57 54 48 82 a5 7c fe 73 41 27 06 54 a8 08 a6 19 fd 5b 48 2c 2c 21 Data Ascii: HQ=f@$(py4s!.IHJ*{L71WTH\|sA'T[H,,!?0qyzNtX[ft8l(EP)gP>4+w#sg9.p#PC3vX?1+I7Qw#KRZYa&Z-
Nov 26, 2024 08:19:57.301815033 CET	1236	IN	Data Raw: e5 2c cd 78 ac 06 46 5b 45 36 49 e9 d8 5a 04 d2 09 48 f1 14 0e 69 6b be cc 23 30 20 5f 0e aa 05 7f c9 24 4b 8f 20 eb 87 53 9a 5d 1f 31 7b dd 4a 19 de cf e6 60 bc 9d a2 77 8f bd b7 10 90 0c 8d 8b 52 04 51 ab 54 01 af a8 90 86 58 2b ca 3c 82 fd e9 Data Ascii: ,xF[E6IZHik#0 _$K S]1{J`wRQTX+<qFkH'oo(XT\|`;4dwej:i'ql.. c>6qsPIL)!%j/[S(<D=:O/7Fd)9MwMZ'DPh1
Nov 26, 2024 08:19:57.301831007 CET	1224	IN	Data Raw: 58 ba 86 c7 65 d1 84 c9 7a 2e 9e 32 32 ac b0 3e 83 d2 a4 15 17 bb 18 ef 05 3b 6c a2 bc 48 b9 db 80 fb 8a 03 58 03 da 51 1b b8 c1 58 df 82 5b b8 f9 d7 42 c1 34 9b 38 66 f0 d2 8b 5a 90 3c 32 ec a9 64 c4 c3 bc 18 8d 54 f9 ef 85 ed 48 be 45 6e 35 6a Data Ascii: Xez.22>;lHXQX[B48fZ<2dTHEn5jge_rZ%/&yL{F8MgWE,i^m5GYphs{wC`'L1&mn6?{ky3o:<M6J]As<]
Nov 26, 2024 08:19:57.301846981 CET	1236	IN	Data Raw: ac 5d d0 ab d6 3b e4 6f c9 8a 91 7d 74 57 da 46 af 98 43 fc 7a 5c 72 0a 32 69 d7 93 86 0d a0 1e b7 e6 30 39 79 02 3b 93 6f cd 79 e7 71 99 77 dc 16 6e 30 3c fe 1d 39 6c e9 59 62 af 87 52 e2 35 bf 5b 20 94 6a d5 ae d0 88 1f 02 83 0d 22 c7 c0 73 df Data Ascii: ];o}tWFCz\r2i09y;oyqwn0<9lYbR5[ j"srZX(^p}".xIKvZ=FP2G1)4}<G^MG/=C3#cw=&{#G~{y 6r
Nov 26, 2024 08:19:57.422118902 CET	1236	IN	Data Raw: 02 d7 b1 a9 44 14 fc 1a f1 48 da 24 95 66 eb 56 c7 b2 59 51 99 34 8d a3 8c c0 ab ab 0d 7d 4b ed 38 31 c6 5e 55 ca 38 b5 21 54 f5 2f 77 30 63 43 43 f4 89 31 2b d9 61 2c 23 d6 c1 c2 00 26 3f 44 fd 16 f4 b8 15 47 b0 af 0f 71 4d 31 8a d6 17 53 10 ea Data Ascii: DH$fVYQ4}K81^U8!T/w0cCC1+a,#&?DGqM1StGYX:y(1<pu25,Rz/5Ok"5"o5ELZ^}{e-m'KRyi3}uQ4DFn2\|%\,Cb"
Nov 26, 2024 08:20:28.821466923 CET	346	OUT	GET /dist/jz/locale/1033.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:29.241337061 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Tue, 15 Oct 2024 08:03:20 GMT Vary: Accept-Encoding ETag: W/"670e21c8-16665" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i24843_c17589, i2103121_c25795, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 39 33 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 bd 6b 8f 24 67 76 26 f6 57 82 85 15 38 83 ad ae 61 37 c9 b9 d4 ee 8a a8 aa ee 66 d7 b0 eb c2 ca 6a f6 70 64 21 11 99 19 99 15 ac c8 88 64 5c aa 3a 7b c0 81 60 60 6f 58 7b 81 b5 01 c1 58 cb 1f 04 c3 06 fc c1 6b 7f b2 21 4b b2 3f e8 9f 68 a5 b1 f4 49 7f c1 e7 39 97 f7 12 11 59 dd 1c 8d 01 b2 2b 22 32 ae ef e5 bc e7 f2 9c e7 dc a5 75 f2 72 f2 2f 7e 35 9d 2e ab b2 9d 2e d3 75 5e 6c a7 4d d6 1e fe c1 af 96 79 dd b4 87 7b 93 7c 3d e9 ca bd fd 26 9b 57 e5 e2 70 ef 6f ff d3 bf fb 9b bf fc 6f f7 be db b7 13 2e cf f2 72 f5 32 7f e5 4f f9 cd 1f ff ef ff ef 9f ff ab df fc 77 ff 3e 3e f1 79 5a ae 26 55 b9 9a 7e 7e fc e4 e3 c7 4f f6 93 bf f9 f3 ff 87 ee e6 af 93 7d fd 39 b8 f0 6f ff ef ff f4 77 7f f9 bf fd fd 7f ff 2f ff fe cf ff 43 f0 22 e1 51 7f f2 df ff c7 ff e3 6f fe ec 7f f6 a7 e9 7e 70 b7 3f fb 8b bf fd 93 7f 15 dc 47 f6 fd 09 93 eb 2f d2 bc cd 83 33 fe eb 7f ff 9b 3f fe d7 bf f9 9f fe cf f8 7b 7e f3 c7 7f f6 9b ff f5 7f fc bb 7f f3 df e0 70 f0 f1 c1 d1 e0 a9 [TRUNCATED] Data Ascii: 93ck$gv&W8a7fjpd!d\:{``oX{Xk!K?hI9Y+"2ur/~5..u^lMy{\|=&Wpoo.r2Ow>>yZ&U~~O}9ow/C"Qo~p?G/3?{~p\|ow_3'[ww\|qA}L\|CSqN\|':Oju7'~$e1zyV<xNItMu$}rE/L\Ezx08}V.-d,\6<iI?9>Ljs/U6mNi^t5=NmnX\7jd%4_$\|^f=E$?,7&+nduFw7Mnjm&-N\tk=pousnV^>IyV]`'^62i:87dya'i2zgzS&C#,/jjv~#ms=jo&K2jdQq;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49724	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.022453070 CET	346	OUT	GET /dist/jz/locale/2052.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:57.301873922 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Tue, 15 Oct 2024 08:03:20 GMT Vary: Accept-Encoding ETag: W/"670e21c8-14f69" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i63240_c21843, i2103121_c25795, i1872280_c17483 X-Cache: HIT from i1872280_c17483(cloudsvr) Data Raw: 39 33 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 bd 79 73 14 57 9a 2f fc 55 68 22 de 77 66 e2 32 d3 80 7b f5 7b ef 4c 80 80 36 d3 16 c8 08 b7 7b 6e c7 84 22 55 95 92 ca 54 55 96 6b 41 c8 1d dd 21 16 09 09 49 48 80 d8 85 41 98 1d b4 60 36 2d 48 fa 2e 33 ca ac d2 5f fd 15 de 67 3d 79 4e 56 96 c0 dd 3d 11 ee c5 aa 5c 4e 9e e5 59 7f cf ef 39 e9 95 77 7c de f9 7f fe d8 d5 d5 13 14 ab 5d 3d 5e 21 97 1f e8 aa f8 d5 4f ff f0 c7 9e 5c b9 52 fd 74 67 67 ae d0 59 2b ee dc 55 f1 33 41 31 fb e9 ce 70 7e 6c 73 ed ca ce 3f ed d2 0b 3a da 73 c5 de cf 73 5f c6 97 44 d7 16 eb ab c3 d1 8d 8b ee 85 87 bc 62 6f 67 50 ec ed fa cd fe bd 9f ec d9 bb 6b c7 e6 ea 06 3c 2d be 8f ff 5d 7e b6 6e 0c d7 e7 1b 6b 0b 5b b7 87 b6 56 2f 59 03 b1 ff 1a 5f bc 75 eb ed e6 f2 a3 f8 32 f9 77 eb 69 cb ef c3 99 61 eb 39 fc ef f1 05 9d c7 7f eb e5 aa 39 eb 8a 89 8b d1 b5 f3 d1 c3 77 ee f7 44 d7 96 a3 b9 ef 1b 23 97 f1 cf d6 c7 5b 7f b5 de 4a cf 08 d7 9e 6e ae 5c 4a 3e 59 fe 9a bc b8 31 3b 0e ef 4c 5e 2c 7f 6d 7a 32 2f 4b f2 c9 c9 c5 e2 8f d8 [TRUNCATED] Data Ascii: 93cysW/Uh"wf2{{L6{n"UTUkA!IHA`6-H.3_g=yNV=\NY9w\|]=^!O\RtggY+U3A1p~ls?:ss_DbogPk<-]~nk[V/Y_u2wia99wD#[Jn\J>Y1;L^,mz2/Kc>mxgu!p_9_{}A/J^_ xNIF_?(KWk/s:[b;AA\|GR{w^9[XeB.+;b]_W*etg}v1`sm>d'UA#_v%]oE3Btac>V~C7/\}G?A+\|=([k=(x{\|z\|gv2l'FS+j_eN_g;{ KY VU//cWNG)i?N^R_W"\|8\|>\|4\p>sZc9XC-Uw+
Nov 26, 2024 08:19:57.301888943 CET	1236	IN	Data Raw: d3 e8 cd 69 7c fc e4 bb ff 1e 3c 43 77 e4 8a 27 bd 7c 0e 8f f2 83 97 d1 55 79 df 40 a5 ea 17 0e 96 cb 41 19 96 f3 d5 6a 7d f5 6e 7d f9 74 b8 71 f3 2f ef c7 e1 61 f5 27 13 e1 e0 cd ad f3 13 8d 85 ab 3b 77 f1 32 1d ad f6 f9 e5 cf 7b 8b 5f 7c d1 5e Data Ascii: i\|<Cw'\|Uy@Aj}n}tq/a';w2{_\|^V/pGtI/h~/Zn]'6WokJb_RjxiswisJpfp/n4_U~y0MglW_WLw.W2o"
Nov 26, 2024 08:19:57.301903009 CET	1236	IN	Data Raw: f0 1d 98 4e b6 0b f5 e7 23 c1 be 1a 9e 4d de 0b ac 87 c0 92 dd 1a bc 05 f3 bf f9 1e c6 7d 8b 1f 89 ca fe d6 19 9e 03 63 e8 38 76 53 27 1c c0 16 96 13 1f 8b 8f b4 9e dc 89 fd 3c c7 36 29 cd 62 7d fa 25 08 81 7f 66 c9 01 62 a3 fe e2 51 7d f5 1c 7c Data Ascii: N#M}c8vS'<6)b}%fbQ}\|pdDC8yv4~Njz5cCS(<#oO?~gD~R}Jt=W?60+mWyRds=x-xt^WntzX6WY$'R
Nov 26, 2024 08:19:57.301919937 CET	1236	IN	Data Raw: b0 14 82 90 8b 8d 8f 89 97 ba 93 c9 26 a2 06 6e d2 9c 2e 3e d1 c7 7c b4 84 f8 7b ad 98 2d cb 4c 96 0e 14 b3 b5 7d 9d 63 7e a7 5f cc d2 9c 8b 45 3b 79 69 6b f0 74 42 e3 b8 a1 d8 d6 6e 1f 1d c3 8f 54 3d fa 02 7c ff d1 13 e0 0f 4a 82 43 c4 98 b3 f4 Data Ascii: &n.>\|{-L}c~_E;yiktBnT=\|JCS<]8=Q0Pf4L*k5-7M'mhh%7utoGSZ(AM#qI0g/{bh,]\|I2H^
Nov 26, 2024 08:19:57.301934958 CET	1236	IN	Data Raw: 84 72 a2 d5 2e f5 05 45 07 60 52 69 ca ea bb a8 07 0b 1f 74 0c 34 8c 8c 5d 64 2a 45 4b e0 e9 f5 e9 97 6c 45 83 9b 06 ef de b9 0b dc 95 5c 9e f5 36 6f 50 3d bd 9d 7e d5 96 9f 17 1f 86 93 df f3 b6 62 db c0 39 c8 29 e3 4f 1e 28 ca 32 35 1f 29 3b d3 Data Ascii: r.E`Rit4]d*EKlE\6oP=~b9)O(25);z&G`z S6kXKk.9~?AVWxq:up2 uXf]I-t>H)eU]<xBH!Qd9rzoS\l9UgC$ubm?Jz
Nov 26, 2024 08:19:57.301949978 CET	1236	IN	Data Raw: 6d 56 c4 aa 2f e0 84 16 0e 17 7a 65 eb 62 04 95 51 3e b7 d7 c3 b5 fb 4d 69 14 9e 62 84 28 b5 93 ea 35 ae 14 8b 6d 05 28 f1 3c f0 e6 33 41 12 38 bd d1 f5 47 d1 e5 07 5b d3 e0 88 0d 46 2f d6 eb d3 af e0 01 24 ea 24 0c bb b9 be 01 47 3a 7a 75 15 7c Data Ascii: mV/zebQ>Mib(5m(<3A8G[F/$$G:zu\|xpB#/lOvh7wd0#X'n9v&aC6}=<zt=l2oDH1FFnAIV6gg^}eP\|8LJ;(\#DJ\gT4{`]2876mg_N
Nov 26, 2024 08:19:57.301966906 CET	776	IN	Data Raw: e1 16 89 da 54 bc 93 28 85 3f 83 e9 04 17 98 e3 31 0f 5e 87 67 27 ed ca b0 e6 07 7e a2 a5 63 09 63 6e 5b b3 74 cf de b4 54 26 ef 75 0e aa 57 8e d0 2e e6 40 43 34 74 7f 73 65 98 cd ff 5d e8 1e 8f 2c 21 ca ed fe 73 2e d6 fe 09 09 61 3e 19 c7 fb 72 Data Ascii: T(?1^g'~ccn[tT&uW.@C4tse],!s.a>rNGbl5eYO]/6WDX&2lEPB{_hq:bp=u;r~2nA+qIZwVjb*C%MVSqY-
Nov 26, 2024 08:19:57.301980972 CET	1236	IN	Data Raw: 86 1a da 46 43 93 ba c0 a3 eb 73 bd 87 c9 8b ba 31 69 0a 7b 54 83 2c 46 22 37 57 2f 50 30 d2 0d c4 c4 e4 01 a6 0c 96 37 ad bc 7f 68 24 05 c5 4e c7 53 30 ec 64 3a cb de 16 0c 7b ab e3 d5 51 f6 4b e4 28 22 22 1c c4 16 4f d4 f9 e1 f0 c1 79 9e c3 d6 Data Ascii: FCs1i{T,F"7W/P07h$NS0d:{QK(""OyZksi:1;L!-l*Y{2K2"\RA:WRYJx\|S1H]bS+K)J8 xm6a,XGOZ,g>KOf;f(U
Nov 26, 2024 08:19:57.301997900 CET	1236	IN	Data Raw: 94 89 55 a4 e2 6e 5e 4b 58 05 3d aa 88 5c c3 85 ca da e9 2e 8a b7 48 98 f3 fe 73 de 20 29 45 48 64 eb f2 ca 1b 8a 19 14 52 31 3a d3 12 51 1f c6 0e 8a fc f9 98 b2 6c 14 f6 24 e3 3f 44 bc 94 46 c0 9a 8c 0e f5 53 b1 0d e8 2c 93 86 4f 23 f8 75 c3 1b Data Ascii: Un^KX=\.Hs )EHdR1:Ql$?DFS,O#u6DW`_G3U1d$0z1K[\|#]mO;2"Y%sS'w."~8ToJjN!'^#g:{f\ILk"TZ\|@
Nov 26, 2024 08:19:57.302020073 CET	1236	IN	Data Raw: 61 a6 25 69 3d 7f 55 49 da 76 22 fd 47 a2 64 4a 32 78 8e 19 25 4a 42 f1 c5 56 51 a8 2d 71 7f 7c 3d 14 a9 40 4d 6f a4 86 29 61 25 a4 a2 cb 2e 18 a3 42 a7 57 76 c1 18 67 9e 51 fd db 9d b5 b6 e9 d5 f1 e3 1b 1e 7d 9b 2b 49 dc 1c 64 e6 7b 84 5e 0f 98 Data Ascii: a%i=UIv"GdJ2x%JBVQ-q\|=@Mo)a%.BWvgQ}+Id{^V~@dGSreqsmneEo46S;!{Qbl]W[PJpr}:@MSP4z>b?)ghfZr255h\|<]Zg4Q`&+4]rx"7
Nov 26, 2024 08:19:57.422213078 CET	1236	IN	Data Raw: 4d a4 9a 85 93 eb f0 06 ec 56 df 5c ce a3 ad be 71 27 ef f7 32 27 8e 07 a4 aa bf 43 bc f4 ec db 26 c4 1c 78 42 ed 14 54 ca 36 53 f3 b1 09 19 1f 7d d6 29 e1 cb ab 18 84 77 c2 28 4e 3f e7 a6 d8 21 35 26 17 4e cb 8f f0 25 5d 2a ec 0f f5 af 66 1a 78 Data Ascii: MV\q'2'C&xBT6S})w(N?!5&N%]*fxk(O@E\|c n:Sq,4CC1i[dh?&+l&~s`%Z jr[Wrt.)\y?EO/M4UZZSfobw{wXI6R4B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49735	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.896382093 CET	368	OUT	GET /css/dist/styles/siteBase2.min.css?v=202408051114 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.199352026 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Expires: Wed, 15 Nov 2034 04:10:52 GMT Server: F-WEB Last-Modified: Mon, 05 Aug 2024 03:14:37 GMT Vary: Accept-Encoding ETag: W/"66b0439d-139b6" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i11903_c17987, i2103121_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 32 64 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 6b 8f 24 c9 71 d8 5f 29 ed e2 80 dd 41 57 6f 55 f5 63 fa 01 d2 bc 5d dd ea 56 b8 3d 2e b8 2b 3e c4 23 1a d5 dd d9 d3 75 5b dd d5 ae aa 9e 9d d9 c6 00 b2 61 c3 94 65 7f 30 64 d3 b0 ad 2f b2 04 7d b2 48 0a 84 05 0b 12 f5 6b 78 3c f2 8b 7e 83 f3 5d f9 ac ca ea e9 59 2e a5 d3 50 7b 5d 55 99 91 91 91 99 11 91 11 91 91 c9 76 b7 2f bf 5f 5e ef c0 d7 16 6b b0 78 3d cf ae 7e 70 b8 04 79 99 2c e2 d4 8f d3 e4 62 3b f1 a3 dd d5 74 a6 be 0c 77 57 37 c9 e6 e2 30 cf f2 25 c8 27 c1 54 29 50 66 bb 9b 79 b6 bc 3e ac b2 6d e9 17 c9 5b 30 09 11 a0 4d 9c 5f 24 db 49 70 13 77 f0 e7 5d bc 5c 26 db 0b f8 62 77 e0 df be b1 01 cb 24 f6 8a 45 0e c0 d6 8b b7 4b ef 81 ff 06 cc 5f 27 a5 bf 49 b6 fe 12 5c 26 0b e0 ef 92 2b 90 fa 79 5c 26 d9 24 78 88 4b 6d e2 2b f6 f5 4d b2 2c d7 93 f3 e1 68 77 f5 f0 80 9a f2 50 03 57 fe 1a 24 17 eb 72 32 c6 ff 07 3b 71 13 ef 97 49 d6 d9 c4 3b 2f ce 41 7c c8 f6 65 9a 6c c1 64 9b 6d c1 cd d9 81 b5 5b 82 2b d2 0d 3f 5e 7e be 2f ca 49 18 04 1f dc 7c [TRUNCATED] Data Ascii: 2d6}k$q_)AWoUc]V=.+>#u[ae0d/}Hkx<~]Y.P{]Uv/_^kx=~py,b;twW70%'T)Pfy>m[0M_$Ipw]\&bw$EK_'I\&+y\&$xKm+M,hwPW$r2;qI;/A\|eldm[+?^~/I\|(SpIJt_Q\|3/_?7_~??E~?/~/gwoWdM^OI;fe-$y.'WtY>TA_WoW7V7YF#(sPeR@WW[vXQMB<y9`Kx*y9h5
Nov 26, 2024 08:19:58.199474096 CET	84	IN	Data Raw: 69 b6 78 6d 80 39 88 46 f1 7c c0 4b 74 d8 8f 0a 38 a4 23 e9 de ce d4 b9 f9 6a 31 07 f4 3b e9 d1 8e 57 cd c1 12 7d 59 67 70 cd d6 36 8d 4b 74 d8 0f ad e9 02 a4 60 51 82 a5 15 c6 d4 5c 5e 03 44 98 08 e5 25 3a 55 c9 fb 8f 09 ba 52 99 d5 6a 14 f4 83 Data Ascii: ixm9F\|Kt8#j1;W}Ygp6Kt`Q\^D%:URj
Nov 26, 2024 08:19:58.199776888 CET	1236	IN	Data Raw: 33 31 31 66 0d 0a aa cc 4b 8e 91 54 0c ce 84 20 20 33 04 ec 62 c8 31 b2 9a c6 ca ad 3c 5d 07 e8 6f 4a f9 1c 64 7b 5e 91 a5 c9 d2 bb 3f 5a a1 bf a9 3c d4 b0 f6 44 a5 eb e4 3e 18 ad 7a 2b 60 80 d1 8b c6 23 f8 41 86 91 20 5e 83 c7 0c fe 17 f3 24 5b Data Ascii: 311fKT 3b1<]oJd{^?Z<D>z+`#A ^$["qzOyQ/Evwu(0z~An!w9>8BPxKaj0)$qp$[ \|;gzZ`JE0E"8VY)<4HxH-Yd,v
Nov 26, 2024 08:19:58.199862957 CET	1236	IN	Data Raw: cd 7e 0f 75 f2 c0 3f 23 ed e3 a6 fa e0 49 f0 ab 62 97 49 91 40 45 93 80 41 ff 7c 93 7e f9 18 83 3f 18 74 0b 04 8e 82 91 76 5d 84 aa 70 d8 bc 6e af 98 ea af 28 9d bb 17 7b 28 18 3e 05 6f fe a0 00 f9 2b b0 81 bc a0 04 07 ba c6 7c 70 09 09 56 70 26 Data Ascii: ~u?#IbI@EA\|~?tv]pn({(>o+\|pVp&Tv]BT(pCfneo`K]E\|+<d,WXHW\|=4KS)mT!%<90tXW,yjRlfU~x8vF] MqXThV_,yD
Nov 26, 2024 08:19:58.199868917 CET	1236	IN	Data Raw: 03 7b 49 8a 82 5c 55 13 fe 82 02 57 09 f0 06 73 90 d2 82 a9 93 5c a4 e1 82 86 1d 12 87 41 55 5d f9 b9 8e 7c 16 35 45 06 70 b0 0e 69 35 a1 58 0d d3 4e 09 7f 83 92 64 53 13 65 59 52 23 f5 a3 55 1e 6f c0 23 58 05 ad 96 7a bf 84 2d 86 06 2f 69 e6 f2 Data Ascii: {I\UWs\AU]\|5Epi5XNdSeYR#Uo#Xz-/i-AKrCjRa{6-&Bh!IZv9h?NO5c(ux%iQ%Z*<Tdr;C1s%fN{fR_Ic%
Nov 26, 2024 08:19:58.199878931 CET	672	IN	Data Raw: 6a 2c 9b 7d 5a 26 4f b2 f4 a9 86 6a a5 8c 6b bd 39 56 5c 10 f3 40 9d e3 de a2 e1 9a a6 44 ad 92 d7 24 02 8d 4b 86 18 46 cc 2a 98 e5 9b e3 62 94 6b d7 69 5a 92 89 e7 60 99 53 0d 6d 18 98 89 ed 63 6b fc dd 98 09 9d 43 e4 d5 1f 6c 0b 34 19 50 30 5d Data Ascii: j,}Z&Ojk9V\@D$KFbkiZ`SmckCl4P0]iTcWUA@<x=v#+.5Xf4Sl!3(,Tn\v(lW\|xRe;+tsKZy)^~I7*(-<YCF]fs&J
Nov 26, 2024 08:19:58.199884892 CET	1236	IN	Data Raw: 65 12 a7 d9 45 b5 71 d0 be 2c 41 21 a4 70 52 fa d7 16 12 24 ae 0a 80 19 47 c4 ad b0 96 0d 93 e7 b7 37 e7 b1 6f 76 97 52 f5 57 b2 b3 ad e3 25 2c 4a e1 4b cf 66 ac 2a 3f a1 8a 9e 24 52 66 c6 0d bb 19 92 e6 34 b4 15 93 2c 21 b6 42 c4 60 a0 e5 b4 b1 Data Ascii: eEq,A!pR$G7ovRW%,JKf*?$Rf4,!B`7+5y$jJl8vt&8ll.Aa%7ze{$n.B?e@buZ[q9]LX?`5}nO[7Q<M(&V3'?/e.4'0F\
Nov 26, 2024 08:19:58.199961901 CET	1236	IN	Data Raw: a1 66 9c e7 d9 1b d9 0e 46 13 3a cb 45 ba d4 1f 7e 68 71 e3 60 05 88 78 5c 14 88 eb 64 09 f4 8c 84 42 89 d9 1a 72 7c f8 9f 12 5d c7 7d 51 f9 ad cd 37 3f 7a 21 0d 18 13 ce ed f1 eb 1a f5 0b 4a f4 c3 b1 da f5 cf bd 01 b9 38 da 78 ab 34 fd 68 fd 40 Data Ascii: fF:E~hq`x\dBr\|]}Q7?z!J8x4h@NF_A#3$3}z}\|#=%"5)J9UkKC_K/ 7]w?S"IhJAAb*M4I669yv
Nov 26, 2024 08:19:58.199966908 CET	1236	IN	Data Raw: 79 fa 7c 40 67 22 b5 01 ba a2 a2 59 71 c8 d4 c2 2e f1 c1 b8 43 fe d7 1d 3c 9c ea b3 ef 3c 42 7f 10 11 e3 aa 1e a0 1b 36 9d d1 80 12 86 64 f5 30 22 42 7d f3 90 83 2a 97 47 75 57 6e f0 71 de 04 21 46 57 4d 31 05 75 0a 9a 6f 80 9a cf 9a a6 20 dd 5e Data Ascii: y\|@g"Yq.C<<B6d0"B}*GuWnq!FWM1uo ^^;4^0\Q8@hw%B5!X8 yfl,+t<y9JU:JEmf<9!&\>4RQ`Fa8?=:@Xw08_P)Nx}
Nov 26, 2024 08:19:58.199975967 CET	672	IN	Data Raw: de 42 5a 62 30 c6 72 5e 58 78 c9 76 95 6c 13 08 bf 4d 59 fb 19 9c 72 9f 6f 6d 47 70 c8 37 cb 7b 99 5e 98 4a 78 1b 05 65 a5 cb cc 63 65 0b 07 6e 6a 53 3d b9 ed 98 6b 03 38 40 98 db d2 cc 63 e2 e3 98 5f 36 28 58 31 a0 17 13 e3 4b 6d e2 6b 12 36 43 Data Ascii: BZb0r^XxvlMYromGp7{^JxecenjS=k8@c_6(X1Kmk6CNs7pk>HJ~n.k.=c5"nvsw11301NB,(x{{AjUa`33w6"lUz1l?/S/@h~ygJHp8"
Nov 26, 2024 08:19:58.319701910 CET	1236	IN	Data Raw: 05 5e 6b d2 4f 5a e2 78 9d 44 7d 35 7c 23 1a d5 78 83 fa c6 ab eb 91 ca d8 37 4e 6b be 02 0c d6 3d 88 10 ba 3f de 27 c8 18 ee d6 12 0b 78 fc 29 95 0f f6 04 4e c9 13 dc ef 87 91 1b a5 0b 99 93 bc df 1b f5 c6 6a a1 e2 f2 c2 87 5b 5d 9f bd a5 0c 2a Data Ascii: ^kOZxD}5\|#x7Nk=?'x)Nj[]*@)ncSQY6mtR+ +p01Dl:R_oq/M%E 4Yu{M#r@3>3K/~%CR}%BB+7gos!l{>
Nov 26, 2024 08:19:59.760175943 CET	454	OUT	GET /image/locater/locater_Arrow3.png?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.170466900 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: image/png Content-Length: 964 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:05 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:44 GMT ETag: "6084db98-3c4" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC149_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC203_lt-obgp-fujian-xiamen-33-cache-2, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 08 00 00 00 04 08 03 00 00 00 84 13 8e c2 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 21 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRtEXtSoftwareAdobe ImageReadyqe<!iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:4A40B5008FD411E4A4309E08706D44C8" xmpMM:DocumentID=
Nov 26, 2024 08:20:00.245273113 CET	440	OUT	GET /image/v2/mbg01.png?v=202407221109 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.656316042 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: image/png Content-Length: 654573 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:22:21 GMT Server: F-WEB Last-Modified: Mon, 22 Jul 2024 03:09:31 GMT ETag: "669dcd6b-9fced" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC202_dx-lt-yd-jiangsu-taizhou-4-cache-12, BC198_lt-obgp-fujian-xiamen-33-cache-1, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0d 77 00 00 06 da 08 06 00 00 00 34 ff a5 87 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6f 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 [TRUNCATED] Data Ascii: PNGIHDRw4tEXtSoftwareAdobe ImageReadyqe<oiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF" xmpMM:DocumentID="xmp.did:8100E979434211EF9671A8786
Nov 26, 2024 08:20:04.018635035 CET	440	OUT	GET /image/v2/mbg01.png?v=202011021234 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://2.ss.508sys.com/css/dist/styles/video.min.css?v=202407231110 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:04.429610968 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: image/png Content-Length: 654573 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:09:54 GMT Server: F-WEB Last-Modified: Mon, 22 Jul 2024 03:09:31 GMT ETag: "669dcd6b-9fced" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC70_dx-lt-yd-zhejiang-huzhou-3-cache-3, BC94_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC202_lt-obgp-fujian-xiamen-33-cache-2, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0d 77 00 00 06 da 08 06 00 00 00 34 ff a5 87 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6f 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 [TRUNCATED] Data Ascii: PNGIHDRw4tEXtSoftwareAdobe ImageReadyqe<oiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF" xmpMM:D
Nov 26, 2024 08:20:07.311861038 CET	441	OUT	GET /image/onlineMap/close.png?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://2.ss.508sys.com/css/dist/module.min.css?v=202410281356 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:07.722034931 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:07 GMT Content-Type: image/png Content-Length: 1198 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:21:43 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:46 GMT ETag: "6084db9a-4ae" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC168_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC195_lt-obgp-fujian-xiamen-33-cache-1, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 14 00 00 00 14 08 06 00 00 00 8d 89 1d 0d 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 33 38 20 37 39 2e 31 35 39 38 32 34 2c 20 32 30 31 36 2f 30 39 2f 31 34 2d 30 31 3a 30 39 3a 30 31 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRtEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C1C0FC2CC0A511E8B3D7C46EC7D88036" xmpMM:InstanceID="xmp.iid:C1C0FC2BC0A511E8B3D7C46EC7D88036" xmp:C
Nov 26, 2024 08:20:28.820859909 CET	374	OUT	GET /css/dist/styles/moduleAnimation.min.css?v=202402221530 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:29.231750965 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:59 GMT Server: F-WEB Last-Modified: Thu, 22 Feb 2024 07:30:21 GMT Vary: Accept-Encoding ETag: W/"65d6f80d-129a" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC8_dx-lt-yd-shandong-jinan-24-cache-3, BC84_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC202_lt-obgp-fujian-xiamen-33-cache-2, i1872280_c17483 X-Cache: HIT from i1872280_c17483(cloudsvr) Data Raw: 32 62 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c5 96 cf 8e d3 30 10 c6 5f 05 6e 20 35 16 05 69 0f 99 13 88 0b d2 72 01 f5 01 9c c4 69 4d 1d 3b 72 9c 2d ec 2a ef 4e fe 39 09 ad 67 52 01 55 4f 4d e7 f7 cd a7 f1 64 6c 87 e5 3c 13 5f f4 4b 74 12 c9 51 ba 88 6b 59 70 27 8d 8e 34 2f 44 3c 50 08 46 1b 36 fc 3e 8a dc d1 f9 9d 02 50 e2 7d be c9 fd 61 c5 a8 97 00 8e bc d5 ae a4 7d 76 25 20 71 ef f0 d9 9c 56 9a d2 29 00 25 0d 2b cc d3 4a 73 66 05 e0 e4 32 d7 c9 42 ea 7d 94 d7 3a ed fe c7 69 9d c8 34 4a c4 b3 14 f6 0d 7b d8 6e 22 f6 6e bb 61 1f 1e 36 db b7 f0 77 69 be 7a f2 95 2c 24 40 a0 fb 2f 60 33 fe 09 4e 45 56 db fe 21 de 56 10 8c 36 54 f6 62 b5 97 33 35 c5 ef da 02 64 92 57 d7 0d e4 6a 43 d3 bf 20 77 5a f1 b3 31 05 7e 98 0d 14 82 51 9f 4b ed d7 59 01 28 f1 3e e4 ce 59 48 00 47 de 0a 1f 3c cf 01 89 37 4c 28 5e 39 99 3e 72 bb 17 98 cb 52 03 04 9b dc be 17 5c 29 72 a4 d8 fb f0 50 75 71 ba 8a de 1b 28 b6 3e 5a 82 57 22 32 b5 83 75 49 c3 ac 51 0a 1f 99 81 42 30 ea df 0f 75 55 cc 0a 40 49 c3 12 d3 d6 45 dc c2 9e [TRUNCATED] Data Ascii: 2b50_n 5iriM;r-N9gRUOMdl<_KtQkYp'4/D<PF6>P}a}v% qV)%+Jsf2B}:i4J{n"na6wiz,$@/`3NEV!V6Tb35dWjC wZ1~QKY(>YHG<7L(^9>rR\)rPuq(>ZW"2uIQB0uU@IEZ F"lH6cVJo<PK$?/&d1p"zLW?;D@?/#=H}5Y__+AfeQnN)grcX:v\|HN9qA IF`y`;0`8`cZI-5A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49734	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.896446943 CET	364	OUT	GET /css/dist/styles/base2.min.css?v=202410151713 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.199482918 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Expires: Wed, 15 Nov 2034 04:10:52 GMT Server: F-WEB Last-Modified: Tue, 15 Oct 2024 09:13:01 GMT Vary: Accept-Encoding ETag: W/"670e321d-74dc6" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i12293_c17987, i2103125_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 32 64 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd cb b2 1b 47 92 20 fa 2b 39 92 d1 4c 64 03 60 3e 90 78 9c 63 55 3d 22 25 95 d8 23 52 34 91 92 a6 e6 f6 35 58 02 48 9c 93 22 80 84 80 04 1f 82 f1 ee 66 d5 76 17 73 db ac 37 b3 9d 75 4d ef c7 6a be a6 ab 6d 7a 33 df 70 e3 99 19 0f 8f 47 26 70 58 54 d5 14 4a 3c 40 66 84 87 47 84 87 87 87 87 3f 06 87 a2 ca bf 2a f7 9b cf 97 cb 47 c7 aa 2a b7 c1 e0 30 2b e6 e4 eb 69 59 1c 76 eb ec dd 55 b1 5d 17 db bc 3f 5f 97 8b 57 d7 b7 79 71 73 5b 5d 0d 87 bb b7 d7 e4 b1 f8 60 53 6c fb 6f 8a 65 75 7b 15 0d 43 f4 bb ca df 56 fd 6c 5d dc 6c af 16 f9 b6 ca f7 d7 f4 ed 74 72 ef fd c0 d6 76 30 58 e7 ab ea b4 5a 97 59 75 85 bf 4a ed 52 20 b1 13 c6 a6 58 2e d7 f9 69 51 ae cb fd d5 a7 ab d5 ea 5a 00 b8 2a b7 15 42 73 f7 36 f8 d3 ff fc c3 ff fa e3 7f ff b7 ff fa 9f ff ed 7f fc 17 47 ff b2 b7 ac 7f 71 3c ae 11 99 46 f7 ae 67 fc eb 20 bd 77 fd 40 f8 e1 c2 71 8f a1 bb 3b ba 39 dc bc 38 ce 37 45 15 90 af 08 16 f9 52 c3 9c 3d 43 bf 39 d4 88 0e 5f cf da 74 5d e8 75 59 e5 df ee f2 7d [TRUNCATED] Data Ascii: 2d5G +9Ld`>xcU="%#R45XH"fvs7uMjmz3pG&pXTJ<@fG?G0+iYvU]?_Wyqs[]`Sloeu{CVl]ltrv0XZYuJR X.iQZ*Bs6Gq<Fg w@q;987ER=C9_t]uY}V<[_d7M:3\ca80]UB^FzDD;{sbK}_98J{JUGIQ<}1l1.vLFl_elc}2"-kx,%aNsb-yzw5`}#1#yk>dG}C\|m"Gt-]poR 9RWfj:1mHO;:qQG0
Nov 26, 2024 08:19:58.199490070 CET	83	IN	Data Raw: f2 1a c1 91 cf 0a 19 f9 51 de c8 31 1b 23 fb 42 1b b9 08 77 64 e6 0e 9d 68 6c ec d3 f7 b1 1d e9 71 5b ee 70 b3 cf f3 ed 5d b0 87 b1 df 24 8d 5d a3 3c 6e cf 1e 68 9f ba f2 87 49 ba 48 c2 b0 7d 6f 3d a8 7b ec a0 c8 71 6b fe 40 bb 7a 47 0c 62 d2 0d Data Ascii: Q1#Bwdhlq[p]$]<nhIH}o={qk@zGb
Nov 26, 2024 08:19:58.199609041 CET	1236	IN	Data Raw: 34 30 30 30 0d 0a 89 41 4c 3a 32 88 89 d7 10 4e 7c 16 c9 c4 8f f6 26 8e e9 98 d8 d7 da c4 45 ba 13 33 83 e8 44 64 53 9f be 4f ed 48 4f db 32 88 5d b1 7d 75 17 fc 61 ea 37 47 53 d7 20 4f db f3 07 d2 a5 ae ec 21 8f 92 7c b2 6c df 59 0f da 9e 3a e8 Data Ascii: 4000AL:2N\|&E3DdSOHO2]}ua7GS O!\|lY:q=wNWpE%N=_K':}SD'b.5eJWUUF][:tXF7eUk-#/e\Bl5y&\6z@2
Nov 26, 2024 08:19:58.199686050 CET	1236	IN	Data Raw: 79 14 3a 75 5f 13 e6 64 ee 56 48 ba 10 f2 8d 22 14 06 af 46 81 ac eb 59 04 9f 8f 66 f2 d3 5a dc c1 2b 7b 46 b7 1c 23 c4 fa 37 a6 91 13 de 6a fa 07 7c ea ec 57 ef 76 39 ed 4a 3d 63 f5 0c 59 a0 2d f3 75 81 0e f9 39 22 45 57 8b 4f aa 7c 03 77 e8 81 Data Ascii: y:u_dVH"FYfZ+{F#7j\|Wv9J=cY-u9"EWO\|w (\*3&~z.l/XX&0)I@XS{Lm\|Mm&_E tCAI:A?w^n%n\}El}lMv)EuMK:Wh
Nov 26, 2024 08:19:58.199692011 CET	1236	IN	Data Raw: c7 71 59 34 fd 58 2e 8b a6 1f c7 65 d1 f4 e3 b8 2c 9a 7e 1c 97 45 d3 8f e3 b2 68 fa b1 5c 16 4d 3f 8e cb a2 e9 c7 71 59 34 fd 38 2e 8b a6 ec b4 e3 29 bb dc f1 29 26 fd 55 9e 62 a6 bf 9a 53 cc aa bf cc 57 d9 71 5d 3d 2a d7 cb 93 12 fd e9 fd 00 87 Data Ascii: qY4X.e,~Eh\M?qY48.))&UbSWq]=<x_! ha/8T"+7'`/P.&[.JV!.c]AG>q5>Gh0> JU6_bHvk&($F]*R;B,
Nov 26, 2024 08:19:58.199759007 CET	1236	IN	Data Raw: 7f 80 d5 ef 5e c9 b6 81 1b aa d1 bb 87 a1 b8 2b 90 e3 86 25 96 77 0b b6 1e 19 f9 ba 79 5c 88 a4 a5 38 5c 99 d4 e3 a9 94 6c c6 0b 31 e3 b4 47 a3 0e a8 62 19 a3 55 fb 2d 5b b8 62 67 65 34 24 54 3a 23 29 4c ec 4c c4 0d 4d ce b5 e0 01 64 5b 12 10 15 Data Ascii: ^+%wy\8\l1GbU-[bge4$T:#)LLMd[ZC%/z,VOBhJn\|MD5] ^bJob,\^t ykrA/yd_Zt,"bbsLm=F&:Z-Pj5xQ&2_mqB2<_
Nov 26, 2024 08:19:58.199764967 CET	896	IN	Data Raw: 1a 3c 91 a0 81 ad f7 12 4d 60 a9 5f ef 8b ec 78 73 ad 3a a8 79 41 8e 4f 2e 16 61 aa 99 cc 22 b9 6e d2 a6 ae d2 2e 3d 55 d4 f2 50 3c 0e bc 17 94 b8 88 b8 f7 a0 cc ae f2 37 6d 57 e7 50 d5 f7 0c 53 7a ea c1 fc fb 45 be 13 5c 76 88 52 6a 89 08 b0 b9 Data Ascii: <M`_xs:yAO.a"n.=UP<7mWPSzE\vRjm\%\w!-%ZE"pT>IwKD)p.o'f50NR;\11R]\v0\|.W5HmP%_.h{g5(*iw<z.A_z(>a?R%op~n`
Nov 26, 2024 08:19:58.200227022 CET	1236	IN	Data Raw: 76 59 58 b4 f0 5a 15 eb 9c 6a 05 31 7d 4b da da 78 2a fb a3 f8 44 91 03 25 03 b9 0d 1c e2 ae d8 3e 2a 97 ef 6a f4 4e ed f5 f2 4e 98 01 29 42 6e 40 99 69 7a cb 6a cd 37 ac 0b 3d 89 83 62 1a 25 5b d0 25 ff 20 7c dd 45 b0 4e bd c3 41 99 4e 5d 3b 00 Data Ascii: vYXZj1}KxD%>jNN)Bn@izj7=b%[% \|ENAN];+<xp.:I]NiqJ5ahjPA~?o8pz?'#\|4jBVV[Mjfw+'f94I!D4X3#blDebM
Nov 26, 2024 08:19:58.200232029 CET	1236	IN	Data Raw: 63 31 82 b8 cf c5 60 b8 4c 1e 73 ce de 28 da 04 b1 4a d4 24 de cd b1 cb ee 35 f8 d4 0a 14 ff 4b c7 40 a1 fc a1 03 1b fc 2f b9 a2 73 c6 df 6f 7f 12 33 9e b9 26 8a 26 0b 52 67 a8 93 cb 14 1c a2 de 22 92 1d 6b c6 90 9f 31 c7 aa ff ae 8e 6a ca db 60 Data Ascii: c1`Ls(J$5K@/so3&&Rg"k1j`-G4.? jA7kdZ3U}<kkH>]Eshfe6yh]`M0y)nSUO5)"#P>o[*%_w!XX=kEsEs`g!}XN5<
Nov 26, 2024 08:19:58.200237036 CET	1236	IN	Data Raw: 44 a4 34 ac 3b 5f 75 58 11 3a 89 96 5b d2 52 8a 2d 5d 79 5a 22 99 91 bb 2e a6 e6 61 fb 72 93 15 eb 9e 1d 0a c0 3f 2e db 7f f8 ce dd 86 f1 a9 f6 1f 55 ca f1 fb 75 d8 e8 4e ba 19 f5 27 58 06 34 18 e0 54 b5 4f 0f 37 a2 36 5d 33 9b f2 d0 6d c0 c0 b3 Data Ascii: D4;_uX:[R-]yZ".ar?.UuN'X4TO76]3m#L{O H?RxL 8ydXW`l>=,V[$qA~fn#bo7N) ~f%YN[8`2T\M}n.B
Nov 26, 2024 08:19:58.319628000 CET	1236	IN	Data Raw: 40 ec cd b1 d4 e5 5c 80 10 45 eb 28 85 4d 4a 00 80 a4 ab 36 3b 60 58 44 23 43 c7 e2 1b 89 9b 42 2a 1b db 82 f7 f3 09 b9 14 e7 42 9d 30 fe 41 1a 8a be b8 96 d8 2d 24 fa b2 b5 37 81 c4 5c ad 49 cb 19 71 a6 86 19 36 c1 24 8a 08 31 84 b0 70 d7 d9 06 Data Ascii: @\E(MJ6;`XD#CBB0A-$7\Iq6$1pO(f7X'(Gmm4RBk/,"-^R&H[67.E.LJb9@rh\|3#YXodJQ.>.6KaQFjN
Nov 26, 2024 08:19:59.743453979 CET	367	OUT	GET /css/dist/styles/fontsIco.min.css?v=202404081140 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.153635025 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:04 GMT Server: F-WEB Last-Modified: Mon, 08 Apr 2024 03:40:40 GMT Vary: Accept-Encoding ETag: W/"66136738-17d12" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC143_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC226_dx-lt-yd-jiangsu-huaian-8-cache-11, BC202_lt-obgp-fujian-xiamen-33-cache-2, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 32 37 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd dd 0d 6f 5b d9 81 de f1 af 92 4e 81 62 53 ac 13 49 b6 f5 32 41 b0 db 24 bb 40 b0 0d 36 dd 2c ba 68 8b 14 a0 25 5a 66 2d 89 1a 8a 1a cf 24 58 40 92 45 99 d4 88 1a 51 12 25 51 12 35 a4 24 52 6f 9e 19 bd 5b 9e d7 6f 94 02 e9 17 28 3d 76 3a 9e 39 bf 43 69 8c 16 28 b6 c0 76 3d ff 7b 7c 79 ff e7 dc e7 f0 21 cd fb b7 f7 d3 23 d9 5b f7 13 fd c9 3f be fa ff 0d a7 86 de 7f 3b d5 9f 1e 4e a7 47 7e f6 cd 9f 8d 65 df 1f 4a be 3d 92 ce 0c 27 86 5e fe c9 a3 64 6a f0 41 f6 ed 3b 1d 1d 3f 1b cb f4 bf 3d 9e 19 fa ab 9f f6 8f 8d fd f4 c5 7f 1c fb 75 7f fa a7 af 8e ff 49 32 9d fd 9b 5b 5d c3 83 c3 03 99 7f f7 ee cf 3b 7b bb 7e 7c 83 03 52 c9 fb a9 f7 be 7b d4 8f ee bf f8 db b3 7f f5 56 72 f8 5e 72 60 20 39 70 2b 3d 9a 1c c9 be 3f 9a 7c eb c7 7f 1d 1f 2d 9b bd ff 37 91 81 b2 99 f1 e4 b5 c7 3f 4a df 8f 0e f0 e2 bf bd f5 e3 7f fd db ff ab 17 70 24 f9 e8 ef db 5f c3 3b 7d 3f be d9 21 df bb 8a ad e3 6e 76 11 35 de 77 af e3 eb 43 e9 32 6a 84 ef 5d c9 d7 87 f8 7f 75 21 7f 3d 32 [TRUNCATED] Data Ascii: 278o[NbSI2A$@6,h%Zf-$X@EQ%Q5$Ro[o(=v:9Ci(v={\|y!#[?;NG~eJ='^djA;?=uI2[];{~\|R{Vr^r` 9p+=?\|-7?Jp$_;}?!nv5wC2j]u!=2\s5{:~%m\|KA{]_/r]=.(16Zz?Ho7%Glb$0x&yk,Fc\|7I}g_}:Jc6.soF3I`F;M$F^8x9
Nov 26, 2024 08:20:00.223819971 CET	369	OUT	GET /css/comm/video.js/video-js.min.css?v=202307101206 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.634576082 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:20:59 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:43 GMT Vary: Accept-Encoding ETag: W/"6084db97-a805" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC144_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC77_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC198_lt-obgp-fujian-xiamen-33-cache-1, i1872280_c17483 X-Cache: HIT from i1872280_c17483(cloudsvr) Data Raw: 32 37 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 69 93 da ca 96 e0 5f f1 bc 8e 8e be 1e 5c 16 02 b1 d9 d1 3d 9d 5a 11 20 40 80 00 31 33 1f 84 76 d0 02 5a 10 c8 e1 ff 3e 99 62 13 20 aa ca 76 dd 17 3d 13 53 f7 56 81 72 39 79 f2 e4 d9 33 53 fe ba b3 35 dd 7f 59 85 9f be ee 56 e1 cb d2 36 5f 36 8e 72 78 59 c6 51 e4 7b df 96 ba e1 07 fa 97 af b7 ad 54 df 8b 02 df 79 52 eb fa 9a e2 bc 68 b6 e2 f8 e6 97 87 92 c7 36 19 38 dd 8b 7e 6c fc d0 8e 6c 38 aa b2 0c 7d 27 8e f4 ef 91 bf f9 56 fe ee e8 46 04 3f 12 5b 8b ac 6f 78 b9 fc af df 2d dd 36 ad 28 fb fe f3 eb 9f cf e0 47 a4 ef a3 17 c5 b1 4d ef 9b 0a 31 d1 83 9f ff 69 c0 16 2f 86 a2 ea 3f 4e df 5c db 39 7c 9b 22 28 9d f1 f7 30 50 bf c5 81 f3 d7 d7 af 18 aa c6 2a 5f cb 5f cb d8 a9 f6 ab ee 47 ff e3 5f 6c dd b0 f7 9f 3f 41 f8 ae 12 fd f5 0f 58 f6 8f cf ef 05 ab 29 91 f2 4d d9 6c 1c 5b 55 10 45 b2 41 5e 12 df 30 be ab 96 12 84 7a f4 ef 71 64 bc 34 bf 2f 95 50 af 13 5f b4 72 8b 1b 99 80 04 d9 4f 8d 00 c0 cf be b1 ae 09 80 08 5e f9 21 87 d2 a1 79 40 df 5a e8 0f [TRUNCATED] Data Ascii: 275}i_\=Z @13vZ>b v=SVr9y3S5YV6_6rxYQ{TyRh68~ll8}'VF?[ox-6(GM1i/?N\9\|"(0P__G_l?AX)Ml[UEA^0zqd4/P_rO^!y@ZM`ur9dR`$UYTzJn_k0BBb:>Te7USKC#0d-/p`.nmd kK"xjhn)dQ:qb=U[+zQD`m%FeEa`@[0I6E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49739	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.896825075 CET	358	OUT	GET /css/dist/module.min.css?v=202410281356 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.199981928 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Expires: Thu, 16 Nov 2034 07:54:36 GMT Server: F-WEB Last-Modified: Mon, 28 Oct 2024 05:56:29 GMT Vary: Accept-Encoding ETag: W/"671f278d-1d0b3" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i33513_c25891, i2103121_c25795, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 38 38 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 8e e3 ca 91 e0 af 70 7c d0 40 97 2d ea f0 aa 4b 09 f6 cc fa 78 8c f5 c2 c6 1c c0 67 d7 33 3b 6b 08 94 44 55 f1 b4 24 ca 14 55 dd d5 42 f9 cd 4f fb 64 2c b0 2f fe 07 cf be 0f ec af 59 2f e6 fc c5 e6 8d 64 5e 22 93 49 8a ea 6a 63 06 65 9f ae 22 33 23 83 91 91 91 91 91 71 19 6f f3 62 bf 3c a5 bb 74 5d a6 9b 6f f2 7c f7 cf 9b a4 4c dc 27 d7 4f 66 b3 60 b5 d9 fe fa 72 cc 4f 59 99 e5 87 fb 64 75 ca 77 e7 32 5d bc cf 36 e5 e3 bd ef 4d 8e 1f 5e c6 0a 04 67 bc 2d d2 74 69 01 b9 05 ce 17 5b b7 44 ff 7e f3 7c 4c 75 7d e3 b0 15 85 0a c4 af 8a e4 a8 45 c1 f7 74 70 dc f7 a8 9f bb ce 9f d2 42 ed bd ca cb 32 df df bb 08 8b c5 63 9a 3d 3c 96 f7 01 82 b4 d0 92 2c f0 de 2c 3e ba d9 61 93 7e 40 df ed 79 a6 31 b3 32 dd b7 d0 0c f5 44 ad 30 08 87 02 c2 7d c6 f8 3f 4b 7f 89 81 38 e3 53 99 14 97 5d 76 48 5d 86 20 1a 16 61 88 3e a7 cc d6 c9 ce 4d 76 d9 c3 e1 be cc 8f 22 b4 c7 bc c8 3e e6 87 32 d9 2d 77 c9 73 7e 2e b5 03 94 59 b9 4b d5 11 34 c8 39 b4 73 91 6c b2 7c bc 46 [TRUNCATED] Data Ascii: 88a}p\|@-Kxg3;kDU$UBOd,/Y/d^"Ijce"3#qob<t]o\|L'Of`rOYduw2]6M^g-ti[D~\|Lu}EtpB2c=<,,>a~@y12D0}?K8S]vH] a>Mv">2-ws~.YK49sl\|FO>F\"W!;t[{cd2@?v'=86`}e?#MZ')@M.;\|n+vD\|>?Bf}R+Px.#CZxV`Ez6w/i`UV~MvJVtS}!/Q]>,c~E\*Iv]14<5[\|)]J2VoZ)
Nov 26, 2024 08:19:58.199994087 CET	1236	IN	Data Raw: d9 35 fb c1 2e 59 a5 3b 60 7e cd 92 68 fd 98 ae df a1 a5 d8 47 18 55 7d 7b ca a3 aa bb 33 ae 7e bb 5a 2a 01 20 07 97 4d c3 0a 26 0d c6 fd c5 93 0e 20 27 a4 aa 17 56 72 0a 80 37 ac 84 6a 06 18 40 48 85 b7 13 52 e1 55 42 4a c7 ec 57 8a aa f0 6a 51 Data Ascii: 5.Y;`~hGU}{3~Z* M& 'Vr7j@HRUBJWjQ.Vi%\|Q`ZZ,&=+#]426Yj'Hw.Qvy#"p X\"{Gs?:ac63fdh@Sf
Nov 26, 2024 08:19:58.200006008 CET	1236	IN	Data Raw: 0f 11 1f 65 07 58 0d 49 13 fc 23 c9 37 aa 50 80 84 90 95 6e 75 52 8d 0a e5 e7 4e 21 f1 d1 ea 01 a0 58 3c 9b 46 ca 8e 40 29 56 9d ec 40 99 5b 1f c2 0a 74 78 64 e2 6a b7 73 c6 d1 c9 59 9f 57 d9 da 5d a5 1f b3 b4 78 3b f6 66 a3 f1 2c 18 8d fd e9 08 Data Ascii: eXI#7PnuRN!X<F@)V@[txdjsYW]x;f,iwSR'sKnxG:c/5mX)Znd5q@.aVem7Q2n,6^X'D!-zc"i__c?k\|l_ec^el
Nov 26, 2024 08:19:58.200012922 CET	1236	IN	Data Raw: 58 b8 1f 16 ba a9 d2 a3 51 74 43 83 88 00 10 0b f2 c9 3d c9 11 68 d6 09 7d b5 d7 bf d2 2f 23 cd 48 61 a7 f9 7f 4e 71 38 d3 6d 58 20 ec c4 02 0c 93 de 5c b0 4d 36 c1 4a 8f 49 d1 19 93 db 30 42 a4 67 84 48 cf 08 91 86 11 4c 1f 1d 77 62 84 d5 ee 9c Data Ascii: XQtC=h}/#HaNq8mX \M6JI0BgHLwbNl@q[=EG<n=L,0YN,P6<0L0)"r.`ow#RioNL@#a~7c!L_FqG)1`RtF`}ktD
Nov 26, 2024 08:19:58.200182915 CET	1236	IN	Data Raw: c1 41 31 32 4c b2 49 8a f9 b1 02 6b 2b 53 cd 22 57 fb 48 f6 73 3a 34 d9 4e 04 04 ed b3 cd 7b bd a0 50 fe 14 cd 58 81 52 eb c0 8c 23 9d 8a 96 04 c0 1a 23 86 04 88 8f 79 f4 66 d3 79 5b c4 0e 14 5e c3 4b 04 ad 46 8c a8 75 5e ae cf 27 f4 3b 3a 69 27 Data Ascii: A12LIk+S"WHs:4N{PXR##yfy[^KFu^';:i'qfx4}p?mAep=Wh]p6+N~v`1i`P&~F=6mIje0m_fkxV#EihBO#wn=VV.3QN
Nov 26, 2024 08:19:58.200189114 CET	1236	IN	Data Raw: 9a 27 07 9c 6b 57 6d 4e a6 6b 0e 37 1f 01 cf ee 1f 31 63 5f ae 0a 57 69 a0 e2 7f 25 bc 2c ca a5 93 7d 8e 20 1e 83 19 f9 ea 0a 9f 6c a3 f7 c4 cf 5b ef f2 53 4a 46 85 87 12 e4 4c 60 4a fa 17 cc 58 aa f9 90 8b 79 c5 bf 6e b3 dd 8e 7c 0e 96 39 39 11 Data Ascii: 'kWmNk71c_Wi%,} l[SJFL`JXyn\|99_}r\`C(xoUG>jt"4C:1TXVM/}5~\|kwZl-O$bdz2u?n3V^MO(;Da<Bv2;@5'+watEfA9
Nov 26, 2024 08:19:58.200200081 CET	776	IN	Data Raw: a2 9a af b5 80 29 3e f8 37 25 c2 8b 17 b5 da 21 24 eb 2c a4 55 09 b2 d3 16 11 d7 a5 0b bb 59 57 27 74 00 c9 d6 0b 55 67 12 4e 95 b5 92 b4 c9 9e 32 bc 99 2e 89 3b 8c 18 eb 07 37 72 dd 6a 01 c0 87 57 cd f2 d0 01 6b ac 30 f2 2c 93 0f cd d6 e5 b9 a0 Data Ascii: )>7%!$,UYW'tUgN2.;7rjWk0,MGU65x$x\KJvRF~sU$pGU1CNs7}'aOE\|@49.s0~zm~55j@>
Nov 26, 2024 08:19:58.200205088 CET	1236	IN	Data Raw: 8e 04 a5 fa 20 6e 68 b5 03 8d e6 03 68 90 5d 5d bc a7 25 e5 87 27 77 70 e8 df ab 07 e9 d6 0e 6a c5 d5 cd a8 f9 8d 2b 79 48 3f 7d d2 96 a6 9e 2c 68 10 09 92 09 98 1f c4 94 54 23 34 15 47 24 a2 0c 9d 42 9c 71 76 20 2e ae d4 a3 4f 9b e9 80 89 3e 4c Data Ascii: nhh]]%'wpj+yH?},hT#4G$Bqv .O>LC7s]x%P1;.`-~'@&}F\|gs$JZSr.BCsUT<{vLv/4 /$`Js>2s\|"O\|G)E;9D%p/c
Nov 26, 2024 08:19:58.200210094 CET	1236	IN	Data Raw: 82 6a a1 de 4b fc ce 1b 16 3c 65 9a ad 8e 88 12 7b 1b 27 9c ef 04 9a 34 d4 63 1b 90 02 49 0f a5 99 53 3e ad 07 2c 9c ac 8d 43 17 c3 f0 3d ad 4d c0 f6 2b 5e 6f e9 94 ee 21 86 b4 d7 d5 af 1f ad af 8a 6f cc 03 47 6f f8 1d 6f 58 94 61 ed 9e 55 96 82 Data Ascii: jK<e{'4cIS>,C=M+^o!oGooXaUCY6#v$p]COLy:.6R%[3^qvu+'hwpEV_}w>?mtGE4_Tt7Xi9>Q%P:
Nov 26, 2024 08:19:58.200215101 CET	1236	IN	Data Raw: 60 1d 34 3a 9c 26 0b d3 19 2f e6 8e f1 ca 33 b8 16 a0 24 75 5a cb 0e 99 31 ae ea 51 c9 31 43 7c c5 59 a1 96 2c 5b 26 17 31 d1 1b b7 5d be f4 5b 4a 70 55 77 fe 70 3d d3 9a 5d 67 a0 b2 ac 4d 80 07 70 bf 88 ab 50 84 88 ef a9 5c 63 81 e5 21 2b 88 1a Data Ascii: `4:&/3$uZ1Q1C\|Y,[&1][JpUwp=]gMpP\c!+P8\o-Q*Up8D6d k%sm,&{Jt+NWPT.q:>Nfeuinxq7taI!obWo9")+\|=QGjC\|@
Nov 26, 2024 08:19:58.320075035 CET	1236	IN	Data Raw: d0 4c 12 6e 18 b4 72 d0 e6 1f 7e 8b f8 2a db 3e bb 95 99 5b e2 ea fe c7 7a ba 60 b3 c3 63 5a 64 a5 fe 6b d1 c1 62 8d a7 35 3b bc 53 3e bc 9a 56 e9 fb d9 63 99 0c dc 63 c1 c8 46 52 86 4b c3 73 c5 05 9b 37 18 fd 91 a1 e5 7a 99 ee 8f e5 f3 32 3f 22 Data Ascii: Lnr~*>[z`cZdkb5;S>VccFRKs7z2?"]w1S=._(.bU&HcO(P&>J?fiva`9Nv19<d]Gl\C!{OKECkxnk'D?d54fx
Nov 26, 2024 08:19:59.759584904 CET	453	OUT	GET /image/locater/national_text.png?v=202410141113 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.170229912 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: image/png Content-Length: 15879 Connection: keep-alive Expires: Sat, 14 Oct 2034 07:11:32 GMT Server: F-WEB Last-Modified: Mon, 14 Oct 2024 03:13:25 GMT ETag: "670c8c55-3e07" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC142_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC227_dx-obgp-guangdong-dongguan-22-cache-1, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f1 00 00 01 5c 08 06 00 00 00 19 3e 58 8d 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 81 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 [TRUNCATED] Data Ascii: PNGIHDR\>XtEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C22A46CA440A11EFB9D3B9225EEAF4C1" xmpMM:DocumentID="xmp.did:5997F33E852111EFB840B
Nov 26, 2024 08:20:00.268178940 CET	441	OUT	GET /image/site/left.png?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.678541899 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: image/png Content-Length: 1613 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:13:49 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:47 GMT ETag: "6084db9b-64d" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC174_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC202_lt-obgp-fujian-xiamen-33-cache-2, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 47 00 00 00 47 08 06 00 00 00 55 b0 5a 1f 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 21 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRGGUZtEXtSoftwareAdobe ImageReadyqe<!iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:C05A2478C5F011E390AA8612195784C7" xmpMM:DocumentID="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49738	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.896879911 CET	369	OUT	GET /css/dist/styles/themeMixin.min.css?v=202402221530 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.191891909 CET	845	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: text/css Content-Length: 295 Connection: keep-alive Expires: Mon, 13 Nov 2034 04:20:11 GMT Server: F-WEB Last-Modified: Sat, 28 Oct 2023 03:49:09 GMT ETag: "653c84b5-127" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i34700_c4672, i2103125_c25795, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 2e 6d 73 67 53 75 62 6d 69 74 20 2e 6d 73 67 53 41 64 64 20 2e 6d 73 67 41 64 64 42 75 74 74 6f 6e 5f 4e 20 2e 6d 5f 69 62 75 74 74 6f 6e 2e 6e 6f 74 2d 61 6c 6c 6f 77 65 64 7b 6f 70 61 63 69 74 79 3a 2e 35 7d 2e 6d 73 67 53 75 62 6d 69 74 20 2e 6d 73 67 53 41 64 64 20 2e 6d 73 67 41 64 64 42 75 74 74 6f 6e 5f 4e 20 2e 6d 5f 69 62 75 74 74 6f 6e 2e 6e 6f 74 2d 61 6c 6c 6f 77 65 64 20 2e 6d 69 64 64 6c 65 7b 63 75 72 73 6f 72 3a 6e 6f 74 2d 61 6c 6c 6f 77 65 64 7d 2e 6d 73 67 42 6f 61 72 64 20 2e 6d 73 67 41 64 64 20 2e 6d 73 67 41 64 64 42 75 74 74 6f 6e 20 2e 67 5f 69 62 75 74 74 6f 6e 2e 6e 6f 74 2d 61 6c 6c 6f 77 65 64 2c 2e 6e 65 77 73 44 65 74 61 69 6c 56 32 20 23 6e 65 77 73 43 6f 6d 6d 65 6e 74 57 72 61 70 20 2e 73 75 62 6d 69 74 42 74 6e 2e 6e 6f 74 2d 61 6c 6c 6f 77 65 64 7b 63 75 72 73 6f 72 3a 6e 6f 74 2d 61 6c 6c 6f 77 65 64 3b 6f 70 61 63 69 74 79 3a 2e 35 7d Data Ascii: .msgSubmit .msgSAdd .msgAddButton_N .m_ibutton.not-allowed{opacity:.5}.msgSubmit .msgSAdd .msgAddButton_N .m_ibutton.not-allowed .middle{cursor:not-allowed}.msgBoard .msgAdd .msgAddButton .g_ibutton.not-allowed,.newsDetailV2 #newsCommentWrap .submitBtn.not-allowed{cursor:not-allowed;opacity:.5}
Nov 26, 2024 08:20:00.268245935 CET	442	OUT	GET /image/site/right.png?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.675117970 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: image/png Content-Length: 1633 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:13:49 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:47 GMT ETag: "6084db9b-661" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC143_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC203_lt-obgp-fujian-xiamen-33-cache-2, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 47 00 00 00 47 08 06 00 00 00 55 b0 5a 1f 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 21 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRGGUZtEXtSoftwareAdobe ImageReadyqe<!iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:41DEBE66001A11E494DCE9E6A4A189DB" xmpMM:InstanceID="xmp.iid:41DEBE65001A11E494DCE9E6A4A189DB" xmp
Nov 26, 2024 08:20:00.675168991 CET	1002	IN	Data Raw: 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 28 57 69 6e 64 6f 77 73 29 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 Data Ascii: :CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:66397EC4FC3A11E39614E69FBAB86579" stRef:documentID="xmp.did:66397EC5FC3A11E39614E69FBAB86579"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=
Nov 26, 2024 08:20:45.679904938 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49737	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.896919012 CET	376	OUT	GET /css/dist/styles/newSearchBoxStyle.min.css?v=202404081140 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.153949022 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Expires: Thu, 02 Nov 2034 03:15:32 GMT Server: F-WEB Last-Modified: Mon, 08 Apr 2024 03:40:40 GMT Vary: Accept-Encoding ETag: W/"66136738-5468" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i33513_c25891, i2103121_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 62 30 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b5 5c 6b 8e e3 b8 11 be 8a 83 c1 02 d3 81 d5 a3 b7 64 1b 41 90 09 32 c0 60 37 c0 62 1b c1 fe 5c a8 6d d9 16 5a 96 0c 49 fd 5a a3 7f e6 00 f9 9d 3b ec 1e 20 48 6e 13 20 7b 8b 90 12 65 eb 51 24 8b 94 1b 8d 69 f4 48 62 f1 63 b1 ea ab 62 91 d2 ed f6 c1 c8 e2 e7 bb 38 2a d6 fb cf f9 cb e9 3e 2f 36 71 b1 cc f2 2c 5e 6d d3 3c aa 96 69 bc ad 56 db 3c ab 8c 32 f9 39 5e 9a ab 7d 9c ec f6 d5 d2 35 8f 2f ab fc 29 2e c8 63 cf cb 7d b2 d9 c4 d9 db ed 40 de 6c 93 3c 9d 36 49 79 4c a3 d7 65 92 a5 49 16 1b f7 69 be 7e 58 fd be 7f 75 d4 f2 cf a4 c7 88 dc 28 4e 1d 18 ac 6b c7 1f 77 bd 3a e6 65 52 25 79 b6 2c e2 34 aa 92 a7 78 f5 9c 6c aa fd d2 a6 4f f7 c5 df c5 69 bc ae e6 c0 b5 1f 8b e8 78 ea 0e b6 46 cc ba 35 f9 20 67 bd 3b 5f b3 e3 63 75 ba 8f d6 0f bb 22 7f cc 36 8d 3a bb aa 5d e7 69 5e 2c 3f f8 be 3f d2 f2 36 3a 24 e9 eb f2 bf ff f9 e5 7f ff fe f5 b7 7f fe fd b7 7f fd a3 a3 7e cb 25 43 67 78 2c d3 fc 66 95 3f 56 14 63 23 f6 18 6d 36 49 b6 5b 9a 33 fa 53 3f db 28 81 3e [TRUNCATED] Data Ascii: b0a\kdA2`7b\mZIZ; Hn {eQ$iHbcb8>/6q,^m<iV<29^}5/).c}@l<6IyLeIi~Xu(Nkw:eR%y,4xlOixF5 g;_cu"6:]i^,??6:$~%Cgx,f?Vc#m6I[3S?(>~42_L:)_j"CsW\dT80N4]"Z7?132QaSm?WYFqEizEI>IV3sM'URQ:6i`ul8cMyVEWir\RupGHJQ6_Q4\|ylf2>s9}@#./85P)r[CH{%BZqJLJ
Nov 26, 2024 08:19:58.153985977 CET	1236	IN	Data Raw: 94 30 d6 91 8a 1b 53 a2 7b a2 e9 c7 2a 96 74 19 d2 2e 77 3f 11 9b 8b d2 d8 32 1d 67 a6 a0 a4 de 70 4d ac a4 bb 7d fe 3c 90 f6 6d fc 5a 0b 04 dc 78 24 71 f3 9a 91 78 b3 6e a4 ca 50 99 2b 98 19 c4 03 bc 5c fc 7a d8 11 13 ae aa fc 40 44 0d 2c 14 4c Data Ascii: 0S{*t.w?2gpM}<mZx$qxnP+\z@D,LHAYFU>#_GzFe6Il\Uf&!cj\\.f:OGaV_a(H'"yc~]t3clvL-nfaY>,7G<qBXe
Nov 26, 2024 08:19:58.153992891 CET	952	IN	Data Raw: 69 4e ce 9d 8f 77 c2 24 e0 8a 49 40 54 2c e8 1d d0 1b eb 80 ab 46 0e 85 b7 67 29 6d fa d3 39 71 e6 60 77 f6 5c a5 1d 61 59 cb 93 b4 64 aa 86 6b 02 83 b9 88 f5 7d a8 cd 60 ee f5 19 cc 45 c6 77 19 83 b9 f8 fd c2 2b 4d 27 0e 91 2e a7 a2 27 52 9d 53 Data Ascii: iNw$I@T,Fg)m9q`w\aYdk}`Ew+M'.'RS+sjTSS}XSU{>SzvTp^kSOTqbM)UCQGQ?Rik)=J/Pkz\ OM,YJN/lV-&w{1E.[
Nov 26, 2024 08:20:00.793993950 CET	450	OUT	GET /image/loading/loading_2b.gif?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://2.ss.508sys.com/css/dist/styles/base2.min.css?v=202410151713 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:01.195163965 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: image/gif Content-Length: 15551 Connection: keep-alive Expires: Sat, 04 Nov 2034 04:18:47 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:44 GMT ETag: "6084db98-3cbf" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i12301_c17987, i2103125_c25795, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 47 49 46 38 39 61 20 00 20 00 e6 76 00 fe fe fe fd fd fd fc fc fc fb fb fb fa fa fa f9 f9 f9 f7 f7 f7 f5 f5 f5 f8 f8 f8 f2 f2 f2 f3 f3 f3 f6 f6 f6 f4 f4 f4 f0 f0 f0 ef ef ef f1 f1 f1 8b 8b 8b 8d 8d 8d ed ed ed 8c 8c 8c 8e 8e 8e e7 e7 e7 ee ee ee 90 90 90 ec ec ec ea ea ea e9 e9 e9 91 91 91 e1 e1 e1 eb eb eb 8f 8f 8f 95 95 95 92 92 92 d9 d9 d9 97 97 97 db db db e4 e4 e4 d8 d8 d8 e3 e3 e3 e8 e8 e8 de de de dc dc dc 93 93 93 e6 e6 e6 94 94 94 e0 e0 e0 c1 c1 c1 c4 c4 c4 96 96 96 da da da ce ce ce d5 d5 d5 df df df e2 e2 e2 e5 e5 e5 be be be a2 a2 a2 a0 a0 a0 b2 b2 b2 9b 9b 9b d7 d7 d7 99 99 99 d2 d2 d2 d0 d0 d0 dd dd dd 98 98 98 b4 b4 b4 d4 d4 d4 a5 a5 a5 9c 9c 9c 9a 9a 9a ba ba ba 9e 9e 9e b8 b8 b8 c9 c9 c9 bc bc bc ca ca ca a8 a8 a8 cb cb cb cd cd cd c7 c7 c7 d3 d3 d3 c8 c8 c8 c3 c3 c3 ae ae ae 9d 9d 9d 9f 9f 9f bb bb bb c2 c2 c2 aa aa aa ac ac ac d1 d1 d1 b9 b9 b9 a6 a6 a6 c6 c6 c6 cc cc cc a7 a7 a7 cf cf cf bf bf bf c0 c0 c0 af af af a4 a4 a4 ab ab ab a3 a3 a3 b6 b6 b6 b7 b7 b7 ad ad ad b1 b1 b1 bd [TRUNCATED] Data Ascii: GIF89a v!NETSCAPE2.0!XMP DataXMP<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:
Nov 26, 2024 08:20:01.195230961 CET	1236	IN	Data Raw: 61 62 6f 75 74 3d 22 22 20 78 6d 6c 6e 73 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 52 65 66 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 Data Ascii: about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:bb7d30ad-7ace-ef4d-b5e2-f3c10caebc0b" xmpMM:Document
Nov 26, 2024 08:20:01.195244074 CET	1236	IN	Data Raw: fb c0 00 2a bb b5 a8 a1 c2 e4 6d 85 14 40 50 08 6f 51 ed 8b 72 2a 64 dc ac 49 41 55 42 88 18 23 a0 a3 e8 20 48 01 19 ec da 75 b4 69 71 53 02 8f 12 df c3 03 39 2c 28 4a f6 35 3a 84 b4 49 f3 c3 25 25 04 1c 0c 31 c3 7b f1 61 40 88 00 37 e0 a7 1f 1a Data Ascii: m@PoQrdIAUB# HuiqS9,(J5:I%%1{a@7IqQH`@K0/@O8B\F^.LR0al18DE/$1b<$,hd4^@Whb?JaPA' _J)_QiBRC A9!v,
Nov 26, 2024 08:20:01.195257902 CET	1236	IN	Data Raw: 48 cc 50 c3 44 f7 ef 27 a4 0f 0a e0 c4 fc 94 38 50 a4 38 41 e1 80 b6 1d 02 0a 9c 80 02 0d 2d b4 f7 5e 07 92 2c e0 05 16 f7 79 21 85 12 4e 3c 11 c6 16 51 cc c0 43 08 23 00 81 42 0b 1c 18 18 d9 24 0a 48 81 5e 7e 4c 7c 21 c3 84 15 5e 18 43 0a 40 10 Data Ascii: HPD'8P8A-^,y!N<QC#B$H^~L\|!^C@b@BhZXB(LD(Q&,`AV ?1AYPCr!G4@H!v, vv)XjH"0;ol!XH=A",* ,GNVE;.:VUF0
Nov 26, 2024 08:20:01.195271015 CET	1236	IN	Data Raw: 82 88 0e 4a 40 d0 24 a4 fd 60 21 86 30 8e c0 21 0d 34 82 88 a3 05 85 79 b4 42 2c 14 2e 66 18 82 90 28 10 59 83 09 36 dc a8 80 59 36 f0 e0 24 94 34 78 48 65 3b 86 3d 70 02 07 28 00 41 43 0d 15 48 70 40 4d 93 04 02 00 21 f9 04 05 03 00 76 00 2c 00 Data Ascii: J@$`!0!4yB,.f(Y6Y6$4xHe;=p(ACHp@M!v, v4^B]VHgdX)R`89E;F="0F7?MDg8pA,0/\M`De=** ]vsYo`]p9H0 FBZfY,A7TjoM]].(#I"*8"p;3oj?"t
Nov 26, 2024 08:20:01.195310116 CET	1236	IN	Data Raw: 03 0c b4 47 4b 20 00 21 f9 04 05 03 00 76 00 2c 00 00 00 00 20 00 20 00 00 07 ff 80 76 82 83 84 76 26 32 37 6b 66 6f 54 49 52 34 03 85 92 93 0c 3f 73 64 6a 5a 59 6f 60 5d 65 67 38 65 71 0f 93 93 01 25 68 3a 6b 64 54 9a 9c 9e 67 70 39 56 39 4c a5 Data Ascii: GK !v, vv&27kfoTIR4?sdjZYo`]eg8eq%h:kdTgp9V9LqhBskn`De8pVHUETbIimB:jD;F8.G\IhmU==9JKWiBN54cp$7f'-A ^2fa+(nC`44I(J,T., D%N
Nov 26, 2024 08:20:01.195332050 CET	1236	IN	Data Raw: 66 54 4c 0a 93 92 40 63 4b 57 5c 49 9a 9c 64 6a 5a 59 6f 4d 4d 61 a5 83 06 4f 63 37 6c 57 47 ac 9b 9d 6a 66 59 4d 60 5d 44 6d 09 b7 52 58 2e 62 37 4b bf ad 6e 54 c3 b3 c8 65 67 59 12 92 06 4e 2f 53 58 63 62 bd 98 6d 3a d5 b1 c6 44 da 38 70 4d 92 Data Ascii: fTL@cKW\IdjZYoMMaOc7lWGjfYM`]DmRX.b7KnTegYN/SXcbm:D8pM>P^77[+5^o]aB&HE~yGI&\|aD8&nE<'9(";v`.IN#FzT0a~-T$i AReS* Q "`Cp;_UJ
Nov 26, 2024 08:20:01.195348978 CET	1236	IN	Data Raw: ba 50 25 1a 06 76 02 0c 36 5f e6 90 69 f7 a6 49 93 34 85 4e 44 f1 41 cf 5e 0c 7e 92 18 48 d1 62 a6 20 98 2e 5d c2 10 92 33 64 21 bd 30 27 6c 09 2a 91 a5 c9 45 22 65 ba 24 10 54 41 8e 9c 19 1d 7d 68 10 39 88 47 17 22 28 cf 9c f1 22 28 46 09 1e 3c Data Ascii: P%v6_iI4NDA^~Hb .]3d!0'lE"e$TA}h9G"("(F<^IhJ38p!b'A!JH%ZR89r0k$I6X;-ERExx+HAEpav(V\5"@lG#0N6RPqbE' c>ACo`
Nov 26, 2024 08:20:01.203603983 CET	1236	IN	Data Raw: 88 83 5b 82 68 70 41 c3 71 ce 1c 21 0c 04 39 b0 11 72 64 8b 06 28 07 01 69 a9 63 cd 9a 30 76 00 54 58 61 83 a6 09 0c 39 09 7d e9 e9 c6 0d 19 1d 76 0c 9c a8 30 74 c5 0a 01 49 07 19 d0 41 86 0c 95 af 26 12 68 d0 70 62 2a ce ac 83 9c 50 51 a3 46 8b Data Ascii: [hpAq!9rd(ic0vTXa9}v0tIA&hpbPQF'2A$k:pW,q#:5<92Gs0oM02DRD2e@608@VrN+\|&HV^`\|Jb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49736	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.896965981 CET	368	OUT	GET /css/dist/styles/floatBtn1.min.css?v=202402221530 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.199270010 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:15:29 GMT Server: F-WEB Last-Modified: Thu, 22 Feb 2024 07:30:21 GMT Vary: Accept-Encoding ETag: W/"65d6f80d-21bc" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC174_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC197_lt-obgp-fujian-xiamen-33-cache-1, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 35 35 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dd 59 6d 6f db 36 10 fe 2b 06 fa 25 01 64 87 a2 28 c9 96 50 0c eb b0 62 fb 50 ac c0 06 0c fb 54 50 14 19 73 91 45 43 92 f3 b2 20 ff bd a4 25 d9 8e 4d 8a 4c ac b4 e8 72 41 22 4a f7 dc 99 f7 f0 78 47 79 86 b3 fa a3 a8 56 f5 64 c6 e4 bf 3f 9b 87 82 ce 7d cf 38 68 d5 fe ae f0 fa 51 dc d2 8a 15 e2 2e b9 e5 35 cf 0a fa b4 7d f4 dc d0 6c 25 f2 4d 41 3f e3 a6 a1 55 f9 b8 c2 d5 35 2f 13 90 9e 62 ef 68 f6 8b 28 1b cc 4b 5a fd 85 e5 2d 69 a7 10 b8 f9 d0 94 1f c4 fd 64 b6 e2 79 5e d0 9d 85 09 de 34 a2 f5 f8 4c f1 91 49 23 53 86 57 bc 78 48 3e 71 52 89 5a b0 66 f2 0f fe 8d f2 74 fb ac e6 ff d1 04 46 eb fb b4 90 be a6 4b ca af 97 4d 12 42 79 43 3f 23 fd 07 21 9b aa 16 55 b2 16 bc 94 53 4b 73 5e af 0b fc 90 64 85 20 37 7b 43 4b a9 4c cb 74 2d 6a de 70 51 26 15 2d 70 c3 6f 69 da d0 fb 66 8a 0b 7e 5d 26 84 6e 2d 4c 65 04 6e 78 33 dd 3e c9 29 11 15 de 42 4a 51 76 ea da 9b 3b 57 b4 28 f8 ba e6 75 7a b7 e4 0d 9d d6 6b 4c a8 d4 bb 93 54 69 e7 c1 0a 79 f5 87 d4 e2 cd c3 23 e3 [TRUNCATED] Data Ascii: 55cYmo6+%d(PbPTPsEC %MLrA"JxGyVd?}8hQ.5}l%MA?U5/bh(KZ-idy^4LI#SWxH>qRZftFKMByC?#!USKs^d 7{CKLt-jpQ&-poif~]&n-Lenx3>)BJQv;W(uzkLTiy#.K\|!e]&_xd\WbS;mOM9$CD2ciF.*Z_[_9@9[6!}(\|z<D(AF\|H;HpH0 yG\|~s%;w?~^"tU\b.xfZk-()62m<x8zcy.v5skB{R9
Nov 26, 2024 08:19:58.199343920 CET	784	IN	Data Raw: 72 df 8a 5c ab ad 58 76 27 17 ca 30 ae bc 82 ca 56 aa 11 eb f6 22 13 4d 23 56 1e ab c4 ea e2 1d a3 b1 3f 0f 2f bd 46 c8 6b 16 66 73 ff f2 32 3d 30 d9 5a d8 5b ec 00 5e af 9c 4e 25 bd d3 97 00 da 6a 91 f8 eb fb 49 2d 0a 9e 4f e4 93 05 c0 20 3d 2a Data Ascii: r\Xv'0V"M#V?/Fkfs2=0Z[^N%jI-O =#B"m%e&2LeC>vS]g"w8k~?}!Alxc)sFiG`3s?g&+i!%0Wp&+VbS+4Qb
Nov 26, 2024 08:20:00.224208117 CET	364	OUT	GET /css/dist/styles/video.min.css?v=202407231110 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.634792089 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:20:59 GMT Server: F-WEB Last-Modified: Tue, 23 Jul 2024 03:10:31 GMT Vary: Accept-Encoding ETag: W/"669f1f27-1d57" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC63_dx-lt-yd-shandong-jinan-24-cache-3, BC233_dx-lt-yd-jiangsu-huaian-8-cache-11, BC201_lt-obgp-fujian-xiamen-33-cache-2, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 36 36 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b5 59 db 8a e3 36 18 7e 15 37 cb c2 0e c4 1e d9 39 4d 6c 96 b6 b0 94 d2 ab 85 85 de 94 32 c8 b6 9c 68 47 b6 8c ac 78 32 1b 02 3d d0 a7 d9 3e 42 0f 6f d4 67 a8 e4 43 2c 1f e3 4c 76 92 8b c4 d2 af ff f0 e9 3f 49 36 52 ec 23 aa 7f 4c 34 23 fd 98 e8 2e de e8 31 81 4f ba bb e3 9c 46 87 80 46 5c 4f f0 27 64 83 a3 31 48 6a bb 28 a0 0c 1d 5c e8 3d 6c 18 dd 45 be bd 63 e4 cd 2d 0e e1 06 dd a6 d6 6d e8 6e 80 69 c4 d1 e6 eb f4 ad 05 ac 39 58 59 96 69 82 f5 8d a6 5b 33 70 17 ef 35 fd 6e be 10 3f 11 d5 19 8a 11 e4 8e 22 dd d9 22 bc d9 72 7b 09 e2 bd 13 42 b6 c1 91 4e 50 c0 6d 7d a6 8c 70 1a 17 03 8f d8 e7 db 8c ba a9 77 cc e8 86 a1 24 d1 3d c1 9d 51 72 28 38 1b 33 14 3a 19 4b e0 84 82 57 ce c1 04 e0 b5 13 d3 04 73 2c 6c 84 6e 42 c9 8e 23 27 13 94 ad 50 c8 3e e9 38 f2 d1 de 36 cf 89 b4 b7 34 45 ac 31 b7 a5 c4 47 4c 41 dc 1c a1 7c 8d 93 dc 8c 92 c0 86 01 2f b9 05 30 c4 e4 c9 fe 96 61 48 a6 df 23 92 22 8e 3d 38 4d 60 94 e8 09 62 38 50 80 36 96 c2 a6 14 27 d8 c5 04 f3 27 [TRUNCATED] Data Ascii: 668Y6~79Ml2hGx2=>BogC,Lv?I6R#L4#.1OFF\O'd1Hj(\=lEc-mni9XYi[3p5n?""r{BNPm}pw$=Qr(83:KWs,lnB#'P>864E1GLA\|/0aH#"=8M`b8P6'';K8=NP"4AB~Qn9/1;yhB@7KV*e6!SS)B58C"RWk+f99#GP+A4{2qJi8"8BKT(\|4.jNvd\enu5-ES\|R&\|6EYZy7M
Nov 26, 2024 08:20:00.634828091 CET	1088	IN	Data Raw: ea 62 f2 0d 9e 0e 79 67 0f 4d 2a aa 40 88 44 01 4a 11 29 fd e4 e4 11 ff fd f9 c7 a4 29 b8 34 b9 a0 cd 1c a5 70 11 cb 51 9f e6 5d 49 5f 6a 54 56 ab 1c de 2e b2 46 41 6e ea 1c ec 08 49 3c 86 50 54 f2 9a 0e a1 d3 9a 14 65 af 77 a1 32 57 e2 a3 83 51 Data Ascii: bygM@DJ))4pQ]I_jTV.FAnI<PTew2WQT(k:iGE*5{`8OG2PFgj2C?sFcVy{`A FLT>_BJjr3nJ8<6
Nov 26, 2024 08:20:00.835211039 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Nov 26, 2024 08:20:45.839910984 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49740	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.898222923 CET	403	OUT	GET /998/fkTheme.min.css?v=20240808102706&aid=28088389&wid=0&isNavV2=true&isBannerV2=true HTTP/1.1 Host: jzs.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.356194019 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: text/css; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 24 Nov 2034 07:19:58 GMT Server: F-WEB FAI-W-FLOW: 312651043 FAI-W-AGENT_AID: 0 Last-Modified: Wed, 21 Sep 2016 16:00:00 GMT Vary: Accept-Encoding Content-Encoding: gzip Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i37400_c25891, i2103127_c25795, i1872274_c17483 X-Cache: HIT from i2103127_c25795(cloudsvr) Data Raw: 33 34 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ed 7d 5b 93 1b 47 76 e6 bb 7e 45 2e 19 b3 12 67 1b 20 80 be b0 2f 31 63 b3 29 6b 48 85 48 d1 62 7b c6 bd eb 0d 44 01 28 a0 4b 04 50 88 aa 42 93 ad 8e 79 f4 93 9f 1c 8e f0 8b ff c3 ac df 37 66 7f 8d d7 b1 fe 17 9b b7 aa ca cc 3a 99 79 b2 aa 9a d2 78 24 8a cd 06 ea 9c 2f 6f 27 6f a7 ce 97 f9 97 f3 9b 28 cb e3 82 3c da 17 cb c1 e9 a3 8b bf 5c a6 db 62 b0 8c e6 f1 bd fc 6d 93 ac ef ce 3f 4f e6 e9 26 4d b7 9f 5f e4 d9 fc 9c ec b3 f5 17 9f 3f 7d 3a 19 e6 f9 f0 78 74 9a df e5 43 fa fc e9 3c cf 9f 32 ad fc d5 3c 7d 2a 35 86 71 5a fc c5 60 b2 59 6d 16 d9 7f bd fd d5 f8 68 f2 f9 93 76 20 8f 93 78 99 7c 34 a0 c8 32 cd 36 51 f1 c5 e7 f1 66 16 2f 16 f1 62 90 ee e2 6d 71 b7 8b 3f 7f 72 10 92 42 51 2c cd 6c 56 d8 45 b6 8f 5b 40 7e 48 97 76 4c f6 90 d6 04 af e4 0f 71 b2 ba 29 ce b7 ec d1 5a 7c 95 17 77 eb b8 fc e6 f7 b3 74 71 27 da 23 4f 7e 88 cf c7 47 bb 8f 90 66 11 7f 2c 06 8b 78 9e 66 51 91 a4 db 73 b2 4d b7 f1 85 da 8e ff f7 ff fc e1 ff fd f1 7f fd c7 bf fc fd 7f [TRUNCATED] Data Ascii: 346d}[Gv~E.g /1c)kHHb{D(KPBy7f:yx$/o'o(<\bm?O&M_?}:xtC<2<}5qZ`Ymhv x\|426Qf/bmq?rBQ,lVE[@~HvLq)Z\|wtq'#O~Gf,xfQsM4;<]3'xZ+9OF#}!],_ESgC&2^Fu=}G8#]q%&T^bG-8K"\|N.`)U2FiX6i$~r^o(gEN([%:^hr]Fm3r?WY./KY/4fk"w`/~Y~ahn]^-!<Raa~2J(x&ON>\~tZ=?M~[=}t8*ou\|i60Mxs~>I9hNyMY
Nov 26, 2024 08:19:58.356225967 CET	1236	IN	Data Raw: 72 2f bb ff fc 68 44 ff d3 d2 e1 a3 dc f4 90 d8 52 3e 20 3e 59 91 aa 52 53 83 46 6a 74 94 da 5d b1 9c dc d3 fe 78 3e 39 a1 65 e5 56 31 3e 14 2d b3 cb 12 6a 2c 77 42 44 1d ec 88 1c ed 04 22 a9 21 1f e7 fb 99 10 a7 f0 eb 74 95 56 a6 20 06 42 31 ec Data Ascii: r/hDR> >YRSFjt]x>9eV1>-j,wBD"!tV B1TA?5^&X1T1h_\*3z\3Ly;a]jL=Y!x)&erOpYr/nYM~LY.OM(.Z,`ZLp]T^e
Nov 26, 2024 08:19:58.356237888 CET	1236	IN	Data Raw: 89 60 04 3a 13 d1 49 23 be c4 4c 7b 20 4c 16 47 eb ab 34 5d 17 c9 ae 25 02 dd f7 af df 66 c9 3c 0e ce fc 65 b2 5d 78 73 6e 9a 26 d5 97 76 22 bf e0 af 34 df c9 1a 64 93 25 f4 3d da f2 db c1 93 21 cd 7b 9c ad b9 f3 c7 96 12 2f f3 2b aa bb ca a2 35 Data Ascii: `:I#L{ LG4]%f<e]xsn&v"4d%=!{/+5MG${oL7>:o(Ontfe<PG[(b9XKWx7xv`~c~GS`'mD}%RY8\|>rO;n4XlZJaq`N"Q]^
Nov 26, 2024 08:19:58.356318951 CET	1236	IN	Data Raw: bd 1b c6 f9 66 40 94 c3 5e 50 8e 7a 41 39 46 a2 f0 c6 bc 7e f9 25 0f 9e 1f 88 37 e4 c9 bb fd 6c 13 6f f7 76 45 f9 49 04 47 d7 18 14 61 1d 47 b7 b1 03 41 cc dc 52 ff 28 3a 3a 3b 3a eb 3f 1b cc fd c5 43 20 f8 fb 5b fa 95 e3 2d 9e 52 91 67 d2 73 c6 Data Ascii: f@^PzA9F~%7lovEIGaGAR(::;:?C [-Rgsh_iRD<<~"WYzm\|}5C-wt\78FD30yjm`0S=;i=d8<:5F1B 6S@u0Lo#'8k~.b,M)/~
Nov 26, 2024 08:19:58.356331110 CET	1236	IN	Data Raw: e2 d4 5e 31 e6 e7 58 7f ab ee 31 76 fd 1c da 63 65 dc b2 07 95 34 03 3c 1e 26 ea e4 be ba ca 41 4b 5d f8 65 d5 80 83 cf d4 55 05 b1 45 59 04 c8 95 82 7e 28 04 88 3a 01 f8 b3 86 12 fe 0c 5a 98 63 0b 0e cb f3 58 df d1 01 91 ff 3f 31 53 11 fb 13 64 Data Ascii: ^1X1vce4<&AK]eUEY~(:ZcX?1Sd0_j\|]uk68[U@%Zb,1Xm!uBp\huJ:}E9 p!`Pa=T0\N~Rj[4pUf@*n3O?~
Nov 26, 2024 08:19:58.356342077 CET	1236	IN	Data Raw: 01 ef 16 d4 90 b7 15 97 b0 02 d2 c5 4c a4 9d c5 30 69 ee 4a 2a c1 f3 f3 32 c4 21 d9 ee f6 c5 80 0e c2 f3 f8 26 5d 33 e7 2b 1a 83 07 23 28 9a e4 e9 2f c9 32 c9 e8 1e ed 23 19 9f 0e c8 2f 9f 86 e4 c7 00 53 b1 ce fe 5b 28 96 88 ab 60 9f 82 8a c6 2b Data Ascii: L0iJ2!&]3+#(/2#/S[(`+U7]a&eP Z,0S}{j=)Glnuk]j<BkCu:m"XBMiL'MQGL%yef18\`i<\5nL_YWlTw
Nov 26, 2024 08:19:58.356353998 CET	1236	IN	Data Raw: 92 7e ae 66 4f 35 cb d3 ef 8e eb 10 c8 0e b5 cf 8c 5c ef 89 e0 f8 11 d2 98 08 38 32 5c 70 42 ce ab ed 32 e5 93 04 51 08 26 82 ab 73 a9 b0 4a 70 0b bd fd 94 2e 0a e9 24 39 15 97 57 4d e9 90 90 dd 0d 06 39 bf a5 09 3f b6 6e 0c 98 2c ce f7 eb a2 f9 Data Ascii: ~fO5\82\pB2Q&sJp.$9WM9?n,\|0Yy2dxyjH613&AX_4![&@"aawSYNhv-9&ff<^=T6)1CQ[Bp/T17VZKP&U@ln/j@-
Nov 26, 2024 08:19:58.356411934 CET	1236	IN	Data Raw: ea 44 7d 0e 54 88 f2 d8 f5 ac 6d 51 99 d7 d6 66 68 63 8b a1 8d 61 43 1b 83 86 36 6e 1a da f8 49 9b ec da fc f0 15 3a e8 89 37 9f e6 8e 87 a9 fd 99 f5 41 8b 82 08 8f fc 8f 50 e9 3f 75 1b 7e 80 ee cc eb 3a a4 3b ff 34 07 ba b6 25 77 f5 ee 07 9c 46 Data Ascii: D}TmQfhcaC6nI:7AP?u~:;4%wF~UUT;N[[cvJ+~,?TyS}6L{_`ofppzpa}c\|'!;FC9wE*@e}?dEYMpG]=WnE~pUF1dDp
Nov 26, 2024 08:19:58.356422901 CET	1236	IN	Data Raw: c7 28 b0 9b 5c 1f 32 11 65 fc 18 04 18 a7 08 f3 f9 99 38 fa d0 c4 51 5f bd 2b 9f ff a4 59 a3 be 72 fe 94 28 a3 8e bc fe 09 f1 45 1d a5 f8 99 2c 6a 79 d6 77 17 fe cf cc 14 f5 15 fb 47 a3 89 b2 16 fb 4a e4 97 f7 90 fa 62 29 23 76 d3 2e a8 1d 7c 31 Data Ascii: (\2e8Q_+Yr(E,jywGJb)#v.\|1jn"5l<<l[5n0A_,wtiVWw&Myl>En\.q5nksPW;Y9%[q7mpYa)k^-'
Nov 26, 2024 08:19:58.356434107 CET	1236	IN	Data Raw: 21 ad dd 62 ca c2 34 a6 bf a1 3d 76 47 3f 4e 37 d3 79 aa 27 68 2b ec 36 ba 7d 3e cf d2 3c 7f 91 f2 db da c2 4b 4b a5 de f3 ad d3 60 5e 05 33 44 56 1c 4b 3e 9a 16 1e 10 26 02 0e 83 d8 01 f3 de 1c f2 ed a3 a7 ba d8 27 a2 42 4c af 15 99 b1 ea b8 28 Data Ascii: !b4=vG?N7y'h+6}><KK`^3DVK>&'BL(d7Eo0SeR?J&M<$RRdhs??"{^uX0:4%E4[RQNqH*xH:rq5a[G#
Nov 26, 2024 08:19:58.476213932 CET	1236	IN	Data Raw: d1 59 61 da 71 e8 1c b9 6a 43 a1 73 c1 e1 19 74 26 4a 27 02 5d 9b 7a 0f c1 6b 41 9f eb d2 86 e1 59 eb 29 6f 1d b9 73 d6 bc 85 52 e7 5a 98 58 70 be f0 c4 39 b7 ba 8f f6 e6 d2 c6 d0 e6 5c fa 48 d6 9c 75 08 0b 51 42 70 e6 20 37 72 38 65 ce 1c 9f dd Data Ascii: YaqjCst&J']zkAY)osRZXp9\HuQBp 7r8e9ozgK([@s-hzEUsW<9D"N,Kjd:n6vo`3n[npCMnJg7qchUs&)!#0#oAM>\JbF82\
Nov 26, 2024 08:20:28.820382118 CET	404	OUT	GET /1010/fkTheme.min.css?v=20240808102706&aid=28088389&wid=1&isNavV2=true&isBannerV2=true HTTP/1.1 Host: jzs.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:29.267585993 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: text/css; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 24 Nov 2034 03:16:26 GMT Server: F-WEB FAI-W-FLOW: 660154043 FAI-W-AGENT_AID: 0 Last-Modified: Wed, 21 Sep 2016 16:00:00 GMT Vary: Accept-Encoding Content-Encoding: gzip Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i63250_c21843, i2103125_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 38 65 32 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ed 7d 5b 93 db 48 96 de 7b ff 0a 58 8a 71 b7 c6 45 8a 64 5d 54 97 98 d9 55 a9 57 23 75 b4 d4 da 56 b9 77 ca 5e 07 03 24 51 2c b4 48 82 01 80 25 95 2a e6 d1 4f fb e4 d8 88 7d f1 7f 18 ef bb 63 fc 6b d6 1b de 7f e1 bc 01 c8 cb c9 cc 93 00 4a ad d9 91 4a 2a 91 c0 39 27 4f 66 9e bc 9d 3c 5f e6 5f cf af e3 bc 48 ca e8 c1 ae bc 1a 1c 3f 38 fb eb ab 6c 53 0e ae e2 79 72 27 3e ad d3 d5 ed e9 d7 e9 3c 5b 67 d9 e6 eb b3 22 9f 9f 46 bb 7c f5 cd d7 8f 1f 4f 86 45 31 3c 1c 1d 17 b7 c5 90 bc 7f 3c 2f 8a c7 94 ab 78 39 cf 1e 0b 8e 61 92 95 7f 35 98 ac 97 eb 45 fe 1f 6f 7e 33 3e 98 7c fd a8 9d 90 87 69 72 95 7e d0 44 45 57 59 be 8e cb 6f be 4e d6 b3 64 b1 48 16 83 6c 9b 6c ca db 6d f2 f5 a3 bd 90 14 ca f2 4a 57 b3 96 5d e6 bb a4 85 c8 f7 d9 95 5d 26 7d 49 4a 82 15 f2 fb 24 5d 5e 97 a7 1b fa 6a c5 1f 15 e5 ed 2a a9 9e fc 61 96 2d 6e 79 7d 14 e9 c7 e4 74 7c b0 fd 00 71 96 c9 87 72 b0 48 e6 59 1e 97 69 b6 39 8d 36 d9 26 39 93 eb f1 ff fe 9f 3f fe bf 3f fd af 7f fb 9f ff fd [TRUNCATED] Data Ascii: 8e2}[H{XqEd]TUW#uVw^$Q,H%O}ckJJ9'Of<__H?8lSyr'><[g"F\|OE1<</x9a5Eo~3>\|ir~DEWYoNdHllmJW]]&}IJ$]^ja-ny}t\|qrHYi96&9??8g,?}8aM%OV~wEy}:F$%}2xVInHX^7&WnUBo_$"5N,Htpfee>Mr{m?LzrIZDv:]XH^%_AD:fJh4Tx>&Yt7y,N^]]??S"Hz~=uuy!hXDwpr%kChtW<O\|-O7<z~vAlG*:NVM\f4-uvC[^%gNy$&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49741	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.898360968 CET	373	OUT	GET /3115/fkNav.min.css?v=20240808102706&aid=28088389&wid=0 HTTP/1.1 Host: jzs.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.201929092 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 1573 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:56 GMT Server: F-WEB FAI-W-FLOW: 1974338115 FAI-W-AGENT_AID: 0 Last-Modified: Wed, 21 Sep 2016 16:00:00 GMT Vary: Accept-Encoding Content-Encoding: gzip Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i11791_c17987, i2103127_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 1f 8b 08 00 00 00 00 00 00 00 bd 5a dd 8e e3 34 14 be e7 29 a2 1d 21 01 da 74 d2 aa 33 bb b4 42 20 f6 06 a1 5d 84 98 15 b7 23 37 f1 b4 d6 a4 71 e4 b8 9d 99 ad f6 92 07 e0 9a 77 80 07 40 f0 36 48 ec 5b e0 c4 49 6a 27 b6 73 9c 96 9d 6a b7 69 72 be cf 3e f6 f9 b1 8f f3 4d bc 41 ac c0 3c 78 b6 e3 77 e1 cb 67 cb 8b 0c ed 7f 9e 05 87 0d 26 eb 0d 5f 5c 45 f9 e3 f2 fd 27 f5 dd 89 f8 7a 83 48 f6 8a 66 1c 67 bc 11 9a 46 d1 a7 47 a1 4a ea 95 78 8c 99 53 ae 12 93 02 96 e6 a0 4c 87 15 8a ef d7 8c ee b2 64 91 d1 0c 1b db 78 1e 28 f7 de d2 5c fb dd f4 a3 bc 7e 8d ef b8 f5 e1 4f 65 f3 d6 a7 5a 5f 07 a4 9e 2b 4f bf a5 9c d3 ad 43 0d c2 f1 d6 a5 66 f5 bc fa bf ec 3d 48 50 f6 02 24 5a 29 3d 20 69 31 98 8a 04 1d b6 88 ad 49 16 72 9a 2f a2 65 50 ff 5a 55 5a 97 37 72 94 24 24 5b 37 cf 9b 9f ad 40 8f cf d8 18 0a 0e 1c 3f f2 30 c1 31 65 88 13 9a c9 8e de 89 b1 0f 0b f2 0e 2f a6 d7 42 be fa f9 20 09 32 ca b6 28 95 b7 ee d0 96 a4 4f 8b 7f fe fe fd df bf fe f8 f0 db 2f 1f fe fc 75 19 d3 94 b2 c5 c5 6c 55 7e 96 15 7b b1 41 09 [TRUNCATED] Data Ascii: Z4)!t3B ]#7qw@6H[Ij'sjir>MA<xwg&_\E'zHfgFGJxSLdx(\~OeZ_+OCf=HP$Z)= i1Ir/ePZUZ7r$$[7@?01e/B 2(O/ulU~{A}fuOx@&}cVjW&GoR781\p`F[9]}AUA<8<o-R)zZ,%BsZ;@k![QO\|l4gelW`"ui#1Mssh (%lQP'x3Ss9*G3zqWh7M4B//2uZefu&`1ha1%mDlIMRIE1Nf7ijWkBg1'zc:12hnuL``0PBv"q5(ZmlBNIN[pJ13TB
Nov 26, 2024 08:19:58.202003002 CET	831	IN	Data Raw: f6 43 6e d0 24 26 9a 37 2c c2 9b c2 32 9c b4 74 a7 10 55 4e 3d 9e 49 75 4e 2f 70 b3 f1 d5 b2 ec 78 ad 8c 74 27 e8 56 f3 75 d4 d3 c0 05 c8 5a ed 10 2f 83 d2 a1 27 1b 15 df 10 96 9c c7 ac 6c 54 63 06 5f e3 f2 37 ad 16 7e 2e e3 72 13 9e a4 21 c0 c0 Data Ascii: Cn$&7,2tUN=IuN/pxt'VuZ/'lTc_7~.r!a\[w&mQ1lzN$D-U-}j>6p.sdAw KAbcrKk1CC)vq(a}QoU5GatEso~QWI?W?\Mgh
Nov 26, 2024 08:20:28.821125984 CET	380	OUT	GET /2/2048_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=1 HTTP/1.1 Host: jzs.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:29.241713047 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: text/css; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 24 Nov 2034 03:16:26 GMT Server: F-WEB FAI-W-FLOW: 1098335043 FAI-W-AGENT_AID: 0 Last-Modified: Wed, 21 Sep 2016 16:00:00 GMT Vary: Accept-Encoding Content-Encoding: gzip Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i37400_c25891, i2103119_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 38 65 31 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ed 9d df 6e 24 47 96 de ef fd 14 05 19 06 66 d6 a2 d4 cd 6a 52 54 37 6c 78 a4 f5 7a c7 de d5 cc 6a c6 06 16 b6 d1 60 93 d5 dd 1c b1 c9 06 c9 96 46 23 f8 d2 57 be 32 0c f8 c6 ef b0 f6 bd b1 7e 1a db f0 be 85 33 23 33 ab e2 cf 89 cc f3 7d e7 44 b1 17 53 22 34 d3 6a d6 f9 ce c9 88 c8 c8 cc c8 f8 7e f5 cf 2e de 9e df dd 6f 1e 56 9f 7c 78 78 7d 74 f6 c9 8b cf 5e df de bd bb 5f 7d f6 bb 3f 1c bd bb bd fc 70 bd f9 f5 f9 c3 c3 e6 ee e6 f8 e9 93 d5 ea b3 37 2f 5f dd de 5d 6e ee 7e 1a fe ef f9 cd ed cd e6 c5 7f d0 c5 fc f9 ed f7 bb c0 a7 ef 7f bf ba bf bd be ba 5c fd c3 e3 57 fd cf 92 ca fb b7 b7 0f b7 bf 79 77 7e 7d fd eb ab 8b 3f 1b 3e 79 71 ff f2 e1 ee ea fc e6 cd f5 e6 e5 87 f7 db 44 bf d9 5c 6f 2e 1e 36 97 63 ae a3 8b db eb db bb e7 da 3c 77 dd df 5d 3c fc e9 e6 e1 fc ea 7a f5 d9 ed fb 87 ab db 9b 5f 3e 6c de ad 5c f5 ff e2 ea fe c1 57 31 6b 9b 8a f4 f3 63 8f 86 8f fe ee 6e d3 fd f5 af 3e 74 9f f7 4b f9 fa bb 97 d9 41 fd fa 6a 73 b1 a9 1f 54 3f 9a 2e cf ef df [TRUNCATED] Data Ascii: 8e1n$GfjRT7lxzj`F#W2~3#3}DS"4j~.oV\|xx}t^_}?p7/_]n~\Wyw~}?>yqD\o.6c<w]<z_>l\W1kcn>tKAjsT?.n)j_\|r8Oz8uqvnaAxy=_ND1v7[?1o/p7Hb:_?iqwwOiB~<[\}?mzm\STr34:.wW?xW7n/o6(zGW<M>r?l}AW vIWO2rsq{wZ{]],<Py^mf._0O__z
Nov 26, 2024 08:20:29.241800070 CET	1236	IN	Data Raw: f1 f9 ea ed d5 e5 e5 e6 46 2d f4 a9 f2 73 bf ed 2f 27 ab 9f de 0e a3 f1 d9 49 37 6e fa 82 8f e2 bf 98 cd d9 5f 29 c3 35 a9 9f f0 56 f1 a9 72 ca 84 02 a7 45 16 5e 9e 14 3f 5c 5d 3e bc 7d fe f4 c9 93 7f 84 08 ad ee fb fe 2b d5 e6 5b 3e c4 7f bd b9 Data Ascii: F-s/'I7n_)5VrE^?\]>}+[>bS?y48z`GH:AD5kw8D_^^9zu]A3*>JYbW_x@%UD`E"04pr&x0 pt~';_An5&~
Nov 26, 2024 08:20:29.241811991 CET	1236	IN	Data Raw: 78 f8 ab ef cf fb 4d d8 db bf 0b 6d 1e 5e ee f6 a5 0f 62 f1 18 7c fa 62 5a 83 1c 52 74 95 3e bc ed 1f 62 3a 8d ab 6e 7a 3a bf ef ae b5 61 1d ed f6 fe f7 f9 67 de dc 9d ff 78 df cd 63 fa 06 9d f6 19 8d b7 77 cf 3f f9 77 9b 2f 9f 1e 7f a2 6f d9 f1 Data Ascii: xMm^b\|bZRt>b:nz:agxcw?w/o*vHnaf(\]to{wj6\|{c3so1rNw}G&{Swvf~K{&v4gG481.aa
Nov 26, 2024 08:20:29.241878033 CET	1236	IN	Data Raw: b3 df 5f 90 22 3d fa 85 92 c1 ef 5f 68 d9 fc fe e9 74 cc 0a f0 7e ff ed db 1e 37 bf 7f b8 36 51 7e ff 4a 24 72 4d 34 fa fd 4b 0d 60 59 26 ba 20 9b fd fe 99 9e dd ef 5f dc 6e 27 0f 4e d1 ab e0 d7 4f fa 9f d4 b5 52 fd 75 c5 08 53 7e 5e f1 90 c3 61 Data Ascii: _"=_ht~76Q~J$rM4K`Y& _n'NORuS~^ax,@!XZru*uvX)Ba,@~3DzdCSdA>l`XJ,@nkJ=?fXR`fe%k@,BcQ,@MXqeCI>XL
Nov 26, 2024 08:20:29.241889954 CET	896	IN	Data Raw: 11 85 14 b2 ae 6a 01 88 28 4a 01 56 01 8d 00 11 85 8c 7e 35 93 04 88 88 b1 30 40 a4 a2 c2 03 44 66 04 69 80 c8 30 8d d2 00 91 50 92 13 40 24 d5 62 01 22 a9 0a 01 10 e9 05 ec 00 91 5e c5 0d 20 d2 8b b9 02 44 84 79 95 dd ee 2b ce f6 c4 25 e2 71 01 Data Ascii: j(JV~50@Dfi0P@$b"^ Dy+%q"O7P` VZd-H3LSH( "Yf wi,U?H}aI)jQ>r<LvQD"D# DjuDf*A"R%H%=;@d2
Nov 26, 2024 08:20:29.241903067 CET	1236	IN	Data Raw: d6 f8 bf 3b 40 d8 bd bf 3b 40 36 74 9f c6 7f 31 65 43 e3 7f da 1d 4a e3 7f 1e a4 ef 43 d2 f8 9f cf a9 0a 53 46 2d 04 34 fe 3b 67 d6 1a ff 5b 1c 30 75 bf 52 ea 61 c6 ff ec f9 d9 60 fc 57 28 69 8d ff 0a 29 8d f1 7f 4e 06 5d 94 b5 19 ff 15 2a c8 02 Data Ascii: ;@;@6t1eCJCSF-4;g[0uRa`W(i)N]*?PQ16WTx mQJr2Z?U!{1W0{D<A^JeC{\|<aijE9/ Q5 Jg#?XE-G.
Nov 26, 2024 08:20:29.241918087 CET	1116	IN	Data Raw: 29 60 3d 0a 92 1b 20 28 28 b9 01 f1 26 be a5 87 68 dc ef bf 76 64 07 ec 4a 50 ba fe 17 92 03 2a d1 c3 dc 81 1d b0 17 76 80 be d5 0f ec 80 e6 ec 00 ec 14 48 4f ea 8b 67 4f ba 7f fc ba 1a 57 6f cd 0e 58 37 61 07 ac 1f 8f 1d b0 76 66 07 c8 7a 3c 3b Data Ascii: )`= ((&hvdJP*vHOgOWoX7avfz<;sc$vv@"vfzcw;N"Wv@8e[v8(Y$`#.\|R-(;`g@vEQfu,I2O' fRa,1X
Nov 26, 2024 08:20:29.241936922 CET	1236	IN	Data Raw: 86 6f c7 25 08 29 db 72 09 c6 41 49 2c c4 67 91 80 25 bc 8f 34 70 09 c4 70 13 97 a0 57 a4 b9 04 63 3b 34 e0 12 8c ca 28 97 60 9a 67 40 2e c1 18 86 72 09 b6 45 b2 5c 82 51 80 e6 12 c4 75 e3 8d eb c0 25 18 95 2c 5c 82 49 02 e2 12 4c 27 20 c6 25 98 Data Ascii: o%)rAI,g%4ppWc;4(`g@.rE\Qu%,\IL' %Ra\, MV\KPm."]sQX6]: Ki\Jv/2sn(RmYFBH;c$T:^h6` _hFNT3rxs\|L/#aI{F
Nov 26, 2024 08:20:29.241952896 CET	1236	IN	Data Raw: 5b 66 54 e8 3b 1a 6f 6e c0 b2 3a 3b 92 79 6e c0 92 8e 4b e3 61 dc 80 54 07 d9 43 2b 47 aa 36 a9 c9 a1 8a ed bf 72 60 e4 25 02 56 28 a4 e2 55 ed ee ed cf cf 25 ed 10 81 36 45 46 12 e4 85 3e 56 d0 1a e0 43 58 46 0e 50 46 65 e5 6a b6 9c a4 71 04 2e Data Ascii: [fT;on:;ynKaTC+G6r`%V(U%6EF>VCXFPFejq.07GMpeQ8Hj=q+6hvcVr\.@9Mqk,\HcV^k#kPhh<d;. sD`(I@EPIB
Nov 26, 2024 08:20:29.250201941 CET	1236	IN	Data Raw: e6 ef 2f 2d 7f cb 52 ea 81 de ff b3 5c 84 f6 fe 2f 2b a9 bd ff cb 52 2a ef ff 8c 0c ba 2e 6b f4 fe 2f ab 20 6b 98 66 ef ff 99 c1 fb 2f c5 e2 de 7f 59 c5 e0 fd af 0b f2 de ff 33 9b f7 ff cc d1 fb 9f 68 d1 de ff 44 85 f1 fe 9f b9 78 ff cf 3c bd ff Data Ascii: /-R\/+R*.k/ kf/Y3hDx<gr^e=qhniaOej!m>3_MYRNXEfF7(zgRDB:J`/g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49742	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.898505926 CET	377	OUT	GET /2/4_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=0 HTTP/1.1 Host: jzs.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.167521000 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: text/css; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:56 GMT Server: F-WEB FAI-W-FLOW: 1881497115 FAI-W-AGENT_AID: 0 Last-Modified: Wed, 21 Sep 2016 16:00:00 GMT Vary: Accept-Encoding Content-Encoding: gzip Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i34694_c4672, i2103127_c25795, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 33 32 65 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ed 9d df 6e 1c 49 96 de ef f7 29 0a 6d 18 98 59 37 bb 45 8a 52 b5 24 d8 f0 74 ef ae 77 ec dd 9e d9 9e b1 8d 85 6d 10 25 b2 24 d5 36 45 12 45 aa 7b 7a 04 5f fa ca 57 86 01 df f8 1d d6 be 37 d6 4f 63 1b de b7 70 46 64 66 55 fc cd 3c df 77 4e 14 65 4c 35 77 7a d5 ac 3a df 39 19 11 19 99 19 19 df 4f ff f4 f2 dd 6a 7b bf 7e 58 7c f6 e1 e1 cd c9 57 9f bd fa e2 cd ed f6 fd fd e2 8b bf f9 fd c9 fb db ab 0f d7 eb 5f af 1e 1e d6 db 9b b3 d3 d3 c5 e2 8b b7 17 af 6f b7 57 eb ed c7 fe ff bd bc b9 bd 59 bf fa f7 b2 98 3f bf fd 61 1f 78 7a f7 bb c5 fd ed f5 e6 6a f1 0f 2e cf 9f 74 ff cc a9 dc bd bb 7d b8 fd cd fb d5 f5 f5 af 37 97 7f d6 7f f3 f2 fe e2 61 bb 59 dd bc bd 5e 5f 7c b8 db 25 fa cd fa 7a 7d f9 b0 be 1a 72 9d 5c de 5e df 6e 5f 4a f3 6c bb df 5d 3e fc c9 fa 61 b5 b9 5e 7c 71 7b f7 b0 b9 bd f9 e5 c3 fa fd c2 54 ff 2f 36 f7 0f b6 8a 49 db 54 a4 5f 9e 59 34 7c f0 bb ed ba fb f5 af 3e 74 df b7 4b f9 e6 fb 8b e4 a0 7e bd 59 5f ae eb 07 e5 46 d3 d5 ea fe dd 5a 9c e2 [TRUNCATED] Data Ascii: 32enI)mY7ER$twm%$6EE{z_W7OcpFdfU<wNeL5wz:9Oj{~X\|W_oWY?axzj.t}7aY^_\|%z}r\^n_Jl]>a^\|q{T/6IT_Y4\|>tK~Y_FZNcu+p#HG=^_??[__<p>.\|9]onofu:vry^{<]?1a,V7@b<<s?i1N7aG{mWX1*zBYj^t'Ic/on/OFp<.n7r^=l~Xz']yw/eUj}y]yO/wA:gtM7\|]~z_^wZasy<rnsu}.
Nov 26, 2024 08:19:58.167540073 CET	84	IN	Data Raw: 6f dd e5 64 f1 f1 5d 3f 1a cf 9f 75 e3 c6 15 7c 12 fe 62 32 a7 bb 52 fa 6b 92 9b f0 16 e1 a9 f2 9c 09 05 4e 8b 24 3c 3f 29 7e dc 5c 3d bc 7b 79 fa e4 c9 3f 44 84 16 f7 ae ff 72 b5 e9 96 f7 f1 df ac 6f ba 5f 2c 3e ba f9 f0 cd f5 ed 8f 2f 7d 07 5e Data Ascii: od]?u\|b2RkN$<?)~\={y?Dro_,>/}^
Nov 26, 2024 08:19:58.167545080 CET	1236	IN	Data Raw: 35 30 33 64 0d 0a cf c4 c6 e9 87 d1 f4 ad 6f 00 df 3b 1f af d7 6f 1e 5e 82 1d 51 d2 11 4d 0c a5 4e 81 4f e0 44 04 38 59 93 c6 78 df dd 40 0d 43 f4 6e 75 75 b5 b9 79 7b f2 fa b6 bb 2a be 87 66 b8 45 78 c6 0f 17 c5 85 3c fa 0b d7 01 8b 6c d6 e8 87 Data Ascii: 503do;o^QMNOD8Yx@Cnuuy{fEx<lc8Yaa\0D?L"*?\_;+>\{F(n]W+gPBqflQ(Oz.?U:cBEn2.8T0skfwga4.]
Nov 26, 2024 08:19:58.167692900 CET	1236	IN	Data Raw: 3f fe a5 ff c0 2f e2 5c 3c bc db ae d7 c3 45 61 b3 bd ec 7e 93 6e 7b 05 77 9d af de ae 6f fc 49 d5 ff f9 d7 db f5 0f 8b 7f b2 58 ed 4e 76 6c 7b 66 2a f7 ad db 19 63 28 77 ab 10 fb 9b df 5f ec f5 2e 7e dc ae ee bc e8 66 f8 85 eb e8 5e f7 65 03 f5 Data Ascii: ?/\<Ea~n{woIXNvl{fc(w_.~f^eF/>vk#~g\4on/>6iv99"Q;h1-\|8Qz_}O6/>{7%W_n1H[<ubwy?>Kd'ko+ui.
Nov 26, 2024 08:19:58.167697906 CET	1236	IN	Data Raw: 87 14 9e 90 04 c9 fb 90 85 27 24 53 af c4 d8 52 09 41 e1 09 b6 99 c5 f0 84 06 07 4c dd d6 e4 7a 20 3c 61 99 8a d0 f0 84 79 25 31 3c 61 5e 4a 04 4f 98 90 41 97 ac 95 f0 84 79 15 64 79 57 0d 4f 58 2a e0 09 a5 58 1c 9e 50 56 51 c0 13 ea 82 3c 3c 61 Data Ascii: '$SRALz <ay%1<a^JOAydyWOXXPVQ<<a',OTx',u,%-<HHUZ'-+':D7lOXJrxBQ',x@ O'H('.!O84','lO;RxB
Nov 26, 2024 08:19:58.167709112 CET	1236	IN	Data Raw: 65 7e 48 b9 c8 36 fc 90 a1 63 10 7e 48 14 62 c5 0f a9 d6 31 c5 0f 99 aa 04 e4 87 14 f3 cf f0 43 6a e9 21 7e c8 d8 d9 04 3f a4 1c 4a f1 43 76 52 3c 3f 24 95 08 a1 1b db b7 af 7f 76 f6 ec d9 e7 8b f1 5f 3f 9f 1d 92 0a 94 48 49 40 7b 40 14 4a a4 a8 Data Ascii: e~H6c~Hb1Cj!~?JCvR<?$v_?HI@{@J`^#2?OtG\|!H!!)>C^Q!}j;\|HM!5!)bh\|W9>CBjm!Ov:(b<'@
Nov 26, 2024 08:19:58.167715073 CET	1236	IN	Data Raw: b5 a5 4b f4 8f b6 f4 6a 83 d5 6d e9 67 cf 50 5b ba ac 2b 48 5b 7a a1 6c f5 7b ab 52 53 60 53 71 10 5e b7 a5 c7 df d3 d9 d2 cf 79 5b 7a 25 54 ba 08 ea 8e 82 b5 a5 67 a9 39 5b 7a 26 c3 d9 d2 2b 0d 81 ed d8 ce 45 a4 cb 74 79 63 b0 b6 f4 78 60 a1 b6 Data Ascii: KjmgP[+H[zl{RS`Sq^y[z%Tg9[z&+Etycx`$.Tj]>Jr&>=lC:WK'47,}^=4vs:&8m[{WtY=)Vl.^xQ{YSI=MyH>FlLT@.nPI
Nov 26, 2024 08:19:58.167743921 CET	1236	IN	Data Raw: 92 27 a6 dc 81 a4 5a 4b ee 40 2a ad e7 0e 38 c5 26 dc 01 69 9f b1 da 86 dc 01 74 2c e8 4a 6e 50 b3 60 90 a9 6b b6 e2 0e 08 87 b0 aa 5e 3d 77 20 97 62 59 01 a9 92 86 3b 90 6a 29 b9 03 d1 74 cc 0a 28 b8 03 e3 1b 28 3b ee 80 bb 36 71 dc 81 72 24 72 Data Ascii: 'ZK@*8&it,JnP`k^=w bY;j)t((;6qr$rMr2`Y# w ~P\?q?}yS4P)\%D9(`fPPJ1dCI((lH(CH(H}HWRBAlr=P<i+%)@
Nov 26, 2024 08:19:58.167794943 CET	1236	IN	Data Raw: 28 0d 01 f0 25 19 41 00 62 2d 16 02 10 ab 10 10 00 27 a0 87 00 38 15 33 08 80 13 33 85 00 14 e6 55 76 cf 5e 71 b6 27 2e 11 8f 0b 01 d8 6f 10 6a 07 01 78 be df da 87 40 00 92 b0 e3 5e 9f 4a cb e0 10 80 a4 65 a5 10 80 52 87 08 f7 f8 58 42 00 fc 0c Data Ascii: (%Ab-'833Uv^q'.ojx@^JeRXBx@Yxf 7i4Q;@}aQGj>r4zICE6<'B@b1A*1AF) !I4(h t/@>
Nov 26, 2024 08:19:58.167802095 CET	1236	IN	Data Raw: 99 9e 85 03 f8 c5 39 ee 33 8f 62 68 9f b9 57 39 80 cf bc cf d3 ce 67 1e ea db f8 cc 43 c5 06 3e f3 6a c3 b7 f3 99 fb 94 6d 7d e6 c3 a0 24 96 ac 93 48 c0 e2 eb 22 15 3e f3 62 b8 ca 67 ee 14 69 9f f9 d0 0e 0d 7c e6 83 32 ea 33 1f e7 19 d0 67 3e 84 Data Ascii: 93bhW9gC>jm}$H">bgi\|23g>>]\|}ax%\|\|T<B\|C(3}}g.?63?G} }JMMAxgO3Xy%Tg9y&+E+<X<D<UNA
Nov 26, 2024 08:19:58.287585974 CET	1236	IN	Data Raw: 87 ed f5 cf be fc f2 f4 8b fb e7 4f 36 5f bc 59 75 b7 08 db 2f 2e 6f df 7f 79 fe 65 27 f9 e5 2f fe f9 5f ff c9 37 bf f8 ab bf ba b8 ba f8 d5 0f 6f ff e5 5f df fe ea 57 5f fd fe ed 5f 7f 71 77 f3 f6 e7 8b 9b db 93 ed fa 6e bd 7a 18 de 3e 7e 5e c3 Data Ascii: O6_Yu/.oye'/_7o_W__qwnz>~^4i}ke 1i<Ax+rA0.Enl$FEv@b.IN ( 8_fQ <$2i5+ #cAWrL]@:U
Nov 26, 2024 08:20:28.820981026 CET	373	OUT	GET /3115/fkNav.min.css?v=20240808102706&aid=28088389&wid=1 HTTP/1.1 Host: jzs.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:29.222342014 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 1573 Connection: keep-alive Expires: Fri, 24 Nov 2034 03:16:26 GMT Server: F-WEB FAI-W-FLOW: 126688043 FAI-W-AGENT_AID: 0 Last-Modified: Wed, 21 Sep 2016 16:00:00 GMT Vary: Accept-Encoding Content-Encoding: gzip Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i11791_c17987, i2103127_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 1f 8b 08 00 00 00 00 00 00 00 bd 5a dd 8e e3 34 14 be e7 29 a2 1d 21 01 da 74 d2 aa 33 bb b4 42 20 f6 06 a1 5d 84 98 15 b7 23 37 f1 b4 d6 a4 71 e4 b8 9d 99 ad f6 92 07 e0 9a 77 80 07 40 f0 36 48 ec 5b e0 c4 49 6a 27 b6 73 9c 96 9d 6a b7 69 72 be cf 3e f6 f9 b1 8f f3 4d bc 41 ac c0 3c 78 b6 e3 77 e1 cb 67 cb 8b 0c ed 7f 9e 05 87 0d 26 eb 0d 5f 5c 45 f9 e3 f2 fd 27 f5 dd 89 f8 7a 83 48 f6 8a 66 1c 67 bc 11 9a 46 d1 a7 47 a1 4a ea 95 78 8c 99 53 ae 12 93 02 96 e6 a0 4c 87 15 8a ef d7 8c ee b2 64 91 d1 0c 1b db 78 1e 28 f7 de d2 5c fb dd f4 a3 bc 7e 8d ef b8 f5 e1 4f 65 f3 d6 a7 5a 5f 07 a4 9e 2b 4f bf a5 9c d3 ad 43 0d c2 f1 d6 a5 66 f5 bc fa bf ec 3d 48 50 f6 02 24 5a 29 3d 20 69 31 98 8a 04 1d b6 88 ad 49 16 72 9a 2f a2 65 50 ff 5a 55 5a 97 37 72 94 24 24 5b 37 cf 9b 9f ad 40 8f cf d8 18 0a 0e 1c 3f f2 30 c1 31 65 88 13 9a c9 8e de 89 b1 0f 0b f2 0e 2f a6 d7 42 be fa f9 20 09 32 ca b6 28 95 b7 ee d0 96 a4 4f 8b 7f fe fe fd df bf fe f8 f0 db 2f 1f fe fc 75 19 d3 94 b2 c5 c5 6c 55 7e 96 15 7b b1 41 09 [TRUNCATED] Data Ascii: Z4)!t3B ]#7qw@6H[Ij'sjir>MA<xwg&_\E'zHfgFGJxSLdx(\~OeZ_+OCf=HP$Z)= i1Ir/ePZUZ7r$$[7@?01e/B 2(O/ulU~{A}fuOx@&}cVjW&GoR781\p`F[9]}AUA<8<o-R)zZ,%BsZ;@k![QO\|l4gelW`"ui#1Mssh (%lQP'x3Ss9*G3zqWh7M4B//2uZefu&`1ha1%mDlIMRIE1Nf7ijWkBg1'zc:12hnuL``0PBv"q5(ZmlBNIN[pJ13TB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49743	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.898591042 CET	377	OUT	GET /4/4_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=0 HTTP/1.1 Host: jzs.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.149647951 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 7056 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:56 GMT Server: F-WEB FAI-W-FLOW: 35495043 FAI-W-AGENT_AID: 0 Last-Modified: Wed, 21 Sep 2016 16:00:00 GMT Vary: Accept-Encoding Content-Encoding: gzip Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i63242_c21843, i2103125_c25795, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 1f 8b 08 00 00 00 00 00 00 00 e5 9d eb 8a 23 49 76 c7 bf fb 29 c4 0c 03 b3 eb d6 ac 54 5d ea 56 ab 31 18 2f 06 2f ac 61 d9 9d 0f 3b 18 b3 a8 aa 54 dd f2 a8 a4 42 ca be 16 fe e8 07 f0 e7 7d 07 fb 01 8c fd 36 06 ef 5b 38 6f 92 e2 72 22 ce 35 aa 4b ea 6e 18 a6 95 19 ff 3c 71 8f 8c df 39 91 7f 7b fd 76 be dd 2d aa c1 37 ef aa db e1 f4 9b d7 3f dc 6e b6 77 bb c1 0f ff f2 79 78 b7 b9 79 b7 5a fc 38 bf fa e3 ef e6 55 b5 d8 ae 27 2f 2e 07 0f 57 9b ed cd 62 3b 5b 6f d6 8b d7 ff 8a dd bd bf 7d b8 9d df 2c df ed 66 23 42 92 f6 86 7f 5c de dc ac 16 bf de ac ab c5 ba 7a b8 9a 5f ff fc 66 bb 79 b7 be 21 3e b7 bd 5e ff e6 cb dc cd b7 6f 96 eb e1 6a 71 5b cd 46 f7 1f 95 32 db e5 9b b7 16 3a d5 e6 de 40 e5 6a 53 55 9b 3b 9a d0 a0 5a 7c ac e6 db c5 fc 61 b5 5c 2f 86 6f 17 6d 4e 2e 5e b0 d2 ce 66 c3 0f 8b ab 9f 97 d5 70 b9 be 7f 57 0d ef 57 f3 eb c5 db cd aa ae 6d 95 6c 7d fd b3 2b 36 f8 d5 2f 07 b7 cb ed e2 76 f3 71 30 9e 0e 07 bf fc 95 d2 ea 40 df 95 7f f5 d7 06 f2 bb e1 fe 5f da 32 69 0b 36 57 ce b7 75 1b 18 de ce [TRUNCATED] Data Ascii: #Iv)T]V1//a;TB}6[8or"5Kn<q9{v-7?nwyxyZ8U'/.Wb;[o},f#B\z_fy!>^ojq[F2:@jSU;Z\|a\/omN.^fpWWml}+6/vq0@_2i6WuO_o7G~g\|X6&Br%vS~74Pmq7_Zw$<bT?owjQ"]'=vrwire?Zxf]/7vLfkv7W_L&Lv4bLdnwI5Wo#_hd~])a?oduhUn8ox!-J]O`nY:wre7&3L]aGO]RH!]}Y?-
Nov 26, 2024 08:19:58.149668932 CET	1236	IN	Data Raw: 8a 97 e3 81 ab f0 c8 a9 1f 54 13 6e 53 ba 6d 85 e3 45 86 b6 e1 ae e1 b0 47 5e bc f5 c0 c2 de f0 8a 16 5a ee 29 4e bb f7 ea e2 db eb cb 51 fd e7 54 d4 f1 96 00 4f 32 dd b0 79 71 29 9c 67 dc b1 f6 39 6d bb 28 b0 83 b7 03 08 26 de ef 07 4e 88 06 54 Data Ascii: TnSmEG^Z)NQTO2yq)g9m(&NTT?,u+}HSi,ir~SrR'!,a_Q\@-V+/)ku-3_/ne_/OH[sJ!e:v-f=e?Lv
Nov 26, 2024 08:19:58.149678946 CET	1236	IN	Data Raw: 0e 98 06 a3 01 c3 d3 5f b9 40 e7 a4 ed f4 40 e7 ee ed b2 70 a0 73 f6 21 8c 40 e7 94 ce c9 04 3a a7 32 60 1b e8 9c 7d 0a 2b d0 f9 72 c2 61 97 f5 dd 5c 76 d9 24 71 5e bd 65 ec b2 16 81 77 27 78 ec 12 93 a1 b2 4b 4c 87 c6 2e 31 15 f2 4e 43 53 c4 52 Data Ascii: _@@ps!@:2`}+ra\v$q^ew'xKL.1NCSRv5d=flTKj=j%M/d{Avn.M\m41TP]zCFD.]ea{K8]&m%LYHC.!+=RgE\|\H^lfs
Nov 26, 2024 08:19:58.149692059 CET	1236	IN	Data Raw: da 2c d1 7a 30 b5 b4 07 30 09 73 a3 a0 06 f9 b1 19 09 90 ef 9d bb dc 72 80 fb f9 b6 5e 92 18 eb 77 8d 12 77 7c e1 ea d2 8f 86 e6 2a 37 07 45 fb a7 51 1b e9 7f 1e 2e d7 37 8b 8f b3 0b d9 eb 05 7f 91 8f ec 0f b8 0d 4c 2d fe 53 51 75 bd 42 ef f3 b1 Data Ascii: ,z00sr^ww\|7EQ.7L-SQuBvWf=PDqw2xBq7\| L1b54B y.ASSSs6>c2T0.B@}vb\OV[cPNKLG1l/q=-1.jZ`\
Nov 26, 2024 08:19:58.149696112 CET	1236	IN	Data Raw: 85 bc 94 28 de bf d1 ee 37 ec 24 8a 7a 5e ca 29 08 22 2f 75 57 2f 40 48 b6 34 3d 8b 97 c6 1a 22 5e 0a ca 48 78 29 28 c4 e5 a5 89 ba 52 f3 d2 6c 2e 25 5a 2e 2f 8d 4e 10 1d d0 8d 61 73 ce f4 c2 59 24 91 42 a5 e8 bb 79 42 44 40 4a 63 25 35 29 05 24 Data Ascii: (7$z^)"/uW/@H4="^Hx)(Rl.%Z./NasY$ByBD@Jc%5)$i43i-Ap?cqf@mW'C+h8{y8-(bbG@Q[BfR%lkQs;]#=g"w7%)Z%!s
Nov 26, 2024 08:19:58.149698019 CET	1236	IN	Data Raw: 6e 00 4a c5 bd 0e 14 89 73 39 77 4d 9e 59 38 00 ad 6b 14 e3 44 63 1b c3 8d 6d 0c 36 b6 71 dc d8 c6 58 7c 55 c2 e0 53 8c 7a 4c 64 25 15 ec 58 bc e0 9f 7a 4b 2e d2 ad db d2 e6 74 eb a7 39 e4 c9 f3 9e eb e5 05 a7 94 bc c1 97 23 0e 2c ab ef e6 46 51 Data Ascii: nJs9wMY8kDcm6qX\|USzLd%XzK.t9#,FQ6IMYe-Y&CtaMk<Y{HXmByHtzC:n^nHiZttu5;.:B#t4qK(f!?5s2"^HC
Nov 26, 2024 08:19:58.149703026 CET	132	IN	Data Raw: 70 9b 9c 5e fd a7 b2 f2 06 12 bd bb ca a6 c7 ce db c5 6a 5e 2d df 4b 85 d2 5e 3d 84 2f dd 32 54 db 19 74 32 fa ce b0 a5 b7 63 fe 10 0f 44 66 88 7a 5f a7 95 77 79 e5 bc c8 f6 6a c2 45 38 33 64 d0 62 b3 5e 4d e3 c8 ab 89 7d f4 77 da 78 ba 57 53 bf Data Ascii: p^j^-K^=/2Tt2cDfz_wyjE83db^M}wxWS5y5}n^M@nO)Y'y53\|^M\|WTi
Nov 26, 2024 08:20:28.821304083 CET	380	OUT	GET /4/2048_1/fkModule.min.css?v=20240808102706&aid=28088389&wid=1 HTTP/1.1 Host: jzs.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:29.219175100 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 7140 Connection: keep-alive Expires: Fri, 24 Nov 2034 03:16:26 GMT Server: F-WEB FAI-W-FLOW: 705436043 FAI-W-AGENT_AID: 0 Last-Modified: Wed, 21 Sep 2016 16:00:00 GMT Vary: Accept-Encoding Content-Encoding: gzip Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i37174_c25891, i2103127_c25795, i1872278_c17483 X-Cache: HIT from i1872278_c17483(cloudsvr) Data Raw: 1f 8b 08 00 00 00 00 00 00 00 e5 9d db 6e 23 49 72 86 ef fd 14 c4 0c 06 98 5d 37 67 45 b5 d4 07 35 0c 18 5e 18 f0 02 6b 60 b1 3b 17 3b 30 8c 05 25 51 dd f4 50 a4 40 56 1f 05 5f fa 01 7c bd ef 60 3f 80 61 bf 8d 01 ef 5b b8 0e 3c 64 56 46 66 c4 1f 11 d5 2d aa bb 81 c1 34 ab f2 af c8 f3 e1 8b a8 fa db ab 37 d3 f5 66 56 8d be 79 5b dd 8c 5f 7c f3 ea 87 9b d5 fa 76 33 fa e1 5f 3e 8d 6f 57 d7 6f 17 b3 1f a7 97 7f fc dd b4 aa 66 eb e5 f9 f3 a7 a3 fb cb d5 fa 7a b6 be 58 ae 96 b3 57 ff ca dd bd bb 7d bc 9e 5e cf df 6e 2e 4e 04 49 da 1b fe 71 7e 7d bd 98 fd 7a b5 ac 66 cb ea fe 72 7a f5 f3 eb f5 ea ed f2 5a f8 dc f6 7a fd 5b 2c 73 3b 5d bf 9e 2f c7 8b d9 4d 75 71 72 f7 c1 28 b3 9e bf 7e e3 a1 53 ad ee 1c 54 2e 57 55 b5 ba 95 09 8d aa d9 87 6a ba 9e 4d ef 17 f3 e5 6c fc 66 d6 e6 e4 f4 19 94 f6 e2 62 fc 7e 76 f9 f3 bc 1a cf 97 77 6f ab f1 dd 62 7a 35 7b b3 5a d4 b5 6d 92 ad af 7f 0a c5 46 bf fa e5 e8 66 be 9e dd ac 3e 8c 26 2f c6 a3 5f fe ca 68 75 4f 3f 94 7f f9 d7 0e f2 9b f1 ee 5f d6 32 69 0b b6 54 ce 37 75 [TRUNCATED] Data Ascii: n#Ir]7gE5^k`;;0%QP@V_\|`?a[<dVFf-47fVy[_\|v3_>oWofzXW}^n.NIq~}zfrzZz[,s;]/Muqr(~ST.WUjMlfb~vwobz5{ZmFf>&/_huO?_2iT7uLo_T~i,h#v]]l^rMl?UfM#?;-fty_OFn$Zwh>.f*I/iZ\M^vznh8bYGx=]5;Ov_lfo'g/LMmljmp5Y]v7r=#G}M,!>j^?g8y.iDW"Rs`AP0My7z#Mmjn+7)Sm0O#_zm [jaOYj
Nov 26, 2024 08:20:29.219326019 CET	1236	IN	Data Raw: bb c2 4f 46 8b bf c2 72 3c 0a 15 3e 73 ea 7b d3 84 db 94 6e 5b e1 7c 91 b1 6d b8 6b 38 f0 c8 cb b7 1e 5a 38 1a 5e d9 42 2b 3d 25 68 f7 51 5d 7c 7b 7a d9 fc 3d 16 75 be 25 d0 93 4c 37 6c 9e 9e 29 e7 99 70 ac 7d 2a 3b 2e ea d9 81 9d 00 92 89 77 e7 Data Ascii: OFr<>s{n[\|mk8Z8^B+=%hQ]\|{z=u%L7l)p}*;.wBofw.)}&PaTAwEz>]\|SvV7Pps~945/"Ag{dZzzy]L[Wc-\{e}Hm9Nc.7jZ^leG?
Nov 26, 2024 08:20:29.219341040 CET	1236	IN	Data Raw: 48 2b d8 ee ee 90 d1 b4 35 5b dc dd 81 d3 00 1a 30 3d fd 0d 17 e8 9c b5 5d 1e e8 dc ed 2e 07 0e 74 2e 3e 04 08 74 ce e9 1c 4d a0 73 2e 03 be 81 ce c5 a7 40 81 ce e7 e7 08 bb ac ef 46 d9 65 93 24 d8 7a eb d8 65 2d 42 9f 4e 60 ec 92 93 91 b2 4b 4e Data Ascii: H+5[0=].t.>tMs.@Fe$ze-BN`KNG.9ICSZvud?Y.>Q]J.6b7} dRvTjVvs`n1nfEr(mR&/D.L.Itz]&:vI%%KK]16
Nov 26, 2024 08:20:29.219424963 CET	1236	IN	Data Raw: a6 63 ad 59 61 bb de ae 57 b0 72 ad 67 c7 69 75 d1 18 81 b7 a3 fd db 66 85 d6 93 a9 b5 3d 00 24 cc 8d 82 19 e4 a7 66 64 40 7e f4 de e5 96 03 dc 4d d7 f5 92 c4 59 bf 6b 94 bc e3 0b aa 2b 7f 35 34 aa dc bc 28 3a 7e 1b b5 93 fe a7 f1 7c 79 3d fb 70 Data Ascii: cYaWrgiuf=$fd@~MYk+54(:~\|y=pq^\|\| l`fU+l}>V[-[ogh;\|qh,p<kFSi'F^C-MO>K3wI(0n-B`H1.#)b-:bH}yqhwh
Nov 26, 2024 08:20:29.227504015 CET	1236	IN	Data Raw: be 9a 95 97 f6 f5 1c 78 69 34 a4 5b 44 8c bc b4 9b bd bd 79 e9 61 d1 31 2c 2f dd af 3d 4a 9b 78 2d 2f 95 89 6f 77 b4 bb 03 3b 8d a2 03 2f 05 0a 42 ca 4b 83 d5 0b 11 92 ad 4d 8f f1 d2 44 43 c7 4b 29 19 15 2f a5 84 60 5e 4a d7 95 9d 97 96 72 a9 d1 Data Ascii: xi4[Dya1,/=Jx-/ow;/BKMDCK)/`^Jryisf**&JvRJAshZ;9k6m~yZ;%I-^VF\|6P;CI&#yLG3f FFEK3&fbEoIUra; g^-G\|pG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49744	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.898788929 CET	349	OUT	GET /js/comm/vue/vue-2.7.14.min.js?v=202310161432 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.155606031 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:04 GMT Server: F-WEB Last-Modified: Mon, 16 Oct 2023 03:14:17 GMT Vary: Accept-Encoding ETag: W/"652caa89-1a8c1" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC168_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC204_lt-obgp-fujian-xiamen-33-cache-2, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 32 34 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bc bd 79 73 db 46 b3 2f fc ff fd 14 12 cb af 02 1c 8d 68 29 79 ce 12 d0 08 cb f1 12 3b f1 16 5b 71 92 47 d1 51 41 e4 50 82 4d 02 0c 00 4a 96 45 de cf 7e fb d7 3d 1b 40 c8 c9 53 e7 de b7 ca 16 81 c1 ec d3 d3 d3 fb dc ff b7 dd ff b5 f3 6f 3b ef 57 7a f8 a1 de b9 fa 7a f8 9f c3 a3 7f 20 25 9a c4 3b 5f 1f 1e fd e3 e0 eb c3 af bf d9 79 72 95 15 3b bf 97 2b 7c 79 ab e7 3a ab f5 74 67 55 4c 75 b5 d3 5c ea 9d 97 cf 8f 77 5e e4 13 5d d4 7a 48 59 ee ff af fb ff 6f aa dd 9d ad 8a 49 93 97 45 d4 28 1d df 0e ca f3 0f 7a d2 0c d2 b4 b9 59 ea 72 b6 a3 3f 2d cb aa a9 f7 f6 06 a8 64 96 17 7a 3a d8 b5 1f 17 e5 74 35 d7 63 f9 19 9a ac a9 8e e2 64 60 ab f5 35 49 e9 bd 3d f9 1d 66 8b e9 58 1e 23 1d 27 51 93 f6 35 70 31 2f cf b3 f9 f1 65 5e 8f fd 63 d2 ac d7 b5 9e cf e2 21 4d 06 5a db 44 0d 25 ab c8 0d 85 c6 b1 aa f5 4e dd 54 39 8d 65 74 95 d1 e0 d3 d7 3c b2 e1 ac d2 fa b3 8e 6e 37 b1 d2 e9 c3 aa ca 6e 86 79 cd bf 23 5b 7e 87 26 23 be ad 74 b3 aa e8 79 35 9f d3 18 36 ee 63 [TRUNCATED] Data Ascii: 24ccysF/h)y;[qGQAPMJE~=@So;Wzz %;_yr;+\|y:tgULu\w^]zHYoIE(zYr?-dz:t5cd`5I=fX#'Q5p1/e^c!MZD%NT9et<n7ny#[~&#ty56c~,U.YqF4(Vs]y9o%-k0AYAqwnbnYMO\|Cs>zv)Nl><xE:]fU^LweYPIy4/Fj#RzfbH$k&60:e^qkz)T7NwB7y*{E7dhbP5t
Nov 26, 2024 08:19:58.155669928 CET	1236	IN	Data Raw: 46 73 83 f6 62 55 a5 cd b0 5e ce f3 26 1a a8 41 ac ca f4 70 54 3e a8 86 73 5d 5c 34 97 a3 72 7f 3f 2e 4e aa 93 f2 f4 34 dd 3d 74 f3 3e f6 b8 c1 cf c0 09 06 f8 a2 bc d6 d5 23 c2 2d 51 7c ba 49 fa b3 9d 6e 18 78 2e d3 ab 68 50 cf cb 46 4d ca c5 b2 Data Ascii: FsbU^&ApT>s]\4r?.N4=t>#-Q\|Inx.hPFM,taQJgzR.AaB(klYTWcGii2M09aOP)$34Qb6_fMEgIM]7)_5fpt6nzw/qPy
Nov 26, 2024 08:19:58.155677080 CET	1236	IN	Data Raw: 58 99 8f 87 9b 98 77 e5 7b 3e 0e df ea 8b 27 9f 96 d1 e0 e4 bf 07 43 ca 47 f8 28 fa 65 58 97 ab 6a a2 d5 60 78 ef ec 8f 3f a6 a7 03 43 2e fc 94 0e ce ce 98 50 38 3b 1b e4 05 1d 6e 3f f6 f2 98 d7 44 25 94 d7 ea cf f4 c7 bd 3d 79 1e 16 d9 55 7e 91 Data Ascii: Xw{>'CG(eXj`x?C.P8;n?D%=yU~5e5$6zxA&I{{utL)aC33V?9@oCC^2j6X~%u?eE\?1eV4C~,JQX5Qk\|U>&,clO
Nov 26, 2024 08:19:58.155745983 CET	1236	IN	Data Raw: 8e ed 94 72 9e 70 79 90 b3 35 f8 f5 3a ea 4c 06 a6 cf f4 92 3e c4 dd 1d 40 f3 41 39 7d 3f 35 f5 93 4e f1 ea 42 33 71 2b 4f 98 82 c7 7a 29 35 b4 cb 17 65 93 cf 6e b6 c1 64 d4 19 80 ef 7f 08 b5 80 05 2f 5a 24 c4 60 31 02 e7 34 bb 93 98 23 27 70 7c Data Ascii: rpy5:L>@A9}?5NB3q+Oz)5end/Z$`14#'p\|PHhO:t<cx;+_$_\FaN@p3cG]\.!g$HeZN4CO2bls**=U!<jzY#%Uf6Yy
Nov 26, 2024 08:19:58.155751944 CET	1236	IN	Data Raw: a6 75 3a bf 4d 07 2b d7 c1 4a 08 d5 14 92 8f 1d ae 2c 6a e5 ef 6a 8d aa 71 91 54 dc 43 93 9b aa 6f 98 2f dd 04 ab 56 da 55 2b 7d 77 7e 0c 61 f9 4f de 29 47 41 6f ff f4 40 c1 a7 bd 07 0a 4a 79 d6 07 26 7a 3c 30 fb e0 b8 34 20 61 81 75 90 f8 4f 2e Data Ascii: u:M+J,jjqTCo/VU+}w~aO)GAo@Jy&z<04 auO.M!mXxj!5Npga0):&S8v.dDfr2Ba"'O2UsI+7n^gusb`?G#-\|.i SvML
Nov 26, 2024 08:19:58.155765057 CET	1236	IN	Data Raw: f1 5b 98 67 ef 1b 1a e3 96 30 75 45 87 4c 8a 23 9e ce 9a 52 24 09 3b 00 e8 2d c7 b0 ed aa ad 47 4f 13 56 54 ee 1f 85 f5 80 b6 c6 5e ab c1 a3 9d 88 69 d8 30 6f 88 1c 6e ca ea 34 be 5d d9 83 84 4d 93 d2 ed 2c 10 83 a5 f3 61 41 d8 94 b0 c6 ee 6c 48 Data Ascii: [g0uEL#R$;-GOVT^i0on4]M,aAlH<+AQ:"jY7Ne$LR\3(aB;tai-X-\|@ho7qt%>Q,.SK!`K)a}2 9"wRohI!-8"\|
Nov 26, 2024 08:19:58.155771971 CET	1236	IN	Data Raw: d4 ef e1 3c 2e 0d 8c b6 85 ad 44 5b 72 6c 8c 3c a5 83 bb ea 09 09 c1 07 3b ad f5 98 b6 6c d2 e0 09 62 06 9a 4c 3b 0b 2b 1c a0 4c 2e ef d2 4c 81 a4 ac 9c b3 69 de 02 d4 6b c8 0b 62 6b b7 50 39 ed 4a 69 f1 f9 1d 8e 45 34 6c 36 63 cd d5 17 e5 f9 9b Data Ascii: <.D[rl<;lbL;+L.LikbkP9JiE4l6c}l;No:b\|3~eNx+#+N=!5tzxs+yV]h&v5}TV*q->L;EMfaI2)S^fi^E$h'#l@\|
Nov 26, 2024 08:19:58.155941010 CET	1236	IN	Data Raw: 08 12 43 f4 c8 76 39 cc f3 6a 19 06 3d 9b b4 c3 59 cd 9c a1 cd 2d 4f 67 32 c0 a6 1c 98 ad bd 2a d4 9c cd 0a bd 18 b7 88 5a 34 ae 43 c8 e5 b8 49 4a 62 d0 89 17 23 46 6c 9a 13 d8 30 1e 9d 6a bd 54 2b 7a e0 ea d5 dc 97 58 8d 07 cb 4a 0f 92 d5 28 1f Data Ascii: Cv9j=Y-Og2*Z4CIJb#Fl0jT+zXJ(Qcd[-#NA\|P v%D`Cq4mvK]0I}r{#KVlzE--^2P6/+\|XYk'-/BH\|JeB1/%$;
Nov 26, 2024 08:19:58.155952930 CET	1224	IN	Data Raw: 99 a8 8f da 2b 44 ed 52 c1 fd a3 f8 ff fb 9a 9a 90 18 5c be 3e bb 46 5e d1 50 04 d2 5a 20 a9 73 13 ff 24 6a 13 65 0d ef 28 1f 41 b8 bd 41 b5 1a c0 80 ee 38 07 4f 69 48 2c 58 2c 6b de db f7 60 11 04 98 26 d2 b9 80 39 35 68 8f 2f 80 66 1c 44 70 32 Data Ascii: +DR\>F^PZ s$je(AA8OiH,X,k`&95h/fDp2ImRNTa&tE--GltQElT@jX-EJMW R0W$"MScI1UcRzns/$X5Vo%5d82_5VO6jvVeBK.y/78w} 4
Nov 26, 2024 08:19:58.155960083 CET	1236	IN	Data Raw: f6 36 45 cc 80 c5 9b d1 5d f6 84 b7 13 0f 22 74 7c f2 52 d2 e6 33 ab 96 d4 72 ff 41 52 29 03 0c 49 01 d1 6c 59 7c ef 59 9e e4 61 41 09 46 46 9f 7c 28 dc 57 61 75 92 27 48 91 e7 69 f2 2a f8 5c 30 8b 94 bc e1 ef 85 e1 97 92 c7 78 7d 68 b9 98 e4 25 Data Ascii: 6E]"t\|R3rAR)IlY\|YaAFF\|(Wau'Hi\0x}h%^{&yw-&y!;+<E8.T'O$XgpY5S'd\ Z?TqL:Ql(HV-G(>[!Nh9lfYXN$*U`?:IP\|bJ
Nov 26, 2024 08:19:58.275772095 CET	1236	IN	Data Raw: c0 a7 16 bf 67 c9 95 81 7a 74 93 81 5e 8c fe 11 cc 36 1e d1 02 b9 f8 d6 fb fb 1b be 51 c0 47 5e 7d c2 11 44 79 ae d0 f3 30 ea 2a 65 2e 86 56 0c 7f 17 12 38 b3 19 9c e5 5b ff 9d ca 10 c2 b7 65 70 da 0e 89 23 86 d5 29 4b df f2 24 07 ea 1b 55 ec 3a Data Ascii: gzt^6QG^}Dy0e.V8[ep#)K$U:%"o{ 3HY@MkD)/JB iSlweYL\|wy52g@5`op>;i`MSLnsV{mEnN
Nov 26, 2024 08:19:58.436973095 CET	341	OUT	GET /js/dist/module.min.js?v=202410281356 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.838712931 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 28 Oct 2034 06:52:46 GMT Server: F-WEB Last-Modified: Mon, 28 Oct 2024 05:56:29 GMT Vary: Accept-Encoding ETag: W/"671f278d-46880" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i91728_c21603, i2103125_c25795, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 33 63 66 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 73 dc 58 76 20 f8 57 92 68 99 05 34 91 a9 4c 4a a5 2a 21 05 a5 55 94 e4 62 b5 5e 16 59 55 dd cd e2 64 80 99 97 24 24 24 90 0d 20 f9 28 32 37 76 c2 e1 c7 cc ce ac 3d e1 1d 7b 66 36 76 3d 9e f0 3c 22 26 c2 f6 6c ec 7a 77 7a dd 33 7f c6 ea c7 27 ff 85 3d e7 dc 07 2e 80 8b cc 24 a5 52 57 f7 ba ba 43 4c dc f7 3d f7 dc f3 ba e7 9e bb 76 38 8b 47 79 98 c4 76 ee 32 e7 c2 4a 0e 5e b1 51 6e f9 7e 7e 3e 65 c9 61 8b 9d 4d 93 34 cf d6 d7 6b 39 93 64 3c 8b d8 80 ff e9 88 72 3e b3 53 f6 a3 59 98 32 db ea dc 7c f5 f5 61 9a c4 39 8b c7 37 0f c2 af db d9 71 90 32 fa b9 43 bf 3a 93 30 ee bc ca 2c c7 35 d7 c1 54 96 e5 90 f4 92 ff 5a 56 61 96 87 51 06 09 9f e3 5f 55 d8 f1 2c 39 c9 62 f4 63 76 18 c6 6c 7d 9d ff ed 04 93 f1 80 ff b4 ad e1 f0 b3 1f 0e 3f 7f fa 70 38 b4 dc 3d d7 dd 07 b8 78 4d 70 19 88 bf 9d a2 d2 b7 13 04 76 ae 0f 51 ff b8 bc bc 98 bb 7a 42 87 2f 29 cc 23 ef a8 81 42 09 35 06 fa 4d 1d 38 ce dc ce 8f c3 cc b5 15 1a 0d 87 5f 3e fa e4 c5 83 ad ef 0d 1f [TRUNCATED] Data Ascii: 3cfbksXv Wh4LJ*!Ub^YUd$$$ (27v={f6v=<"&lzwz3'=.$RWCL=v8Gyv2J^Qn~~>eaM4k9d<r>SY2\|a97q2C:0,5TZVaQ_U,9bcvl}?p8=xMpvQzB/)#B5M8_>}g>Gao]P`%zs\|-%,c,OCXISv0F\|2L[=OGw7t.fOkM5Z&&>M!3v1O,"<mEAyd8<p{Ka1,WqKgm`>7lRvUd2Ia\|I,~1~z,$sD,>KrEL3"c~'\jcc}0>+vgFa8p=p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49745	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.898943901 CET	350	OUT	GET /js/dist/libs/comMethods.min.js?v=202402281530 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.249689102 CET	1118	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 05 Aug 2034 03:11:22 GMT Server: F-WEB Last-Modified: Thu, 22 Feb 2024 07:30:21 GMT Vary: Accept-Encoding ETag: W/"65d6f80d-43c" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC205_dx-lt-yd-jiangsu-taizhou-4-cache-12, BC85_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC194_lt-obgp-fujian-xiamen-33-cache-1, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 31 39 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dd 92 3d 6f db 30 10 86 ff 8a cd 41 20 61 96 6a d7 04 84 86 16 1d 8a ba 0d 5a 78 c9 97 c0 88 67 98 85 cc 63 49 2a 76 21 e9 bf 87 b6 94 d8 40 1d 4f 99 32 dd c7 7b 3c de 3d e4 74 d9 d8 2a 1a b4 14 38 b2 96 e0 c3 1f a8 22 91 32 fe 73 80 cb 09 6c 1d fa 18 b2 ec 3f 65 8d ba a9 a1 18 8c 18 eb 24 52 76 41 9e 7b 1e 8a 35 2c 8d 85 2c 1b ac 50 6b 5d 0c 2e 25 65 f9 ed ba 5c cc bf 94 25 e1 37 77 69 88 8b d7 86 28 46 2b 0e 47 f6 f7 51 38 ce 1c 07 5d d7 f6 fc 38 71 43 6a f3 10 f2 0a d7 73 88 2b d4 81 dc ed 5a b0 9e c6 95 09 9c be d0 60 ad 87 d8 78 3b d9 18 ab 71 23 7e 9b 08 5d 47 8f 22 d9 f6 8c ef 1c a1 b4 fe 05 7f 1b 08 f1 ca a7 a5 b6 f2 c0 94 b5 8f ca 4f 30 0d 65 61 73 a5 e2 8a c7 e4 63 ad f7 be 49 7e 13 e0 47 92 f6 07 b9 95 8f 68 f4 e4 a3 94 d2 74 9d e1 fa a5 80 ab 51 9a 4a a9 13 47 ee 24 69 ec c0 50 93 e9 33 a9 af ca a4 a7 3a 2d 88 88 ee ac 28 ca aa f1 df 95 fd 8c 1a 78 29 53 f1 87 4f e9 ba 71 e7 1a 2b b5 5b 4a b8 34 ba 55 6b 10 29 0f db 9f 4b 4a 72 32 3b d1 62 96 [TRUNCATED] Data Ascii: 198=o0A ajZxgcIv!@O2{<=t8"2sl?e$RvA{5,,Pk].%e\%7wi(F+GQ8]8qCjs+Z`x;q#~]G"O0eascI~GhtQJG$iP3:-(x)SOq+[J4Uk)KJr2;br.EYjUoYI5!4Iyn5\|F<0
Nov 26, 2024 08:19:58.251570940 CET	356	OUT	GET /js/comm/jquery/jquery-ui-core.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.671224117 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Thu, 21 Sep 2034 20:32:12 GMT Server: F-WEB Last-Modified: Mon, 09 Jan 2023 10:05:16 GMT Vary: Accept-Encoding ETag: W/"63bbe6dc-381d5" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC148_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC204_lt-obgp-fujian-xiamen-33-cache-2, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 32 39 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 0b 77 db 46 92 28 fc 57 24 ec 1c 07 08 9b 14 65 cf 2b a0 60 ae 63 39 1b df 89 1f 9f e5 38 33 ab d1 f8 40 64 4b 42 42 01 5c 02 b4 ac 88 fc ef 5f 55 f5 bb d1 20 29 3b 99 9d b9 37 39 27 16 d1 ef ae ae ae ae ae ae c7 c5 b2 9c 34 45 55 ee bd 6f 6e e7 bc ba 88 9b e4 6e c1 9b e5 a2 8c 65 4a 16 5d c8 32 51 96 89 a4 bd 93 db eb f3 6a f6 e0 41 54 d3 0f 3f 63 50 34 7c 91 37 d5 62 7c d1 d9 fc 9e ac d1 ac d3 4d 85 a0 8f ee ee 9b c1 a4 2a eb 66 b1 9c 40 5f 59 96 e9 f4 7d f5 7b 30 5f 54 4d 85 d5 c6 6a ac a9 ee 38 81 8e d6 fb aa f9 78 c1 66 c9 9d 1e 4b 1d 37 8c 27 77 1f f2 c5 5e 91 35 83 b2 9a f2 97 f9 35 1f 34 d5 77 d5 0d 5f 3c cd 6b 1e 27 a3 e2 22 8e f2 05 cf 23 e8 b1 48 24 e0 0e 8a 72 be 6c 56 35 9f f1 49 b3 6a f8 c7 06 8b ac ce 97 4d 53 95 ab ea fc 47 48 3e 18 34 bc 6e e2 22 19 ef 37 83 69 51 e7 e7 33 3e 4d a3 1c 26 59 e0 c4 ae 16 fc 62 b5 e2 c9 83 07 25 8c 72 84 43 98 43 2b 65 f3 12 06 c2 78 56 0c 4a 18 cd 48 f4 b8 1f ef ab 1a fb 7c b5 8a ae f3 39 0d a8 63 d4 [TRUNCATED] Data Ascii: 292wF(W$e+`c983@dKBB\_U );79'4EUonneJ]2QjAT?cP4\|7b\|M*f@_Y}{0_TMj8xfK7'w^554w_<k'"#H$rlV5IjMSGH>4n"7iQ3>M&Yb%rCC+exVJH\|9chlGP#{Y_$k~q2]b+kU1r\l1,OONYbV4QZ-\|!L`j,Y>@ioH\|W/#}`I\|6=3~Ygz=}(gqg<o!$\|w
Nov 26, 2024 08:19:58.671334982 CET	84	IN	Data Raw: d8 f1 b3 ef 9e bd 7d 96 fe fe 8f ec f8 d5 0f 2f d3 df 0f d9 33 68 e4 d1 1f e0 cf db 67 6f d2 c3 47 ec d9 09 f4 f8 2c 7d f8 27 f6 ed ab 17 cf d2 47 7f 64 cf 5f 9e 3c 7b f3 36 fd fd 1f 18 f5 f0 e8 4f ec c5 b3 97 df 63 c3 2f bf 7f f1 fa c9 f1 fb 27 Data Ascii: }/3hgoG,}'Gd_<{6Oc/'
Nov 26, 2024 08:19:58.671344995 CET	1236	IN	Data Raw: 33 66 66 38 0d 0a c7 c7 e9 e1 f0 4f ea f3 f8 d9 d3 e7 2f 9e 40 77 87 43 9d f4 fc dd f3 e3 67 90 72 a8 52 64 7f c3 3f ab 84 17 df 7f f7 f6 f9 eb ef fe 06 69 7f 54 69 27 df 7f fd f6 cd 93 a7 00 93 e1 57 ec f5 93 ff 7a f6 9e 46 fd e8 f7 e2 e3 fb d7 Data Ascii: 3ff8O/@wCgrRd?iTi'WzFG7_21G_oH=do\|~_B;':(?iEJ?sHd/yMY1\^\|h3GMY7ok^-a8a$R9X')*6@\|q
Nov 26, 2024 08:19:58.671381950 CET	1236	IN	Data Raw: 8e ca 23 75 a6 8f ca 5e 2f 69 06 d5 1c 5b 87 fe 4f cb 33 a8 77 86 47 3d fc 3a 3c 53 cc a8 6a 94 21 92 31 b8 1f 37 39 f4 6a c6 35 b7 09 c5 9e 41 a8 ea 1a 87 70 2c bf 5f 4b 96 60 7c f8 c7 07 9d 99 b0 66 29 32 2f 5c de c4 a9 27 48 5c b3 ab bc 3e 21 Data Ascii: #u^/i[O3wG=:<Sj!179j5Ap,_K`\|f)2/\'H\>!^{!uDfIap$z4CqzjNT~3Ovy"75+Wkv{o^,3duHXOP/G?sUl!zVd8.3Y
Nov 26, 2024 08:19:58.671394110 CET	1236	IN	Data Raw: 8b d8 9d 3e c6 26 79 39 e1 b3 34 4a e9 a1 51 52 85 08 31 a1 c1 9c f4 10 48 26 5c a1 e1 e2 ce de 53 e5 e7 0e 55 6d d4 4b 44 e7 41 a3 e5 a7 9b ce 1a 23 45 e1 03 d1 cd 31 d4 a0 eb 82 6c 66 02 8c d4 4f 5b 9a 00 6c da 47 a2 55 4a 36 42 ae 3b e3 56 85 Data Ascii: >&y94JQR1H&\SUmKDA#E1lfO[lGUJ6B;V^OEZv}Q+{}`z?Qj_%HPIYiF< {H^juyUz~[.S.')(Me%7N^\+`c$\|_m>.S
Nov 26, 2024 08:19:58.671401024 CET	1236	IN	Data Raw: 39 87 8d 2b 7a 00 9a 2f 07 b5 2c be cd 91 8e 26 2c 88 1c 0e b5 55 cf e5 b5 a2 4f e2 e0 ca 6c d9 bc 38 eb cc e5 79 82 b4 5d 24 a2 58 02 f6 98 dd 80 c8 7e 41 aa 49 3a d1 3e 6d 32 fd c6 70 62 a5 c6 01 9a 6a 41 dc a3 ab b2 d4 1d f2 28 56 c2 00 be fb Data Ascii: 9+z/,&,UOl8y]$X~AI:>m2pbjA(Vc)n1LY'"eVavGN<5FQ;5-3~fM72EY;)F29)AZP0$hL77FHLh?`jZ]Q![Scze6I/
Nov 26, 2024 08:19:58.671415091 CET	1236	IN	Data Raw: 0e c6 02 d5 dd 67 16 e2 e6 14 ab d6 d5 4f b5 6c 3e af 83 6c 98 38 d4 c7 da 52 aa 6f 97 4a 5b 66 43 52 24 d2 99 ef 18 5b 05 8a da eb bd 1f 5a 6f d9 41 e0 23 38 10 79 87 14 bd c6 89 2b f8 63 77 f2 f1 8e a0 a5 f0 d1 3c ce c9 8f f7 65 f5 0d 0e e8 04 Data Ascii: gOl>l8RoJ[fCR$[ZoA#8y+cw<epFa/"X?HYx(ZM!!HK(JJY";00I-icgSIq(I/I9)bSEP,4ydtk ~$Bg34nd
Nov 26, 2024 08:19:58.671520948 CET	1236	IN	Data Raw: 11 f2 3a 25 aa 76 09 d8 a8 d6 4f 20 fb 5d 2f 20 1d c9 b5 22 7e fb e1 e7 11 29 a6 6e 5f 38 a5 0f a5 b1 47 60 fc 7c 26 3a 48 52 f1 97 a1 a1 97 bc 13 02 4e 58 6e dd 50 23 47 2c 85 4a ff 56 3e 87 a2 03 89 c2 88 c6 05 83 98 89 f7 2c 46 cc 6a 46 cf 4f Data Ascii: :%vO ]/ "~)n_8G`\|&:HRNXnP#G,JV>,FjFOp{eTrn%;<"i\=.!eldKAkWfGmAHRP";6/uus;9y_\;X`&FO}rlJMiM\|}p
Nov 26, 2024 08:19:58.671531916 CET	1236	IN	Data Raw: ac 65 62 67 86 f8 5a 0d b1 45 7c 9c 53 5d 11 0c 5b 6e 67 1f e7 76 be 16 c3 09 57 08 96 8d a8 e9 f6 67 75 78 a1 a9 b8 fb 26 ae b8 19 72 d2 6b 5b 9d c6 ce 77 d6 a9 03 09 24 57 6d 5f c0 48 af 91 48 98 89 f8 19 4a 52 60 77 70 3a 74 b4 92 15 96 6f 54 Data Ascii: ebgZE\|S][ngvWgux&rk[w$Wm_HHJR`wp:toTfuUUXeqc?X\|N$!>IZ\C:WTf9HrVm=k8)I$y*Xy6i5b=)J&4g^Poj%
Nov 26, 2024 08:19:58.671544075 CET	1236	IN	Data Raw: d4 80 39 85 f5 d0 5a 23 dc 80 df 97 81 a4 bc 25 16 61 e2 8e 61 d5 42 5f 3f 64 e9 c1 6d 2c 66 35 70 f4 d0 37 c6 62 54 3a dc e4 15 03 55 72 b5 7f 0d c2 19 c5 8d b0 3b a0 b1 e8 b7 21 8d fe f3 dd b3 37 27 cf 5f bd 8c d6 d2 81 91 c4 2b 8c af 1a 99 50 Data Ascii: 9Z#%aaB_?dm,f5p7bT:Ur;!7'_+P\sjW\ZDyM[7#DFJ\>J~"Oor~%:5>-AJvNR]^8a 8@wOgg>zUj#mdR*g<+{d%/-$
Nov 26, 2024 08:19:58.679804087 CET	1236	IN	Data Raw: 7c 66 87 c5 4e c0 2c 04 30 a7 9f db d9 8e c0 2c 04 30 97 9f df dd 8e c0 2c 04 30 7f fa cc 0e ab 9d 80 59 09 60 7e fc dc ce 76 04 66 25 80 79 fc f9 dd ed 08 cc 4a 00 73 ee 76 88 52 a2 9d fa ab f5 6d 8e 5e a3 5d a6 f6 95 74 4e 89 61 bf 5f 66 35 30 Data Ascii: \|fN,0,0,0Y`~vf%yJsvRm^]tNa_f50'V_?@_?/L77'VRt?0<a\|jOa.`x}9p[Rz)^)01o)GW^,k-<NRx):
Nov 26, 2024 08:20:02.675673008 CET	350	OUT	GET /js/dist/libs/photoSlide.min.js?v=202408061027 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.094769001 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 05 Aug 2034 09:17:15 GMT Server: F-WEB Last-Modified: Tue, 06 Aug 2024 02:27:04 GMT Vary: Accept-Encoding ETag: W/"66b189f8-59b0" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC33_dx-lt-yd-shandong-jinan-24-cache-3, BC92_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC205_lt-obgp-fujian-xiamen-33-cache-2, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 31 61 38 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d5 3c 0d 77 db 36 92 7f 45 66 6f 1d 32 82 68 c9 6d da 2e 69 d8 db f5 b6 1b e7 a5 4d 6e 95 b6 f7 ce e7 f3 a3 49 48 44 42 91 5c 92 92 9d 58 fa ef 37 83 0f 12 a4 28 d9 4e db bd bb 97 e7 88 04 06 5f 83 f9 1e 80 07 b3 65 1a 56 3c 4b ed 8a 64 ce bd 95 dd bc 67 61 65 51 5a 7d cc 59 36 1b b0 bb 3c 2b aa f2 f0 70 ab 66 91 45 cb 84 9d c9 1f 57 c1 d1 cc 76 3c 4b f7 d9 00 47 6c c6 53 76 78 28 7f dd 60 11 9d c9 47 db ba be 7e f5 9f d7 3f ff f8 b7 eb 6b 8b 5c 5e c1 24 bc 5d 93 38 53 bf 6e d3 44 8c 67 57 66 89 f9 b2 5e df 6f 88 59 70 69 25 fc a6 3c ca e3 ac ca a6 09 8f 98 75 85 5d 38 1b bb 8a 79 49 ec 1a 1b ce 7d c1 aa 65 91 0e 8c 92 55 50 0c 00 4b 84 13 46 52 12 90 88 c4 be ae 1e e4 76 55 b7 c9 69 0f 0a a6 1f 17 37 59 02 88 2c c5 43 b7 c2 e5 15 2b 82 2a 2b ce 9a 1d a9 3b 54 90 d5 c6 eb ab 84 3e 77 0f 57 b9 61 96 96 55 b1 0c a1 6f 4a 69 5d 7e a0 9f dd bc 00 6c 60 b3 33 3d 37 af 1e 90 e0 ba 36 f5 2a 4b 63 5c 73 2a 7c 66 7f 57 14 c1 47 97 97 e2 17 ca 1c 05 96 60 07 f0 [TRUNCATED] Data Ascii: 1a8a<w6Efo2hm.iMnIHDB\X7(N_eV<KdgaeQZ}Y6<+pfEWv<KGlSvx(`G~?k\^$]8SnDgWf^oYpi%<u]8yI}eUPKFRvUi7Y,C++;T>wWaUoJi]~l`3=76Kc\s\|fWG`^wXT@dtg./;ZuRJ%0+EH0A}`m1mhsFd(G4t eCfKFh67s1E2wab\UI+xv=zIYNXYi-v;XEu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49746	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.902080059 CET	347	OUT	GET /js/dist/libs/jzUtils.min.js?v=202404081140 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.204968929 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:04 GMT Server: F-WEB Last-Modified: Mon, 08 Apr 2024 03:40:40 GMT Vary: Accept-Encoding ETag: W/"66136738-29be" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC178_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC195_lt-obgp-fujian-xiamen-33-cache-1, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 32 39 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dd 5a 6d 6f 2b c7 75 fe 2b e4 20 26 76 a1 d1 8a 94 a8 fb 42 de 0d 43 4b 54 ae 5c 49 57 15 a9 3a ae 2c 2c 56 e4 90 5a 69 b9 c3 ec ce 5e 5d 85 24 60 b8 2d da 1a 76 db 00 71 d1 b4 0e 9a 7e 08 6a 14 a8 af bf 14 c9 87 18 fd 2f a9 af 7c fd a9 7f a1 e7 cc ec cb 2c 49 d9 09 d2 a2 40 60 5f 91 73 e6 cc cc 79 79 e6 cc 99 33 2c 0f e3 a0 2f 3c 1e 18 82 32 73 4a f8 c5 15 eb 0b 62 db e2 76 c2 f8 b0 c4 5e 4c 78 28 a2 4a 65 a9 67 cc 07 b1 cf 5a ea c3 4a f8 6c 66 98 0d 92 ce 99 33 0f d8 d0 0b 58 a5 a2 3e 2d 77 3c 68 a9 af 06 71 9c b7 fe d4 39 3d dc 75 1c 42 cf ce 41 88 c6 7d 42 b4 92 4f 2b 1f 22 d7 33 84 4e d1 1b b3 d9 74 4e 75 c2 19 f1 bd 8b 68 e3 ea 47 a7 c2 f3 23 72 8e e3 cd b9 21 2e bd 88 1a 99 29 cc 69 c8 44 1c 06 25 8d f2 dc 0d 4b c2 9e d6 1f 3c ae 3e 6a e8 46 a3 dc 9c a6 ed 12 50 b2 c1 81 bd c2 10 dd db f1 05 f7 c1 9c 91 fc b2 d8 61 79 82 85 ae e0 61 2b 5f 22 9b 30 e1 14 f3 c6 aa 4e 98 f3 fe e5 84 d5 e7 41 24 c2 b8 0f 73 db b6 9d d1 cb e9 77 6b 12 72 c1 71 58 2b 95 [TRUNCATED] Data Ascii: 296Zmo+u+ &vBCKT\IW:,,VZi^]$`-vq~j/\|,I@`_syy3,/<2sJbv^Lx(JegZJlf3X>-w<hq9=uBA}BO+"3NtNuhG#r!.)iD%K<>jFPaya+_"0NA$swkrqX+-Hqye2fv0gH\62W`3~,cPg5dCor3+#nBO$}&}&a)\|BqxxnM\P0soh(+"M8KL#q==gM{RL8lF@871fD!)+wI=m8D)&]"\#Z]q/Xh@l!9
Nov 26, 2024 08:19:58.204984903 CET	1236	IN	Data Raw: fa 02 83 99 2d d6 60 6b 84 cc 51 15 d7 e6 c6 56 b5 fe 70 cb a4 8e ad c1 3f 33 a9 80 46 79 c9 98 65 43 94 3c 00 98 1b f4 e5 86 35 cd 95 fa ed b8 41 c0 45 09 6d 05 1a f5 7d 37 8a 4a 2e fc 9f 6d 34 92 6e 46 90 5b fa 8d 72 1a 24 42 83 13 05 0d ec b3 Data Ascii: -`kQVp?3FyeC<5AEm}7J.m4nF[r$B)d088&T$L\s,<KI/_/ 2jQ%s{*yct)n7^j\|Zd9)F^]kF64>$1r_]uVH\
Nov 26, 2024 08:19:58.205019951 CET	1236	IN	Data Raw: a3 65 a7 a3 43 16 9c 5e 7f b8 ec f4 fa 83 fb 9d fe 10 f2 04 cf 0e ad cc e9 d4 85 56 11 07 cd 70 65 9e 61 1b c1 8a ff 18 9e 79 9e a5 19 91 ba 7a 0b 0e 7e 6b 01 45 c0 b0 40 41 26 cd e6 c0 a0 b5 b0 33 b7 3e f4 e5 0d ec d2 6c 0e 7d 5a 0b 3b 35 eb 43 Data Ascii: eC^Vpeayz~kE@A&3>l}Z;5CN7<+ +L`\@J# -Qh+mPTeVEB[1,8HP,KX$i$(&!f.Rvj.}+IXVl:nZitNrnxZFjYLwx
Nov 26, 2024 08:19:58.205054045 CET	533	IN	Data Raw: 37 90 c8 c0 8c b2 f2 2d 79 30 48 21 39 08 99 3b b8 8d 84 2b 58 ff d2 0d 46 4c 47 6c dd b6 21 6b 41 86 2e 32 54 2a 9b d5 2a 92 90 3d 8e 5a 99 21 0c e4 8a 26 b0 ff 58 8f bd 10 66 23 b1 1e 82 56 95 f1 21 cc c1 30 16 0c 0c ac e9 a6 e2 1c 3f eb 2e c8 Data Ascii: 7-y0H!9;+XFLGl!kA.2T**=Z!&Xf#V!0?.1),ITBuU%<&bf"xfPEAz0}[DSHGIcq(^,\|p;1}-w0</^A6i8vWTlv9X!D3>
Nov 26, 2024 08:19:58.406168938 CET	428	IN	Data Raw: 15 ae 8c 6c f1 fd 4f 3d 70 fe 7e d6 19 4b 21 34 03 81 0f df 4e 6d b4 a0 56 7a ec 45 a8 1e 59 63 2b 1f 55 21 21 be fa e3 98 85 b7 ea 4d 15 5f 57 81 9c a5 45 59 ae 99 a1 3a 64 08 0e 43 3e 82 7e 8b 99 65 98 3a 61 78 bd b6 97 40 8b bf 29 4b 0f 22 1e Data Ascii: lO=p~K!4NmVzEYc+U!!M_WEY:dC>~e:ax@)K"Hfw4'U~[9<l?/~' >N]C^}/?';5ue'm}j>lO /.Y=f\|1EbH\]YkASLIjuw
Nov 26, 2024 08:19:58.416903019 CET	348	OUT	GET /js/dist/partitionSite.min.js?v=202410281114 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.829742908 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 28 Oct 2034 06:52:48 GMT Server: F-WEB Last-Modified: Mon, 28 Oct 2024 03:14:48 GMT Vary: Accept-Encoding ETag: W/"671f01a8-1323b2" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i47062_c17987, i2103125_c25795, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 32 63 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 97 e3 c8 75 20 fa dd bf 82 44 97 32 81 66 90 49 66 6d dd 60 22 e9 da 52 5d ad da 54 59 ad 96 95 4a f3 80 24 48 a2 0a 04 28 00 cc ac ac 4c ce 91 ec 19 cb 1e 4b 5e 9e 3d cf 96 ed 19 5b 3e e3 b1 ce f8 d8 1a fb 78 bc c8 d6 f8 c7 b8 ab ba f5 e9 fd 85 77 ef 8d 05 01 10 64 32 4b 25 59 3e 53 bd 24 81 40 ec 71 e3 6e 71 ef 8d ea 70 16 f6 53 3f 0a cd 94 79 d6 a9 11 f5 9e 7a fd d4 70 9c f4 64 ea 45 c3 8a f7 7c 1a c5 69 b2 b1 b1 f0 65 12 0d 66 81 d7 e1 3f 0d 91 cf f1 cc d8 fb da cc 8f 3d d3 68 6c 3d 7d 31 8c a3 30 f5 c2 c1 56 cf 7f 51 4f c6 6e ec d1 e3 3e 3d 35 26 7e d8 78 9a 18 16 2b 2f 33 4b fd 20 81 84 8f f0 57 65 b6 6c 43 f6 39 eb cc c0 1b fa a1 b7 b1 c1 7f 1b ee 64 d0 e1 8f a6 d1 ed 7e f8 95 ee 47 f7 6f 77 bb 06 3b 60 87 30 4a 7b d9 28 3b e2 b7 91 95 f9 a9 0c c8 4c f5 16 f5 97 b3 b3 d3 39 d3 13 1a 53 37 4e 7d 1c fc be 9f 7a d0 bb b4 a1 9a 87 8c a2 6e cb 9a 9b e9 d8 4f 98 a9 96 b7 db fd f8 ce cd 47 37 6e 7d a1 7b e7 cb 4f ee 3c 7e 70 e3 5e f7 fe c3 db 1f [TRUNCATED] Data Ascii: 2c5iu D2fIfm`"R]TYJ$H(LK^=[>xwd2K%Y>S$@qnqpS?yzpdE\|ief?=hl=}10VQOn>=5&~x+/3K WelC9d~Gow;`0J{(;L9S7N}znOG7n}{O<~p^ZulEvNc/aEUjq=zS!A^jkc%5=UO,p=?4`Fq'B3e~&i<C\|nL(XGV2\!@>@Z{j%F^;_gaOJ^MOb4N+fl7[WK0e=}/wXvex1LV/z[u[-h%YC)<<\
Nov 26, 2024 08:19:58.829752922 CET	84	IN	Data Raw: 7c cb c9 f4 b3 33 1d b7 30 df 3a 4d 0f bc 43 c7 6f 1c b9 c1 cc 9b b3 64 f9 ea 77 f8 8f 0d 5d 08 9c 44 2d f9 d9 99 f1 f3 3f 2f 5f 0c 36 80 4f 6e 72 12 f6 ef ea df 73 29 06 eb 43 a6 34 da 87 65 08 47 4f dc 11 65 d1 de 8d b6 5a b3 99 ec a6 98 8a d2 Data Ascii: \|30:MCodw]D-?/_6Onrs)C4eGOeZ
Nov 26, 2024 08:19:58.829864025 CET	1236	IN	Data Raw: 37 66 66 38 0d 0a 41 51 9e 53 1a 81 ed 33 2f 9c 4d a0 a1 5e e0 d9 d5 26 03 00 1a fa a3 99 7a 3f 8e fd 54 3c cf 2d 86 83 9f a7 f1 c9 e9 cc 84 61 19 86 35 ef bb 69 7f 6c 42 83 33 a7 38 53 12 64 69 c2 e6 19 5c 4d 79 06 16 f1 9d 17 3a 80 f3 bc 6c 75 Data Ascii: 7ff8AQS3/M^&z?T<-a5ilB38Sdi\My:lu*>q&{racM=32[w\oFggV[4.3~x=9GfqXmQ<q 01\ZJ==qN)1Y2S@hI{`#{}@`G[ax
Nov 26, 2024 08:19:58.829906940 CET	1236	IN	Data Raw: aa 2d 96 b6 0b df 7d f5 b1 c9 d2 b9 02 76 0e ca f1 7c 2e 30 70 0e da 50 12 ab 19 12 c6 08 f4 80 09 37 14 61 3c d6 18 2b 10 5e cc 4b cc d0 44 3f 45 8b 4f 8a fc 3c 90 fb d8 3c 29 cf 7c 5c 92 f9 98 a8 41 e0 9e e0 3e 74 66 50 14 f6 9c a2 9c 7b 72 e6 Data Ascii: -}v\|.0pP7a<+^KD?EO<<)\|\A>tfP{r-~JjQp&\|wv> wgNg#$vJSvsgd/ew/GK2bNe>%+xyh.9:IL)g,n(&"rhOjF\|fN[%j
Nov 26, 2024 08:19:58.829916954 CET	1236	IN	Data Raw: ac df f7 92 c4 3a 15 5d db be 26 10 2d 12 60 20 a8 98 8b 08 f8 94 37 bc 0f a4 68 06 13 95 a5 7c 14 c3 ac c1 eb c4 9b f4 bc 18 e1 86 f5 d5 eb 3d e0 6b 03 4a 9b 65 69 d1 c8 0f b1 54 b3 ea 64 0d b7 de 13 0d 4f 81 eb 33 87 ce 20 ea cf 90 e4 09 21 e8 Data Ascii: :]&-` 7h\|=kJeiTdO3 !N@4\%1:<n/pg$"UlS<$1!9}1P9tl!W.g${8>bbUqfgb/mI:{y4T0e75M= 4-
Nov 26, 2024 08:19:58.829957008 CET	1236	IN	Data Raw: b1 c8 c0 11 8f bb 98 e9 03 e9 82 1d 7c 13 b9 0f e8 d4 ad c0 07 f0 7b 8c aa 56 24 a3 d1 14 24 b3 8d 0d d4 97 0e 53 f1 d8 8b d2 34 9a ec 38 12 e0 fd 30 f4 e2 0f 3c b4 36 3b 3b 53 00 2c 1f 04 5f 88 0c 21 fc f0 6c 16 56 43 e6 69 85 5a 3e f6 07 e9 f8 Data Ascii: \|{V$$S480<6;;S,_!lVCiZ>J(I,-Yn$GgOdIr>~8rrKD}7{(8 FJ{g"C<@I{4tq)nLd5F&#LdbdyLC<=l5
Nov 26, 2024 08:19:58.838521957 CET	896	IN	Data Raw: 5c e5 3f 3c f7 65 5e f4 0a fe 9c 9d 99 31 1a 9b d6 81 05 f3 5c 34 9c 6d f1 ac e2 67 5b e5 e1 19 ea cf 21 cb 36 7d db e6 59 b6 17 b2 9c 40 96 cb dc 32 5a 25 42 12 ef ca d5 42 6e 21 37 24 8e d1 07 10 04 11 a1 fd 7e ae 65 f8 c0 e7 1c 6a b8 96 b5 cb Data Ascii: \?<e^1\4mg[!6}Y@2Z%BBn!7$~ej z@:rMiea=qHR+HzVYFV5&jIQm:WhSmz\GAsOwtn?AGD(3r+IIjI:dgmOY
Nov 26, 2024 08:20:02.673039913 CET	349	OUT	GET /js/comm/video.js/video.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.083537102 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:09:53 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:49 GMT Vary: Accept-Encoding ETag: W/"6084db9d-3c251" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC147_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC205_lt-obgp-fujian-xiamen-33-cache-2, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 64 66 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 09 5b db 58 96 e8 5f 31 7a dd 44 6a 84 63 b3 23 a3 e2 4b 01 e9 62 ba b2 bc 40 aa a7 1f cd d0 c2 96 b1 3a 42 f2 48 72 08 0d fe ef ef 9c bb df ab 2b db 24 a4 a6 6b ca 35 d3 41 be fb 7a b6 7b 96 e1 24 eb 57 49 9e b5 ae aa fb 71 9c 0f dd ca 7b 28 e2 6a 52 64 2e 4b 09 9d 21 2b e3 84 21 4d 6a 9d dd df 5e e7 e9 ea aa 53 92 0f 33 a3 9d 54 71 11 55 79 71 c8 ab b6 62 d9 70 8b 95 ad a6 81 c8 2e d4 6c 68 b7 b9 cb aa dd cf b3 b2 2a 26 7d 68 3f 0c 43 91 be c2 bf db e3 22 af 72 ac 76 c8 c7 17 88 2e 3d e8 68 ba c2 9b c7 5e 93 a1 eb e4 d7 ff 8c fb 15 74 e6 3a 93 6c 10 0f 93 2c 1e c8 ae e3 2f e3 bc a8 ca 43 25 2f e0 cb c5 f2 3c 0f 06 2d b3 57 78 d5 db 7c 30 49 63 8f fe 69 b3 c2 61 e5 7a bd 38 2d e3 16 f6 5d 9f 2a 6d 65 75 95 fe 6d 47 b7 03 8f 7e ba 17 97 7e 45 ab 3e b8 b6 ee ee 92 6c 90 df 1d d2 3f 81 ad c4 4d 9a 5f 47 e9 21 fd 63 2d 51 c6 e9 f0 10 ff 09 aa 51 52 7a ed cf c9 20 ce ff 49 06 3d 9d ba 62 e5 bc 87 cf 51 d1 3a ed b1 4d 13 3b d9 77 13 bf f4 23 ef 41 a4 a4 [TRUNCATED] Data Ascii: dfa}[X_1zDjc#Kb@:BHr+$k5Az{$WIq{(jRd.K!+!Mj^S3TqUyqbp.lh&}h?C"rv.=h^t:l,/C%/<-Wx\|0Iciaz8-]meumG~~E>l?M_G!c-QQRz I=bQ:M;w#Anu^)/K/l""IR{]x>ifaN"/\(jDlGZ/byxjTwO;zc^t9\t.(M.:AR{yQ]JNbK7eG9D"WaWD4nQZ[R7xbS\_x%\COla_}uoJV
Nov 26, 2024 08:20:18.139942884 CET	338	OUT	GET /js/dist/svg.min.js?v=202411111122 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:18.550128937 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:18 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 11 Nov 2034 07:20:00 GMT Server: F-WEB Last-Modified: Mon, 11 Nov 2024 03:22:58 GMT Vary: Accept-Encoding ETag: W/"67317892-a047" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i11785_c17987, i2103125_c25795, i1872278_c17483 X-Cache: HIT from i1872278_c17483(cloudsvr) Data Raw: 32 61 37 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d cd 73 dc 48 b2 df bf 02 61 d6 9a ee 15 00 e2 fb a3 39 2d 06 87 a3 59 ee 0b 72 34 f1 a4 a1 e3 89 e2 d2 50 37 c8 c6 0a 04 38 00 ba 25 2e d9 97 67 1f 7c 71 84 4f f6 c1 57 1f 7c 71 38 7c f2 c1 8e f7 df 6c ac fd 5f 38 7f 55 f8 28 74 a3 29 51 d2 f4 ce 7b b1 33 22 1a a8 cf ac ca ac ac cc ac ac aa 47 17 f3 74 52 c6 59 3a 28 95 74 78 2b 67 6f fe 18 4d 4a 79 3c 2e 6f ae a3 ec 42 8a de 5f 67 79 59 3c 7e bc 16 73 95 4d e7 49 b4 c7 7f b4 2a dd 38 1d 0c 47 72 5d 66 9b 78 1a 5d c4 69 f4 f8 31 ff d5 c2 ab e9 1e 7f 1d c8 e7 e7 7f f7 ea fc a7 e3 ef ce cf 65 e5 f4 8c 80 18 6d 02 62 af fa d5 da 2c ac be 41 29 86 88 1f 77 77 b7 4b 45 0c d0 8a c5 25 f2 0c 97 83 72 16 17 ca a0 69 fe f0 36 8f ca 79 9e 4a 42 c8 22 cc a5 72 7c 6b fa 81 37 12 fb 49 c9 86 b7 65 d3 64 21 83 3c 2f 22 a9 28 f3 98 a0 df e5 b9 db 7c bc bc 94 00 8c a7 4a 46 3f 8b 38 7a f7 6d f6 5e 89 e8 7d 92 a5 65 94 96 bb 80 8a e2 c7 a9 c2 de aa 24 e3 8c 7f 56 a9 c6 d1 72 b7 d4 ae f3 ac cc d0 43 1a 6a 4c 2f e3 [TRUNCATED] Data Ascii: 2a76}sHa9-Yr4P78%.g\|qOW\|q8\|l_8U(t)Q{3"GtRY:(tx+goMJy<.oB_gyY<~sMI8Gr]fx]i1emb,A)wwKE%ri6yJB"r\|k7Ied!</"(\|JF?8zm^}e$VrCjL/zs\|6W`6ejJEex[mT"W[U\|]dp26UN$#<M]W4@-~u I=?1(j>x#mr\|^F;DO_%PzD Izjd#}85HRLet\|[vT@R4{F})2rz(xOe8.fMJxS(}t4~BzLIBe2-R<o`wz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49747	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.902465105 CET	343	OUT	GET /js/comm/polyfill.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.251679897 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:04 GMT Server: F-WEB Last-Modified: Sun, 26 Sep 2021 03:56:07 GMT Vary: Accept-Encoding ETag: W/"614fef57-1f911" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC206_dx-lt-yd-jiangsu-taizhou-4-cache-12, BC85_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC201_lt-obgp-fujian-xiamen-33-cache-2, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 61 64 31 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 7d 07 7b e2 58 b2 e8 5f 31 ba 77 59 a9 11 34 22 23 7c cc 73 ec 76 07 b7 b7 dd 61 66 19 6e 7f 12 51 04 09 13 1d e0 fe f6 57 75 92 8e 84 f0 78 e6 ed 9b dd 36 4a 27 d7 a9 53 b9 f4 fe ca ef 2c bd c0 3f ea e9 ae 39 30 bb c6 b3 7c d2 d1 a7 e6 c8 78 f6 fa 7a 6a d0 9a b6 d9 95 4b af d6 ce fc c8 23 cb c7 59 2f e8 1f cd 7b f7 2b 6f de 23 44 13 45 b5 74 9a 3f 6c 60 99 51 3a ed 19 cf f3 de 72 35 f7 8f 3c a8 35 95 37 76 f0 c2 91 0f 1d fe 10 eb 1d 13 bf b7 39 ba 9c cf 83 b9 ae 9d 3b be 1f 2c 8f fa 9e df 3d 9a 06 dd d5 a4 77 f4 4f 2d 33 cd 68 ff d4 8c c6 72 38 0f 36 47 e3 5c 27 e8 f6 88 f6 f9 cb c5 f7 4f 97 bf 6e be 7c fb 75 f5 e5 fb cd 85 66 8e 69 7d 43 82 bd 27 cf bd 87 59 30 5f 2e ec e7 dd ae 81 a3 68 e5 db b9 8e 33 99 e8 c3 1c 7f 65 8a fe eb 13 36 c4 80 d0 0f ad 76 6b d2 6e f0 ae 76 f4 a0 19 d8 13 63 67 0e cd b0 64 cf 64 b3 b7 e3 5f 61 93 e2 25 ed 85 f3 aa d9 ea c3 98 f1 eb 3e c9 37 fa c7 dd dc a4 e7 0f 96 c3 46 3f 93 31 9e 3b 7a b7 d5 6f cb 16 3a 3b 43 7f b6 [TRUNCATED] Data Ascii: ad1d}{X_1wY4"#\|svafnQWux6J'S,?90\|xzjK#Y/{+o#DEt?l`Q:r5<57v9;,=wO-3hr86G\'On\|ufi}C'Y0_.h3e6vknvcgdd_a%>7F?1;zo:;Cs3},S,T`s\Mnc`uN/I/EN.JVx#_,;ho[Too,^%kvz8G0H~qGmtILa3Ylogrl,^
Nov 26, 2024 08:19:58.251737118 CET	1236	IN	Data Raw: 9a 96 83 eb bb a5 33 5f 1a 8d 03 5f 7e f5 06 43 f9 e9 a5 df 35 1a da 2c 98 99 f3 de ba 37 5f f4 cc c5 d0 eb 2f cd 71 ef 71 c1 1a 05 e0 f0 a1 1a f8 05 20 ee 3d 7c e9 9b f8 e1 a3 b9 08 a6 3d 13 16 fc d2 e9 0c cd a9 33 33 61 2a 96 bd b9 89 b0 4e ff Data Ascii: 3__~C5,7_/qq =\|=33a*N\P3Yu(\|s1:txgiVG+3'by+x~hB}8ZX0$#;Bxna~:;0W%?9o`_u&)U='h#>`aCf\|]05w
Nov 26, 2024 08:19:58.251755953 CET	1236	IN	Data Raw: 3b c3 55 19 2e ca 40 54 c1 6f 01 7e 4b 00 43 a5 2a 02 8e 4a 5d f5 55 c0 e9 eb 45 81 12 fb 21 ac 0c e1 a6 24 37 64 9f c1 4d 02 ac cc cc 29 6c b9 b9 79 0f 94 80 ce 91 59 00 a0 35 13 ab 36 14 9b 70 b4 87 31 7d 72 df 1c c1 b0 f2 7c 93 de e3 18 e9 49 Data Ascii: ;U.@To~KCJ]UE!$7dM)lyY56p1}r\|I2>.lc5&ZEo74y%&M8ok_)So:[>9H2U{KQ51]}1}30.Eu9JSXR]YJ.fGn"Fg;4,y#Y(
Nov 26, 2024 08:19:58.251806974 CET	1236	IN	Data Raw: 01 00 53 3a 9e 2a 6b 36 74 7e f0 2f 59 e3 02 ae 8c 67 d8 ba 70 bd 81 4e 66 32 91 1d bf 61 5b 1d 5e 8a ae 6f 76 26 0c f5 d2 87 e3 c4 1e 9a 8b de 12 10 69 e0 0f c2 b1 ac 60 2c 0b a4 c1 f1 42 19 e1 1a c9 61 5c 9c 25 c0 2a 1d 21 bb 1d 93 35 bf 52 20 Data Ascii: S:k6t~/YgpNf2a[^ov&i`,Ba\%!5R ~g4=@)&n`3X^.xCM&h5LC&7o?~RApmES@ZlL(F<Jy8{UT<d\|8t =V
Nov 26, 2024 08:19:58.251825094 CET	1236	IN	Data Raw: 40 bc 95 80 78 2b c1 f3 52 39 44 9c 65 40 99 e5 4a 1c 81 32 d4 09 bf 25 f8 45 c9 68 a1 78 48 8b 1e 52 a3 cf 68 8d 03 ef 6d ad 90 2b e7 f2 9a ba 0b 7e fd 42 89 91 2f 0c 1f f0 d6 e1 82 9b 42 5c e0 ed 0a ec dc 47 c1 8d d4 33 d4 0b c9 82 6d 73 80 f8 Data Ascii: @x+R9De@J2%EhxHRhm+~B/B\G3msBs# s;>}YI}o6d:DIB8:hAuVz}n]MPk*7?KJ2X\|r?fG4HLfWjs7od}2\>
Nov 26, 2024 08:19:58.251876116 CET	1236	IN	Data Raw: 36 f4 4d 4d 6b 4d da 62 7b 4e 5b f9 36 df 5d d3 96 45 ad 44 9c 38 b7 78 8f d2 8a 7b dc 16 49 27 09 9f 62 5a ab 7e 6f d0 43 05 21 70 cf 77 60 62 8e d0 07 83 9b 98 87 cf 7d 33 20 a4 d0 54 cc da ee 65 f5 33 86 c1 e6 54 f6 85 00 1d 1e 66 7b 1f dd 33 Data Ascii: 6MMkMb{N[6]ED8x{I'bZ~oC!pw`b}3 Te3Tf{3]N/Wpa`Ur5we4A>>ls`s?M=Sx{G-jIJ8pZx\|C;\|Kzsj=r7g%O^h\u\9Ed
Nov 26, 2024 08:19:58.251898050 CET	1236	IN	Data Raw: 79 29 6d 03 ba 76 c0 9d 68 f7 77 9e b9 7f 74 31 15 71 92 c2 7f 4c 75 39 cf ca e9 00 93 e5 98 cf 48 0d c2 c0 91 10 d8 21 3f 0b df 01 c9 7a 2d 1b 89 a9 00 e3 de b9 a1 d9 99 a4 07 ca d1 63 d1 01 8a 52 7a db 55 f2 82 c4 4e b6 88 40 f3 05 21 36 40 29 Data Ascii: y)mvhwt1qLu9H!?z-cRzUN@!6@)BrD)p&bIJoshNk8zY4b$?$(0A>D9g%L]wg0}2m}:}_nBwOY\9w/=n6oWqE/Q.yO,
Nov 26, 2024 08:19:58.251941919 CET	1236	IN	Data Raw: 8e 32 99 8e b9 a1 76 0a c6 9e 63 31 55 5f e1 09 36 d3 e7 46 9c dd 44 e5 ee e2 71 ea 06 13 ad 39 b7 75 f5 29 17 3c 68 77 9a ad dd 6a 46 86 da 3a a6 d0 7f dd 37 f8 91 a8 54 a8 5d 51 9d 50 4a 6a c1 b4 4b 6d 87 a1 0e a4 29 62 cb 6f e7 bc 9d d0 27 ee Data Ascii: 2vc1U_6FDq9u)<hwjF:7T]QPJjKm)bo'Pl&#UwNh(bx'P'#tEmyk#W^g;@FBIihznNkpZ4I!H(j9we/T*E9=J_0"<t0^
Nov 26, 2024 08:19:58.251960039 CET	1236	IN	Data Raw: 0b 4b 93 d1 58 39 2d e3 67 34 89 b9 af f8 d6 a1 a1 9b df ca 2f b0 5c 67 12 2c 10 bd 8e 80 a4 bb e2 0b 1c a0 1b 16 77 51 1a b5 ba ed d6 b8 15 b4 db 62 3d 47 80 06 f7 d4 9e fc 70 50 38 38 16 63 f2 59 06 ce 0b 52 22 f8 53 07 aa 24 18 57 08 70 3a a7 Data Ascii: KX9-g4/\g,wQb=GpP88cYR"S$Wp:nL!h&pO/(:"*#wUVP/Pkx$ZFB+NK"o7g"i E@3j`kDia3GmB_"Rvm9 Eb5
Nov 26, 2024 08:19:58.251977921 CET	1236	IN	Data Raw: 6f 3d fc d6 7e ab a0 92 a1 ee 64 b4 7c 8d 0e b8 b6 dd b2 db 07 ab 42 1f 14 42 df 2b ca ea 8c c5 be 95 83 9f d0 c1 4b ca 6e 64 ea e3 93 93 13 a4 94 01 6c 97 bd 05 46 2f 6d 5a 15 c0 83 68 1b 3f fc f3 41 d7 92 57 93 3a ce d6 43 b3 c9 30 9c 2f 0d 7e Data Ascii: o=~d\|BB+KndlF/mZh?AW:C0/~}P<aS]Z)KbDK&')a0'$DD2d@{a`g"[T*Pr?}GJ3w3Y(NS%PCZeN7Pum;
Nov 26, 2024 08:19:58.372070074 CET	1236	IN	Data Raw: 3d bf 47 76 18 70 c5 96 95 7f 29 9c 60 39 79 ed 14 ff f2 14 fa a8 44 e4 50 fd e6 40 51 f5 a8 8a 1e d3 92 7e ae 14 e5 0a cc 2e 24 52 56 be 72 b8 2f 96 55 09 a5 e9 85 da 9f 01 55 48 c6 ce 84 50 94 53 3b a8 9c 09 93 df cd 64 fc 39 f5 b8 82 0d 45 cf Data Ascii: =Gvp)`9yDP@Q~.$RVr/UUHPS;d9Ec\'JP5d<N(brPlrhREe,8\-A"algfc+odaV`d*r"^,TD:/%,+&A!hGG#;No<%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49749	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.902574062 CET	353	OUT	GET /js/comm/jquery/jquery-core.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.158900023 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Thu, 16 Nov 2034 07:54:28 GMT Server: F-WEB Last-Modified: Tue, 28 Mar 2023 01:43:18 GMT Vary: Accept-Encoding ETag: W/"64224636-171e6" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i33485_c25891, i2103119_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 32 63 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 bd 89 7a db 46 96 28 fc 2a 22 da a3 00 66 89 22 9d a4 ef 34 28 98 d7 6b c7 9d 78 49 e4 c4 49 28 da 1f 44 16 25 c4 20 c0 00 a0 25 59 60 3f cb 7d 96 fb 64 f7 2c b5 01 04 15 cf fc f3 cf 74 2c 02 a8 bd 4e 9d 3a fb 59 6e b2 79 95 e4 d9 c1 87 ea 66 2d f3 a5 2f 83 db 42 56 9b 22 f3 d5 9b c8 5b aa 32 5e 14 f1 ab 83 d3 9b d5 79 9e 1e 1e 7a 25 fd 68 7f 18 24 95 2c e2 2a 2f 26 cb bd cd 1f a8 1a 72 1b de 51 48 42 1f fb bb 97 83 79 9e 95 55 b1 99 43 5f 51 14 99 f7 3d fd 7b b0 2e f2 2a c7 6a 13 3d d6 d0 74 1c 40 47 db 9e 6e de 5f 89 d3 e0 f6 53 5c 1c 24 e2 26 5a 0d 16 f9 7c b3 92 59 25 24 3c a4 f9 3c c6 42 a2 82 87 2c fe 94 5c e0 f4 44 06 4f 7f fc b8 91 c5 8d 28 e0 e7 3d 91 47 8f 8a 22 be b1 dd 0e d6 9b f2 52 7c da 79 5d a6 c9 5c 8a 78 e7 7d 92 2d e4 f5 eb a5 28 a3 d7 e7 7f c8 79 e5 7c aa f2 d3 aa 48 b2 0b 91 ee 7e bb 8c cb d7 57 d9 9b 22 5f cb a2 ba 11 9b 88 8b ba b5 8b 64 25 3e c8 c8 2e b6 f4 a5 a8 cc 4a 67 f2 0a 5e 0d 96 19 0c 21 a9 f0 93 f8 23 d8 8a 79 74 3c 3d [TRUNCATED] Data Ascii: 2c6zF("f"4(kxII(D% %Y`?}d,t,N:Ynyf-/BV"[2^yz%h$,/&rQHByUC_Q={.*j=t@Gn_S\$&Z\|Y%$<<B,\DO(=G"R\|y]\x}-(y\|H~W"_d%>.Jg^!#yt<=;&$<[?Sl_e)`JX<?eXlg~zw\|!P}}dzvunL?W7GX\B'a;LjZ855YQl-=~UtMc,j9Y/uIoa`GX\|$'UOR)lg~p{3gVHJf7
Nov 26, 2024 08:19:58.158998966 CET	84	IN	Data Raw: 42 ae f2 4f b2 f1 da f7 9e be 7e f9 24 cf 2a 7c 97 c7 0b b9 f0 c4 33 d1 1b 05 00 18 50 3e 5e dc f8 41 10 7a f3 7c b5 4e 65 25 e1 c0 45 37 fc fe b4 8a 2b 38 8b d0 ec 42 56 f1 fc 92 9a f5 bd 3c a3 af 25 7e 9d 5f c6 d9 85 84 06 1b ad 6d c5 c7 e8 76 Data Ascii: BO~$*\|3P>^Az\|Ne%E7+8BV<%~_mv
Nov 26, 2024 08:19:58.159256935 CET	1236	IN	Data Raw: 34 30 30 30 0d 0a 3b 26 c8 8a e0 5f 03 90 d1 ad 73 76 c3 0f 52 20 d8 59 54 50 65 04 82 19 9f c8 42 24 e3 64 e9 f7 64 a0 91 c7 65 52 e2 1b 39 c8 f2 85 7c 0b ed b9 5f 10 2d 54 f2 ba 8a f0 61 3a 9c 45 d0 14 be 4e 65 76 51 5d 46 23 a1 ab 7b 25 1d 13 Data Ascii: 4000;&_svR YTPeB$ddeR9\|_-Ta:ENevQ]F#{%1i5j$SSA28pD4,~1N_D<G?>lj*G#I'SG!srPb:Vj~j&;XU6'\|XWT
Nov 26, 2024 08:19:58.159348965 CET	1236	IN	Data Raw: 05 b6 b5 2b 03 15 d2 96 ee b9 f3 ae 6b 4b 4a 2b 9c c0 cb 80 23 55 93 18 8d ab e2 e6 96 a8 6e 07 69 1e 1e f6 52 8d 83 3d e7 bd 17 38 5f dc 0a 16 5b 0a 0f c6 ab 1f 5e 2f 3d db d3 16 d8 6d b8 69 cd b5 00 6f 10 b1 20 d6 54 c8 45 1f d9 0a f9 fe ba 36 Data Ascii: +kKJ+#UniR=8_[^/=mio TE6ChM{*1sS?pPi+V]q3m!am'Me1at qXU4-Bu}#]J~2s8&TT-q&I> !Tt/e\|Ho<a$Q
Nov 26, 2024 08:19:58.159354925 CET	1236	IN	Data Raw: 6a 9c 4e d2 6e c2 03 65 14 47 04 4c cd 25 2b 90 64 4d 27 e5 04 0a 54 c2 4a 9b 34 c4 6a 26 93 d7 e4 03 63 39 58 8f d0 d7 68 1e ba 24 bc 17 84 15 83 da e6 64 3e de 00 a8 21 a8 c0 a8 32 51 4e b4 e0 17 9f 37 42 7f 00 82 ad 80 35 a1 01 6b 21 f5 44 86 Data Ascii: jNneGL%+dM'TJ4j&c9Xh$d>!2QN7B5k!DD7b0kmd) dZE7\X-AT.:?{)^[V'}_(g7T UYK5DGMTXICWIMKn%^pm[+/S&'GWQo*
Nov 26, 2024 08:19:58.159409046 CET	1236	IN	Data Raw: 64 58 1a 8f 59 e3 71 5c 00 d5 51 00 d5 91 03 01 d4 5e 09 7c 67 17 c3 7d d2 e0 bf 01 92 33 03 40 53 d0 9f ee 42 3f 96 a8 80 f7 a7 b1 6b 30 ec 98 44 1e 88 d4 81 76 e6 46 ca cd 7a 9d 17 55 5b ad 9c 0b cb 26 12 45 06 5c d2 1c e8 98 9b 96 de c0 5b 24 Data Ascii: dXYq\Q^\|g}3@SB?k0DvFzU[&E\[$<.@%?8Ti\(tY!W.04>?<e!WWI7zF_/y~C}n}c/3`u[4Guk!r\| zE=+1zTK
Nov 26, 2024 08:19:58.159456968 CET	1236	IN	Data Raw: 6e 61 e4 5f 50 27 81 a6 94 e8 8b b1 76 47 a8 ef c7 c8 83 39 22 f2 bd bb 01 5e 0e 2a 0b 6d d1 93 e8 a2 42 3b cf 62 7b 43 81 bb 50 6f 56 f6 f6 8e f4 3b 6a 3c f2 86 16 10 d4 1b 3a 84 55 e3 30 65 81 03 6d 0e 29 10 f5 1c 9b b5 ae 99 65 ee d2 38 a3 80 Data Ascii: na_P'vG9"^*mB;b{CPoV;j<:U0em)e8dRdabH>wlx\h [G8OU#Gj1)Y6_R6}kH:+qN~lwTDIGK\|P;rz:Eom}6g'LHV\+
Nov 26, 2024 08:19:58.159466028 CET	1236	IN	Data Raw: d0 99 53 d0 70 2f db 8f 59 5b 1e 7f bb e0 6a 2b 6a 27 da ad 56 35 e8 83 04 44 c7 c6 d1 b1 fd dc 30 46 fc 39 23 bb 43 7d 39 fe 4c cb fb 41 23 07 58 2d a4 e7 ae bd a0 ef 51 33 48 9c c0 2e f4 7e ce 1a 56 86 70 9e 5a 35 9b de d2 68 e9 f5 73 c6 5a 6e Data Ascii: Sp/Y[j+j'V5D0F9#C}9LA#X-Q3H.~VpZ5hsZnR>!oJ_WEU4&6a.?\8RXqiQ\|([6Z&"D6v<l6IT} #@UWSky^Y/v4yl_qlBt[i7a!
Nov 26, 2024 08:19:58.159471035 CET	776	IN	Data Raw: f6 31 23 86 a9 f9 7e 8f 20 0b 05 b8 40 32 7b 28 28 24 57 05 59 69 26 c2 23 8b 0d 0f 43 6b 9c 6a a0 65 13 90 0a 51 29 3a 27 b4 07 d0 d9 fb 5d 5d 5f 98 ae 7d b4 ef bd c0 de 4d c7 d4 f3 44 86 3b aa 1a bc 4a a9 0c da f7 6a 08 7a 83 ba 85 d0 5d 25 f6 Data Ascii: 1#~ @2{(($WYi&#CkjeQ):']]_}MD;Jjz]%z`-PJRCG'D.&0Efko>M.^ kIJ%95k,96<(1Nq,Fq#hb1\|8Ojay)Nll3SuR\|@"I}x
Nov 26, 2024 08:19:58.159478903 CET	1236	IN	Data Raw: e5 07 fe a2 ed 62 e8 cb 1b 7e 80 11 e4 57 50 25 83 01 e4 57 50 3c 83 b2 79 ca 6f e0 07 bf d9 94 12 43 0b 78 f0 f7 65 bc f6 04 39 ea 2a 43 2e 8f 1e 1e d3 03 d6 25 0f 63 b9 48 c8 80 0e db a0 17 cf d4 0b af 5b ba d1 8c 52 d0 89 40 73 46 a0 39 23 d0 Data Ascii: b~WP%WP<yoCxe9*C.%cH[R@sF9#\G'%zk$FrJY=I,IH"iXUSy=q$Yzh<;-C-h/v~]Dh?pu--6u. \|70GNTCPF!2iH`lc
Nov 26, 2024 08:19:58.279417992 CET	1236	IN	Data Raw: c6 70 80 fd 8d 05 fd dc 01 fd 34 da 60 08 05 15 28 72 bd 0b ac b1 81 f4 45 b4 9c c6 c0 8c 4d d6 4d 80 5f bb 00 8f c5 11 5c 4c a0 f4 94 02 c0 72 5c 26 df f3 e1 36 38 1b 04 5e 3f dd 3d 67 0a 0e e1 3b a0 fb c1 fd 33 4c e2 82 66 6a 3e fe ba 17 28 49 Data Ascii: p4`(rEMM_\Lr\&68^?=g;3Lfj>(I7x~s/t>=Q#N*RL'r`l2a0[SP`CKeM.\ws55.U}Hisj6-XDl>}e;~K
Nov 26, 2024 08:19:58.422151089 CET	339	OUT	GET /js/dist/site.min.js?v=202411111122 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.823112011 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Tue, 14 Nov 2034 04:16:15 GMT Server: F-WEB Last-Modified: Mon, 11 Nov 2024 03:22:58 GMT Vary: Accept-Encoding ETag: W/"67317892-52412" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i91534_c21603, i2103119_c25795, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 33 36 31 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 79 7f 24 c7 71 20 fa 55 80 12 8d a9 22 b2 1b dd 0d cc 55 3d 35 ed 39 49 50 73 79 30 24 25 63 f0 fa 57 e8 ae 6e d4 4c 75 55 ab aa 1a c7 00 fd 7e 92 fc 6c 51 cf 94 64 af d7 d2 5a e2 ae 8e 95 d6 7a f6 9a 94 bc 7e b2 44 8a d2 87 79 c4 70 f8 97 bf c2 8b c8 ab 32 eb 68 00 c3 c3 5a 13 b4 3c e8 ca 3b 23 23 23 23 22 23 22 e7 07 93 b0 97 fa 51 68 a6 c4 b3 f6 8d 68 f3 91 d7 4b 0d c7 49 f7 c6 5e 34 98 f3 76 c7 51 9c 26 0b 0b 85 9c 51 d4 9f 04 5e 87 fd a9 f3 72 8e 67 c6 de 57 26 7e ec 99 46 7d e9 d1 93 41 1c 85 a9 17 f6 97 36 fd 27 b5 64 cb 8d 3d fa 73 8d fe aa 8f fc b0 fe 28 31 2c 52 5e 07 53 bd 24 85 a4 fb ec d7 51 15 26 a9 1f 24 90 f0 2a fe 95 85 2d db 10 93 cc 46 df f7 06 7e e8 2d 2c b0 bf 75 77 d4 ef b0 9f a6 d1 ed be f2 a7 dd 57 6f 5f ef 76 0d b2 4e c8 06 c0 c5 ae 82 4b 87 ff ad 67 95 fe 30 41 60 a6 ea 10 d5 8f 83 83 fd 29 51 13 ea 89 9f 7a 30 8b b4 2e 87 09 f9 72 04 f4 37 6d de b2 a6 66 ba e5 27 c4 94 48 d4 ed be 7e e3 ea bd 2b d7 be d8 bd f1 a5 07 37 [TRUNCATED] Data Ascii: 361ay$q U"U=59IPsy0$%cWnLuU~lQdZz~Dyp2hZ<;####"#"QhhKI^4vQ&Q^rgW&~F}A6'd=s(1,R^S$Q&$-F~-,uwWo_vNKg0A`)Qz0.r7mf'H~+7r{WovnZ8Djv~8Zn<xc2oZ$4$\>,i;g7=?5/xtj7ME"'oE8+V4%,}kZUOz}7u5:SLI[=o9ZMNfYmFgaNFqG(oLvY&Y]ZE!vav2}^(ZGT2b.:
Nov 26, 2024 08:20:02.810172081 CET	351	OUT	GET /js/dist/libs/imageEffect.min.js?v=202404081140 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.211328983 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:05 GMT Server: F-WEB Last-Modified: Mon, 08 Apr 2024 03:40:40 GMT Vary: Accept-Encoding ETag: W/"66136738-3907" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC205_dx-lt-yd-jiangsu-taizhou-4-cache-12, BC204_lt-obgp-fujian-xiamen-33-cache-2, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 31 31 66 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b5 3b 0b 73 da 48 93 7f 05 2b 77 ac b4 1e 14 70 e2 c4 2b 32 e1 23 18 3b 4e fc ba 18 d7 57 7b 2e 9f 6a 10 23 d0 46 48 9c 24 fc 58 e0 bf 5f cf 43 d2 08 09 8c 53 b7 9b 4a 90 a6 7b 66 ba 7b 7a fa a9 dd 73 e7 81 93 78 61 a0 53 94 18 0b 2d 1c fe 45 9d 44 c3 38 79 9e d1 d0 ad d1 a7 59 18 25 71 bd 5e 82 4c c3 d1 dc a7 1d f1 63 4a 3c 9c e8 86 a5 a5 6b e6 c8 23 ea 7a 01 ad d7 c5 af 49 a6 a3 8e 78 d4 35 db fe f6 df f6 ed c5 b1 6d 6b e8 ee 1e 88 b0 36 11 d1 91 bf 66 3e 85 ef a7 53 75 44 7d 59 2e 17 2b a4 0e dc 69 be 37 8c df 7a 53 32 a6 7d d7 65 bb dc b3 35 8c 95 9e 4c bc 18 e9 99 38 8c 45 44 93 79 14 d4 94 91 07 12 d5 68 3b 1d a8 25 3a cd b0 12 5c c1 f5 cd f3 74 18 fa 20 bb 98 3f ac 03 4c 2f a1 11 49 c2 a8 93 1f 42 be a0 64 7d 65 55 00 41 92 5b b6 a3 a6 13 06 71 12 cd 1d 58 1b 63 9c 8d ef a5 cf e6 2c 0a 93 90 4d eb a4 b4 59 d9 86 88 f1 b5 ca b8 f4 40 33 3c 14 0a ee 49 5b 52 40 b0 a2 38 9e b1 f0 5c 3d 3d b6 3d cc 16 58 2e f7 a8 91 92 db 66 73 43 4c ef e4 f6 49 78 [TRUNCATED] Data Ascii: 11f6;sH+wp+2#;NW{.j#FH$X_CSJ{f{zsxaS-ED8yY%q^LcJ<k#zIx5mk6f>SuD}Y.+i7zS2}e5L8EDyh;%:\t ?L/IBd}eUA[qXc,MY@3<I[R@8\===X.fsCLIxyS/}>mph:B~mnA$k}~_V<Nj, 0]y$.!&C)t+uE5~3%\"CZ{M'zyy\|^1Ln@\@g}itZB7aOrQ&SkFCI`\S_%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49748	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:56.902621031 CET	359	OUT	GET /js/comm/jquery/jquery-mousewheel.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.198437929 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Wed, 15 Nov 2034 04:11:12 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:49 GMT Vary: Accept-Encoding ETag: W/"6084db9d-b58" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i34692_c4672, i2103127_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 32 63 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 6d 6f db 36 10 fe 2b 8e 80 19 64 a1 70 76 36 0c 98 5d c2 e8 d6 0d 0d d0 2c 5d d3 0f c9 0c a3 60 a4 93 cd 8c 22 35 91 ca 4b 63 fd f7 1d 29 eb c5 ae bb e5 83 6c f2 ee b9 e3 dd 91 f7 90 59 a5 13 27 8d 1e 7d 76 4f 05 98 8c 00 7d 2e c1 55 a5 26 3b 09 8f b2 1d 26 e2 bc 11 8d ae 9e f2 5b a3 c6 e3 c8 86 c1 a1 82 49 07 a5 70 a6 5c b4 a6 23 d7 3b 1e ed b0 50 cf 3a b5 1e a8 01 fd 7e 7b 49 60 89 d1 d6 95 55 82 fe 39 e7 9d fc a4 1d b3 a2 34 ce 78 b3 45 1b df ac 5b 92 e2 42 f5 49 eb de af 7a 64 ad 14 32 a9 31 8c e6 9f 89 3c 5d 34 43 b2 8c ee fe a9 a0 7c 8a 56 31 d0 59 64 6e ef 20 71 68 c8 49 54 e9 06 93 f6 7e e0 b1 30 a5 b3 8b 81 6e d6 d5 b9 d1 51 ba c8 4d 5a 29 60 3b 01 87 19 90 bb 3f fd 22 b4 26 5d a0 29 7d be 17 e5 28 89 f3 18 f8 32 7a d8 00 a8 28 8e 72 53 59 68 27 6f 2f 2f 2e fc fc 2a 29 8d f2 82 0b f3 25 08 3e c8 47 50 3b e9 2a 76 3c 32 ba b1 91 7a 94 9a a4 ca 41 bb ed f6 e7 d7 bc 9d b0 76 70 61 52 58 b4 cb ad 66 cb 83 05 4d fe 92 05 d7 fc 4d 59 8a a7 7e 5f [TRUNCATED] Data Ascii: 2caVmo6+dpv6],]`"5Kc)lY'}vO}.U&;&[Ip\#;P:~{I`U94xE[BIzd21<]4C\|V1Ydn qhIT~0nQMZ)`;?"&])}(2z(rSYh'o//.)%>GP;v<2zAvpaRXfMMY~_U2HwmifJvCz"Tso]t[@"b}J5E?)EWQLo{ih(6@X0JX&>9(3z,Nzn@7.t]4l>=:v <>s5?QRKB;LS+Zq<a[F&S)`^KgQVwtwnFoI"DZ8hXKhw%0O!~
Nov 26, 2024 08:19:58.198472023 CET	613	IN	Data Raw: f0 c5 80 2d 7d fc ac 49 98 60 c2 18 ab 93 7a 6d 67 cf 22 bd ab ac bb 54 e9 5b 50 4e d8 d9 c9 24 d6 a6 cc 85 c2 35 2e 43 52 28 aa eb 79 e7 d5 f4 45 81 ed f6 41 6a 3c 1b 4d 17 61 7d d6 2c 11 4a 11 51 ae 03 2f d8 78 4a 63 c3 27 b1 c4 4f e1 67 f1 13 Data Ascii: -}I`zmg"T[PN$5.CR(yEAj<Ma},JQ/xJc'Og204m5>Y(e>,cRO!\|pAncn@-H6K4c.?u7?>j:Qj!g3.] A;u\|4xv&xK{Jn/:7x+#
Nov 26, 2024 08:19:58.200767040 CET	343	OUT	GET /js/dist/frontend.min.js?v=202407231110 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.607081890 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Thu, 09 Nov 2034 04:12:39 GMT Server: F-WEB Last-Modified: Tue, 23 Jul 2024 03:10:31 GMT Vary: Accept-Encoding ETag: W/"669f1f27-1299a" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i11831_c17987, i2103127_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 32 63 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd fb 7b dc c8 75 28 f8 af 34 21 99 04 d4 e8 66 a3 5f 24 d1 04 3b 12 25 59 f2 48 23 79 a8 b1 c6 26 39 fa c0 6e b0 09 ab 1b 68 03 68 3e 86 ec 7c 89 6f 12 3b b9 49 ec 7c 9b c4 b1 af b3 49 be bc bc be 1b 3b bb 77 6f 5e 7e fd 31 d7 d2 8c 7f ca bf b0 e7 9c aa 02 aa 00 34 49 8d c7 89 93 dd 99 4f 6c d4 fb 54 d5 a9 53 a7 aa ce 63 e9 70 16 0c 12 3f 0c 74 cf 4c 8c 73 2d 3c f8 a2 37 48 34 c7 49 ce a6 5e 78 58 f1 4e a7 61 94 c4 cb cb 85 94 49 38 9c 8d bd 3e fb a9 f3 7c 4e a2 1b b6 26 ea cc 32 0f bd 43 3f f0 96 97 d9 6f dd 9d 0c fb ec 53 d7 5e bc f8 cc 17 5e bc fb f8 ee 8b 17 9a b9 bb 0f 40 d8 8b 80 e8 f3 df 7a 56 84 da d3 3d 39 46 0e 5c 5c 9c cf 4d 39 a2 7e 18 85 41 e2 05 43 2c 68 cc f5 e4 c8 8f 4d 3d 1d 03 e3 3c f2 92 59 14 54 a4 98 63 37 aa 78 ce 79 77 6d 6d 7d c3 56 47 0b 93 7c 33 30 43 33 ea 89 94 8a ab 7b 69 35 ae 53 32 16 3b 67 93 83 70 0c 23 1a d3 47 3e a1 ee 27 5e e4 26 61 d4 cf 1a 4b 2b 14 03 32 b7 4b 12 61 7c 2f 69 ce ab 0f c2 20 4e a2 d9 00 ea 76 1c 27 [TRUNCATED] Data Ascii: 2c6{u(4!f_$;%YH#y&9nhh>\|o;I\|I;wo^~14IOlTScp?tLs-<7H4I^xXNaI8>\|N&2C?oS^^@zV=9F\\M9~AC,hM=<YTc7xywmm}VG\|30C3{i5S2;gp#G>'^&aK+2Ka\|/i Nv'_i&!A5]m{ O49Ms>aA^T7OY=BE{Q\|ti+_\|\|i+O/-o5`\|yVyRXoP:i{F~kXkpirg~n0.'~0O{#/H>9{'4"QzN#cc/qT9$_UZ5cF `l5nsfA
Nov 26, 2024 08:19:58.607148886 CET	84	IN	Data Raw: ad ad 6a a6 0b c1 36 04 db 3c 39 86 70 67 79 d9 df ed ec f7 86 e1 80 ea 82 b5 19 be f4 3d 07 60 70 b4 aa 17 0f dc a9 a7 27 46 55 c7 12 8e 13 f6 35 cd d6 7a b8 13 f8 91 17 43 96 10 80 fc f4 e3 67 3b 40 7d 82 11 d0 72 91 33 e2 39 a7 6e 72 04 d9 a2 Data Ascii: j6<9pgy=`p'FU5zCg;@}r39nr
Nov 26, 2024 08:19:58.607157946 CET	1236	IN	Data Raw: 35 64 61 38 0d 0a 34 c1 e5 09 c3 70 e2 fa 01 24 b9 90 64 39 4e dc 87 c8 d8 1b cc 22 0f d2 35 63 6e fa f5 91 32 64 c6 f9 61 18 e9 38 0e 89 a3 bf c9 d8 19 d8 19 18 b0 24 1b a8 5c 7f 45 42 e4 34 60 98 1a bd 68 33 ec 19 e7 fe a1 ee 3a 51 35 30 f3 b9 Data Ascii: 5da84p$d9N"5cn2da8$\EB4`h3:Q50A:E oSc5zPGSh&eppcU=H7'N*w%ef/m{$4@yZ8FCJ143z5dyYOLagW11
Nov 26, 2024 08:19:58.607217073 CET	1236	IN	Data Raw: 8c bc 06 f0 cc 5a ef a8 ea ac 08 04 d3 56 aa 87 50 83 a8 34 f1 a7 b1 b6 b5 52 9d 55 95 b6 26 f1 08 63 a7 55 8d b5 24 a5 ad 0c 90 cf 5b a9 84 c1 60 ec 0f 5e 3a 7b 9a 18 0e fc 8d bc 49 78 0c c0 8c f4 43 77 1c 7b 66 45 c3 e6 8c 9e 00 99 03 6e 8e eb Data Ascii: ZVP4RU&cU$[`^:{IxCw{fEnZuNnI38f:~lavHXEB{cq>zj#ciI,$&/."~qm?Z?jU5WFf~b5<."@Pp]"MIWcpkT.P*
Nov 26, 2024 08:19:58.607228994 CET	1236	IN	Data Raw: 96 56 25 60 6e 0e d7 88 20 7c b2 e8 bc f5 fa cf fe fa c3 6f ff d7 8f be ff 37 af ff cb 6f 22 fe 29 f3 c8 00 dd 5a 34 17 b4 3b ff c7 9c 8a 4a 38 4b 70 71 da 01 30 84 80 6f af be f6 c7 af ff e1 ab a5 3d e6 d8 4c e7 8a 81 73 0e bb fa c3 a1 ed 9b 78 Data Ascii: V%`n \|o7o")Z4;J8Kpq0o=Lsxf;=L^]blk7L9thrt6nC6\|Fsc59OyuYnC4'f\&%1p>48k8\8Tp=0{&(Y0oSyq<})4Z{mkL8
Nov 26, 2024 08:19:58.607243061 CET	1236	IN	Data Raw: 26 83 23 3d 80 de 64 bb c7 23 9d bd 3b 2d 1d eb f8 16 04 8c 1b 6c 67 f7 21 d5 30 b2 01 6b f4 fc 4d 35 55 8c 60 b5 ea b3 b1 09 1c 35 03 8c 66 0f df 64 96 f0 41 2d a8 fb c3 25 bc ea 02 9a 9c f8 13 2f 5a 5e 26 31 85 87 bc 80 88 36 4c cb 71 e0 1b a5 Data Ascii: &#=d#;-lg!0kM5U`5fdA-%/Z^&16Lqt/<Aud){T&B@C`Hh\1\OsW^'#7./0QAlewSVkZ2_8&nMU8,vS.9=m5../
Nov 26, 2024 08:19:58.607258081 CET	896	IN	Data Raw: 41 ab 6a 8e be fb 7e 6f ff 96 a1 19 74 a9 95 57 10 31 8c fe 54 8f 77 ad 7d 83 74 9d e6 73 fd 8b 9f 9d 79 d1 99 8a 7c ec 8e 66 75 57 db db db 3b 6d 34 6a 7b a7 d6 e1 de e9 da 21 7c 6c 1c ee af 8e 60 a5 9c 6b 7b 07 d0 df 3d f8 6b 6a 7b 09 7d e2 ae Data Ascii: Aj~otW1Tw}tsy\|fuW;m4j{!\|l`k{=kj{}gb{}+{{DQ$B:LhKGn$xGrC'oKo[4k=x=hEv[4k:J~FN&d_+J_Y1EbQk? 0@e
Nov 26, 2024 08:19:58.607362032 CET	1236	IN	Data Raw: 2a 70 9f c6 e2 dd 3f 71 76 b5 1d 58 27 2e 5e 9e c2 06 c3 3e 9e cd bc 98 7d 3d f7 86 81 f8 7e 76 04 bb 08 fb bc 1f f9 ec 63 c7 85 a6 f1 73 9f 94 dd 3e e3 22 43 70 df 43 66 e1 b1 8b 57 9e b7 a7 11 7d 63 e6 cf cc 02 fa 3b c6 f8 d9 08 8b 7b 53 f8 fb Data Ascii: *p?qvX'.^>}=~vcs>"CpCfW}c;{Sd1H"XXc5gqjO<"FOuh>h>g?alX87:g}Fyg'8:!d`&(v3TBO6
Nov 26, 2024 08:19:58.607469082 CET	1236	IN	Data Raw: 15 e8 58 18 f3 60 0e d8 fd ac 35 b3 db e8 5a 8d ce ba b5 81 0c 4e a0 b3 fa 67 94 01 f6 cb 26 54 61 35 da ed 4e b3 d3 6a 91 80 aa 02 44 b5 4d 60 58 6b dd b6 b5 be be b1 56 04 a3 43 60 58 28 40 b1 de 68 37 4b c0 e8 12 18 35 ab 0d e3 d3 b2 5a 6d ab Data Ascii: X`5ZNg&Ta5NjDM`XkVC`X(@h7K5ZmYkt6[E0kmU,Vhl6pm,j0@FUhll4hYjn]oJn@GUFGlnNAd5[]X&`nNG34np@mnY4
Nov 26, 2024 08:19:58.615807056 CET	1236	IN	Data Raw: cd d6 31 f1 01 67 09 0f c5 49 9d d7 87 36 7a d2 c0 c5 05 0a 02 85 90 99 b2 88 c2 e9 7a 29 b3 2b ed f7 7d 5b ba bc 9f 9b 28 b4 c4 05 b5 78 17 45 f5 1a 1c 50 73 29 a2 09 68 35 9f 84 8f c9 a8 89 ac c1 b0 d4 5f 7a 67 d3 c8 8b e1 cc 27 0d 5d 1a 4b e9 Data Ascii: 1gI6zz)+}[(xEPs)h5_zg']Ki!q65Y&`$8{.2Z^WfH;IJ';#q8aqDHF>9;pcVNX=n&-lyycr]\H1Tn}.,^c#0vGf{"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49752	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:57.682116032 CET	315	OUT	GET /dist/jz/request/jzRequest.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.940227032 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Thu, 16 Nov 2023 07:06:57 GMT Vary: Accept-Encoding ETag: W/"6555bf91-e696" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i34712_c4672, i2103121_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 31 34 61 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd bd 6b 73 1c c9 96 18 f6 5d bf a2 bb 96 ea ad 1a 24 1a 68 3e 66 e6 56 33 d9 0b 02 20 09 92 78 10 0f be 9a 3d 50 75 77 36 50 44 77 55 b3 1e 78 10 dd 8a 90 6d 85 64 5b bb 0e 3b 56 5a 6f c4 95 22 1c 61 39 d6 0a 7b af 14 76 48 b2 d6 f2 46 f8 b7 78 e6 de fd e4 bf e0 73 4e 66 56 65 55 17 40 ce bd 1b ba 8e 20 d1 55 59 f9 ce 93 e7 95 e7 9c 5c f9 a6 d6 6a b6 9a df d7 be 59 f9 3b f5 51 1a 0c 12 3f 0c 6c c1 12 e7 da 0a fb 1f c5 20 b1 38 4f ae a6 22 1c d5 c4 e5 34 8c 92 b8 d1 b0 d2 60 28 46 7e 20 86 56 5d 7f 9c 84 c3 74 2c 3a f2 a7 a9 b2 f2 c4 76 5c 4b 57 9b d7 24 4b 37 1a f2 b7 e9 4d 86 1d f9 68 27 8e 6b 0b 5e d5 c0 c9 38 ec 7b e3 c3 53 3f ee e4 8f ae 98 cd 62 31 1e 39 cd 8f 9f f7 c5 a7 54 c4 09 b6 39 b7 13 f8 c8 ec 6c 40 30 9a 34 16 b5 38 89 7c 18 51 5b a7 d7 84 1c ea b9 17 d5 02 be 4b e3 6d 9e 89 ab d8 16 4e db 1f d9 2a e5 44 24 bb 17 c1 5e 14 4e 45 94 5c 1d 5c 4d fa e1 38 96 a5 22 7e 5b 1e ac 26 69 34 ec 88 47 cd 91 3f 4e 44 64 e7 7d 82 76 23 91 a4 51 50 ab [TRUNCATED] Data Ascii: 14a6ks]$h>fV3 x=Puw6PDwUxmd[;VZo"a9{vHFxsNfVeU@ UY\jY;Q?l 8O"4`(F~ V]t,:v\KW$K7Mh'k^8{S?b19T9l@048\|Q[KmND$^NE\\M8"~[&i4G?NDd}v#QPbC&aD}l q4i\|y6Ar\|vN c$`iI$H:rt^\|q5-v612\v@w/0rU_PB7j:ppz\|f=%HxHnG[6- 99$b77kaK(%TPPHlVo{6ORsovp4/"?QVjpw4@OvUM5%:,2_<&=E}cu4EUiY@k(w 7/Nz-QNfBFg!NotH3fPf<-iJ`BJ3&[f+F4REV~
Nov 26, 2024 08:19:58.940285921 CET	1236	IN	Data Raw: 3b ee 91 3f db 72 82 04 9e be 9f b5 be 9d dd bb eb c0 e3 fa d8 9b 4c c5 d0 e9 50 25 77 56 9a 09 10 10 3b 70 8a 23 2d cd 96 73 9d 9c 46 e1 45 2d 10 17 b5 43 18 f1 66 14 c1 ce b0 b6 02 80 23 7f 58 f3 92 44 4c a6 49 2d 09 6b f1 34 12 de b0 16 84 c1 Data Ascii: ;?rLP%wV;p#-sFE-Cf#XDLI-k42-@Oy@4?[PD_TF<QM6IvW[XyMDr6,l<j:0f@`hXaa&`wt-X>PUXp/'~.j+R0`h\|
Nov 26, 2024 08:19:58.940305948 CET	1236	IN	Data Raw: 09 80 86 10 ee 4b 5c 82 16 9f 00 81 87 c2 c0 67 be 28 23 b4 23 43 cc 14 06 cb 1b 0a 3b c2 9a 97 ac 9a 1f 83 a0 91 00 7f 9b 6d 7b e8 9a 27 4a 1b 4d f3 e5 49 c6 f6 6f e1 c6 ca 76 87 eb 0b 78 9f b3 d4 ec cf 40 54 f3 2b 2c 2e 57 8f 23 06 e9 70 ca 84 Data Ascii: K\g(##C;m{'JMIovx@T+,.W#p%o5% FIa#A1@@$#CU=DvD5cl:mmn!}\^]Mp-Z0U&wW` 585Ab
Nov 26, 2024 08:19:58.940315962 CET	1236	IN	Data Raw: 47 24 b1 d1 49 62 2d 92 d9 0c 46 02 c2 5c a2 88 d9 88 86 46 09 72 86 e8 91 0e 1e 62 d8 98 23 5a 7c 2e 7f d8 88 b8 45 2e 7f f0 2d 96 df e0 87 bd aa e0 79 64 c6 a2 4a 07 e4 c9 34 c9 69 66 73 e4 0d 3c 10 02 84 aa 8e ca 32 10 22 de 57 2e 8f ec 08 71 Data Ascii: G$Ib-F\Frb#Z\|.E.-ydJ4ifs<2"W.qRHErC&\|.q;vt@7qU~*k]_G`=HaX.h{(g5?[ukKv5(cG4+8'Vb`"1CH\|J@m`c&
Nov 26, 2024 08:19:58.940327883 CET	1236	IN	Data Raw: e8 3c 46 5b 57 3c f8 e8 e0 99 85 5b af 23 92 f8 04 48 22 01 f4 18 4d 48 58 a8 de ed c4 be 08 47 b3 4b f6 93 84 e1 99 57 13 61 e4 42 44 eb 5e 8c 36 13 ec 88 ea 1a 7a 89 87 42 c9 63 7a db 59 3b dc 7a bd c9 ad 1d 8b 7d a6 84 bd dd 97 ef 9e 6c bd 7c Data Ascii: <F[W<[#H"MHXGKWaBD^6zBczY;z}l\|=$,o0G/Bno&2C;St"8pnH,h Y5-;=z.q&&1CP+?B6T7pGe2
Nov 26, 2024 08:19:58.940347910 CET	1236	IN	Data Raw: 01 30 27 b0 f7 41 1a ec f3 31 a0 f9 80 5d 00 10 f7 a1 9e 2b c7 85 9d e7 d1 33 48 ef d9 1c b4 af 1e 9d b4 4f 94 5c 0b 82 eb 09 02 2f f2 81 f6 94 9f db 43 3e e9 9e f4 d8 09 83 76 60 de 91 af 74 2e 20 85 4f 25 40 43 c2 d4 51 54 4f 48 8a 57 bb a7 e9 Data Ascii: 0'A1]+3HO\/C>v`t. O%@CQTOHWjPO]w?/vru,xN^Z~{[M`h"''\|=hBl-6K}wv=PV0m;h'7
Nov 26, 2024 08:19:58.940421104 CET	1236	IN	Data Raw: ae 7e 44 f2 93 b6 c5 89 8b b0 2c 6b 44 fb 18 a0 d2 6c 14 11 e6 84 15 63 63 00 2b 7c b0 d8 30 c2 29 1b a3 d2 b1 0b 48 47 ba d1 b6 9c ee 38 ea 15 84 35 cc 47 7e 0b 5f c1 30 0e 23 e0 17 89 3d ad 3a 07 8b 7e 2b 86 91 c5 91 3d 8e e4 28 a7 11 3b 8d d8 Data Ascii: ~D,kDlcc+\|0)HG85G~_0#=:~+=(;$bS2G/"mE4g?m`-?wXz&V"J>n^zbd0Cj-QYYP2Q&~mI$M7sgKH:Zwf61!9
Nov 26, 2024 08:19:58.940432072 CET	1236	IN	Data Raw: 8b 6b 7b 54 97 17 b2 69 b9 16 4f d7 62 bf 42 ae 1e 80 8a 0f 42 25 00 a1 06 07 95 52 28 d4 32 f2 f3 a2 cc cd 50 ae aa fd 1e 45 8c 53 2f f2 06 30 0d a8 55 93 aa d4 62 03 ef 23 69 cd 82 d5 bf 8a e6 b4 90 e6 c6 53 13 3b 9b d1 c4 c2 1b ec 4c 42 0c b8 Data Ascii: k{TiObBB%R(2PES/0Ub#iS;LBx!op!Tl\|R)`0"tf:H+?f>!!W -7Ih@p,d!;f.Cv%t=D,Hh:Fak!j$OB(t!6yhfok
Nov 26, 2024 08:19:58.940443993 CET	1236	IN	Data Raw: 90 d7 67 26 d1 85 4a 0b 9d ff 2c 2b 65 d7 f8 d5 7d 12 32 35 6a a6 f1 27 3e cb fd 80 4f 19 d2 75 95 8c 96 01 33 7e a5 09 75 35 73 9e 87 00 73 4c 43 73 7e 0a 62 68 c8 2c 24 a6 26 0b 6b d8 8d e9 91 02 02 79 11 da fb ea c0 e0 59 98 bb 76 04 6a 8f 22 Data Ascii: g&J,+e}25j'>Ou3~u5ssLCs~bh,$&kyYvj"F@Sy]7$\3B,i)[S]cH0 )$-!rj/18m2eKirszYk`"Df.%vh &El?@U>+>@tMtb/E
Nov 26, 2024 08:19:58.940455914 CET	1236	IN	Data Raw: 92 7c 4b ef b2 a4 74 c3 4a 76 6c 99 a8 9b 0c 68 6c 59 04 05 f4 38 cd 16 08 d7 34 9f 55 1d 7b 5c 8f 6c dd 67 67 3e 5b f3 b5 a5 d5 ce 02 b3 a9 63 cd 22 b7 16 14 a3 1c 19 37 1a ac 7b 01 12 40 1d 73 d0 53 b1 6f 65 a0 41 8c 3d e8 d5 ca 91 04 d7 48 8b Data Ascii: \|KtJvlhlY84U{\lgg>[c"7{@sSoeA=HEk[U%2LwQ!R)itBIKUO1]EJX))\|<FQiv 9?8RIWEH:/N6/<}b\|c/Ne o01P6\|/V*f:%9
Nov 26, 2024 08:19:59.060275078 CET	1236	IN	Data Raw: b7 b2 df ab 71 49 46 f9 aa 40 cc 2e 3d 2d ab b2 ab 98 ee c5 ec 12 08 dd 10 41 67 6f ec f9 81 4a f0 31 21 8b 6d e3 46 f8 ba 81 c7 62 b7 c0 14 7e af 00 26 74 62 bd ad 18 7e af 82 41 a0 5d b7 15 c3 ef 55 ad a9 12 ae e7 c9 c9 13 de a4 0a 90 43 09 bd Data Ascii: qIF@.=-AgoJ1!mFb~&tb~A]UC;S*<^48"o%JU.hXDB/\>h60EK~79U[fss}WSMl\| AK( cX#j4B=E&[L1Bk/1z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49753	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:57.682389021 CET	311	OUT	GET /dist/jz/utils/jzUtils.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.994869947 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Tue, 30 Jan 2024 06:39:55 GMT Vary: Accept-Encoding ETag: W/"65b899bb-1aef2" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i92702_c22643, i2103125_c25795, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 33 38 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 bd e9 7a e3 46 b2 28 f8 7f 9e 82 c2 a9 a3 0b 14 21 88 8b 56 b0 60 1c b9 4a b6 d5 6d 95 ea 94 64 bb db 24 5b 1f 08 26 49 48 20 40 63 a1 c4 12 78 3f df d9 67 1e 61 fe cc fc 9d 5f f3 0e f7 4d c6 f3 22 13 11 99 89 85 84 aa 54 be 7d ba cb 22 90 c8 35 32 32 b6 8c 8c dc 7f dd 68 1b c7 46 b7 f1 7a ff bf db 99 a4 81 9b 78 61 a0 26 3a d3 9e 94 70 74 c7 dc 44 b1 ac 64 b5 60 e1 a4 c1 1e 17 61 94 c4 bb bb 5b 5f e6 e1 38 f5 99 cd 7f 0c 91 cf 62 aa 66 2a b2 ce 22 f3 98 4d bc 80 ed ee f2 5f c3 99 8f 6d fe a8 f6 87 d0 ae f9 5c bb b6 f8 35 ee 3e fd 94 78 3e af 3f 29 bf ad 55 25 0d 78 5d 63 65 47 16 8f 99 3f b1 f1 8f 99 cc bc 58 57 f3 51 6a 4f 11 4b d2 28 68 14 e3 d6 9e 96 4e d4 60 d6 d3 ba 27 13 1b 91 1a 68 4f de 44 65 fd 60 a8 89 12 f8 2c c7 d9 c3 22 9e 85 49 d6 93 67 06 ba 6f ee b4 75 f1 d1 7c 5a af 7b a2 50 82 85 5c c7 f7 55 4f 96 d5 3d bd 78 8e 34 78 f1 ad 9d 56 91 b6 16 45 23 63 6e 25 7a 64 b8 16 83 bf 63 ab 3c 53 3a 74 2f 32 42 9a b4 2c bb 22 e0 19 1c 0a 1f a2 70 [TRUNCATED] Data Ascii: 388zF(!V`Jmd$[&IH @cx?ga_M"T}"522hFzxa&:ptDd`a[_8bf"M_m\5>x>?)U%x]ceG?XWQjOK(hN`'hODe`,"Igou\|Z{P\UO=x4xVE#cn%zdc<S:t/2B,"pdEXY\|fBSZ[C}U@WQ_#7tw]?erI5-E6YlXUDiB4dJznUNi`skXP)N'&(u:\ '$T`>OrMl6F^0~I4FB;?\5s\1]qaJ(LB1s@,u,,E#plu]XG1k `&{INjMh\|g':;+@X^~v`AfL4=vW]=O4SW5'#q"X~8r\|}qF,sLcS_c FCe0Hg5KluaytBvwG8:C1QDOecXVNI
Nov 26, 2024 08:19:58.994918108 CET	84	IN	Data Raw: cf f3 15 e5 6b 2e 34 e7 05 29 eb c5 ea 58 f7 61 02 61 38 33 67 9e 65 40 3b 7c 7a 84 9a 42 f8 a6 e0 b3 a2 ef b4 00 a0 d8 21 80 49 a2 7d 71 62 d4 f2 4a 20 78 56 66 5e 62 29 e2 f9 a5 93 cc 2c cb c2 1f 78 5d 97 66 25 52 b7 48 01 87 fe 0d b0 87 dd dd Data Ascii: k.4)Xaa83ge@;\|zB!I}qbJ xVf^b),x]f%RH
Nov 26, 2024 08:19:58.994926929 CET	1236	IN	Data Raw: 33 61 32 36 0d 0a e2 19 a8 69 4d de 07 58 73 e1 c3 ee 2e ff ad cf 83 dc 66 77 17 ff d6 7f 87 d5 8f b4 ba 66 81 41 b3 6b 15 3e e1 43 96 7d 27 33 28 a5 ef 8a 06 48 ad 89 85 83 1c 0d f0 b0 ab 69 2f c4 e9 83 53 44 6a 59 71 81 43 80 df 1e d5 09 08 1e Data Ascii: 3a26iMXs.fwfAk>C}'3(Hi/SDjYqCzD[85PLh8a)30Gn.\|D,_Im(C)RPSaayW`)u/)EY>C$UX--Pm24}
Nov 26, 2024 08:19:58.995011091 CET	1236	IN	Data Raw: a2 90 41 02 d4 97 3a 54 62 dc ed 97 f6 fd 10 3b cf 67 e1 f3 90 f1 38 7b 7b 79 1f ea d0 06 84 74 c0 6f a1 ed e5 83 fd 4a 6a d5 3d d6 fe c9 fc 38 57 8b 5f c8 90 75 0f 90 93 b8 ef e1 31 67 bf 1d 2e 5e 1f 73 03 13 5a a0 26 42 df f4 31 19 a0 3c c6 f5 Data Ascii: A:Tb;g8{{ytoJj=8W_u1g.^sZ&B1<p7?bxK<>g@Dn>_s,YJ+KYOtV-P@/<`TKdh.slq1^+fua}zMD5BcbOhs*R:xn}
Nov 26, 2024 08:19:58.995023012 CET	1236	IN	Data Raw: aa 9a 57 d4 0e a6 15 26 15 f5 00 df b9 61 86 7d 45 e3 75 48 1f 38 4b 6f 8a 02 e5 ee ae 40 c9 3c c5 80 5a a2 b3 29 e2 61 96 29 ca 4b 85 2c e9 51 d0 fe 82 9b 80 85 6c b6 b0 b3 80 06 9f 77 cf 44 1b d7 cb 30 e0 b3 86 a1 92 0c 40 1b 5b 1b 6e 12 42 85 Data Ascii: W&a}EuH8Ko@<Z)a)K,QlwD0@[nBT_mGFT_m/Y]X!JhL,[MpwWOFO~:@?4c.?+uGn((zh$B=*.{/?'doVbSrJBiL)
Nov 26, 2024 08:19:58.995054960 CET	672	IN	Data Raw: ac 0f c2 68 4e db 8f 75 f0 15 42 4e a2 01 db 5a f8 8e cb 50 87 83 e5 07 88 fb 63 f8 c0 a2 b7 0e 1a 6f d6 b0 a8 53 63 ec 24 e8 62 08 eb 3a 35 de 9f dd 5c fc 7c 6e 29 ef 15 58 c8 a9 f1 e1 ea c7 bf 7f 77 f1 e3 8f 96 f2 a1 ac 6e a4 7f 42 43 db 76 ff Data Ascii: hNuBNZPcoSc$b:5\\|n)XwnBCvB<'^[j3iKe[V0AEae[@Ln+I1%T^60dM(y~Ze\|!!m3W%D;3+<(rVo)E!t#,5:SO>pU#
Nov 26, 2024 08:19:58.995066881 CET	1236	IN	Data Raw: 48 0e 20 bf c8 19 dc ee e6 33 6d 08 5b 01 2b 56 fe 56 0b 12 2d d6 7a 18 7c 17 31 f6 a9 d6 23 65 b1 bb bb dc dd c5 9a 41 53 e7 8d ed ee 62 5d b8 07 df 0b 71 ca 11 c8 2f 5b 5e dd ca ce 39 6e ec a5 c2 63 8b 56 48 5b 18 71 3a d2 51 ea 54 2e 90 13 be Data Ascii: H 3m[+VV-z\|1#eASb]q/[^9ncVH[q:QT.@NNh5gQ586M[XH_SA~mEhpQw"=qv}{^}\|g7W5R?%@X")PWV
Nov 26, 2024 08:19:58.995079994 CET	1236	IN	Data Raw: b2 03 10 a8 13 23 e3 42 68 2c f9 82 d3 e7 90 fa ed 4f df 7f ff f7 db eb b3 ef ce 3e 5e e4 8a d8 b5 fe 68 2d 81 a7 8b 12 8a a6 5f 59 7c 63 01 54 3e be e0 e0 f1 0e cf be c2 78 f1 f9 f6 39 f6 fe fc c9 c8 54 5f ea 23 fd 1c ed 35 40 c6 f4 94 8b 71 f7 Data Ascii: #Bh,O>^h-_Y\|cT>x9T_#5@q~eQ*IRxG(_^lI^z+5l\|@"CLhu~6We/U_0WPhhfu+C:so9;igTy=i\|P 2G
Nov 26, 2024 08:19:58.995093107 CET	1236	IN	Data Raw: 66 94 87 44 cd f2 9c b5 4c e8 06 c6 b8 5a 54 e6 9a 1f c5 b3 45 bd cd 52 71 33 a0 f1 91 fb b1 b4 33 a2 03 dd 8c fa 04 78 56 a6 c9 28 f4 a5 56 bb 97 be d9 34 4e ee 75 7a 29 00 b2 30 50 a6 c3 b2 1b 08 7a f0 60 52 49 1c 01 88 41 a3 f7 24 48 7a 02 ab Data Ascii: fDLZTERq33xV(V4Nuz)0Pz`RIA$Hz,yDT.-h^nR}ubC5B7L`Y*@x;@BaH88{m7%nltguwbo:uPMp@[7l$-THR#Wyk,2[T(
Nov 26, 2024 08:19:58.995105028 CET	1236	IN	Data Raw: 07 a5 c6 f1 0c 67 b5 50 b7 52 a8 a6 1d a8 42 0e 68 88 ae e9 61 cf 6f 5a 1d 20 71 7f 79 6e 76 79 ec f4 02 9f 18 cc 0f 87 2d 3e e5 e0 2d bb 20 b6 7a c1 9b d2 c7 5e c0 99 d0 6f 2a 26 f6 71 a6 72 9f 3d 1b 2d d3 91 1d 9a d1 5a 0a 5b 3c 5b 6d 9e 22 6a Data Ascii: gPRBhaoZ qynvy->- z^o*&qr=-Z[<[m"jWT(co]VLxmt`(s_(Cg/Nu#9x48[Pr)zqh:1G0s#/<aSz$CHg)a/gkx
Nov 26, 2024 08:19:59.114872932 CET	1236	IN	Data Raw: 01 cd 90 ca cf 98 03 92 42 1c 53 6f 19 b2 a4 a2 e9 ac 51 2a 75 03 2b e5 07 91 99 17 6d 3c 2c 07 c0 4d f8 40 59 dd 4a c1 32 bf b0 d1 cf 1e 7b 90 58 3c 8e 42 6f 6c 34 1b 25 11 4c 82 15 38 02 0a 0b 84 f4 02 af 33 fe 53 ee fc 59 40 55 14 04 83 37 9f Data Ascii: BSoQ*u+m<,M@YJ2{X<Bol4%L83SY@U79~x; 6s}\Fw:<`iC_kRH@x]];4Z2{L^uy(Ii26>Rr=.=^m\|Ts=lIX(Y9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49754	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:57.684072018 CET	309	OUT	GET /dist/jz/locale/2052.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:58.995254040 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Tue, 15 Oct 2024 08:03:20 GMT Vary: Accept-Encoding ETag: W/"670e21c8-14f69" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i63240_c21843, i2103121_c25795, i1872280_c17483 X-Cache: HIT from i1872280_c17483(cloudsvr) Data Raw: 33 64 62 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 bd 79 73 14 57 9a 2f fc 55 68 22 de 77 66 e2 32 d3 80 7b f5 7b ef 4c 80 80 36 d3 16 c8 08 b7 7b 6e c7 84 22 55 95 92 ca 54 55 96 6b 41 c8 1d dd 21 16 09 09 49 48 80 d8 85 41 98 1d b4 60 36 2d 48 fa 2e 33 ca ac d2 5f fd 15 de 67 3d 79 4e 56 96 c0 dd 3d 11 ee c5 aa 5c 4e 9e e5 59 7f cf ef 39 e9 95 77 7c de f9 7f fe d8 d5 d5 13 14 ab 5d 3d 5e 21 97 1f e8 aa f8 d5 4f ff f0 c7 9e 5c b9 52 fd 74 67 67 ae d0 59 2b ee dc 55 f1 33 41 31 fb e9 ce 70 7e 6c 73 ed ca ce 3f ed d2 0b 3a da 73 c5 de cf 73 5f c6 97 44 d7 16 eb ab c3 d1 8d 8b ee 85 87 bc 62 6f 67 50 ec ed fa cd fe bd 9f ec d9 bb 6b c7 e6 ea 06 3c 2d be 8f ff 5d 7e b6 6e 0c d7 e7 1b 6b 0b 5b b7 87 b6 56 2f 59 03 b1 ff 1a 5f bc 75 eb ed e6 f2 a3 f8 32 f9 77 eb 69 cb ef c3 99 61 eb 39 fc ef f1 05 9d c7 7f eb e5 aa 39 eb 8a 89 8b d1 b5 f3 d1 c3 77 ee f7 44 d7 96 a3 b9 ef 1b 23 97 f1 cf d6 c7 5b 7f b5 de 4a cf 08 d7 9e 6e ae 5c 4a 3e 59 fe 9a bc b8 31 3b 0e ef 4c 5e 2c 7f 6d 7a 32 2f 4b f2 c9 c9 c5 e2 8f [TRUNCATED] Data Ascii: 3db0ysW/Uh"wf2{{L6{n"UTUkA!IHA`6-H.3_g=yNV=\NY9w\|]=^!O\RtggY+U3A1p~ls?:ss_DbogPk<-]~nk[V/Y_u2wia99wD#[Jn\J>Y1;L^,mz2/Kc>mxgu!p_9_{}A/J^_ xNIF_?(KWk/s:[b;AA\|GR{w^9[XeB.+;b]_W*etg}v1`sm>d'UA#_v%]oE3Btac>V~C7/\}G?A+\|=([k=(x{\|z\|gv2l'FS+j_eN_g;{ KY VU//cWNG)i?N^R_W"\|8\|>\|4\p>sZc9XC-Uw+
Nov 26, 2024 08:19:58.995328903 CET	1236	IN	Data Raw: e8 d3 e8 cd 69 7c fc e4 bb ff 1e 3c 43 77 e4 8a 27 bd 7c 0e 8f f2 83 97 d1 55 79 df 40 a5 ea 17 0e 96 cb 41 19 96 f3 d5 6a 7d f5 6e 7d f9 74 b8 71 f3 2f ef c7 e1 61 f5 27 13 e1 e0 cd ad f3 13 8d 85 ab 3b 77 f1 32 1d ad f6 f9 e5 cf 7b 8b 5f 7c d1 Data Ascii: i\|<Cw'\|Uy@Aj}n}tq/a';w2{_\|^V/pGtI/h~/Zn]'6WokJb_RjxiswisJpfp/n4_U~y0MglW_WLw.W2o"
Nov 26, 2024 08:19:58.995338917 CET	1236	IN	Data Raw: a5 f0 1d 98 4e b6 0b f5 e7 23 c1 be 1a 9e 4d de 0b ac 87 c0 92 dd 1a bc 05 f3 bf f9 1e c6 7d 8b 1f 89 ca fe d6 19 9e 03 63 e8 38 76 53 27 1c c0 16 96 13 1f 8b 8f b4 9e dc 89 fd 3c c7 36 29 cd 62 7d fa 25 08 81 7f 66 c9 01 62 a3 fe e2 51 7d f5 1c Data Ascii: N#M}c8vS'<6)b}%fbQ}\|pdDC8yv4~Njz5cCS(<#oO?~gD~R}Jt=W?60+mWyRds=x-xt^WntzX6WY$'R
Nov 26, 2024 08:19:58.995352030 CET	672	IN	Data Raw: 89 97 ba 93 c9 26 a2 06 6e d2 9c 2e 3e d1 c7 7c b4 84 f8 7b ad 98 2d cb 4c 96 0e 14 b3 b5 7d 9d 63 7e a7 5f cc d2 9c 8b 45 3b 79 69 6b f0 74 42 e3 b8 a1 d8 d6 6e 1f 1d c3 8f 54 3d fa 02 7c ff d1 13 e0 0f 4a 82 43 c4 98 b3 f4 aa 53 f8 0b ed c0 3c Data Ascii: &n.>\|{-L}c~_E;yiktBnT=\|JCS<]8=Q0Pf4L*k5-7M'mhh%7utoGSZ(AM#qI0g/{bh,]\|I2H^%P
Nov 26, 2024 08:19:58.995454073 CET	1236	IN	Data Raw: b0 1f 6c 60 cc f8 6e cd 0c da a9 91 9d bb 02 d8 ea f4 55 c6 09 c5 cf 1b 59 0a af 3e 42 eb 75 e3 79 78 71 15 63 17 af 97 c3 a9 c7 64 11 76 07 c1 09 78 25 bf 1c 53 80 2c eb b7 ee 9f ab af 3c 62 41 09 0f 02 6b 03 ae e6 3f da 53 20 f3 4d 53 6b 66 bd Data Ascii: l`nUY>Buyxqcdvx%S,<bAk?S MSkfi.Rg!V]3sM3$SsB,S"<4M%hsu`8E%isiNE4.zy>z+0!ohj:7n\p;vObRTSZda
Nov 26, 2024 08:19:58.995595932 CET	1236	IN	Data Raw: 02 09 50 cc 56 9e a2 7c c6 8e 1d 76 ea 16 e7 c0 35 4e 41 7e 34 1b a7 76 f8 17 2c 05 3f 4f 32 fe 0f ec 54 b0 bd f5 9f 26 d4 f4 65 e9 30 06 b9 70 a8 af e1 1f 14 d9 97 c7 1b 1b 37 d1 51 5b 9c 04 01 81 63 be 3a b4 b9 32 06 7e 93 08 78 0c 42 c0 0c 4a Data Ascii: PV\|v5NA~4v,?O2T&e0p7Q[c:2~xBJu>y'\>Pp(Mv1sN6M)V>7}8yd'TsRTY+#YV5K8x=J4/Zo%:4}p
Nov 26, 2024 08:19:58.995724916 CET	1236	IN	Data Raw: 95 60 71 e2 d1 36 a7 8e 60 5e 95 ad 29 8d 12 7f f1 45 eb 28 f1 c7 16 11 56 28 08 22 50 c4 76 bf da 17 64 9d 6c af 8d 49 ec 75 43 4f 2c 46 5a d8 32 47 82 83 05 83 07 6e 1d bf ff f1 61 7b 2b df 8c 1b 75 41 cf 67 d9 f7 32 df d4 72 65 bf dd 97 a2 2d Data Ascii: `q6`^)E(V("PvdlIuCO,FZ2Gna{+uAg2re-_6jbimDjh^u}8dW>US^?Qj'!E2&fuBOf'~w1XuzqAjF}_yf,W2nR\
Nov 26, 2024 08:19:58.995735884 CET	1236	IN	Data Raw: 09 44 33 cf 04 2b 65 39 8e 69 68 02 27 5c ac 4b d3 14 30 b6 03 b5 3f 22 60 ec ce c1 91 40 0a 11 f9 99 9a ce 12 c5 dc c1 8e d3 11 43 29 03 87 4b 7c 26 e5 96 f9 89 5b 2a e2 56 88 24 f7 09 01 ab 71 8b 74 e6 be e5 10 b4 6d ad c7 21 68 fa 23 57 91 c3 Data Ascii: D3+e9ih'\K0?"`@C)K\|&[V$qtm!h#WFNqi0\FCs1i{T,F"7W/P07h$NS0d:{QK(""OyZksi:1;L!-lY{2K2"\RA:WRYJx\|S
Nov 26, 2024 08:19:58.995928049 CET	1236	IN	Data Raw: 41 ae 1b da bb a8 e4 d4 7b 1f 4f af b7 60 23 d9 5a 0d b1 92 5b 92 e1 5a 3a c8 26 a7 52 e4 fb 76 e4 54 56 5c 99 c9 a9 64 ef 06 fd 45 d4 1a e4 51 c8 a6 35 9b 1d 5e 8e 19 e1 c6 c6 0d 26 22 0b 27 ce 23 4a 78 64 11 b6 09 73 91 61 45 e3 da 1a ba 52 56 Data Ascii: A{O`#Z[Z:&RvTV\dEQ5^&"'#JxdsaERV4+Rc5<GUn^KX=\.Hs )EHdR1:Ql$?DFS,O#u6DW`_G3U1d$0z1K[\|#]mO;2"
Nov 26, 2024 08:19:58.995939970 CET	1236	IN	Data Raw: e3 a8 8d c4 d9 56 fa 34 11 8f 6e 55 49 9c e3 d1 8a f4 58 2c ba 87 ca 99 cd a2 df 5f f9 e2 18 15 1b 13 9c 9d 70 10 58 ca 00 f3 17 a3 21 6c 4f b4 89 2b 2c 31 4d 87 ca 01 39 97 23 8b 20 82 d0 46 e6 c8 b1 31 2d 59 72 ea 84 89 28 38 9a 1c 82 f5 f2 62 Data Ascii: V4nUIX,_pX!lO+,1M9# F1-Yr(8bpG:6^a%i=UIv"GdJ2x%JBVQ-q\|=@Mo)a%.BWvgQ}+Id{^V~@dGSreqsmneEo46S;!{Qbl]W[PJ
Nov 26, 2024 08:19:59.115259886 CET	1236	IN	Data Raw: 9d 7a 5a 36 ca 2d 82 6a 32 aa 72 4c d5 50 ab e1 7f 64 de b9 d5 ed 1f 55 e3 f6 b1 4d 91 7b ec c7 da cf 75 1f 67 87 fc 6a d5 40 32 05 e0 7b 6c 2e 3d 08 2f 3d 41 8d 3d 34 a1 38 dc 51 f6 c0 f6 e7 70 c1 1b 1b 53 2e 0c 5e bd 1c f6 a4 5d 93 bb 42 32 ba Data Ascii: zZ6-j2rLPdUM{ugj@2{l.=/=A=48QpS.^]B2;m4ltMV\q'2'C&xBT6S})w(N?!5&N%]*fxk(O@E\|c n:Sq,4CC1i[dh?&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49755	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:57.799911976 CET	318	OUT	GET /dist/jz/biz-shared/bizShared.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:59.049005032 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Fri, 08 Nov 2024 03:23:15 GMT Vary: Accept-Encoding ETag: W/"672d8423-28ada" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i63780_c21843, i2103127_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 33 63 39 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd fd 77 24 47 72 18 f8 fb fd 15 40 1d 8d ad 22 12 3d 68 cc 90 4b 56 b3 d8 c2 00 18 12 4b 60 30 0b 60 86 cb 05 a1 7e 85 ee ec 46 cd 54 57 35 ab b2 f1 31 e8 d6 3b bd b3 3e 7c 3e 9d 4e 67 4b 3e cb f2 d9 ba 27 4b e7 d3 b3 2c df f3 49 f2 4a 67 fd 33 cb 0f fd e4 7f e1 22 f2 ab b2 aa b2 1a 98 e1 70 bd 92 b5 6f 39 a8 ce ef 8c 8c 8c 8c 88 8c 88 bc f7 f6 d2 46 6b e3 7e 6b e3 bd a5 b7 ef fd 77 cb c3 69 d2 67 51 9a b8 94 30 ef c6 49 cf 9e d3 3e 73 82 80 5d 4f 68 3a 5c a2 57 93 34 63 f9 ca 4a 2d 67 9c 0e a6 31 ed 8a 3f 2d 59 2e 60 6e 46 bf 98 46 19 75 9d 56 eb de 94 45 71 7e ef f9 cb a7 f8 b7 35 8e 92 d6 f3 dc f1 88 2e 72 31 a5 8e e7 f9 8e 1a 44 d1 fa 80 0e a3 84 ae ac 88 bf ad 70 3c e8 8a 4f f7 84 9c c2 48 fd a6 91 76 e5 df d6 59 f4 f2 e8 3c cc e8 e0 f5 c6 44 4b 0d d0 96 ac 40 68 eb d9 94 7a 73 d7 99 26 62 40 03 67 59 0d 21 a7 f1 b0 8b ff f8 ec 3c ca 89 5b 86 6d 46 d9 34 4b 96 8a 44 ef 46 7d 2f 31 17 0a 0c d3 cc bd 08 b3 a5 84 44 24 0b d8 c9 fa 29 09 e1 4f fb [TRUNCATED] Data Ascii: 3c90w$Gr@"=hKVK`0`~FTW51;>\|>NgK>'K,IJg3"po9Fk~kwigQ0I>s]Oh:\W4cJ-g1?-Y.`nFFuVEq~5.r1Dp<OHvY<DK@hzs&b@gY!<[mF4KDF}/1D$)O:'d;I~J8(Z,e)u,]a)$:]Y&G#X(Y;5tIr[WVbNF[y4dzs>fN>'MN':D`RprLf>J+F.@<E<k\!!zenA_++7~l9O1\J0^4pg34}'d:qHwp4b$q8"zI3<QN: _U\|pVy$}pd5&5l'?>G1l8J^&?E9IeAAo6T2EzPuLsJqVFB&lzyY1im.g2a
Nov 26, 2024 08:19:59.049124002 CET	1236	IN	Data Raw: 31 94 7e 46 43 46 e5 68 14 dc 3a 43 9c 50 60 ce 92 0c 5b b8 ed 02 87 d1 2b 76 0f 96 c5 81 42 69 42 b3 2c cd 02 fc 8a d3 70 50 60 6a ca 77 8c a5 44 32 8d 63 e2 e0 27 02 2e e5 8d 7a 30 ae 0e 8d 73 ca a7 98 05 29 80 b2 52 a4 eb 00 ba e6 51 32 72 7c Data Ascii: 1~FCFh:CP`[+vBiB,pP`jwD2c'.z0s)RQ2r\|Yp0_-l#`A4yUgiF1>O\g5_u<D?Dho?lnml;/h 'SFp{&@Z"nGz$q\|EpAH2p'Z&
Nov 26, 2024 08:19:59.049166918 CET	1236	IN	Data Raw: 76 92 9c 76 d2 56 81 fd 81 f9 63 36 5b 6e 93 b4 65 ee 06 1c a2 c3 11 d0 81 ad 85 52 4e da 52 bb 03 f2 9a cf ed 08 0a be a0 d7 1e e2 dd fc b6 dd bb 84 c2 90 4b 8b c3 01 0f 93 84 a7 91 64 01 6f a0 cb c3 11 5b ec d9 f6 dc 7b 53 9b 15 87 e8 4c 73 ba Data Ascii: vvVc6[neRNRKdo[{SLsG4Qy\O@h>DKAP^`CX?M9[WQm1Oxb/Pv/HuRE[o]$ ]hy&(,BB(rRQOP=`P
Nov 26, 2024 08:19:59.049179077 CET	1236	IN	Data Raw: 96 25 8e d3 09 88 32 b7 b5 f3 a3 5b db d9 a3 43 38 3d 27 f5 93 bc 86 ce eb 26 3a af 37 a1 f3 fa a9 0f e7 71 bd 76 db ac dd 6e aa dd 86 da c8 40 2c 1b 5b f4 f1 74 7c 46 33 0f 0e f5 d9 cc 96 5e 52 6e 09 c5 16 de ac 01 bc e1 df f1 34 67 4b 67 40 e0 Data Ascii: %2[C8='&:7qvn@,[t\|F3^Rn4gKg@^,TaE/W8T`fMM)cCrfH9sJlDj*j#kU#YO_V+$.%~(Z(9cY1"\"v
Nov 26, 2024 08:19:59.049209118 CET	1236	IN	Data Raw: 02 8b 63 0d 23 dc 45 2d ab 51 6c ee 11 55 36 fe 25 b9 fd e2 72 36 ab 42 5d d8 62 4a 93 48 d2 6f 96 c9 ba e2 0f de 0a c4 41 5f 0b 62 80 91 bf f0 0b ea 87 43 a6 90 15 e6 d7 49 7f d7 cc 2f a5 38 64 00 85 0c e3 75 5e c4 f8 6d 18 85 0d 2b 66 6d 6f d6 Data Ascii: c#E-QlU6%r6B]bJHoA_bCI/8du^m+fmop[o]ya2Je(5mXbMKg.ltZ6r7#N/J.s$\@b8jC"Iq;$FXp.''~!,Ey90]f$p\N>z\IE48:pO2
Nov 26, 2024 08:19:59.049211979 CET	1236	IN	Data Raw: 10 aa 02 23 a3 4f ce 47 5a f1 0d 53 8c f2 5a ba 45 8f 69 5b ad 8a 56 ac a3 8c a2 19 57 28 06 41 0f 10 a2 de 27 64 c0 c6 30 86 37 9b 31 a1 3e 03 39 1b b6 74 98 bd b0 5d d6 2c bc 2e c9 2b 37 1e e4 c0 f3 5d e3 6a 04 60 8d a9 76 18 a0 3d 7a 13 cb bb Data Ascii: #OGZSZEi[VW(A'd071>9t],.+7]j`v=zp>@vcS?t?lcp]bJY@nC"UX!G1kc>MT]_U &H%%y=uj9iD1@h^RprhR
Nov 26, 2024 08:19:59.049248934 CET	776	IN	Data Raw: 97 aa e0 08 93 8a cf 48 88 c6 1e 51 e7 3d b7 1e c4 66 40 24 28 ae 70 79 e8 d8 34 a0 73 c9 88 dc c8 21 2e f7 15 49 48 4a 8a fb d0 fc ed 2a 7b 4c 37 c4 b1 ea f8 a5 ba 31 8c c1 a1 ae 57 54 48 82 a5 7c fe 73 41 27 06 54 a8 08 a6 19 fd 5b 48 2c 2c 21 Data Ascii: HQ=f@$(py4s!.IHJ*{L71WTH\|sA'T[H,,!?0qyzNtX[ft8l(EP)gP>4+w#sg9.p#PC3vX?1+I7Qw#KRZYa&Z-
Nov 26, 2024 08:19:59.049262047 CET	1236	IN	Data Raw: 20 8a ee d8 31 7b b7 54 d8 9c 99 ac d7 40 88 cd 6a 61 a5 4a 13 14 af cc 4a 26 eb 77 d1 4c 65 7a 0b ea d8 77 5f a9 c2 ce 16 e7 5f 0f 1e 1e ed 1c 3e db 39 ec 6d 6f 1e 6f 5a ab 3d aa c2 e1 2e 7d bd d4 ab 95 a9 d5 ca 44 23 19 e1 d1 f8 ad b5 9e eb 73 Data Ascii: 1{T@jaJJ&wLezw__>9mooZ=.}D#sJLuaK\|\|Ho%{=~8QEV{(gw\y {\|1PJ/n+-npstrK#Q):QfTC/0A,"`[o+wG
Nov 26, 2024 08:19:59.049273968 CET	1236	IN	Data Raw: 95 07 d7 22 e8 b2 d0 fb f7 74 4c a7 c4 e3 11 56 98 f9 7e 56 d7 1c 44 75 00 a5 87 b6 22 cf d7 c3 38 83 5d 53 c9 d4 93 ee 49 9e b6 3e eb 52 57 82 8e 28 41 2d 4a a0 bb 4f 91 79 fe 20 68 af 6f 3c d0 ad 89 c6 76 85 7a 6a 21 24 3b f5 0d a2 89 5f 16 0e Data Ascii: "tLV~VDu"8]SI>RW(A-JOy ho<vzj!$;_eI"TMZD2I8`}.YnzKM/cIM8C7xVPuEA?G7*a01h@ObHo<Fzm[z
Nov 26, 2024 08:19:59.049287081 CET	1236	IN	Data Raw: 59 4a 45 73 e0 46 bc 58 16 ad 23 41 96 85 cf 61 c4 2d 53 78 9c ab 84 62 91 68 14 25 db a2 d1 39 79 11 dc e4 be a3 46 00 b2 f3 90 3f 30 6e 8c 01 46 80 02 b2 68 10 ea 63 70 fb a2 0d 87 f4 7d 61 64 e6 90 0c 1a 52 63 82 82 58 8e 5b ec 45 90 2e ca b2 Data Ascii: YJEsFX#Aa-Sxbh%9yF?0nFhcp}adRcX[E.h4dc&@zd+#GFd~\{_6Y4ahuftu;3^rtfK=k@H6;=:lmq'#>ncn}89Q**\|cT
Nov 26, 2024 08:19:59.169173002 CET	1236	IN	Data Raw: 51 3c 15 28 8e c4 fb 33 a4 5a 3c 9c 38 f4 1d b6 72 20 c5 cb 6e 16 84 c0 cd 48 7f 6e 1d 31 37 93 41 96 f3 95 95 02 a5 cd 6f 89 d4 b9 80 1e 39 d1 28 1d 91 4f 80 78 f1 a0 26 b9 e7 e9 e8 dd 7d ef 26 6c 51 f8 a3 a9 73 d8 1a 16 c6 3d 12 ad a4 5e be e0 Data Ascii: Q<(3Z<8r nHn17Ao9(Ox&}&lQs=^~TXluH5-/)r[y8.LZcB_0Mc&;w0a;WV\|=fXM)>BRqp>GWDD).: o?"Y#`:j
Nov 26, 2024 08:20:29.456676960 CET	309	OUT	GET /dist/jz/locale/1033.min.js?v=202411131400 HTTP/1.1 Host: jzfe.faisys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:29.853909016 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Server: F-WEB Last-Modified: Tue, 15 Oct 2024 08:03:20 GMT Vary: Accept-Encoding ETag: W/"670e21c8-16665" Origin-Agent-Cluster: ?0 Content-Encoding: gzip X-Ser: i24843_c17589, i2103121_c25795, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 33 63 39 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 bd 6b 8f 24 67 76 26 f6 57 82 85 15 38 83 ad ae 61 37 c9 b9 d4 ee 8a a8 aa ee 66 d7 b0 eb c2 ca 6a f6 70 64 21 11 99 19 99 15 ac c8 88 64 5c aa 3a 7b c0 81 60 60 6f 58 7b 81 b5 01 c1 58 cb 1f 04 c3 06 fc c1 6b 7f b2 21 4b b2 3f e8 9f 68 a5 b1 f4 49 7f c1 e7 39 97 f7 12 11 59 dd 1c 8d 01 b2 2b 22 32 ae ef e5 bc e7 f2 9c e7 dc a5 75 f2 72 f2 2f 7e 35 9d 2e ab b2 9d 2e d3 75 5e 6c a7 4d d6 1e fe c1 af 96 79 dd b4 87 7b 93 7c 3d e9 ca bd fd 26 9b 57 e5 e2 70 ef 6f ff d3 bf fb 9b bf fc 6f f7 be db b7 13 2e cf f2 72 f5 32 7f e5 4f f9 cd 1f ff ef ff ef 9f ff ab df fc 77 ff 3e 3e f1 79 5a ae 26 55 b9 9a 7e 7e fc e4 e3 c7 4f f6 93 bf f9 f3 ff 87 ee e6 af 93 7d fd 39 b8 f0 6f ff ef ff f4 77 7f f9 bf fd fd 7f ff 2f ff fe cf ff 43 f0 22 e1 51 7f f2 df ff c7 ff e3 6f fe ec 7f f6 a7 e9 7e 70 b7 3f fb 8b bf fd 93 7f 15 dc 47 f6 fd 09 93 eb 2f d2 bc cd 83 33 fe eb 7f ff 9b 3f fe d7 bf f9 9f fe cf f8 7b 7e f3 c7 7f f6 9b ff f5 7f fc bb 7f f3 df e0 70 f0 f1 c1 d1 e0 [TRUNCATED] Data Ascii: 3c90k$gv&W8a7fjpd!d\:{``oX{Xk!K?hI9Y+"2ur/~5..u^lMy{\|=&Wpoo.r2Ow>>yZ&U~~O}9ow/C"Qo~p?G/3?{~p\|ow_3'[ww\|qA}L\|CSqN\|':Oju7'~$e1zyV<xNItMu$}rE/L\Ezx08}V.-d,\6<iI?9>Ljs/U6mNi^t5=NmnX\7jd%4_$\|^f=E$?,7&+nduFw7Mnjm&-N\tk=pousnV^>IyV]`'^62i:87dya'i2zgzS&C#,/jjv~#ms=jo&K2jdQq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49759	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:58.480531931 CET	322	OUT	GET /js/comm/jquery/jquery-mousewheel.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:59.817545891 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Wed, 15 Nov 2034 04:11:12 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:49 GMT Vary: Accept-Encoding ETag: W/"6084db9d-b58" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i34692_c4672, i2103127_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 32 63 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 6d 6f db 36 10 fe 2b 8e 80 19 64 a1 70 76 36 0c 98 5d c2 e8 d6 0d 0d d0 2c 5d d3 0f c9 0c a3 60 a4 93 cd 8c 22 35 91 ca 4b 63 fd f7 1d 29 eb c5 ae bb e5 83 6c f2 ee b9 e3 dd 91 f7 90 59 a5 13 27 8d 1e 7d 76 4f 05 98 8c 00 7d 2e c1 55 a5 26 3b 09 8f b2 1d 26 e2 bc 11 8d ae 9e f2 5b a3 c6 e3 c8 86 c1 a1 82 49 07 a5 70 a6 5c b4 a6 23 d7 3b 1e ed b0 50 cf 3a b5 1e a8 01 fd 7e 7b 49 60 89 d1 d6 95 55 82 fe 39 e7 9d fc a4 1d b3 a2 34 ce 78 b3 45 1b df ac 5b 92 e2 42 f5 49 eb de af 7a 64 ad 14 32 a9 31 8c e6 9f 89 3c 5d 34 43 b2 8c ee fe a9 a0 7c 8a 56 31 d0 59 64 6e ef 20 71 68 c8 49 54 e9 06 93 f6 7e e0 b1 30 a5 b3 8b 81 6e d6 d5 b9 d1 51 ba c8 4d 5a 29 60 3b 01 87 19 90 bb 3f fd 22 b4 26 5d a0 29 7d be 17 e5 28 89 f3 18 f8 32 7a d8 00 a8 28 8e 72 53 59 68 27 6f 2f 2f 2e fc fc 2a 29 8d f2 82 0b f3 25 08 3e c8 47 50 3b e9 2a 76 3c 32 ba b1 91 7a 94 9a a4 ca 41 bb ed f6 e7 d7 bc 9d b0 76 70 61 52 58 b4 cb ad 66 cb 83 05 4d fe 92 05 d7 fc 4d 59 8a a7 7e 5f [TRUNCATED] Data Ascii: 2caVmo6+dpv6],]`"5Kc)lY'}vO}.U&;&[Ip\#;P:~{I`U94xE[BIzd21<]4C\|V1Ydn qhIT~0nQMZ)`;?"&])}(2z(rSYh'o//.)%>GP;v<2zAvpaRXfMMY~_U2HwmifJvCz"Tso]t[@"b}J5E?)EWQLo{ih(6@X0JX&>9(3z,Nzn@7.t]4l>=:v <>s5?QRKB;LS+Zq<a[F&S)`^KgQVwtwnFoI"DZ8hXKhw%0O!~
Nov 26, 2024 08:19:59.817564964 CET	613	IN	Data Raw: f0 c5 80 2d 7d fc ac 49 98 60 c2 18 ab 93 7a 6d 67 cf 22 bd ab ac bb 54 e9 5b 50 4e d8 d9 c9 24 d6 a6 cc 85 c2 35 2e 43 52 28 aa eb 79 e7 d5 f4 45 81 ed f6 41 6a 3c 1b 4d 17 61 7d d6 2c 11 4a 11 51 ae 03 2f d8 78 4a 63 c3 27 b1 c4 4f e1 67 f1 13 Data Ascii: -}I`zmg"T[PN$5.CR(yEAj<Ma},JQ/xJc'Og204m5>Y(e>,cRO!\|pAncn@-H6K4c.?u7?>j:Qj!g3.] A;u\|4xv&xK{Jn/:7x+#
Nov 26, 2024 08:19:59.818933010 CET	304	OUT	GET /js/dist/module.min.js?v=202410281356 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.235198021 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 28 Oct 2034 06:52:46 GMT Server: F-WEB Last-Modified: Mon, 28 Oct 2024 05:56:29 GMT Vary: Accept-Encoding ETag: W/"671f278d-46880" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i91728_c21603, i2103125_c25795, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 38 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 73 dc 58 76 20 f8 57 92 68 99 05 34 91 a9 4c 4a a5 2a 21 05 a5 55 94 e4 62 b5 5e 16 59 55 dd cd e2 64 80 99 97 24 24 24 90 0d 20 f9 28 32 37 76 c2 e1 c7 cc ce ac 3d e1 1d 7b 66 36 76 3d 9e f0 3c 22 26 c2 f6 6c ec 7a 77 7a dd 33 7f c6 ea c7 27 ff 85 3d e7 dc 07 2e 80 8b cc 24 a5 52 57 f7 ba ba 43 4c dc f7 3d f7 dc f3 ba e7 9e bb 76 38 8b 47 79 98 c4 76 ee 32 e7 c2 4a 0e 5e b1 51 6e f9 7e 7e 3e 65 c9 61 8b 9d 4d 93 34 cf d6 d7 6b 39 93 64 3c 8b d8 80 ff e9 88 72 3e b3 53 f6 a3 59 98 32 db ea dc 7c f5 f5 61 9a c4 39 8b c7 37 0f c2 af db d9 71 90 32 fa b9 43 bf 3a 93 30 ee bc ca 2c c7 35 d7 c1 54 96 e5 90 f4 92 ff 5a 56 61 96 87 51 06 09 9f e3 5f 55 d8 f1 2c 39 c9 62 f4 63 76 18 c6 6c 7d 9d ff ed 04 93 f1 80 ff b4 ad e1 f0 b3 1f 0e 3f 7f fa 70 38 b4 dc 3d d7 dd 07 b8 78 4d 70 19 88 bf 9d a2 d2 b7 13 04 76 ae 0f 51 ff b8 bc bc 98 bb 7a 42 87 2f 29 cc 23 ef a8 81 42 09 35 06 fa 4d 1d 38 ce dc ce 8f c3 cc b5 15 1a 0d 87 5f 3e fa e4 c5 83 ad ef 0d 1f 7d [TRUNCATED] Data Ascii: 87aksXv Wh4LJ*!Ub^YUd$$$ (27v={f6v=<"&lzwz3'=.$RWCL=v8Gyv2J^Qn~~>eaM4k9d<r>SY2\|a97q2C:0,5TZVaQ_U,9bcvl}?p8=xMpvQzB/)#B5M8_>}g>Gao]P`%zs\|-%,c,OCXISv0F\|2L[=OGw7t.fOkM5Z&&>M!3v1O,"<mEAyd8<p{Ka1,WqKgm`>7lRvUd2Ia\|I,~1~z,$sD,>KrEL3"c~'\jcc}0>+vgFa8p=p
Nov 26, 2024 08:20:00.235248089 CET	1236	IN	Data Raw: 61 94 b3 14 93 b3 27 21 6c 90 55 c7 9a 61 0d 01 dc c8 ae b5 a3 a1 74 e8 c6 12 29 f6 c2 4e 98 b3 49 56 eb e5 35 3b f7 62 77 61 5f 11 50 97 95 96 9d 4a 37 ae bd fe 9f c0 83 b0 13 ab 85 2f 65 97 91 60 b5 8e 43 58 7e 81 a1 04 19 31 e3 12 3c 12 b5 49 Data Ascii: a'!lUat)NIV5;bwa_PJ7/e`CX~1<IJH-[5\0C.>%?@<#2 ?0#urZCMbbgj61ehKr)U"HU%VZb'rb\bM48]`FTY5O+pqrj0@v
Nov 26, 2024 08:20:00.235259056 CET	308	IN	Data Raw: c8 0c d0 3c 37 f0 bb fd e0 5e dc 0f 36 36 78 f1 c8 0f dc 51 c5 7a 15 ed 63 0b 56 3c 9b 1c b0 d4 5a 93 c7 08 23 e7 02 da e8 f5 0f 52 16 bc 9e a7 1b d0 28 0a e5 a3 20 b7 47 8e fc 05 8d b7 7b 03 c0 10 0f 50 76 0e cd 64 bc 9f 19 ce 30 37 e0 5d 7d 2a Data Ascii: <7^66xQzcV<Z#R( G{Pvd07]}*KP[y%n;uxCOp>Yg:)gBG~'>qn)a#8aY'GlP\|9%lq1M[PWi+z2L\0NY+D!&%X`!=1X
Nov 26, 2024 08:20:00.235336065 CET	1236	IN	Data Raw: 34 30 30 30 0d 0a fe fe bf ff 7b 3c 8a 5b a9 b9 2f 02 d0 69 74 1b 45 23 22 55 c7 b0 be ce 17 9a 46 31 58 04 3a 58 57 8d 74 1a a1 b6 d8 9a d4 b0 30 8b 2b ad 3c 1e 60 96 a7 41 3e 3a 46 f9 6b 04 94 06 e5 20 0d 08 7c 92 71 98 2b f2 6d a3 e1 9b e5 c7 Data Ascii: 4000{<[/itE#"UF1X:XWt0+<`A>:Fk \|q+m324@}aG)N#kFv1E*ZlTYysm9#BxLz}z~MK][5K&dwCn)zr\|i~M-~n(9W Y%{lNeb
Nov 26, 2024 08:20:00.235400915 CET	1236	IN	Data Raw: 0f 86 f1 92 dd bb 62 e1 58 cd e2 2b 4b 73 8b 6b b4 dc 12 aa 0c 28 34 76 61 c2 68 34 03 f5 7a 6b a4 4f ac af f7 36 f9 2f ae 0b 29 6d 55 57 42 25 dc 0d 0a a8 a6 3d d3 b1 9e b2 eb de fc 2a bb 79 e4 5a eb f1 41 36 ed 03 6e 59 5e 4b 33 6a 74 68 bd 9d Data Ascii: bX+Ksk(4vah4zkO6/)mUWB%=*yZA6nY^K3jthmwm8}1[>SD.~YLhMw#C86j5qiNe^vPpsNN49U]/@p2!OCNQL.V]Qdf AA
Nov 26, 2024 08:20:00.235414028 CET	1236	IN	Data Raw: f7 d7 7c 5f 1d 35 0e f4 0c 14 9d 59 bd 7a 4f 2b d4 db f7 54 5d 41 ad b8 4e 8a 67 d3 7c c8 4a 98 82 1d 61 a0 5f 54 3a 02 84 b1 db 6a 73 82 fc ff 5d 2a 27 f9 be 6b fd 86 db ea d2 b6 2c ca ab e2 ed cd cd db df b5 4b 15 da 3d 32 e7 f2 4a 6e a1 25 cb Data Ascii: \|_5YzO+T]ANg\|Ja_T:js]'k,K=2Jn%!SErL.bX/~n7D{JWry';m__zR.nPCO5#FN}tfqv%F;'xR
Nov 26, 2024 08:20:00.235518932 CET	672	IN	Data Raw: d0 9a 4c a1 23 7e 19 cf 67 75 ce 49 01 17 9f c7 d7 da 4b 54 77 a5 ad 44 25 af b4 93 44 db bf 0a 1b 89 86 2a a8 96 70 7b aa 41 f8 c9 aa ce 9a 30 7b 77 61 47 3c 78 84 c4 5b 63 76 5b f3 e7 c5 06 97 06 75 3b 4a 76 13 0a 63 69 8b d8 6c d6 ee 69 08 1c Data Ascii: L#~guIKTwD%D*p{A0{waG<x[cv[u;Jvcili'\|7(b?vb;qrVLf! ~T3QI:0y\|nCPByT)I}Wk7</]\2C,S9EEeb?^t
Nov 26, 2024 08:20:00.235531092 CET	1236	IN	Data Raw: c4 0e 92 e4 b5 db da 8e 47 1d 2c 0d ac 98 c5 19 6b d9 4f b7 77 1d af 75 9c e7 d3 cc bb 79 f3 08 98 dd ec 00 6f 72 de 3c 14 75 6e 6a fd dd c4 73 cd 9b e8 c8 74 f3 c9 f6 d6 a3 67 3b 8f 5a df bd 39 f1 eb 66 18 56 b8 c8 e0 c5 09 49 ec d5 6c e9 5a d1 Data Ascii: G,kOwuyor<unjstg;Z9fVIlZqi&y//N4+5kU)?@ ;Gz~)r#('0GTDy,3wD]<O/F6L}%Fo89XJ4dBZT\G4o vwNa\|
Nov 26, 2024 08:20:00.235543013 CET	1236	IN	Data Raw: 16 66 cf 82 67 b6 0a ec 24 59 46 bb 07 32 bc 26 0a 70 5d be bf b1 91 dc 93 65 fb 0e 06 f7 93 f2 5f e2 14 a3 e0 8c 94 a1 b0 10 12 e6 a2 1b 48 d8 af e4 e7 2a b3 eb 86 73 a5 74 72 54 4e e7 73 93 21 65 6c e3 35 78 89 63 84 7a 20 84 2b 8b 49 eb 40 13 Data Ascii: fg$YF2&p]e_HstrTNs!el5xcz +I@Nu-MSOSsCAU qs>G0uw&j]U@hmI8D86wy)H0IC;0Dr*F"hk<0Q.HE:C9]n@]
Nov 26, 2024 08:20:00.243797064 CET	1236	IN	Data Raw: 14 0f 4e 28 17 d6 25 d0 2c 95 95 50 d4 dd 6e 9b ea 2f f0 93 ad bb de d2 5b ba 78 8f db e4 99 df d4 83 be 75 06 16 dd 65 81 46 86 07 51 80 4e f2 73 a7 31 76 c2 08 df d7 7a 92 40 4f 62 50 e5 47 04 a4 0b a6 29 7a e3 97 2c 3c 0b 85 00 4c de 98 74 03 Data Ascii: N(%,Pn/[xueFQNs1vz@ObPG)z,<Lt*< wf gXW1b&xa<NNS-$!4+}?26\h6)B}'])cs1ku=T$!\|KYiW)\|Iz?~O??_~O?g?_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49760	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:58.480690002 CET	313	OUT	GET /js/dist/libs/comMethods.min.js?v=202402281530 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:59.778907061 CET	1118	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 05 Aug 2034 03:11:22 GMT Server: F-WEB Last-Modified: Thu, 22 Feb 2024 07:30:21 GMT Vary: Accept-Encoding ETag: W/"65d6f80d-43c" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC205_dx-lt-yd-jiangsu-taizhou-4-cache-12, BC85_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC194_lt-obgp-fujian-xiamen-33-cache-1, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 31 39 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dd 92 3d 6f db 30 10 86 ff 8a cd 41 20 61 96 6a d7 04 84 86 16 1d 8a ba 0d 5a 78 c9 97 c0 88 67 98 85 cc 63 49 2a 76 21 e9 bf 87 b6 94 d8 40 1d 4f 99 32 dd c7 7b 3c de 3d e4 74 d9 d8 2a 1a b4 14 38 b2 96 e0 c3 1f a8 22 91 32 fe 73 80 cb 09 6c 1d fa 18 b2 ec 3f 65 8d ba a9 a1 18 8c 18 eb 24 52 76 41 9e 7b 1e 8a 35 2c 8d 85 2c 1b ac 50 6b 5d 0c 2e 25 65 f9 ed ba 5c cc bf 94 25 e1 37 77 69 88 8b d7 86 28 46 2b 0e 47 f6 f7 51 38 ce 1c 07 5d d7 f6 fc 38 71 43 6a f3 10 f2 0a d7 73 88 2b d4 81 dc ed 5a b0 9e c6 95 09 9c be d0 60 ad 87 d8 78 3b d9 18 ab 71 23 7e 9b 08 5d 47 8f 22 d9 f6 8c ef 1c a1 b4 fe 05 7f 1b 08 f1 ca a7 a5 b6 f2 c0 94 b5 8f ca 4f 30 0d 65 61 73 a5 e2 8a c7 e4 63 ad f7 be 49 7e 13 e0 47 92 f6 07 b9 95 8f 68 f4 e4 a3 94 d2 74 9d e1 fa a5 80 ab 51 9a 4a a9 13 47 ee 24 69 ec c0 50 93 e9 33 a9 af ca a4 a7 3a 2d 88 88 ee ac 28 ca aa f1 df 95 fd 8c 1a 78 29 53 f1 87 4f e9 ba 71 e7 1a 2b b5 5b 4a b8 34 ba 55 6b 10 29 0f db 9f 4b 4a 72 32 3b d1 62 96 [TRUNCATED] Data Ascii: 198=o0A ajZxgcIv!@O2{<=t8"2sl?e$RvA{5,,Pk].%e\%7wi(F+GQ8]8qCjs+Z`x;q#~]G"O0eascI~GhtQJG$iP3:-(x)SOq+[J4Uk)KJr2;br.EYjUoYI5!4Iyn5\|F<0
Nov 26, 2024 08:19:59.780855894 CET	306	OUT	GET /js/dist/frontend.min.js?v=202407231110 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.190479994 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Thu, 09 Nov 2034 04:12:39 GMT Server: F-WEB Last-Modified: Tue, 23 Jul 2024 03:10:31 GMT Vary: Accept-Encoding ETag: W/"669f1f27-1299a" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i11831_c17987, i2103127_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 32 63 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd fb 7b dc c8 75 28 f8 af 34 21 99 04 d4 e8 66 a3 5f 24 d1 04 3b 12 25 59 f2 48 23 79 a8 b1 c6 26 39 fa c0 6e b0 09 ab 1b 68 03 68 3e 86 ec 7c 89 6f 12 3b b9 49 ec 7c 9b c4 b1 af b3 49 be bc bc be 1b 3b bb 77 6f 5e 7e fd 31 d7 d2 8c 7f ca bf b0 e7 9c aa 02 aa 00 34 49 8d c7 89 93 dd 99 4f 6c d4 fb 54 d5 a9 53 a7 aa ce 63 e9 70 16 0c 12 3f 0c 74 cf 4c 8c 73 2d 3c f8 a2 37 48 34 c7 49 ce a6 5e 78 58 f1 4e a7 61 94 c4 cb cb 85 94 49 38 9c 8d bd 3e fb a9 f3 7c 4e a2 1b b6 26 ea cc 32 0f bd 43 3f f0 96 97 d9 6f dd 9d 0c fb ec 53 d7 5e bc f8 cc 17 5e bc fb f8 ee 8b 17 9a b9 bb 0f 40 d8 8b 80 e8 f3 df 7a 56 84 da d3 3d 39 46 0e 5c 5c 9c cf 4d 39 a2 7e 18 85 41 e2 05 43 2c 68 cc f5 e4 c8 8f 4d 3d 1d 03 e3 3c f2 92 59 14 54 a4 98 63 37 aa 78 ce 79 77 6d 6d 7d c3 56 47 0b 93 7c 33 30 43 33 ea 89 94 8a ab 7b 69 35 ae 53 32 16 3b 67 93 83 70 0c 23 1a d3 47 3e a1 ee 27 5e e4 26 61 d4 cf 1a 4b 2b 14 03 32 b7 4b 12 61 7c 2f 69 ce ab 0f c2 20 4e a2 d9 00 ea 76 1c 27 [TRUNCATED] Data Ascii: 2c6{u(4!f_$;%YH#y&9nhh>\|o;I\|I;wo^~14IOlTScp?tLs-<7H4I^xXNaI8>\|N&2C?oS^^@zV=9F\\M9~AC,hM=<YTc7xywmm}VG\|30C3{i5S2;gp#G>'^&aK+2Ka\|/i Nv'_i&!A5]m{ O49Ms>aA^T7OY=BE{Q\|ti+_\|\|i+O/-o5`\|yVyRXoP:i{F~kXkpirg~n0.'~0O{#/H>9{'4"QzN#cc/qT9$_UZ5cF `l5nsfA
Nov 26, 2024 08:20:00.190510988 CET	84	IN	Data Raw: ad ad 6a a6 0b c1 36 04 db 3c 39 86 70 67 79 d9 df ed ec f7 86 e1 80 ea 82 b5 19 be f4 3d 07 60 70 b4 aa 17 0f dc a9 a7 27 46 55 c7 12 8e 13 f6 35 cd d6 7a b8 13 f8 91 17 43 96 10 80 fc f4 e3 67 3b 40 7d 82 11 d0 72 91 33 e2 39 a7 6e 72 04 d9 a2 Data Ascii: j6<9pgy=`p'FU5zCg;@}r39nr
Nov 26, 2024 08:20:00.190709114 CET	1236	IN	Data Raw: 33 61 32 62 0d 0a 34 c1 e5 09 c3 70 e2 fa 01 24 b9 90 64 39 4e dc 87 c8 d8 1b cc 22 0f d2 35 63 6e fa f5 91 32 64 c6 f9 61 18 e9 38 0e 89 a3 bf c9 d8 19 d8 19 18 b0 24 1b a8 5c 7f 45 42 e4 34 60 98 1a bd 68 33 ec 19 e7 fe a1 ee 3a 51 35 30 f3 b9 Data Ascii: 3a2b4p$d9N"5cn2da8$\EB4`h3:Q50A:E oSc5zPGSh&eppcU=H7'N*w%ef/m{$4@yZ8FCJ143z5dyYOLagW11
Nov 26, 2024 08:20:00.190720081 CET	1236	IN	Data Raw: 8c bc 06 f0 cc 5a ef a8 ea ac 08 04 d3 56 aa 87 50 83 a8 34 f1 a7 b1 b6 b5 52 9d 55 95 b6 26 f1 08 63 a7 55 8d b5 24 a5 ad 0c 90 cf 5b a9 84 c1 60 ec 0f 5e 3a 7b 9a 18 0e fc 8d bc 49 78 0c c0 8c f4 43 77 1c 7b 66 45 c3 e6 8c 9e 00 99 03 6e 8e eb Data Ascii: ZVP4RU&cU$[`^:{IxCw{fEnZuNnI38f:~lavHXEB{cq>zj#ciI,$&/."~qm?Z?jU5WFf~b5<."@Pp]"MIWcpkT.P*
Nov 26, 2024 08:20:00.190761089 CET	1236	IN	Data Raw: 96 56 25 60 6e 0e d7 88 20 7c b2 e8 bc f5 fa cf fe fa c3 6f ff d7 8f be ff 37 af ff cb 6f 22 fe 29 f3 c8 00 dd 5a 34 17 b4 3b ff c7 9c 8a 4a 38 4b 70 71 da 01 30 84 80 6f af be f6 c7 af ff e1 ab a5 3d e6 d8 4c e7 8a 81 73 0e bb fa c3 a1 ed 9b 78 Data Ascii: V%`n \|o7o")Z4;J8Kpq0o=Lsxf;=L^]blk7L9thrt6nC6\|Fsc59OyuYnC4'f\&%1p>48k8\8Tp=0{&(Y0oSyq<})4Z{mkL8
Nov 26, 2024 08:20:00.190773964 CET	1236	IN	Data Raw: 26 83 23 3d 80 de 64 bb c7 23 9d bd 3b 2d 1d eb f8 16 04 8c 1b 6c 67 f7 21 d5 30 b2 01 6b f4 fc 4d 35 55 8c 60 b5 ea b3 b1 09 1c 35 03 8c 66 0f df 64 96 f0 41 2d a8 fb c3 25 bc ea 02 9a 9c f8 13 2f 5a 5e 26 31 85 87 bc 80 88 36 4c cb 71 e0 1b a5 Data Ascii: &#=d#;-lg!0kM5U`5fdA-%/Z^&16Lqt/<Aud){T&B@C`Hh\1\OsW^'#7./0QAlewSVkZ2_8&nMU8,vS.9=m5../
Nov 26, 2024 08:20:00.190875053 CET	1236	IN	Data Raw: 41 ab 6a 8e be fb 7e 6f ff 96 a1 19 74 a9 95 57 10 31 8c fe 54 8f 77 ad 7d 83 74 9d e6 73 fd 8b 9f 9d 79 d1 99 8a 7c ec 8e 66 75 57 db db db 3b 6d 34 6a 7b a7 d6 e1 de e9 da 21 7c 6c 1c ee af 8e 60 a5 9c 6b 7b 07 d0 df 3d f8 6b 6a 7b 09 7d e2 ae Data Ascii: Aj~otW1Tw}tsy\|fuW;m4j{!\|l`k{=kj{}gb{}+{{DQ$B:LhKGn$xGrC'oKo[4k=x=hEv[4k:J~FN&d_+J_Y1EbQk? 0@e
Nov 26, 2024 08:20:00.190886974 CET	1236	IN	Data Raw: 9b 18 8f dc 8d ed cf 6d 56 06 b8 7d 2a 04 bf bc 08 7c f1 02 14 47 d9 35 d8 0f 79 bb e7 c8 ac 65 6b 92 ae 7d f0 a0 cb d8 d2 90 34 ed cc 31 fb 19 b0 9f 21 fb 99 b1 9f 43 fa 59 c0 32 92 0e bb 60 e8 8c b1 a3 84 75 d4 ff a2 98 8c 2f 1c b2 08 ce 14 ce Data Ascii: mV}\|G5yek}41!CY2`u/DX+`Y>;y{^M{ufk[>)gPlWwUkS1Q@4L=iw;V<0l(5_9&A5m#K.9GG
Nov 26, 2024 08:20:00.190898895 CET	776	IN	Data Raw: 86 b5 be d6 ea b6 36 ba 56 11 8c 75 02 c3 82 91 ec b4 60 e2 ac 22 18 38 f1 38 25 6d 80 63 dd 6a 77 d7 8a 90 34 09 90 8e 05 b8 01 5d 29 82 b1 46 60 00 dd 80 b9 5e 87 d5 82 8d 44 84 17 2a 30 88 85 38 28 d6 46 13 46 6e 6d ad d5 36 e4 39 69 e3 a4 ad Data Ascii: 6Vu`"88%mcjw4])F`^D*08(FFnm69i tZDE6FW!dQIiA+VcpEH\koFp@%apjlh5F$-faiuf;MkcmFX6Fmc
Nov 26, 2024 08:20:00.193330050 CET	1236	IN	Data Raw: 85 1d ab 59 5d bf 95 a4 d6 24 b1 db ae c8 12 18 26 6e 2a bc db e6 10 4b cc cb 6e 21 d9 81 af cf 7e 6c a6 2a 61 d4 27 c3 8e a3 be 45 64 47 b3 be df 3f d4 13 38 97 d9 03 9d 7d 18 b6 df c7 39 81 88 19 0d f2 5c cf 8b c1 1c 06 f5 60 36 f1 22 7f e0 a8 Data Ascii: Y]$&nKn!~la'EdG?8}9\`6"%7'NYHbi1gI6zz)+}[(xEPs)h5_zg']Ki!q65Y&`$8{.2Z^WfH;I
Nov 26, 2024 08:20:00.193413019 CET	1236	IN	Data Raw: 46 a1 3f 54 cb 0b 49 1c ae 46 64 e3 54 92 26 3d 1f 12 88 68 62 44 43 33 51 8b 0c 85 ab 6c 1f e6 1c f3 c0 7e 12 38 70 40 23 db 39 7c 6a f1 88 58 f4 85 80 76 66 59 03 b8 13 ec fa 22 b4 8f 0c 61 20 74 97 80 97 3b 4e 8d ea d7 45 73 bc 84 08 ee 93 c1 Data Ascii: F?TIFdT&=hbDC3Ql~8p@#9\|jXvfY"a t;NEsoA&m3^&:8Je)p<\|6x@}bH>alIl`NIA(>ddv$zSLBB( 4/u [ZWNVs{/vo?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49762	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:58.598787069 CET	310	OUT	GET /js/dist/libs/jzUtils.min.js?v=202404081140 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:59.901951075 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:04 GMT Server: F-WEB Last-Modified: Mon, 08 Apr 2024 03:40:40 GMT Vary: Accept-Encoding ETag: W/"66136738-29be" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC178_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC195_lt-obgp-fujian-xiamen-33-cache-1, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 38 34 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dd 5a 6d 6f 2b c7 75 fe 2b e4 20 26 76 a1 d1 8a 94 a8 fb 42 de 0d 43 4b 54 ae 5c 49 57 15 a9 3a ae 2c 2c 56 e4 90 5a 69 b9 c3 ec ce 5e 5d 85 24 60 b8 2d da 1a 76 db 00 71 d1 b4 0e 9a 7e 08 6a 14 a8 af bf 14 c9 87 18 fd 2f a9 af 7c fd a9 7f a1 e7 cc ec cb 2c 49 d9 09 d2 a2 40 60 5f 91 73 e6 cc cc 79 79 e6 cc 99 33 2c 0f e3 a0 2f 3c 1e 18 82 32 73 4a f8 c5 15 eb 0b 62 db e2 76 c2 f8 b0 c4 5e 4c 78 28 a2 4a 65 a9 67 cc 07 b1 cf 5a ea c3 4a f8 6c 66 98 0d 92 ce 99 33 0f d8 d0 0b 58 a5 a2 3e 2d 77 3c 68 a9 af 06 71 9c b7 fe d4 39 3d dc 75 1c 42 cf ce 41 88 c6 7d 42 b4 92 4f 2b 1f 22 d7 33 84 4e d1 1b b3 d9 74 4e 75 c2 19 f1 bd 8b 68 e3 ea 47 a7 c2 f3 23 72 8e e3 cd b9 21 2e bd 88 1a 99 29 cc 69 c8 44 1c 06 25 8d f2 dc 0d 4b c2 9e d6 1f 3c ae 3e 6a e8 46 a3 dc 9c a6 ed 12 50 b2 c1 81 bd c2 10 dd db f1 05 f7 c1 9c 91 fc b2 d8 61 79 82 85 ae e0 61 2b 5f 22 9b 30 e1 14 f3 c6 aa 4e 98 f3 fe e5 84 d5 e7 41 24 c2 b8 0f 73 db b6 9d d1 cb e9 77 6b 12 72 c1 71 58 2b 95 [TRUNCATED] Data Ascii: 84aZmo+u+ &vBCKT\IW:,,VZi^]$`-vq~j/\|,I@`_syy3,/<2sJbv^Lx(JegZJlf3X>-w<hq9=uBA}BO+"3NtNuhG#r!.)iD%K<>jFPaya+_"0NA$swkrqX+-Hqye2fv0gH\62W`3~,cPg5dCor3+#nBO$}&}&a)\|BqxxnM\P0soh(+"M8KL#q==gM{RL8lF@871fD!)+wI=m8D)&]"\#Z]q/Xh@l!9
Nov 26, 2024 08:19:59.902111053 CET	1236	IN	Data Raw: fa 02 83 99 2d d6 60 6b 84 cc 51 15 d7 e6 c6 56 b5 fe 70 cb a4 8e ad c1 3f 33 a9 80 46 79 c9 98 65 43 94 3c 00 98 1b f4 e5 86 35 cd 95 fa ed b8 41 c0 45 09 6d 05 1a f5 7d 37 8a 4a 2e fc 9f 6d 34 92 6e 46 90 5b fa 8d 72 1a 24 42 83 13 05 0d ec b3 Data Ascii: -`kQVp?3FyeC<5AEm}7J.m4nF[r$B)8&T$L\s,<KI/_/ 2jQ%s{*yct)n7^j\|Zd9)F^]kF64>$1r_]uVH\%/qm
Nov 26, 2024 08:19:59.902127028 CET	1236	IN	Data Raw: 5e 7f b8 ec f4 fa 83 fb 9d fe 10 f2 04 cf 0e ad cc e9 d4 85 56 11 07 cd 70 65 9e 61 1b c1 8a ff 18 9e 79 9e a5 19 91 ba 7a 0b 0e 7e 6b 01 45 c0 b0 40 41 26 cd e6 c0 a0 b5 b0 33 b7 3e f4 e5 0d ec d2 6c 0e 7d 5a 0b 3b 35 eb 43 a7 d6 c2 4e dd 0f d0 Data Ascii: ^Vpeayz~kE@A&3>l}Z;5CN7<+ +L`\@J# -Qh+mPTeVEB[1,8HP,KX$i$(&!f.Rvj.}+IXVl:nZitNrnxZFjYLwx^}
Nov 26, 2024 08:19:59.902141094 CET	961	IN	Data Raw: 37 90 c8 c0 8c b2 f2 2d 79 30 48 21 39 08 99 3b b8 8d 84 2b 58 ff d2 0d 46 4c 47 6c dd b6 21 6b 41 86 2e 32 54 2a 9b d5 2a 92 90 3d 8e 5a 99 21 0c e4 8a 26 b0 ff 58 8f bd 10 66 23 b1 1e 82 56 95 f1 21 cc c1 30 16 0c 0c ac e9 a6 e2 1c 3f eb 2e c8 Data Ascii: 7-y0H!9;+XFLGl!kA.2T**=Z!&Xf#V!0?.1),ITBuU%<&bf"xfPEAz0}[DSHGIcq(^,\|p;1}-w0</^A6i8vWTlv9X!D3>
Nov 26, 2024 08:19:59.903892040 CET	302	OUT	GET /js/dist/site.min.js?v=202411111122 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.314760923 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Tue, 14 Nov 2034 04:16:15 GMT Server: F-WEB Last-Modified: Mon, 11 Nov 2024 03:22:58 GMT Vary: Accept-Encoding ETag: W/"67317892-52412" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i91534_c21603, i2103119_c25795, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 31 33 65 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 79 7f 24 c7 71 20 fa 55 80 12 8d a9 22 b2 1b dd 0d cc 55 3d 35 ed 39 49 50 73 79 30 24 25 63 f0 fa 57 e8 ae 6e d4 4c 75 55 ab aa 1a c7 00 fd 7e 92 fc 6c 51 cf 94 64 af d7 d2 5a e2 ae 8e 95 d6 7a f6 9a 94 bc 7e b2 44 8a d2 87 79 c4 70 f8 97 bf c2 8b c8 ab 32 eb 68 00 c3 c3 5a 13 b4 3c e8 ca 3b 23 23 23 23 22 23 22 e7 07 93 b0 97 fa 51 68 a6 c4 b3 f6 8d 68 f3 91 d7 4b 0d c7 49 f7 c6 5e 34 98 f3 76 c7 51 9c 26 0b 0b 85 9c 51 d4 9f 04 5e 87 fd a9 f3 72 8e 67 c6 de 57 26 7e ec 99 46 7d e9 d1 93 41 1c 85 a9 17 f6 97 36 fd 27 b5 64 cb 8d 3d fa 73 8d fe aa 8f fc b0 fe 28 31 2c 52 5e 07 53 bd 24 85 a4 fb ec d7 51 15 26 a9 1f 24 90 f0 2a fe 95 85 2d db 10 93 cc 46 df f7 06 7e e8 2d 2c b0 bf 75 77 d4 ef b0 9f a6 d1 ed be f2 a7 dd 57 6f 5f ef 76 0d b2 4e c8 06 c0 c5 ae 82 4b 87 ff ad 67 95 fe 30 41 60 a6 ea 10 d5 8f 83 83 fd 29 51 13 ea 89 9f 7a 30 8b b4 2e 87 09 f9 72 04 f4 37 6d de b2 a6 66 ba e5 27 c4 94 48 d4 ed be 7e e3 ea bd 2b d7 be d8 bd f1 a5 07 37 [TRUNCATED] Data Ascii: 13e2y$q U"U=59IPsy0$%cWnLuU~lQdZz~Dyp2hZ<;####"#"QhhKI^4vQ&Q^rgW&~F}A6'd=s(1,R^S$Q&$-F~-,uwWo_vNKg0A`)Qz0.r7mf'H~+7r{WovnZ8Djv~8Zn<xc2oZ$4$\>,i;g7=?5/xtj7ME"'oE8+V4%,}kZUOz}7u5:SLI[=o9ZMNfYmFgaNFqG(oLvY&Y]ZE!vav2}^(ZGT2b.:
Nov 26, 2024 08:20:00.314860106 CET	1236	IN	Data Raw: 30 18 7f 60 5e 89 63 77 af ee 27 f4 2f a4 59 62 80 80 e1 d6 c1 81 4e 24 71 09 42 27 9c 04 01 0c b9 83 7f 6d 63 12 32 f2 d1 37 e6 0b d3 58 cf 81 69 e3 e0 20 5d 37 fe f8 8f c5 b7 b1 d1 86 21 60 3b f3 4e c8 9a f7 49 44 62 e2 92 c4 59 df 20 81 33 df Data Ascii: 0`^cw'/YbN$qB'mc27Xi ]7!`;NIDbY 3 gN=mz)O's*3N!IiNf{wbH>$[_vx0"'}>y8`l@mZ1hhb[q3M\|MA
Nov 26, 2024 08:20:00.314872980 CET	1236	IN	Data Raw: 77 61 5a 09 a5 b7 c0 0a d2 b3 9c 84 c4 17 5c 09 70 35 04 d8 b1 f5 7d 38 fc 6d 23 2b 6b 10 7a 4a da 39 91 37 75 64 fb 04 19 a2 84 20 2b b7 03 4c 50 5a 9f 20 5f 5e f7 49 0c ff 0e 88 8b 2c 1e c8 13 69 1d e4 46 59 09 f1 5f 0c 6c 20 09 9a 13 b2 14 14 Data Ascii: waZ\p5}8m#+kzJ97ud +LPZ _^I,iFY_l j#%L#?etG~,V>R+?`'l"N"Q"c-7l#m -qrYG=caH;f\@AmkLP2~\|K"
Nov 26, 2024 08:20:00.314969063 CET	1236	IN	Data Raw: 73 f4 df f3 f4 df 0b f4 df 8b f4 df e6 32 fb b3 c2 fe 9c 65 7f 58 e9 26 2b be 82 2d c0 d1 09 8d 86 51 2d a6 4a 01 18 4e 93 95 e1 7f 5a b2 0c 2b 50 db 85 22 2d 9a d7 62 45 5a 85 22 7b 50 84 75 cf 7a 67 9d 2f 37 72 e5 70 ea d9 1c 77 94 39 72 f1 48 Data Ascii: s2eX&+-Q-JNZ+P"-bEZ"{Puzg/7rpw9rHb~(@?P"#"E]P'.eEs<uE&EY`\QV 5av&mh-N'.2m;uiQNHMlZKvVRA\-.g\|QJ$5(5
Nov 26, 2024 08:20:00.314980030 CET	1236	IN	Data Raw: 1d 55 3a ab 37 9a 2f 7a d8 0b 15 b4 f3 07 f2 65 47 08 64 f8 ed 9a 40 46 fc ec ba 0b 58 0d 0b b8 08 f1 69 52 a5 0b d5 4c f8 d9 8f d6 86 94 8f 91 77 a1 3c 14 61 4a 58 23 d7 e5 17 58 87 c8 60 9c 77 32 eb 51 6e f2 98 49 d3 9a 92 86 64 02 b5 1c 63 74 Data Ascii: U:7/zeGd@FXiRLw<aJX#X`w2QnIdct2~LBd]\|']aL\|mvu]hoT1V,"]c"F-E,&2MyO^b_~kzu2TF}NDK^v1nE5z~
Nov 26, 2024 08:20:00.314990997 CET	1236	IN	Data Raw: e4 a8 aa e8 c6 6c 2b 63 aa 18 50 95 cb a5 77 54 07 00 5c cf aa 38 31 5d dd 90 1a d8 be 1e f2 6f 3e 7a 11 54 77 b8 cf 4c 58 a1 5d b9 a4 f6 7c 83 a8 1e a4 f8 9d 59 70 37 a6 96 9d a2 a5 71 a8 5a 67 27 ca 9e 39 a6 63 7b c0 3c 29 35 df f6 4a 2f 0b b1 Data Ascii: l+cPwT\81]o>zTwLX]\|Yp7qZg'9c{<)5J/ZX9_{t~MR]:1ZC3A8k{9oO{S8oTNh7}]r"};Z{Li6/,6$7]XF8wGnQ<z<0
Nov 26, 2024 08:20:00.323116064 CET	1236	IN	Data Raw: 2c d4 0c 98 19 ab 8b 5a 5d 48 2c 6a 65 89 99 a0 ca 55 8b f5 79 02 fc 07 12 07 dd 02 0e ba 19 7a a1 1b 48 39 0e e6 0a 95 e0 a0 5e 62 f6 70 d5 6a 62 71 5c 7d d0 44 34 16 9c 74 b9 83 6c 20 81 13 e8 ad e6 ca 05 d5 17 3f 5e 3b 83 19 48 bb 6a 45 4f 0c Data Ascii: ,Z]H,jeUyzH9^bpjbq\}D4tl ?^;HjEOlZ!P6 }Uc,&r0'` 37`QfVS:trUr,lJlLB;x\|xI7p.GRd"vRD<\@F#Tn/Rq:P
Nov 26, 2024 08:20:00.323208094 CET	1236	IN	Data Raw: 9a 55 b5 cb 0b a5 a9 52 ed aa 25 32 ed 2b 9d 19 bd e0 17 5d 4e a9 3c d2 38 26 f9 2c 8b 92 78 5c 82 c7 ef 9f f0 ba 3a c7 f8 5b 32 c4 61 21 cb f4 4e 42 3c 70 b3 d0 46 f4 a2 0b 0b 25 89 3a bd a7 37 62 41 50 46 a6 cb 2e c7 79 71 a4 89 a5 37 eb 0b 0b Data Ascii: UR%2+]N<8&,x\:[2a!NB<pF%:7bAPF.yq7e2M{k.^T3^=I(.a}P$Bh^7APtjgJIdf_vNUH3vxp`dYx~)84E?5me$eGH
Nov 26, 2024 08:20:03.468277931 CET	314	OUT	GET /js/dist/libs/imageEffect.min.js?v=202404081140 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.878004074 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:05 GMT Server: F-WEB Last-Modified: Mon, 08 Apr 2024 03:40:40 GMT Vary: Accept-Encoding ETag: W/"66136738-3907" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC205_dx-lt-yd-jiangsu-taizhou-4-cache-12, BC204_lt-obgp-fujian-xiamen-33-cache-2, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 31 31 66 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b5 3b 0b 73 da 48 93 7f 05 2b 77 ac b4 1e 14 70 e2 c4 2b 32 e1 23 18 3b 4e fc ba 18 d7 57 7b 2e 9f 6a 10 23 d0 46 48 9c 24 fc 58 e0 bf 5f cf 43 d2 08 09 8c 53 b7 9b 4a 90 a6 7b 66 ba 7b 7a fa a9 dd 73 e7 81 93 78 61 a0 53 94 18 0b 2d 1c fe 45 9d 44 c3 38 79 9e d1 d0 ad d1 a7 59 18 25 71 bd 5e 82 4c c3 d1 dc a7 1d f1 63 4a 3c 9c e8 86 a5 a5 6b e6 c8 23 ea 7a 01 ad d7 c5 af 49 a6 a3 8e 78 d4 35 db fe f6 df f6 ed c5 b1 6d 6b e8 ee 1e 88 b0 36 11 d1 91 bf 66 3e 85 ef a7 53 75 44 7d 59 2e 17 2b a4 0e dc 69 be 37 8c df 7a 53 32 a6 7d d7 65 bb dc b3 35 8c 95 9e 4c bc 18 e9 99 38 8c 45 44 93 79 14 d4 94 91 07 12 d5 68 3b 1d a8 25 3a cd b0 12 5c c1 f5 cd f3 74 18 fa 20 bb 98 3f ac 03 4c 2f a1 11 49 c2 a8 93 1f 42 be a0 64 7d 65 55 00 41 92 5b b6 a3 a6 13 06 71 12 cd 1d 58 1b 63 9c 8d ef a5 cf e6 2c 0a 93 90 4d eb a4 b4 59 d9 86 88 f1 b5 ca b8 f4 40 33 3c 14 0a ee 49 5b 52 40 b0 a2 38 9e b1 f0 5c 3d 3d b6 3d cc 16 58 2e f7 a8 91 92 db 66 73 43 4c ef e4 f6 49 78 [TRUNCATED] Data Ascii: 11f6;sH+wp+2#;NW{.j#FH$X_CSJ{f{zsxaS-ED8yY%q^LcJ<k#zIx5mk6f>SuD}Y.+i7zS2}e5L8EDyh;%:\t ?L/IBd}eUA[qXc,MY@3<I[R@8\===X.fsCLIxyS/}>mph:B~mnA$k}~_V<Nj, 0]y$.!&C)t+uE5~3%\"CZ{M'zyy\|^1Ln@\@g}itZB7aOrQ&SkFCI`\S_%
Nov 26, 2024 08:20:18.755055904 CET	301	OUT	GET /js/dist/svg.min.js?v=202411111122 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:19.165882111 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:18 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 11 Nov 2034 07:20:00 GMT Server: F-WEB Last-Modified: Mon, 11 Nov 2024 03:22:58 GMT Vary: Accept-Encoding ETag: W/"67317892-a047" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i11785_c17987, i2103125_c25795, i1872278_c17483 X-Cache: HIT from i1872278_c17483(cloudsvr) Data Raw: 32 61 37 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d cd 73 dc 48 b2 df bf 02 61 d6 9a ee 15 00 e2 fb a3 39 2d 06 87 a3 59 ee 0b 72 34 f1 a4 a1 e3 89 e2 d2 50 37 c8 c6 0a 04 38 00 ba 25 2e d9 97 67 1f 7c 71 84 4f f6 c1 57 1f 7c 71 38 7c f2 c1 8e f7 df 6c ac fd 5f 38 7f 55 f8 28 74 a3 29 51 d2 f4 ce 7b b1 33 22 1a a8 cf ac ca ac ac cc ac ac aa 47 17 f3 74 52 c6 59 3a 28 95 74 78 2b 67 6f fe 18 4d 4a 79 3c 2e 6f ae a3 ec 42 8a de 5f 67 79 59 3c 7e bc 16 73 95 4d e7 49 b4 c7 7f b4 2a dd 38 1d 0c 47 72 5d 66 9b 78 1a 5d c4 69 f4 f8 31 ff d5 c2 ab e9 1e 7f 1d c8 e7 e7 7f f7 ea fc a7 e3 ef ce cf 65 e5 f4 8c 80 18 6d 02 62 af fa d5 da 2c ac be 41 29 86 88 1f 77 77 b7 4b 45 0c d0 8a c5 25 f2 0c 97 83 72 16 17 ca a0 69 fe f0 36 8f ca 79 9e 4a 42 c8 22 cc a5 72 7c 6b fa 81 37 12 fb 49 c9 86 b7 65 d3 64 21 83 3c 2f 22 a9 28 f3 98 a0 df e5 b9 db 7c bc bc 94 00 8c a7 4a 46 3f 8b 38 7a f7 6d f6 5e 89 e8 7d 92 a5 65 94 96 bb 80 8a e2 c7 a9 c2 de aa 24 e3 8c 7f 56 a9 c6 d1 72 b7 d4 ae f3 ac cc d0 43 1a 6a 4c 2f e3 [TRUNCATED] Data Ascii: 2a76}sHa9-Yr4P78%.g\|qOW\|q8\|l_8U(t)Q{3"GtRY:(tx+goMJy<.oB_gyY<~sMI8Gr]fx]i1emb,A)wwKE%ri6yJB"r\|k7Ied!</"(\|JF?8zm^}e$VrCjL/zs\|6W`6ejJEex[mT"W[U\|]dp26UN$#<M]W4@-~u I=?1(j>x#mr\|^F;DO_%PzD Izjd#}85HRLet\|[vT@R4{F})2rz(xOe8.fMJxS(}t4~BzLIBe2-R<o`wz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49763	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:58.609735966 CET	316	OUT	GET /js/comm/jquery/jquery-core.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:59.868426085 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Thu, 16 Nov 2034 07:54:28 GMT Server: F-WEB Last-Modified: Tue, 28 Mar 2023 01:43:18 GMT Vary: Accept-Encoding ETag: W/"64224636-171e6" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i33485_c25891, i2103119_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 33 63 65 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 bd 89 7a db 46 96 28 fc 2a 22 da a3 00 66 89 22 9d a4 ef 34 28 98 d7 6b c7 9d 78 49 e4 c4 49 28 da 1f 44 16 25 c4 20 c0 00 a0 25 59 60 3f cb 7d 96 fb 64 f7 2c b5 01 04 15 cf fc f3 cf 74 2c 02 a8 bd 4e 9d 3a fb 59 6e b2 79 95 e4 d9 c1 87 ea 66 2d f3 a5 2f 83 db 42 56 9b 22 f3 d5 9b c8 5b aa 32 5e 14 f1 ab 83 d3 9b d5 79 9e 1e 1e 7a 25 fd 68 7f 18 24 95 2c e2 2a 2f 26 cb bd cd 1f a8 1a 72 1b de 51 48 42 1f fb bb 97 83 79 9e 95 55 b1 99 43 5f 51 14 99 f7 3d fd 7b b0 2e f2 2a c7 6a 13 3d d6 d0 74 1c 40 47 db 9e 6e de 5f 89 d3 e0 f6 53 5c 1c 24 e2 26 5a 0d 16 f9 7c b3 92 59 25 24 3c a4 f9 3c c6 42 a2 82 87 2c fe 94 5c e0 f4 44 06 4f 7f fc b8 91 c5 8d 28 e0 e7 3d 91 47 8f 8a 22 be b1 dd 0e d6 9b f2 52 7c da 79 5d a6 c9 5c 8a 78 e7 7d 92 2d e4 f5 eb a5 28 a3 d7 e7 7f c8 79 e5 7c aa f2 d3 aa 48 b2 0b 91 ee 7e bb 8c cb d7 57 d9 9b 22 5f cb a2 ba 11 9b 88 8b ba b5 8b 64 25 3e c8 c8 2e b6 f4 a5 a8 cc 4a 67 f2 0a 5e 0d 96 19 0c 21 a9 f0 93 f8 23 d8 8a 79 74 3c [TRUNCATED] Data Ascii: 3cefzF("f"4(kxII(D% %Y`?}d,t,N:Ynyf-/BV"[2^yz%h$,/&rQHByUC_Q={.*j=t@Gn_S\$&Z\|Y%$<<B,\DO(=G"R\|y]\x}-(y\|H~W"_d%>.Jg^!#yt<=;&$<[?Sl_e)`JX<?eXlg~zw\|!P}}dzvunL?W7GX\B'a;LjZ855YQl-=~UtMc,j9Y/uIoa`GX\|$'UOR)lg~p{3gVHJf7
Nov 26, 2024 08:19:59.868576050 CET	1236	IN	Data Raw: 83 42 ae f2 4f b2 f1 da f7 9e be 7e f9 24 cf 2a 7c 97 c7 0b b9 f0 c4 33 d1 1b 05 00 18 50 3e 5e dc f8 41 10 7a f3 7c b5 4e 65 25 e1 c0 45 37 fc fe b4 8a 2b 38 8b d0 ec 42 56 f1 fc 92 9a f5 bd 3c a3 af 25 7e 9d 5f c6 d9 85 84 06 1b ad 6d c5 c7 e8 Data Ascii: BO~$\|3P>^Az\|Ne%E7+8BV<%~_mv;&_svR YTPeB$ddeR9\|_-Ta:ENevQ]F#{%1i5j$SSA28pD4,~1N_D<G?>ljG#I
Nov 26, 2024 08:19:59.868588924 CET	1236	IN	Data Raw: 07 37 4e 7e 65 7b fd d4 be 35 7b 38 7d 89 f4 d8 15 15 c5 4a af e0 0c 14 c9 dc d6 3a 77 6a f5 e0 7b fc ca 27 92 e7 79 9a c7 15 d2 64 87 87 30 45 44 1f dc 2f 0e c0 d6 be ee ba a9 99 a9 c3 8b e0 e3 b4 54 78 2f 80 13 ae 4f 36 8e c3 39 05 b6 b5 2b 03 Data Ascii: 7N~e{5{8}J:wj{'yd0ED/Tx/O69+kKJ+#UniR=8_[^/=mio TE6ChM{*1sS?pPi+V]q3m!am'Me1at qXU4-Bu}#]J~2
Nov 26, 2024 08:19:59.868601084 CET	1236	IN	Data Raw: 38 7a d8 2c e7 0f 2d 34 fe e8 f7 61 d4 41 78 0a 4c fb 7c 2e cb d2 4e ee 4f b5 f3 2c 31 10 31 4f b3 14 69 c4 98 22 13 1b 00 82 79 03 08 80 d3 ee 60 fb 61 b9 09 cf 6e 70 3f b2 00 7a e6 be a8 fd 8d c8 a6 9b 99 18 41 17 b0 09 49 34 da 6a 9c 4e d2 6e Data Ascii: 8z,-4aAxL\|.NO,11Oi"y`anp?zAI4jNneGL%+dM'TJ4j&c9Xh$d>!2QN7B5k!DD7b0kmd) dZE7\X-AT.:?{)^[V'}_(g
Nov 26, 2024 08:19:59.868612051 CET	1236	IN	Data Raw: 6d 77 1c 0e e1 ba 1f d1 3e c9 b0 49 f6 6e ec 9d bf f1 a9 53 8b 72 1c b2 99 48 12 da e1 02 7f 8d 4e da 0a cf c9 ce 30 43 60 12 a0 cb 64 92 2a c8 21 e4 85 1d 84 47 47 25 6a 02 5c 1d 14 be 07 34 05 54 03 b4 4d 2c 45 c2 a2 54 ba 41 62 64 58 1a 8f 59 Data Ascii: mw>InSrHN0C`d*!GG%j\4TM,ETAbdXYq\Q^\|g}3@SB?k0DvFzU[&E\[$<.@%?8Ti\(tY!W.04>?<e!WWI7zF_/
Nov 26, 2024 08:19:59.868624926 CET	1236	IN	Data Raw: a0 12 9f 03 a1 0b 27 6a ac 3e e0 bc cd ed 13 7d 43 84 06 cf f2 1d 36 05 5f 17 b9 2c 5f e5 d5 0b c0 a5 9b 85 ba b8 5e 64 8f 01 be 79 85 88 77 49 54 a5 b7 f9 5a ac 70 ab f1 0a 86 6e 16 a7 b8 26 28 05 1b 34 ae b3 c8 1b fd 07 5e f3 fe 6e 61 e4 5f 50 Data Ascii: 'j>}C6_,_^dywITZpn&(4^na_P'vG9"^*mB;b{CPoV;j<:U0em)e8dRdabH>wlx\h [G8OU#Gj1)Y6_R
Nov 26, 2024 08:19:59.868638039 CET	1236	IN	Data Raw: 18 ac 02 77 12 7c fb a0 96 86 8d 9e 17 08 70 a5 17 28 14 11 23 76 60 57 54 82 c2 52 1f f4 71 7a 12 8f 53 38 e7 e8 3a 85 47 15 65 2a 81 76 ed f7 15 e1 c4 8e 56 0d 1c 02 84 e2 e6 9c ef 2f ff 5b d8 00 dc 8b 1c b6 01 ee 17 18 ff be f1 d0 99 53 d0 70 Data Ascii: w\|p(#v`WTRqzS8:Ge*vV/[Sp/Y[j+j'V5D0F9#C}9LA#X-Q3H.~VpZ5hsZnR>!oJ_WEU4&6a.?\8RXqiQ\|([6Z&"D6v
Nov 26, 2024 08:19:59.868654013 CET	1236	IN	Data Raw: f4 76 ec f6 d8 11 c6 01 c7 2c 10 dd e0 c8 f3 36 32 02 3d 33 67 5a be 92 2d 56 51 32 c9 9a 70 8a 96 0e 68 bb 8f 52 98 c8 03 20 69 7b b7 55 93 aa 8f 1f 1a 52 3c ed 6a 49 a1 65 c4 dd 1e 9e e8 e0 b9 45 6b 0d a2 98 a1 3b a2 e4 38 3a 12 f6 31 23 86 a9 Data Ascii: v,62=3gZ-VQ2phR i{UR<jIeEk;8:1#~ @2{(($WYi&#CkjeQ):']]_}MD;Jjz]%z`-PJRCG'D.&0Efko>M.^ kIJ%95k,96<
Nov 26, 2024 08:19:59.868716955 CET	1236	IN	Data Raw: 66 51 07 3b 7b e6 a1 80 d9 a3 cb 21 60 7e c2 34 3b 68 a1 22 de 14 ba 02 f6 2d 9e c1 e1 11 77 3b 51 46 65 21 19 80 35 5c a9 06 4d 4f 17 0e 6b c5 8b 42 de 2d c2 2b 8b 39 fc 7b d7 0a 55 ad 15 aa f6 ae 50 05 2b d4 81 35 e4 0e 59 25 1e 04 e3 06 63 8a Data Ascii: fQ;{!`~4;h"-w;QFe!5\MOkB-+9{UP+5Y%cCiVG,F/qey^tM][AScXOK7ht{[I-5r-{;2GNwnrbr!i){q_`C0!2-P\Vj74?Y=Uh{u#=
Nov 26, 2024 08:19:59.868729115 CET	1236	IN	Data Raw: de 35 8c 46 85 91 6b 87 0f d4 8f 4a 32 c5 e0 b1 c0 68 a4 cd 37 30 22 22 aa e1 13 6c f7 5b 9e 3a fa 88 63 2b f3 14 c8 b0 4f 32 ca e1 c9 9c 1d 38 32 e6 12 71 df 7f 28 c8 11 45 3f 76 a3 82 cb 2f 3c f8 1b 77 2d 43 34 da 20 12 bb bf 40 6b 6d 16 25 22 Data Ascii: 5FkJ2h70""l[:c+O282q(E?v/<w-C4 @km%"H +'J:}cNJ3~Ho?lxtKb6#Q@&Y&Pe@s_HGF\|MK!UTIieSw2+zMm
Nov 26, 2024 08:19:59.988607883 CET	1236	IN	Data Raw: 01 6b 0b 15 11 bc e9 e6 ae 69 3a 4b 06 44 92 75 d7 86 5a 60 e9 ba 7b 1d e7 11 79 81 ac cb 89 ca 5e 07 3f 75 6c 79 f5 45 99 e5 d2 ef 31 9b 54 1b 8e 8a 22 b2 e7 c6 30 0d 13 1b 64 51 3e 3d 3a aa 66 e8 78 9a 39 b9 0d 76 99 16 58 7d 83 51 10 56 c4 d7 Data Ascii: ki:KDuZ`{y^?ulyE1T"0dQ>=:fx9vX}QVMJz=b O %\[/jfq;Szo+o0;9d0Mm%W'Z<s[\Ph<e/Nc/F@6;~]&Mmrl::<UMp
Nov 26, 2024 08:20:00.123898983 CET	319	OUT	GET /js/comm/jquery/jquery-ui-core.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.524297953 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Thu, 21 Sep 2034 20:32:12 GMT Server: F-WEB Last-Modified: Mon, 09 Jan 2023 10:05:16 GMT Vary: Accept-Encoding ETag: W/"63bbe6dc-381d5" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC148_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC204_lt-obgp-fujian-xiamen-33-cache-2, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 32 39 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 0b 77 db 46 92 28 fc 57 24 ec 1c 07 08 9b 14 65 cf 2b a0 60 ae 63 39 1b df 89 1f 9f e5 38 33 ab d1 f8 40 64 4b 42 42 01 5c 02 b4 ac 88 fc ef 5f 55 f5 bb d1 20 29 3b 99 9d b9 37 39 27 16 d1 ef ae ae ae ae ae ae c7 c5 b2 9c 34 45 55 ee bd 6f 6e e7 bc ba 88 9b e4 6e c1 9b e5 a2 8c 65 4a 16 5d c8 32 51 96 89 a4 bd 93 db eb f3 6a f6 e0 41 54 d3 0f 3f 63 50 34 7c 91 37 d5 62 7c d1 d9 fc 9e ac d1 ac d3 4d 85 a0 8f ee ee 9b c1 a4 2a eb 66 b1 9c 40 5f 59 96 e9 f4 7d f5 7b 30 5f 54 4d 85 d5 c6 6a ac a9 ee 38 81 8e d6 fb aa f9 78 c1 66 c9 9d 1e 4b 1d 37 8c 27 77 1f f2 c5 5e 91 35 83 b2 9a f2 97 f9 35 1f 34 d5 77 d5 0d 5f 3c cd 6b 1e 27 a3 e2 22 8e f2 05 cf 23 e8 b1 48 24 e0 0e 8a 72 be 6c 56 35 9f f1 49 b3 6a f8 c7 06 8b ac ce 97 4d 53 95 ab ea fc 47 48 3e 18 34 bc 6e e2 22 19 ef 37 83 69 51 e7 e7 33 3e 4d a3 1c 26 59 e0 c4 ae 16 fc 62 b5 e2 c9 83 07 25 8c 72 84 43 98 43 2b 65 f3 12 06 c2 78 56 0c 4a 18 cd 48 f4 b8 1f ef ab 1a fb 7c b5 8a ae f3 39 0d a8 63 d4 [TRUNCATED] Data Ascii: 292wF(W$e+`c983@dKBB\_U );79'4EUonneJ]2QjAT?cP4\|7b\|M*f@_Y}{0_TMj8xfK7'w^554w_<k'"#H$rlV5IjMSGH>4n"7iQ3>M&Yb%rCC+exVJH\|9chlGP#{Y_$k~q2]b+kU1r\l1,OONYbV4QZ-\|!L`j,Y>@ioH\|W/#}`I\|6=3~Ygz=}(gqg<o!$\|w
Nov 26, 2024 08:20:03.470105886 CET	312	OUT	GET /js/comm/video.js/video.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.870328903 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:09:53 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:49 GMT Vary: Accept-Encoding ETag: W/"6084db9d-3c251" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC147_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC205_lt-obgp-fujian-xiamen-33-cache-2, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 38 34 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 09 5b db 58 96 e8 5f 31 7a dd 44 6a 84 63 b3 23 a3 e2 4b 01 e9 62 ba b2 bc 40 aa a7 1f cd d0 c2 96 b1 3a 42 f2 48 72 08 0d fe ef ef 9c bb df ab 2b db 24 a4 a6 6b ca 35 d3 41 be fb 7a b6 7b 96 e1 24 eb 57 49 9e b5 ae aa fb 71 9c 0f dd ca 7b 28 e2 6a 52 64 2e 4b 09 9d 21 2b e3 84 21 4d 6a 9d dd df 5e e7 e9 ea aa 53 92 0f 33 a3 9d 54 71 11 55 79 71 c8 ab b6 62 d9 70 8b 95 ad a6 81 c8 2e d4 6c 68 b7 b9 cb aa dd cf b3 b2 2a 26 7d 68 3f 0c 43 91 be c2 bf db e3 22 af 72 ac 76 c8 c7 17 88 2e 3d e8 68 ba c2 9b c7 5e 93 a1 eb e4 d7 ff 8c fb 15 74 e6 3a 93 6c 10 0f 93 2c 1e c8 ae e3 2f e3 bc a8 ca 43 25 2f e0 cb c5 f2 3c 0f 06 2d b3 57 78 d5 db 7c 30 49 63 8f fe 69 b3 c2 61 e5 7a bd 38 2d e3 16 f6 5d 9f 2a 6d 65 75 95 fe 6d 47 b7 03 8f 7e ba 17 97 7e 45 ab 3e b8 b6 ee ee 92 6c 90 df 1d d2 3f 81 ad c4 4d 9a 5f 47 e9 21 fd 63 2d 51 c6 e9 f0 10 ff 09 aa 51 52 7a ed cf c9 20 ce ff 49 06 3d 9d ba 62 e5 bc 87 cf 51 d1 3a ed b1 4d 13 3b d9 77 13 bf f4 23 ef 41 a4 a4 [TRUNCATED] Data Ascii: 846}[X_1zDjc#Kb@:BHr+$k5Az{$WIq{(jRd.K!+!Mj^S3TqUyqbp.lh&}h?C"rv.=h^t:l,/C%/<-Wx\|0Iciaz8-]meumG~~E>l?M_G!c-QQRz I=bQ:M;w#Anu^)/K/l""IR{]x>ifaN"/\(jDlGZ/byxjTwO;zc^t9\t.(M.:AR{yQ]JNbK7eG9D"WaWD4nQZ[R7xbS\_x%\COla_}uoJV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49764	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:58.617376089 CET	312	OUT	GET /js/comm/vue/vue-2.7.14.min.js?v=202310161432 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:59.867603064 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:04 GMT Server: F-WEB Last-Modified: Mon, 16 Oct 2023 03:14:17 GMT Vary: Accept-Encoding ETag: W/"652caa89-1a8c1" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC168_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC204_lt-obgp-fujian-xiamen-33-cache-2, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 38 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bc bd 79 73 db 46 b3 2f fc ff fd 14 12 cb af 02 1c 8d 68 29 79 ce 12 d0 08 cb f1 12 3b f1 16 5b 71 92 47 d1 51 41 e4 50 82 4d 02 0c 00 4a 96 45 de cf 7e fb d7 3d 1b 40 c8 c9 53 e7 de b7 ca 16 81 c1 ec d3 d3 d3 fb dc ff b7 dd ff b5 f3 6f 3b ef 57 7a f8 a1 de b9 fa 7a f8 9f c3 a3 7f 20 25 9a c4 3b 5f 1f 1e fd e3 e0 eb c3 af bf d9 79 72 95 15 3b bf 97 2b 7c 79 ab e7 3a ab f5 74 67 55 4c 75 b5 d3 5c ea 9d 97 cf 8f 77 5e e4 13 5d d4 7a 48 59 ee ff af fb ff 6f aa dd 9d ad 8a 49 93 97 45 d4 28 1d df 0e ca f3 0f 7a d2 0c d2 b4 b9 59 ea 72 b6 a3 3f 2d cb aa a9 f7 f6 06 a8 64 96 17 7a 3a d8 b5 1f 17 e5 74 35 d7 63 f9 19 9a ac a9 8e e2 64 60 ab f5 35 49 e9 bd 3d f9 1d 66 8b e9 58 1e 23 1d 27 51 93 f6 35 70 31 2f cf b3 f9 f1 65 5e 8f fd 63 d2 ac d7 b5 9e cf e2 21 4d 06 5a db 44 0d 25 ab c8 0d 85 c6 b1 aa f5 4e dd 54 39 8d 65 74 95 d1 e0 d3 d7 3c b2 e1 ac d2 fa b3 8e 6e 37 b1 d2 e9 c3 aa ca 6e 86 79 cd bf 23 5b 7e 87 26 23 be ad 74 b3 aa e8 79 35 9f d3 18 36 ee 63 d5 [TRUNCATED] Data Ascii: 848ysF/h)y;[qGQAPMJE~=@So;Wzz %;_yr;+\|y:tgULu\w^]zHYoIE(zYr?-dz:t5cd`5I=fX#'Q5p1/e^c!MZD%NT9et<n7ny#[~&#ty56c~,U.YqF4(Vs]y9o%-k0AYAqwnbnYMO\|Cs>zv)Nl><xE:]fU^LweYPIy4/Fj#RzfbH$k&60:e^qkz)T7NwB7y*{E7dhbP5tF
Nov 26, 2024 08:19:59.867615938 CET	1236	IN	Data Raw: 73 83 f6 62 55 a5 cd b0 5e ce f3 26 1a a8 41 ac ca f4 70 54 3e a8 86 73 5d 5c 34 97 a3 72 7f 3f 2e 4e aa 93 f2 f4 34 dd 3d 74 f3 3e f6 b8 c1 cf c0 09 06 f8 a2 bc d6 d5 23 c2 2d 51 7c ba 49 fa b3 9d 6e 18 78 2e d3 ab 68 50 cf cb 46 4d ca c5 b2 2c Data Ascii: sbU^&ApT>s]\4r?.N4=t>#-Q\|Inx.hPFM,taQJgzR.AaB(klYTWcGii2M09aOP)$34Qb6_fMEgIM]7)_5fpt6nzw/qPyC
Nov 26, 2024 08:19:59.867631912 CET	1236	IN	Data Raw: 99 8f 87 9b 98 77 e5 7b 3e 0e df ea 8b 27 9f 96 d1 e0 e4 bf 07 43 ca 47 f8 28 fa 65 58 97 ab 6a a2 d5 60 78 ef ec 8f 3f a6 a7 03 43 2e fc 94 0e ce ce 98 50 38 3b 1b e4 05 1d 6e 3f f6 f2 98 d7 44 25 94 d7 ea cf f4 c7 bd 3d 79 1e 16 d9 55 7e 91 35 Data Ascii: w{>'CG(eXj`x?C.P8;n?D%=yU~5e5$6zxA&I{{utL)aC33V?9@oCC^2j6X~%u?eE\?1eV4C~,JQX5Qk\|U>&,clO
Nov 26, 2024 08:19:59.867786884 CET	532	IN	Data Raw: 52 10 d2 3e cc 8c 4d 8e ed 94 72 9e 70 79 90 b3 35 f8 f5 3a ea 4c 06 a6 cf f4 92 3e c4 dd 1d 40 f3 41 39 7d 3f 35 f5 93 4e f1 ea 42 33 71 2b 4f 98 82 c7 7a 29 35 b4 cb 17 65 93 cf 6e b6 c1 64 d4 19 80 ef 7f 08 b5 80 05 2f 5a 24 c4 60 31 02 e7 34 Data Ascii: R>Mrpy5:L>@A9}?5NB3q+Oz)5end/Z$`14#'p\|PHhO:t<cx;+_$_\FaN@p3cG]\.!g$HeZN4CO2bls**=U!<jzY#%
Nov 26, 2024 08:19:59.867799044 CET	1236	IN	Data Raw: 71 af 46 d6 0f 8a 91 a6 e6 9e 50 3b 74 fc 28 7b 28 60 7a b7 8e a1 27 6e 1d 6d cb 7b 7b 67 c1 e4 b2 01 80 3c 87 b8 fb 43 33 b6 c9 c9 ee eb 06 5a ab bd bd 8a 90 07 3d 69 36 1b d8 5d b1 0d c1 ae 99 9a bc 7e f2 a9 d1 45 9d 13 a1 c5 1f 50 fc ea ac fe Data Ascii: qFP;t({(`z'nm{{g<C3Z=i6]~EP/I[7\|I<LnUn.tJ'{{THGhE.q{{_oaT^D=t7c,6SdC[W(%lgLjs%c}
Nov 26, 2024 08:19:59.867810011 CET	1236	IN	Data Raw: e9 2c ad 63 a4 8b ac 65 12 27 52 82 6a 38 05 73 2f f9 58 b7 07 34 9c f9 c1 fd 6c 77 7d 89 01 02 eb 45 86 8e 3e 63 bb 4c 87 4f ad 0d a4 ca d7 6b 43 65 f1 2b f1 fc 26 73 d9 cd 5c b6 33 97 c8 bc 71 76 6f 9e af d7 01 ce 87 89 ff f8 84 75 65 a7 09 3e Data Ascii: ,ce'Rj8s/X4lw}E>cLOkCe+&s\3qvoue>Ml2R"Qs;btOjs2`b+S-jlILy1r<T8:C,UCMOYdT:$C'ADU4s@n iF0'9U8n
Nov 26, 2024 08:19:59.867820978 CET	1236	IN	Data Raw: 04 9a c2 4f c6 94 f0 6c 62 b4 56 44 72 49 51 22 bd ec b0 09 85 40 5f 16 30 81 4b dd 76 3d da 99 6a a3 a3 21 be 27 28 a9 1d 31 57 8c 07 3e b9 00 99 19 77 c5 99 53 1d c8 c7 99 05 0e b4 63 c0 bd a1 ee 0a 48 1c a7 8b 9c 0a ce 7e 56 92 a1 b7 07 12 f3 Data Ascii: OlbVDrIQ"@_0Kv=j!'(1W>wScH~Vt,Ko_-E\XCM0UcM{IcO>g3jSz4Uu6io{16<r&asc)iI2HO74+I:1)3RzC=V^>&
Nov 26, 2024 08:19:59.867832899 CET	672	IN	Data Raw: 7b 8d e7 53 d7 cb a7 a8 30 00 52 7a d7 41 cb bf 68 2b 26 1e 59 ad d4 3d f1 05 8b 47 31 8b 0f cf f2 82 bd dc 83 a8 10 db fa 98 ef 43 4e 47 c4 8e 67 e2 a8 ff dc 94 86 d5 f7 2f 81 0a 73 63 05 64 5b 39 03 ab ab a0 75 4b 4a a6 61 8f 6e 83 97 10 9d 58 Data Ascii: {S0RzAh+&Y=G1CNGg/scd[9uKJanX8WW3Pm]:;{\|WhabA+{TY2V6GzN(#Sy@`:_VJAe,"~,YPw2LY7OV??9@
Nov 26, 2024 08:19:59.867949963 CET	1236	IN	Data Raw: 15 f4 db af bc b4 af 8b 48 bb 98 5b 55 91 0e cc ea 0c 54 59 04 78 aa 22 62 7f 07 42 cc f3 6c 42 c8 4a 65 5b 1f 69 24 08 12 43 f4 c8 76 39 cc f3 6a 19 06 3d 9b b4 c3 59 cd 9c a1 cd 2d 4f 67 32 c0 a6 1c 98 ad bd 2a d4 9c cd 0a bd 18 b7 88 5a 34 ae Data Ascii: H[UTYx"bBlBJe[i$Cv9j=Y-Og2*Z4CIJb#Fl0jT+zXJ(Qcd[-#NA\|P v%D`Cq4mvK]0I}r{#KVlzE--^2P6/+
Nov 26, 2024 08:19:59.867964029 CET	1236	IN	Data Raw: 90 a7 ef 5d 91 76 04 27 c7 fa 53 f3 aa 9c 6a 1b 5d fc 11 ed fb d1 c7 c2 fa 0a 47 ef 0a 75 0b 4f 0a c2 91 ba 7a 9c 35 99 a8 8f da 2b 44 ed 52 c1 fd a3 f8 ff fb 9a 9a 90 18 5c be 3e bb 46 5e d1 50 04 d2 5a 20 a9 73 13 ff 24 6a 13 65 0d ef 28 1f 41 Data Ascii: ]v'Sj]GuOz5+DR\>F^PZ s$je(AA8OiH,X,k`&95h/fDp2ImRNTa&tE--GltQElT@jX-EJMW R0W$"MScI1UcRzns/$X5Vo%_5VO6j
Nov 26, 2024 08:19:59.987649918 CET	1236	IN	Data Raw: 09 ed 8e 57 09 5b 4f e8 96 5d 51 60 53 a4 ef b2 29 d2 a9 f6 36 45 cc 80 c5 9b d1 5d f6 84 b7 13 0f 22 74 7c f2 52 d2 e6 33 ab 96 d4 72 ff 41 52 29 03 0c 49 01 d1 6c 59 7c ef 59 9e e4 61 41 09 46 46 9f 7c 28 dc 57 61 75 92 27 48 91 e7 69 f2 2a f8 Data Ascii: W[O]Q`S)6E]"t\|R3rAR)IlY\|YaAFF\|(Wau'Hi\0x}h%^{&yw-&y!;+<E8.T'O$XgpY5S'd\ Z?TqL:Ql(HV-G(>[!Nh9lfYXN$*U`?:I
Nov 26, 2024 08:20:00.140127897 CET	311	OUT	GET /js/dist/partitionSite.min.js?v=202410281114 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.538176060 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 28 Oct 2034 06:52:48 GMT Server: F-WEB Last-Modified: Mon, 28 Oct 2024 03:14:48 GMT Vary: Accept-Encoding ETag: W/"671f01a8-1323b2" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i47062_c17987, i2103125_c25795, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 32 63 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 97 e3 c8 75 20 fa dd bf 82 44 97 32 81 66 90 49 66 6d dd 60 22 e9 da 52 5d ad da 54 59 ad 96 95 4a f3 80 24 48 a2 0a 04 28 00 cc ac ac 4c ce 91 ec 19 cb 1e 4b 5e 9e 3d cf 96 ed 19 5b 3e e3 b1 ce f8 d8 1a fb 78 bc c8 d6 f8 c7 b8 ab ba f5 e9 fd 85 77 ef 8d 05 01 10 64 32 4b 25 59 3e 53 bd 24 81 40 ec 71 e3 6e 71 ef 8d ea 70 16 f6 53 3f 0a cd 94 79 d6 a9 11 f5 9e 7a fd d4 70 9c f4 64 ea 45 c3 8a f7 7c 1a c5 69 b2 b1 b1 f0 65 12 0d 66 81 d7 e1 3f 0d 91 cf f1 cc d8 fb da cc 8f 3d d3 68 6c 3d 7d 31 8c a3 30 f5 c2 c1 56 cf 7f 51 4f c6 6e ec d1 e3 3e 3d 35 26 7e d8 78 9a 18 16 2b 2f 33 4b fd 20 81 84 8f f0 57 65 b6 6c 43 f6 39 eb cc c0 1b fa a1 b7 b1 c1 7f 1b ee 64 d0 e1 8f a6 d1 ed 7e f8 95 ee 47 f7 6f 77 bb 06 3b 60 87 30 4a 7b d9 28 3b e2 b7 91 95 f9 a9 0c c8 4c f5 16 f5 97 b3 b3 d3 39 d3 13 1a 53 37 4e 7d 1c fc be 9f 7a d0 bb b4 a1 9a 87 8c a2 6e cb 9a 9b e9 d8 4f 98 a9 96 b7 db fd f8 ce cd 47 37 6e 7d a1 7b e7 cb 4f ee 3c 7e 70 e3 5e f7 fe c3 db 1f [TRUNCATED] Data Ascii: 2c5iu D2fIfm`"R]TYJ$H(LK^=[>xwd2K%Y>S$@qnqpS?yzpdE\|ief?=hl=}10VQOn>=5&~x+/3K WelC9d~Gow;`0J{(;L9S7N}znOG7n}{O<~p^ZulEvNc/aEUjq=zS!A^jkc%5=UO,p=?4`Fq'B3e~&i<C\|nL(XGV2\!@>@Z{j%F^;_gaOJ^MOb4N+fl7[WK0e=}/wXvex1LV/z[u[-h%YC)<<\
Nov 26, 2024 08:20:03.466778994 CET	313	OUT	GET /js/dist/libs/photoSlide.min.js?v=202408061027 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.863930941 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Sat, 05 Aug 2034 09:17:15 GMT Server: F-WEB Last-Modified: Tue, 06 Aug 2024 02:27:04 GMT Vary: Accept-Encoding ETag: W/"66b189f8-59b0" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC33_dx-lt-yd-shandong-jinan-24-cache-3, BC92_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC205_lt-obgp-fujian-xiamen-33-cache-2, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 64 64 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d5 3c 0d 77 db 36 92 7f 45 66 6f 1d 32 82 68 c9 6d da 2e 69 d8 db f5 b6 1b e7 a5 4d 6e 95 b6 f7 ce e7 f3 a3 49 48 44 42 91 5c 92 92 9d 58 fa ef 37 83 0f 12 a4 28 d9 4e db bd bb 97 e7 88 04 06 5f 83 f9 1e 80 07 b3 65 1a 56 3c 4b ed 8a 64 ce bd 95 dd bc 67 61 65 51 5a 7d cc 59 36 1b b0 bb 3c 2b aa f2 f0 70 ab 66 91 45 cb 84 9d c9 1f 57 c1 d1 cc 76 3c 4b f7 d9 00 47 6c c6 53 76 78 28 7f dd 60 11 9d c9 47 db ba be 7e f5 9f d7 3f ff f8 b7 eb 6b 8b 5c 5e c1 24 bc 5d 93 38 53 bf 6e d3 44 8c 67 57 66 89 f9 b2 5e df 6f 88 59 70 69 25 fc a6 3c ca e3 ac ca a6 09 8f 98 75 85 5d 38 1b bb 8a 79 49 ec 1a 1b ce 7d c1 aa 65 91 0e 8c 92 55 50 0c 00 4b 84 13 46 52 12 90 88 c4 be ae 1e e4 76 55 b7 c9 69 0f 0a a6 1f 17 37 59 02 88 2c c5 43 b7 c2 e5 15 2b 82 2a 2b ce 9a 1d a9 3b 54 90 d5 c6 eb ab 84 3e 77 0f 57 b9 61 96 96 55 b1 0c a1 6f 4a 69 5d 7e a0 9f dd bc 00 6c 60 b3 33 3d 37 af 1e 90 e0 ba 36 f5 2a 4b 63 5c 73 2a 7c 66 7f 57 14 c1 47 97 97 e2 17 ca 1c 05 96 60 07 f0 b7 [TRUNCATED] Data Ascii: dd0<w6Efo2hm.iMnIHDB\X7(N_eV<KdgaeQZ}Y6<+pfEWv<KGlSvx(`G~?k\^$]8SnDgWf^oYpi%<u]8yI}eUPKFRvUi7Y,C++;T>wWaUoJi]~l`3=76Kc\s\|fWG`^wXT@dtg./;ZuRJ%0+EH0A}`m1mhsFd(G4t eCfKFh67s1E2wab\UI+xv=zIYNXYi-v;XEu`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49765	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:58.685159922 CET	306	OUT	GET /js/comm/polyfill.min.js?v=202307101206 HTTP/1.1 Host: 1.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:19:59.967356920 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:59 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:04 GMT Server: F-WEB Last-Modified: Sun, 26 Sep 2021 03:56:07 GMT Vary: Accept-Encoding ETag: W/"614fef57-1f911" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC206_dx-lt-yd-jiangsu-taizhou-4-cache-12, BC85_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC201_lt-obgp-fujian-xiamen-33-cache-2, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 32 36 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 7d 07 7b e2 58 b2 e8 5f 31 ba 77 59 a9 11 34 22 23 7c cc 73 ec 76 07 b7 b7 dd 61 66 19 6e 7f 12 51 04 09 13 1d e0 fe f6 57 75 92 8e 84 f0 78 e6 ed 9b dd 36 4a 27 d7 a9 53 b9 f4 fe ca ef 2c bd c0 3f ea e9 ae 39 30 bb c6 b3 7c d2 d1 a7 e6 c8 78 f6 fa 7a 6a d0 9a b6 d9 95 4b af d6 ce fc c8 23 cb c7 59 2f e8 1f cd 7b f7 2b 6f de 23 44 13 45 b5 74 9a 3f 6c 60 99 51 3a ed 19 cf f3 de 72 35 f7 8f 3c a8 35 95 37 76 f0 c2 91 0f 1d fe 10 eb 1d 13 bf b7 39 ba 9c cf 83 b9 ae 9d 3b be 1f 2c 8f fa 9e df 3d 9a 06 dd d5 a4 77 f4 4f 2d 33 cd 68 ff d4 8c c6 72 38 0f 36 47 e3 5c 27 e8 f6 88 f6 f9 cb c5 f7 4f 97 bf 6e be 7c fb 75 f5 e5 fb cd 85 66 8e 69 7d 43 82 bd 27 cf bd 87 59 30 5f 2e ec e7 dd ae 81 a3 68 e5 db b9 8e 33 99 e8 c3 1c 7f 65 8a fe eb 13 36 c4 80 d0 0f ad 76 6b d2 6e f0 ae 76 f4 a0 19 d8 13 63 67 0e cd b0 64 cf 64 b3 b7 e3 5f 61 93 e2 25 ed 85 f3 aa d9 ea c3 98 f1 eb 3e c9 37 fa c7 dd dc a4 e7 0f 96 c3 46 3f 93 31 9e 3b 7a b7 d5 6f cb 16 3a 3b 43 7f b6 ec [TRUNCATED] Data Ascii: 265}{X_1wY4"#\|svafnQWux6J'S,?90\|xzjK#Y/{+o#DEt?l`Q:r5<57v9;,=wO-3hr86G\'On\|ufi}C'Y0_.h3e6vknvcgdd_a%>7F?1;zo:;Cs3},S,T`s\Mnc`uN/I/EN.JVx#_,;ho[Too,^%kvz8G0H~qGmtILa3Ylogrl,^
Nov 26, 2024 08:19:59.967442036 CET	1236	IN	Data Raw: 96 83 eb bb a5 33 5f 1a 8d 03 5f 7e f5 06 43 f9 e9 a5 df 35 1a da 2c 98 99 f3 de ba 37 5f f4 cc c5 d0 eb 2f cd 71 ef 71 c1 1a 05 e0 f0 a1 1a f8 05 20 ee 3d 7c e9 9b f8 e1 a3 b9 08 a6 3d 13 16 fc d2 e9 0c cd a9 33 33 61 2a 96 bd b9 89 b0 4e ff 5c Data Ascii: 3__~C5,7_/qq =\|=33a*N\3a14P3Yu(\|s1:txgiVG+3'by+x~hB}8ZX0$#;Bxna~:;0W%?9o`_u&)U='h#>`aCf\|
Nov 26, 2024 08:19:59.967454910 CET	1236	IN	Data Raw: 0a 3b ff 5c 80 4a 7c 3b c3 55 19 2e ca 40 54 c1 6f 01 7e 4b 00 43 a5 2a 02 8e 4a 5d f5 55 c0 e9 eb 45 81 12 fb 21 ac 0c e1 a6 24 37 64 9f c1 4d 02 ac cc cc 29 6c b9 b9 79 0f 94 80 ce 91 59 00 a0 35 13 ab 36 14 9b 70 b4 87 31 7d 72 df 1c c1 b0 f2 Data Ascii: ;\J\|;U.@To~KCJ]UE!$7dM)lyY56p1}r\|I2>.lc5&ZEo74y%&M8ok_)So:[>9H2U{KQ51]}1}30.Eu9JSXR]YJ.fGn"Fg;4,y
Nov 26, 2024 08:19:59.967467070 CET	1236	IN	Data Raw: af 08 7e 61 fa ca 64 01 00 53 3a 9e 2a 6b 36 74 7e f0 2f 59 e3 02 ae 8c 67 d8 ba 70 bd 81 4e 66 32 91 1d bf 61 5b 1d 5e 8a ae 6f 76 26 0c f5 d2 87 e3 c4 1e 9a 8b de 12 10 69 e0 0f c2 b1 ac 60 2c 0b a4 c1 f1 42 19 e1 1a c9 61 5c 9c 25 c0 2a 1d 21 Data Ascii: ~adS:k6t~/YgpNf2a[^ov&i`,Ba\%!5R ~g4=@)&n`3X^.xCM&h5LC&7o?~RApmES@ZlL(F<Jy8{UT<d\|8t =
Nov 26, 2024 08:19:59.967483997 CET	1236	IN	Data Raw: e1 17 30 66 51 45 98 40 bc 95 80 78 2b c1 f3 52 39 44 9c 65 40 99 e5 4a 1c 81 32 d4 09 bf 25 f8 45 c9 68 a1 78 48 8b 1e 52 a3 cf 68 8d 03 ef 6d ad 90 2b e7 f2 9a ba 0b 7e fd 42 89 91 2f 0c 1f f0 d6 e1 82 9b 42 5c e0 ed 0a ec dc 47 c1 8d d4 33 d4 Data Ascii: 0fQE@x+R9De@J2%EhxHRhm+~B/B\G3msBs# s;>}YI}o6d:DIB8:hAuVz}n]MPk*7?KJ2X\|r?fG4HLfWjs7od}2\
Nov 26, 2024 08:19:59.967504025 CET	1236	IN	Data Raw: d6 75 c2 7c 8e 8c 81 36 f4 4d 4d 6b 4d da 62 7b 4e 5b f9 36 df 5d d3 96 45 ad 44 9c 38 b7 78 8f d2 8a 7b dc 16 49 27 09 9f 62 5a ab 7e 6f d0 43 05 21 70 cf 77 60 62 8e d0 07 83 9b 98 87 cf 7d 33 20 a4 d0 54 cc da ee 65 f5 33 86 c1 e6 54 f6 85 00 Data Ascii: u\|6MMkMb{N[6]ED8x{I'bZ~oC!pw`b}3 Te3Tf{3]N/Wpa`Ur5we4A>>ls`s?M=Sx{G-jIJ8pZx\|C;\|Kzsj=r7g%O^h\u\
Nov 26, 2024 08:19:59.967516899 CET	1204	IN	Data Raw: d0 5b aa 5e 50 c4 c9 79 29 6d 03 ba 76 c0 9d 68 f7 77 9e b9 7f 74 31 15 71 92 c2 7f 4c 75 39 cf ca e9 00 93 e5 98 cf 48 0d c2 c0 91 10 d8 21 3f 0b df 01 c9 7a 2d 1b 89 a9 00 e3 de b9 a1 d9 99 a4 07 ca d1 63 d1 01 8a 52 7a db 55 f2 82 c4 4e b6 88 Data Ascii: [^Py)mvhwt1qLu9H!?z-cRzUN@!6@)BrD)p&bIJoshNk8zY4b$?$(0A>D9g%L]wg0}2m}:}_nBwOY\9w/=n6oWqE/Q
Nov 26, 2024 08:19:59.967529058 CET	1236	IN	Data Raw: dd 03 52 ae 89 2e 29 93 de 1a 05 69 ac ca c0 5f e8 cf 3b 43 d8 4c 2a 4e 7f d4 5b fe de f4 4d 8e b8 9f 3d 5b fb a2 65 8e 32 99 8e b9 a1 76 0a c6 9e 63 31 55 5f e1 09 36 d3 e7 46 9c dd 44 e5 ee e2 71 ea 06 13 ad 39 b7 75 f5 29 17 3c 68 77 9a ad dd Data Ascii: R.)i_;CL*N[M=[e2vc1U_6FDq9u)<hwjF:7T]QPJjKm)bo'Pl&#UwNh(bx'P'#tEmyk#W^g;@FBIihznNkpZ4I!H(j9
Nov 26, 2024 08:19:59.967539072 CET	1236	IN	Data Raw: 7e 3b ef 10 6d e4 ac 9d 45 67 ee cd 96 b6 d6 a0 06 21 01 20 73 7f f9 93 99 4f 48 05 fd 7d 2e 80 e2 00 cb f7 39 0c c0 0b 4b 93 d1 58 39 2d e3 67 34 89 b9 af f8 d6 a1 a1 9b df ca 2f b0 5c 67 12 2c 10 bd 8e 80 a4 bb e2 0b 1c a0 1b 16 77 51 1a b5 ba Data Ascii: ~;mEg! sOH}.9KX9-g4/\g,wQb=GpP88cYR"S$Wp:nL!h&pO/(:"*#wUVP/Pkx$ZFB+NK"o7g"i E@3j
Nov 26, 2024 08:19:59.967552900 CET	1236	IN	Data Raw: 1d b6 3c 14 33 50 d4 80 c8 02 63 e8 48 59 55 ad 9a 8c 1a 86 ea c0 ae fd a4 61 85 21 9f 25 4d f8 f6 7f 5a d9 4c bb 99 6f 3d fc d6 7e ab a0 92 a1 ee 64 b4 7c 8d 0e b8 b6 dd b2 db 07 ab 42 1f 14 42 df 2b ca ea 8c c5 be 95 83 9f d0 c1 4b ca 6e 64 ea Data Ascii: <3PcHYUa!%MZLo=~d\|BB+KndlF/mZh?AW:C0/~}P<aS]Z)KbDK&')a0'$DD2d@{a`g"[T*Pr?}GJ3w3Y(N
Nov 26, 2024 08:20:00.087557077 CET	1236	IN	Data Raw: dc 37 d5 bd 53 eb 95 99 6f 46 22 dc 2b 9e 15 23 63 cf 81 57 7a c0 8d a3 06 55 3a b2 dd 63 8c d8 63 a8 5a 48 cf 76 f5 3d bf 47 76 18 70 c5 96 95 7f 29 9c 60 39 79 ed 14 ff f2 14 fa a8 44 e4 50 fd e6 40 51 f5 a8 8a 1e d3 92 7e ae 14 e5 0a cc 2e 24 Data Ascii: 7SoF"+#cWzU:ccZHv=Gvp)`9yDP@Q~.$RVr/UUHPS;d9Ec\'JP5d<N(brPlrhREe,8\-A"algfc+odaV`d*r"^,TD:/%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49770	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:59.196170092 CET	387	OUT	GET /image/loading/dot.gif HTTP/1.1 Host: 0.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:00.457743883 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: image/gif Content-Length: 807 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:06 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:44 GMT ETag: "6084db98-327" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC169_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC196_lt-obgp-fujian-xiamen-33-cache-1, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 47 49 46 38 39 61 01 00 01 00 f7 00 00 ff ff ff ff ff cc ff ff 99 ff ff 66 ff ff 33 ff ff 00 ff cc ff ff cc cc ff cc 99 ff cc 66 ff cc 33 ff cc 00 ff 99 ff ff 99 cc ff 99 99 ff 99 66 ff 99 33 ff 99 00 ff 66 ff ff 66 cc ff 66 99 ff 66 66 ff 66 33 ff 66 00 ff 33 ff ff 33 cc ff 33 99 ff 33 66 ff 33 33 ff 33 00 ff 00 ff ff 00 cc ff 00 99 ff 00 66 ff 00 33 ff 00 00 cc ff ff cc ff cc cc ff 99 cc ff 66 cc ff 33 cc ff 00 cc cc ff cc cc cc cc cc 99 cc cc 66 cc cc 33 cc cc 00 cc 99 ff cc 99 cc cc 99 99 cc 99 66 cc 99 33 cc 99 00 cc 66 ff cc 66 cc cc 66 99 cc 66 66 cc 66 33 cc 66 00 cc 33 ff cc 33 cc cc 33 99 cc 33 66 cc 33 33 cc 33 00 cc 00 ff cc 00 cc cc 00 99 cc 00 66 cc 00 33 cc 00 00 99 ff ff 99 ff cc 99 ff 99 99 ff 66 99 ff 33 99 ff 00 99 cc ff 99 cc cc 99 cc 99 99 cc 66 99 cc 33 99 cc 00 99 99 ff 99 99 cc 99 99 99 99 99 66 99 99 33 99 99 00 99 66 ff 99 66 cc 99 66 99 99 66 66 99 66 33 99 66 00 99 33 ff 99 33 cc 99 33 99 99 33 66 99 33 33 99 33 00 99 00 ff 99 00 cc 99 00 99 99 00 66 99 00 33 99 00 00 66 [TRUNCATED] Data Ascii: GIF89af3f3f3ffffff3f3333f333f3f3f3f3ffffff3f3333f333f3f3f3f3ffffff3f3333f333f3ffffff3fffffff3fffffff3ffffffffffff3fff3f3f3f3ff33f3ffffff3f3333f3333333f3333333f3333f3f3f3ff3f33f33333333f333333333f333f3f3f3ffffff3f333
Nov 26, 2024 08:20:00.457914114 CET	173	IN	Data Raw: 00 33 66 00 33 33 00 33 00 00 00 ff 00 00 cc 00 00 99 00 00 66 00 00 33 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 3f333f3!,;
Nov 26, 2024 08:20:11.863461018 CET	411	OUT	GET /image/onlineMap/multi_only.png?v=201809101152 HTTP/1.1 Host: 0.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.264664888 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:12 GMT Content-Type: image/png Content-Length: 1311 Connection: keep-alive Expires: Thu, 16 Nov 2034 08:00:52 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:46 GMT ETag: "6084db9a-51f" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i91530_c21603, i2103121_c25795, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 1d 08 06 00 00 00 b0 ba ac 4b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 21 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRKtEXtSoftwareAdobe ImageReadyqe<!iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:82161B336FA311E98835E35E3D1000FD" xmpMM:DocumentID="xmp.did:82161B346FA311E98835E35E3D1000FD"> <xmpMM:
Nov 26, 2024 08:20:12.264760017 CET	628	IN	Data Raw: 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 38 32 31 36 31 42 33 31 36 46 41 33 31 31 45 39 38 38 33 35 45 33 35 45 33 44 31 30 30 30 46 44 22 20 73 74 52 65 66 3a 64 6f 63 75 Data Ascii: DerivedFrom stRef:instanceID="xmp.iid:82161B316FA311E98835E35E3D1000FD" stRef:documentID="xmp.did:82161B326FA311E98835E35E3D1000FD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>IDATx1KA7K La" ZXPQ%
Nov 26, 2024 08:20:57.270975113 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49771	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:19:59.864609957 CET	345	OUT	GET /jssdk_1_1/js/hawkEye.min.js?v=202403151700 HTTP/1.1 Host: fe.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:01.214256048 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Mon, 06 Nov 2034 03:20:06 GMT Server: F-WEB Last-Modified: Tue, 02 Jan 2024 03:45:24 GMT Vary: Accept-Encoding ETag: W/"659386d4-b64a" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip X-Ser: i33513_c25891, i2103121_c25795, i1872278_c17483 X-Cache: HIT from i1872278_c17483(cloudsvr) Data Raw: 33 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dd 7d 6b 8f e3 c8 76 d8 5f 51 d3 6b 0d b9 62 ab 1f bb b3 7b 57 1a 4e 5b 2d a9 a7 b5 ad d7 48 ea 9e 99 db ad 15 d8 12 d5 62 b7 44 6a 45 4a ea 87 64 24 0e 10 38 37 76 90 04 36 02 38 70 80 1b c0 b0 3f d9 09 12 27 0b c7 89 ff cc de bd 37 9f f2 17 72 4e 3d c8 22 45 4a ea b9 bb 41 92 c1 a0 c5 aa 3a 75 ea 54 d5 a9 53 e7 9c 7a cd 4d ab 67 cf d3 27 b9 52 e7 34 f7 ee ac 53 fc 50 d4 76 76 e6 ab b1 47 11 71 99 a7 65 36 22 3a ed f4 ee 3a 33 63 e2 98 b6 a5 1d a4 0f 62 61 c6 43 dd ed db 93 91 26 8d bb 52 24 94 18 e8 34 8a f5 5a a3 d5 39 6f 94 b5 28 d8 5b 07 71 4e 8c b1 3d 71 3b d3 c9 30 16 61 ee eb dc fb 4e ab 54 29 d6 ce 5b 6b 30 e9 b7 fa 7d c7 35 47 86 3d 75 17 8b 83 7d f8 17 89 b2 37 9e 70 2c 3d 63 66 76 8d ba 79 6f 0c 1b ba 6b da 8b 05 4b 98 1b d7 77 a6 5b 88 4b 1e d9 8f ab 69 7e bb f5 c6 51 64 66 e5 fe d4 ea 02 a8 25 eb ea b5 f2 a4 a7 3b 85 e2 89 f6 d4 a9 d4 0a e7 65 e8 9c 4e eb 43 1d 7e ea 17 3c 66 5f ad 17 1b 27 b5 46 25 57 cd 17 79 e4 81 5a 7c 9f 2f d6 5b a5 5a [TRUNCATED] Data Ascii: 33f}kv_Qkb{WN[-HbDjEJd$87v68p?'7rN="EJA:uTSzMg'R4SPvvGqe6"::3cbaC&R$4Z9o([qN=q;0aNT)[k0}5G=u}7p,=cfvyokKw[Ki~Qdf%;eNC~<f_'F%WyZ\|/[ZGr)b&VyBE~!tVw%UsR3gV#Sv^/YCiIQu$%P-%V_cM ]Q#XN#E2\Jhe.I8"u\Bk2ITIR;@HyFc:i$(T<)R5pf~&?Fy/1_F.8,5)zcJ#&r:7gb)Hgq}C\|RUr!u{]UerYDZ.U!,E+hEZ&~ 92ABc_iJP'L0,Ad6bh
Nov 26, 2024 08:20:01.214366913 CET	84	IN	Data Raw: 76 1c 8f c6 7a 03 c3 20 e5 10 85 30 98 b0 57 69 e3 94 a1 df cf eb ac 39 60 68 f5 30 6f 2b 2f c4 b8 2e a1 e8 ed 79 b1 d9 f2 63 49 5f 1d 23 c7 16 ab 05 21 7a 8c f1 d8 36 f5 5c a3 59 14 f0 92 84 77 8d 52 0b 6a c6 e9 e5 89 73 42 f1 49 a9 01 25 84 d3 Data Ascii: vz 0Wi9`h0o+/.ycI_#!z6\YwRjsBI%
Nov 26, 2024 08:20:01.214378119 CET	1236	IN	Data Raw: 33 32 37 32 0d 0a fa 0e c7 d8 28 e6 0a 1f 04 8c 13 9a a9 5a 02 66 f3 c1 31 f2 b4 d5 aa af 92 3c 98 18 df 0a a9 cd 7a ad 2a 52 08 c9 94 8c 46 ad da 0a 54 aa 4f 3a bd 5c cb 15 3a 5f 37 fd e8 5b c7 8b ce 37 85 f8 ae e3 27 94 2a 6f fc 04 73 74 e3 25 Data Ascii: 3272(Zf1<zRFTO:\:_7[7'ost%xIJ,t=)gCIXOb$RO##&?x2l~J#@~rZ*H4[Hb{S5[3HU}/Yq5fB"S%:GQ$ eSr0t-U;F-
Nov 26, 2024 08:20:01.214385033 CET	1236	IN	Data Raw: f7 5e dd 28 a4 79 b0 6f d2 1d c7 70 eb 20 49 de 4c f4 07 60 30 eb 86 36 d2 ce 8e 9e d6 7b 3d 42 7a d9 74 40 18 18 13 f4 ea 84 e3 64 09 5b 40 52 bd 1e 31 57 51 9f d8 36 30 53 7e a0 5b 96 31 04 f4 6a 5f 1f 3a 86 b2 34 e0 ef 13 2f cb 75 75 d6 52 a4 Data Ascii: ^(yop IL`06{=Bzt@d[@R1WQ60S~[1j_:4/uuR?(K2d:D;R<G{*>p6p'Tzbbn]#4;Vis$40)]wuhS`WSCQc8~`f
Nov 26, 2024 08:20:01.214396954 CET	1236	IN	Data Raw: 57 18 f0 ae dd 24 e0 6c 82 c9 4d 60 6a 4e 9b 0e f9 05 7e e1 f9 6f 3d 6a 06 69 d0 2c 86 10 a1 69 9a 74 69 13 7c 09 02 0e 5c cd 1a fe 09 39 fd c5 d5 95 f4 42 95 e0 6f 06 fe c0 0f 7c 5f 93 ef 6b fc ec 93 cf 3e 7e 5a e4 d3 c2 cf 09 f9 9c e0 a7 4b 3e Data Ascii: W$lM`jN~o=ji,iti\|\9Bo\|_k>~ZK>]Ty>-m{)4IFR]!}x LueK jKspr5gW6)06Sh7v?ac#YHQtN4d[>1cd3"C*&d<]V\|PQ
Nov 26, 2024 08:20:01.214488029 CET	1236	IN	Data Raw: 07 d1 04 b2 56 b8 30 0d 82 7d 16 02 7b 23 2d 43 ea 0c d8 4b bd a6 ab 77 ef a2 66 48 71 01 86 6b c3 43 f4 cb b3 2a ee 98 60 46 57 65 62 75 9d 80 1c 73 21 0d a4 93 a7 ee 9a ca d2 cb e7 08 f9 4c a2 b8 13 a5 1d c8 3b 87 59 9d 1b d6 26 53 d8 c9 5c 25 Data Ascii: V0}{#-CKwfHqkC*`FWebus!L;Y&S\%W-5w`:f3R2n:>$Ufl13=]{8YUXo@S@Dmbt:`@u'\}PJ%Qf8O7Yg[}!3,iJ)Gx
Nov 26, 2024 08:20:01.214499950 CET	896	IN	Data Raw: e6 d0 81 a8 6b e1 f8 cb 70 04 93 b2 bb 07 c4 27 a5 c7 13 41 92 a0 39 69 1a 52 d2 e1 0e 55 2d ce 33 8c 3b 93 36 ed 7c eb 0b 36 95 2e 73 01 f2 b4 64 9c df 0f 74 09 e3 fc 3e 3f 26 88 1b f6 d8 cc df 17 8f 3e b2 71 d4 5f 59 b2 92 fb ac 13 e9 79 a9 74 Data Ascii: kp'A9iRU-3;6\|6.sdt>?&>q_Yyt\fPYL?jF~]=Pi}Txav[8FkA\|:= \#.\|axuwf+<zcWf!vp>D.KVt{;."p,E
Nov 26, 2024 08:20:01.214510918 CET	1236	IN	Data Raw: 74 f4 ad 01 08 1e c1 4f 47 9f 9b f7 0c 76 52 32 d9 fe f3 23 17 1b 38 e8 4f 8b fb 71 0b 08 1c ed 5f 2e c5 ba 2c 16 c1 06 85 b4 c0 99 16 48 ac 2c 16 81 28 8f d1 2a c1 3d 0c 3e 62 36 da 84 f1 0d 13 d5 90 8c 4a dc 73 ee e0 19 0e 7f 34 2e f5 4d 3b 68 Data Ascii: tOGvR2#8Oq_.,H,(*=>b6Js4.M;hf;kLxmKC5^eQ7LTUEYZ:6mh5b2Bmid}iU{Nt],Gw=hm"Bz0_z^Z,
Nov 26, 2024 08:20:01.214526892 CET	1236	IN	Data Raw: 1c f5 d9 fe be b7 65 76 37 78 3a fb 34 94 7f f7 6c 65 fc 08 82 f0 54 f6 09 d4 57 cf 30 40 aa 0f 7b 2c 13 d5 96 aa 31 fb 82 a9 75 16 32 97 2a a0 36 50 13 45 2b ef 9e 31 af 8c b6 2f 1e 7f c0 b8 57 78 4f b5 57 fa 89 5c f1 8e 1c 1c 2a aa 34 02 bb db Data Ascii: ev7x:4leTW0@{,1u26PE+1/WxOW\4R/B<_G*uB+2Sg&; D]$g@Xs;Js+C;_[EqA/=V`'UU!Xx~49JzV:Zu=F1pV"do
Nov 26, 2024 08:20:01.214539051 CET	1236	IN	Data Raw: 6d 6c d5 e7 0a e4 e8 d9 23 76 f1 66 99 dc 54 4c 24 5d d3 5b 6d 8a 67 8b 78 b4 b1 fc 12 5f 16 e3 94 18 72 8a cc ed fc d3 13 03 25 05 49 19 8d d1 d7 f9 13 95 4e 91 8b 05 96 80 a0 89 4e 37 6c fe 14 65 0a f8 c5 62 b1 05 00 e2 27 29 92 e1 66 c5 b5 9e Data Ascii: ml#vfTL$][mgx_r%INN7leb')fg~\|<q~C<{:JK+2RJNy=Zh8/sQa,K?w_WI# co?~<Wftd#+kSx3Q44
Nov 26, 2024 08:20:01.334847927 CET	1236	IN	Data Raw: a7 2e 56 07 c4 70 bb 01 01 2c 38 86 7a c0 a4 b4 8d 5b 2f 8a a1 57 16 38 89 0b 29 8a cd bb 43 b3 7b 27 f4 f1 83 f2 c4 32 ce b5 58 f7 1a c8 be 29 40 2e 97 ea e7 c4 69 16 89 b9 77 3d 8c 44 4e 97 48 ba 43 43 9f 70 ec 73 25 4b f0 f9 bc 19 e2 cc 98 fa Data Ascii: .Vp,8z[/W8)C{'2X)@.iw=DNHCCps%Kpm\|&`GjJ7F[c4>xq tJb+Q-yB2yJn~{;f<<(\|C`89joR$m([[fsR`nbe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49772	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:00.364880085 CET	507	OUT	GET /ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26
Nov 26, 2024 08:20:02.080143929 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1016990014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:02.080149889 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:02.080240965 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:02.080248117 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:02.081513882 CET	299	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:32.242954969 CET	1082	OUT	POST /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Nov 26, 2024 08:20:32.828710079 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019231014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:32.828763962 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:32.828774929 CET	1236	IN	Data Raw: 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 66 61 69 6d 61 Data Ascii: p://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508mallsys
Nov 26, 2024 08:20:32.828865051 CET	1236	IN	Data Raw: 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 69 63 6f 63 2e 69 6e 20 2a 2e 69 63 6f 63 2e 69 6e 20 69 63 6f 63 2e 6d 65 Data Ascii: om .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info *.mallfkw.info mallfk
Nov 26, 2024 08:20:32.828876019 CET	188	IN	Data Raw: 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 Data Ascii: allfkw.cn *.mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopen
Nov 26, 2024 08:20:32.843947887 CET	1236	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605631424 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 81 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true Data Raw: 61 69 64 3d 32 38 30 38 38 33 38 39 26 73 6f 75 72 63 65 53 69 74 65 49 64 3d 30 26 64 61 74 61 49 64 3d 32 30 32 26 73 6f 75 72 63 65 4d 6f 64 75 6c 65 3d 34 30 30 30 31 26 73 6f 75 72 63 65 43 6f 6e 74 65 6e 74 54 79 70 65 3d 34 30 30 Data Ascii: aid=28088389&sourceSiteId=0&dataId=202&sourceModule=40001&sourceContentType=400
Nov 26, 2024 08:20:32.843947887 CET	6	OUT	Data Raw: 30 34 Data Ascii: 04
Nov 26, 2024 08:20:33.427725077 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 250 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019309014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:33.427788973 CET	224	IN	Data Raw: 7a 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 Data Ascii: zfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gti
Nov 26, 2024 08:20:33.509341002 CET	1248	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 124 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 6c 6f 67 4a 5a 46 64 70 54 72 61 63 6b 26 65 76 65 6e 74 3d 6a 7a 5f 62 61 69 64 75 5f 6d 61 70 73 26 70 72 6f 70 65 72 74 69 65 73 3d 7b 22 6a 7a 5f 63 6f 6e 74 65 6e 74 5f 74 65 72 6d 69 6e 61 6c 22 3a 22 73 69 74 65 22 2c 22 6a 7a 5f 76 65 72 73 69 6f 6e 22 3a 30 2c 22 6a 7a 5f 66 72 65 65 5f 62 6f 6f 6c 31 22 3a 74 72 75 65 7d Data Ascii: cmd=wafNotCk_logJZFdpTrack&event=jz_baidu_maps&properties={"jz_content_terminal":"site","jz_version":0,"jz_free_bool1":true}
Nov 26, 2024 08:20:34.099648952 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019358014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:37.293323040 CET	1251	OUT	POST /en/ajax/module_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 62 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170 Data Raw: 63 6d 64 3d 67 65 74 57 61 66 4e 6f 74 43 6b 5f 67 65 74 48 69 64 64 65 6e 4d 6f 64 75 6c 65 4c 69 73 74 26 5f 63 6f 6c 49 64 3d 32 26 5f 6d 61 6e 61 67 65 4d 6f 64 65 3d 66 61 6c 73 65 Data Ascii: cmd=getWafNotCk_getHiddenModuleList&_colId=2&_manageMode=false
Nov 26, 2024 08:20:38.190774918 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 68 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019643014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:39.433589935 CET	1168	OUT	POST /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 39 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170 Data Raw: 63 6d 64 3d 73 65 74 57 61 66 43 6b 5f 73 65 74 52 65 71 41 72 67 73 43 6f 6f 6b 69 65 26 5f 72 65 71 41 72 67 73 3d Data Ascii: cmd=setWafCk_setReqArgsCookie&_reqArgs=
Nov 26, 2024 08:20:40.032006979 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019778014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:40.051641941 CET	1179	OUT	POST /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 39 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs= Data Raw: 63 6d 64 3d 73 65 74 57 61 66 43 6b 5f 73 65 74 52 65 71 41 72 67 73 43 6f 6f 6b 69 65 26 5f 72 65 71 41 72 67 73 3d Data Ascii: cmd=setWafCk_setReqArgsCookie&_reqArgs=
Nov 26, 2024 08:20:40.638676882 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019824014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:40.659168959 CET	1237	OUT	POST /en/ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 10 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs= Data Raw: 26 73 74 61 74 49 64 3d 2d 31 Data Ascii: &statId=-1
Nov 26, 2024 08:20:41.523371935 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019907014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:41.639367104 CET	1316	OUT	GET /en/jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:42.672013044 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:42 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 6021 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019971014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:42 GMT; HttpOnly Data Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f [TRUNCATED] Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t_l6)'M&#lj5":5D"K/~
Nov 26, 2024 08:20:43.495654106 CET	1418	OUT	POST /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 220 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:44.415771008 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1107 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020192014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:53.504829884 CET	1172	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 38 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 64 6f 67 26 64 6f 67 49 64 3d 32 30 30 31 30 35 26 64 6f 67 53 72 63 3d 31 Data Ascii: cmd=wafNotCk_dog&dogId=200105&dogSrc=1
Nov 26, 2024 08:20:54.213516951 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 55 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021071014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:54.225361109 CET	1333	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605652387 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:55.065907955 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021173014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:59.051500082 CET	1406	OUT	POST /en/ajax/module_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 62 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:59.914315939 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 68 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021648014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:00.354173899 CET	1316	OUT	GET /en/jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:01.512797117 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:01 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 6021 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021721014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:21:01 GMT; HttpOnly Data Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f [TRUNCATED] Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t_l6)'M&#lj5":5D"K/~
Nov 26, 2024 08:21:02.177054882 CET	1418	OUT	POST /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 220 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:03.031478882 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1107 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021905014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.046145916 CET	1434	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605661453 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 81 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:03.870481014 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 251 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021968014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.889817953 CET	1388	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605662748 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605662728
Nov 26, 2024 08:21:04.478990078 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022032014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:04.497626066 CET	1379	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605663355 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:05.363056898 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022096014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:06.651284933 CET	1179	OUT	POST /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 39 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626 Data Raw: 63 6d 64 3d 73 65 74 57 61 66 43 6b 5f 73 65 74 52 65 71 41 72 67 73 43 6f 6f 6b 69 65 26 5f 72 65 71 41 72 67 73 3d Data Ascii: cmd=setWafCk_setReqArgsCookie&_reqArgs=
Nov 26, 2024 08:21:07.322583914 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022239014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:07.569252014 CET	1179	OUT	POST /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 39 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626 Data Raw: 63 6d 64 3d 73 65 74 57 61 66 43 6b 5f 73 65 74 52 65 71 41 72 67 73 43 6f 6f 6b 69 65 26 5f 72 65 71 41 72 67 73 3d Data Ascii: cmd=setWafCk_setReqArgsCookie&_reqArgs=
Nov 26, 2024 08:21:08.158499956 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022338014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:08.180504084 CET	1433	OUT	POST /en/ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 10 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:09.048995018 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022431014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:09.378117085 CET	1316	OUT	GET /en/jzcusstyle.jsp?id=-1&colId=2&extId=0&_csw=0&clientSupportWebp=true HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:10.510392904 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:10 GMT Content-Type: text/css; charset=UTF-8 Content-Length: 6021 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022532014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:21:10 GMT; HttpOnly Data Raw: 1f 8b 08 00 00 00 00 00 00 00 d5 5d eb 8e db 48 76 fe af a7 60 6c 2c b0 b3 e8 6e 8b e2 45 97 46 80 d8 9e 78 ed cd d8 e3 8c 9d 2c 90 20 10 d8 12 5b cd b1 44 0a 12 e5 6e 4f c3 3f f7 01 f6 77 de 21 79 80 20 79 9b 00 d9 b7 48 b1 8a a4 aa 58 e7 d4 8d d2 c4 99 ab 29 9d 5b 55 9d 3a 55 df a9 a3 e2 df 2c ee 92 dd 3e 2d bd 27 87 f2 f6 72 f2 e4 7a 30 f0 ea bf 9e 6e 8a e5 61 9d 46 81 ef 5d dd 16 bb cd 8b 24 cf d3 1d 79 7c f4 96 d9 7e bb 4e be cc f2 22 4f af bd af 2d 0b f9 6b d0 61 7d bc 29 76 cb 74 c7 48 bf 4a 42 df 66 cb 25 7d 34 a5 a3 f2 b9 8f 5e a6 79 c9 ac 52 0b f8 58 6c 2b 22 c1 f2 af 5d 63 59 3b 8b b2 2c 36 32 31 6e 13 ff f8 43 7a 5b ba f2 fe 94 ad ee 00 e6 41 db af 52 df 26 8b 4f ab 5d 71 c8 97 7a 3d 36 c4 ad 32 b8 a3 0d 05 bd 2c 08 47 5e 82 2c 03 c8 57 38 de 6e 27 ad e6 77 c5 e7 74 e7 25 de 7e 9b e4 17 b6 5c b6 0c 0e 4a 1e 6f 49 73 2f f7 d9 2f e9 cc f3 e3 ed c3 35 7d be 4d 36 d9 fa cb cc fb ef ff fa b7 ff f9 cf 7f ff cb bf fe e9 2f ff f1 67 f6 cd 7d 5a 8d f6 cc bb 29 d6 4b f6 c9 be fc b2 26 cc 39 11 9f [TRUNCATED] Data Ascii: ]Hv`l,nEFx, [DnO?w!y yHX)[U:U,>-'rz0naF]$y\|~N"O-ka})vtHJBf%}4^yRXl+"]cY;,621nCz[AR&O]qz=62,G^,W8n'wt%~\JoIs//5}M6/g}Z)K&9\bYu^b7v(FO<H}Z[OLmAl5=xM,3lqU#>6dMIw?,S'i,]Q'q1+i-Jj&4?gV`i>P0x~&,$*C>V{t_l6)'M&#lj5":5D"K/~
Nov 26, 2024 08:21:11.041227102 CET	1418	OUT	POST /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 220 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:11.659528971 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1107 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022704014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.676723957 CET	1323	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:12.507525921 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022798014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:12.558090925 CET	1259	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 124 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605672209 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 6c 6f 67 4a 5a 46 64 70 54 72 61 63 6b 26 65 76 65 6e 74 3d 6a 7a 5f 62 61 69 64 75 5f 6d 61 70 73 26 70 72 6f 70 65 72 74 69 65 73 3d 7b 22 6a 7a 5f 63 6f 6e 74 65 6e 74 5f 74 65 72 6d 69 6e 61 6c 22 3a 22 73 69 74 65 22 2c 22 6a 7a 5f 76 65 72 73 69 6f 6e 22 3a 30 2c 22 6a 7a 5f 66 72 65 65 5f 62 6f 6f 6c 31 22 3a 74 72 75 65 7d Data Ascii: cmd=wafNotCk_logJZFdpTrack&event=jz_baidu_maps&properties={"jz_content_terminal":"site","jz_version":0,"jz_free_bool1":true}
Nov 26, 2024 08:21:13.421017885 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022868014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49773	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:00.760360003 CET	630	OUT	POST /ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 36 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 63 68 65 63 6b 42 61 69 64 75 41 75 74 6f 6d 61 74 69 63 50 75 73 68 Data Ascii: cmd=wafNotCk_checkBaiduAutomaticPush
Nov 26, 2024 08:20:02.095053911 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 46 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1016991014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:02.095062017 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:02.095073938 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:02.095179081 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:02.095185995 CET	282	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:17.542392969 CET	906	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 39 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 64 6f 67 26 64 6f 67 49 64 3d 32 30 30 30 39 39 26 64 6f 67 53 72 63 3d 32 32 Data Ascii: cmd=wafNotCk_dog&dogId=200099&dogSrc=22
Nov 26, 2024 08:20:18.128436089 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 55 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1018130014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:18.128482103 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:18.128494978 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:18.128563881 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:18.128576040 CET	291	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:32.202915907 CET	1083	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Nov 26, 2024 08:20:32.792412996 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019228014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:32.792488098 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:32.795126915 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:32.814119101 CET	1056	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605631122 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Nov 26, 2024 08:20:33.408394098 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019305014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:33.518275023 CET	1111	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605632371 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Nov 26, 2024 08:20:34.106143951 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019359014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:34.262928963 CET	1102	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605633116 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Nov 26, 2024 08:20:34.854753017 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019399014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:37.286873102 CET	1246	OUT	POST /en/ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 25 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170 Data Raw: 64 6f 6d 61 69 6e 3d 77 77 77 2e 77 68 65 65 6c 2d 64 6f 6e 65 2e 63 6f 6d Data Ascii: domain=www.wheel-done.com
Nov 26, 2024 08:20:38.157903910 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 54 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019644014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:40.058084011 CET	1391	OUT	POST /en/ajax/log_h.jsp?_v=1732605638909 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 195 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs= Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 6c 6f 67 46 64 70 46 6f 72 57 65 62 56 69 74 61 6c 73 26 70 72 6f 70 65 72 74 69 65 73 3d 25 37 42 25 32 32 6c 25 32 32 3a 31 30 31 30 33 2e 39 2c 25 32 32 64 63 6c 25 32 32 3a 35 30 30 35 2c 25 32 32 74 74 66 62 25 32 32 3a 31 30 34 39 2c 25 32 32 66 63 70 25 32 32 3a 35 30 32 30 2e 35 2c 25 32 32 6c 63 70 25 32 32 3a 34 39 32 32 2e 32 2c 25 32 32 75 72 6c 25 32 32 3a 25 32 32 68 74 74 70 25 32 35 33 41 25 32 35 32 46 25 32 35 32 46 77 77 77 2e 77 68 65 65 6c 2d 64 6f 6e 65 2e 63 6f 6d 25 32 35 32 46 65 6e 25 32 35 32 46 25 32 32 25 37 44 Data Ascii: cmd=wafNotCk_logFdpForWebVitals&properties=%7B%22l%22:10103.9,%22dcl%22:5005,%22ttfb%22:1049,%22fcp%22:5020.5,%22lcp%22:4922.2,%22url%22:%22http%253A%252F%252Fwww.wheel-done.com%252Fen%252F%22%7D
Nov 26, 2024 08:20:40.926579952 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019864014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:43.506596088 CET	1360	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:44.394162893 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020196014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:53.503146887 CET	1447	OUT	POST /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 36 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:54.402890921 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 46 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021096014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:59.102929115 CET	1397	OUT	GET /en/ HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:00.214011908 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021651014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:59 GMT; HttpOnly Data Raw: 36 63 34 66 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ec bd 6b 73 e4 c8 71 28 fa 79 26 42 ff 01 6e 5d ab 67 e3 f0 d1 40 3f d8 24 97 d4 e1 63 1e 1c 91 33 b3 43 ce 8e d6 5e 45 07 1a 8d ee 06 89 06 7a 01 34 9b e4 5e 46 58 7e 9c 95 7c 75 ae ad 73 6c c9 92 25 79 a5 6b 4b b2 6c 59 b6 75 6c ad 56 af 08 cb fe aa 58 9d 2f 96 8f bf ac 22 34 b3 da 13 f7 86 ff c2 cd cc 2a 00 85 57 37 48 36 39 9c d1 70 76 49 00 55 95 95 95 95 95 95 95 95 95 f5 e2 af ad df 5d db 79 e5 de 75 e9 d6 ce d6 e6 f2 07 ae be f8 6b d3 d3 2f 76 bd 9e b9 fc 62 57 57 5b cb 2f ce b2 3f 4d bb 75 08 2f fc 0f 65 98 9e c6 fc f8 28 99 aa d5 59 2a e8 56 41 d2 4c d5 75 97 0a 8d 86 65 df ec a9 86 25 75 1a 98 a3 40 59 11 d2 07 ae c2 93 67 78 a6 be fc cb 37 be fd cb 1f fe f0 3f be ff 89 c7 df f9 bb 47 5f f8 f6 7f 7c ff 93 8f fe f4 07 ef 7f ee f7 de fb e4 5f 3e fe 87 8f 3f fe c2 27 df ff dc 1f 3e fa bd bf 7e f4 07 6f bd 38 cb 4a 40 d1 9e ee a9 92 a5 f6 f4 a5 c2 9e 7e 38 b4 9d 96 0b b5 da 96 a7 5b de 52 21 3f c8 c2 6c 0c 5a 4b 77 35 c7 e8 7b 86 6d 9d 1e a0 0f [TRUNCATED] Data Ascii: 6c4fksq(y&Bn]g@?$c3C^Ez4^FX~\|usl%ykKlYulVX/"4W7H69pvIU]yuk/vbWW[/?Mu/e(YVALue%u@Ygx7?G_\|_>?'>~o8J@~8[R!?lZKw5{myiTXcw<"uU$4=M@r=[T-LTwQNQF>Ei'UC(tui6iQ-m;=F(4::0MtObdS:VaXv[-Po}vga
Nov 26, 2024 08:21:02.181526899 CET	1432	OUT	POST /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 176 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:03.012865067 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021906014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.037364960 CET	1333	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605661099 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:03.921587944 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021970014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.964898109 CET	1259	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 124 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 6c 6f 67 4a 5a 46 64 70 54 72 61 63 6b 26 65 76 65 6e 74 3d 6a 7a 5f 62 61 69 64 75 5f 6d 61 70 73 26 70 72 6f 70 65 72 74 69 65 73 3d 7b 22 6a 7a 5f 63 6f 6e 74 65 6e 74 5f 74 65 72 6d 69 6e 61 6c 22 3a 22 73 69 74 65 22 2c 22 6a 7a 5f 76 65 72 73 69 6f 6e 22 3a 30 2c 22 6a 7a 5f 66 72 65 65 5f 62 6f 6f 6c 31 22 3a 74 72 75 65 7d Data Ascii: cmd=wafNotCk_logJZFdpTrack&event=jz_baidu_maps&properties={"jz_content_terminal":"site","jz_version":0,"jz_free_bool1":true}
Nov 26, 2024 08:21:04.834490061 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022064014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:08.189351082 CET	1397	OUT	GET /en/ HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:09.339030027 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022434014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:21:09 GMT; HttpOnly Data Raw: 36 63 34 66 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ec bd 6b 73 e4 c8 71 28 fa 79 26 42 ff 01 6e 5d ab 67 e3 f0 d1 40 3f d8 24 97 d4 e1 63 1e 1c 91 33 b3 43 ce 8e d6 5e 45 07 1a 8d ee 06 89 06 7a 01 34 9b e4 5e 46 58 7e 9c 95 7c 75 ae ad 73 6c c9 92 25 79 a5 6b 4b b2 6c 59 b6 75 6c ad 56 af 08 cb fe aa 58 9d 2f 96 8f bf ac 22 34 b3 da 13 f7 86 ff c2 cd cc 2a 00 85 57 37 48 36 39 9c d1 70 76 49 00 55 95 95 95 95 95 95 95 95 95 f5 e2 af ad df 5d db 79 e5 de 75 e9 d6 ce d6 e6 f2 07 ae be f8 6b d3 d3 2f 76 bd 9e b9 fc 62 57 57 5b cb 2f ce b2 3f 4d bb 75 08 2f fc 0f 65 98 9e c6 fc f8 28 99 aa d5 59 2a e8 56 41 d2 4c d5 75 97 0a 8d 86 65 df ec a9 86 25 75 1a 98 a3 40 59 11 d2 07 ae c2 93 67 78 a6 be fc cb 37 be fd cb 1f fe f0 3f be ff 89 c7 df f9 bb 47 5f f8 f6 7f 7c ff 93 8f fe f4 07 ef 7f ee f7 de fb e4 5f 3e fe 87 8f 3f fe c2 27 df ff dc 1f 3e fa bd bf 7e f4 07 6f bd 38 cb 4a 40 d1 9e ee a9 92 a5 f6 f4 a5 c2 9e 7e 38 b4 9d 96 0b b5 da 96 a7 5b de 52 21 3f c8 c2 6c 0c 5a 4b 77 35 c7 e8 7b 86 6d 9d 1e a0 0f [TRUNCATED] Data Ascii: 6c4fksq(y&Bn]g@?$c3C^Ez4^FX~\|usl%ykKlYulVX/"4W7H69pvIU]yuk/vbWW[/?Mu/e(YVALue%u@Ygx7?G_\|_>?'>~o8J@~8[R!?lZKw5{myiTXcw<"uU$4=M@r=[T-LTwQNQF>Ei'UC(tui6iQ-m;=F(4::0MtObdS:VaXv[-Po}vga
Nov 26, 2024 08:21:11.045361042 CET	1432	OUT	POST /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 176 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:11.878503084 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022722014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49774	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:00.760449886 CET	509	OUT	POST /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26
Nov 26, 2024 08:20:02.077619076 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1016992014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:02.077626944 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:02.077641010 CET	1236	IN	Data Raw: 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 66 61 69 6d 61 Data Ascii: p://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508mallsys
Nov 26, 2024 08:20:02.077752113 CET	1236	IN	Data Raw: 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 69 63 6f 63 2e 69 6e 20 2a 2e 69 63 6f 63 2e 69 6e 20 69 63 6f 63 2e 6d 65 Data Ascii: om .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info *.mallfkw.info mallfk
Nov 26, 2024 08:20:02.077756882 CET	188	IN	Data Raw: 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 Data Ascii: allfkw.cn *.mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopen
Nov 26, 2024 08:20:32.243547916 CET	1161	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 38 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 64 6f 67 26 64 6f 67 49 64 3d 32 30 30 31 30 35 26 64 6f 67 53 72 63 3d 31 Data Ascii: cmd=wafNotCk_dog&dogId=200105&dogSrc=1
Nov 26, 2024 08:20:32.830153942 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 55 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019232014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:32.830288887 CET	176	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inl
Nov 26, 2024 08:20:32.830297947 CET	1236	IN	Data Raw: 69 6e 65 27 20 2a 2e 77 68 65 65 6c 2d 64 6f 6e 65 2e 63 6f 6d 20 62 64 69 6d 67 2e 63 6f 6d 20 2a 2e 62 64 69 6d 67 2e 63 6f 6d 20 67 74 69 6d 67 2e 63 6f 6d 20 2a 2e 67 74 69 6d 67 2e 63 6f 6d 20 66 61 69 64 65 76 2e 63 63 20 2a 2e 66 61 69 64 Data Ascii: ine' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc *.for
Nov 26, 2024 08:20:32.830308914 CET	1236	IN	Data Raw: 63 6f 6d 20 35 30 38 6d 61 6c 6c 75 73 72 2e 63 6f 6d 20 2a 2e 35 30 38 6d 61 6c 6c 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 35 30 38 6d 61 6c 6c 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 35 30 38 6d 61 6c 6c 75 73 72 2e 63 6f 6d 20 Data Ascii: com 508mallusr.com .508mallusr.com http://508mallusr.com http://.508mallusr.com 508mallsys.com .508mallsys.com http://508mallsys.com http://.508mallsys.com faidns.com .faidns.com http://faidns.com http://.faidns.com faisco.cn *.faisco.cn
Nov 26, 2024 08:20:32.830322981 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 Data Ascii: .info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;frame-src 'self' .wheel-done.com baidu.com .baidu.com qq.com .qq.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc .faide
Nov 26, 2024 08:20:32.830405951 CET	115	IN	Data Raw: 62 6c 6f 63 6b 0d 0a 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ab 56 2a 2a 51 b2 32 d0 51 2a 2e 4d Data Ascii: blockX-Download-Options: noopenVary: Accept-EncodingV*Q2Q.MNN-.V)MQ-NWRV+#
Nov 26, 2024 08:20:43.538454056 CET	1093	OUT	POST /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:44.125230074 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020179014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.125262976 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:44.142962933 CET	1323	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:44.731998920 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020231014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.916882992 CET	1259	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 124 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 6c 6f 67 4a 5a 46 64 70 54 72 61 63 6b 26 65 76 65 6e 74 3d 6a 7a 5f 62 61 69 64 75 5f 6d 61 70 73 26 70 72 6f 70 65 72 74 69 65 73 3d 7b 22 6a 7a 5f 63 6f 6e 74 65 6e 74 5f 74 65 72 6d 69 6e 61 6c 22 3a 22 73 69 74 65 22 2c 22 6a 7a 5f 76 65 72 73 69 6f 6e 22 3a 30 2c 22 6a 7a 5f 66 72 65 65 5f 62 6f 6f 6c 31 22 3a 74 72 75 65 7d Data Ascii: cmd=wafNotCk_logJZFdpTrack&event=jz_baidu_maps&properties={"jz_content_terminal":"site","jz_version":0,"jz_free_bool1":true}
Nov 26, 2024 08:20:45.503202915 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020287014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:48.465883017 CET	1406	OUT	POST /en/ajax/module_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 62 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:49.576013088 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 68 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020635014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:50.525630951 CET	1397	OUT	GET /en/ HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:51.646867037 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020833014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 P3P: CP=CAO PSA OUR Update-Time: 1680503039 Src-Update: true Origin-Agent-Cluster: ?0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Set-Cookie: _nocache=true; domain=www.wheel-done.com; path=/; expires=Tue, 26-Nov-2024 19:20:51 GMT; HttpOnly Data Raw: 36 63 34 66 0d 0a 1f 8b 08 00 00 00 00 00 00 00 ec bd 6b 73 e4 c8 71 28 fa 79 26 42 ff 01 6e 5d ab 67 e3 f0 d1 40 3f d8 24 97 d4 e1 63 1e 1c 91 33 b3 43 ce 8e d6 5e 45 07 1a 8d ee 06 89 06 7a 01 34 9b e4 5e 46 58 7e 9c 95 7c 75 ae ad 73 6c c9 92 25 79 a5 6b 4b b2 6c 59 b6 75 6c ad 56 af 08 cb fe aa 58 9d 2f 96 8f bf ac 22 34 b3 da 13 f7 86 ff c2 cd cc 2a 00 85 57 37 48 36 39 9c d1 70 76 49 00 55 95 95 95 95 95 95 95 95 95 f5 e2 af ad df 5d db 79 e5 de 75 e9 d6 ce d6 e6 f2 07 ae be f8 6b d3 d3 2f 76 bd 9e b9 fc 62 57 57 5b cb 2f ce b2 3f 4d bb 75 08 2f fc 0f 65 98 9e c6 fc f8 28 99 aa d5 59 2a e8 56 41 d2 4c d5 75 97 0a 8d 86 65 df ec a9 86 25 75 1a 98 a3 40 59 11 d2 07 ae c2 93 67 78 a6 be fc cb 37 be fd cb 1f fe f0 3f be ff 89 c7 df f9 bb 47 5f f8 f6 7f 7c ff 93 8f fe f4 07 ef 7f ee f7 de fb e4 5f 3e fe 87 8f 3f fe c2 27 df ff dc 1f 3e fa bd bf 7e f4 07 6f bd 38 cb 4a 40 d1 9e ee a9 92 a5 f6 f4 a5 c2 9e 7e 38 b4 9d 96 0b b5 da 96 a7 5b de 52 21 3f c8 c2 6c 0c 5a 4b 77 35 c7 e8 7b 86 6d 9d 1e a0 0f [TRUNCATED] Data Ascii: 6c4fksq(y&Bn]g@?$c3C^Ez4^FX~\|usl%ykKlYulVX/"4W7H69pvIU]yuk/vbWW[/?Mu/e(YVALue%u@Ygx7?G_\|_>?'>~o8J@~8[R!?lZKw5{myiTXcw<"uU$4=M@r=[T-LTwQNQF>Ei'UC(tui6iQ-m;=F(4::0MtObdS:VaXv[-Po}vga
Nov 26, 2024 08:20:53.456898928 CET	1432	OUT	POST /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 176 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:54.283070087 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021089014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:54.297358990 CET	1434	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605652686 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 81 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:55.172045946 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 252 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021183014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:55.199332952 CET	1388	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605654057 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:56.076591969 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021293014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:56.102797031 CET	1379	OUT	POST /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605654961 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:56.966057062 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021371014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:57.874068022 CET	1179	OUT	POST /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 39 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897 Data Raw: 63 6d 64 3d 73 65 74 57 61 66 43 6b 5f 73 65 74 52 65 71 41 72 67 73 43 6f 6f 6b 69 65 26 5f 72 65 71 41 72 67 73 3d Data Ascii: cmd=setWafCk_setReqArgsCookie&_reqArgs=
Nov 26, 2024 08:20:58.464584112 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021523014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:58.484371901 CET	1179	OUT	POST /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 39 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897 Data Raw: 63 6d 64 3d 73 65 74 57 61 66 43 6b 5f 73 65 74 52 65 71 41 72 67 73 43 6f 6f 6b 69 65 26 5f 72 65 71 41 72 67 73 3d Data Ascii: cmd=setWafCk_setReqArgsCookie&_reqArgs=
Nov 26, 2024 08:20:59.073939085 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021571014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:59.095120907 CET	1433	OUT	POST /en/ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 10 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:59.961667061 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021652014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:00.303401947 CET	1402	OUT	POST /en/ajax/log_h.jsp?_v=1732605659155 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 198 Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49775	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:00.760561943 CET	588	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 38 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 64 6f 67 26 64 6f 67 49 64 3d 32 30 30 31 30 35 26 64 6f 67 53 72 63 3d 31 Data Ascii: cmd=wafNotCk_dog&dogId=200105&dogSrc=1
Nov 26, 2024 08:20:02.029032946 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 55 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1016989014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:02.029055119 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:02.029062033 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:02.029074907 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:02.029117107 CET	236	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:02.220827103 CET	55	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 00 ab 56 2a 2a 51 b2 32 d0 51 2a 2e 4d 4e 4e 2d 2e 56 b2 2a 29 2a 4d d5 51 ca 2d 4e 57 b2 52 ca cf 56 aa e5 02 00 87 0c ca 2b 23 00 00 00 Data Ascii: V*Q2Q.MNN-.V)MQ-NWRV+#
Nov 26, 2024 08:20:17.513343096 CET	927	OUT	POST /ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 25 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D Data Raw: 64 6f 6d 61 69 6e 3d 77 77 77 2e 77 68 65 65 6c 2d 64 6f 6e 65 2e 63 6f 6d Data Ascii: domain=www.wheel-done.com
Nov 26, 2024 08:20:18.099102974 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 54 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1018124014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:18.099138021 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:18.099157095 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:18.099164009 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:18.107701063 CET	290	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:32.242203951 CET	1206	OUT	POST /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 36 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 63 68 65 63 6b 42 61 69 64 75 41 75 74 6f 6d 61 74 69 63 50 75 73 68 Data Ascii: cmd=wafNotCk_checkBaiduAutomaticPush
Nov 26, 2024 08:20:32.823151112 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 46 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019229014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:32.823257923 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:43.537565947 CET	1447	OUT	POST /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 36 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:44.398505926 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 46 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020197014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:53.504015923 CET	1093	OUT	POST /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 0 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:54.204960108 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021070014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:54.219118118 CET	1323	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:55.033590078 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021172014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:55.168086052 CET	1259	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 124 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654008 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 6c 6f 67 4a 5a 46 64 70 54 72 61 63 6b 26 65 76 65 6e 74 3d 6a 7a 5f 62 61 69 64 75 5f 6d 61 70 73 26 70 72 6f 70 65 72 74 69 65 73 3d 7b 22 6a 7a 5f 63 6f 6e 74 65 6e 74 5f 74 65 72 6d 69 6e 61 6c 22 3a 22 73 69 74 65 22 2c 22 6a 7a 5f 76 65 72 73 69 6f 6e 22 3a 30 2c 22 6a 7a 5f 66 72 65 65 5f 62 6f 6f 6c 31 22 3a 74 72 75 65 7d Data Ascii: cmd=wafNotCk_logJZFdpTrack&event=jz_baidu_maps&properties={"jz_content_terminal":"site","jz_version":0,"jz_free_bool1":true}
Nov 26, 2024 08:20:56.014815092 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021291014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:59.046057940 CET	1438	OUT	POST /en/ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 25 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:59.902692080 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 54 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021650014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:02.183222055 CET	1360	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:03.038441896 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021909014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.089061022 CET	1172	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 38 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 64 6f 67 26 64 6f 67 49 64 3d 32 30 30 31 30 35 26 64 6f 67 53 72 63 3d 31 Data Ascii: cmd=wafNotCk_dog&dogId=200105&dogSrc=1
Nov 26, 2024 08:21:11.664750099 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 55 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022708014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.683559895 CET	1333	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605669970 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:12.549879074 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022802014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49776	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:00.869636059 CET	420	OUT	GET /2/ABUIABACGAAgj4iFjAYonO_WGjCKDzjYBA.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:02.221138000 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: image/jpeg Content-Length: 54640 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAgj4iFjAYonO_WGjCKDzjYBA.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i31813_c17589, i2103119_c25795, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 52 49 46 46 68 d5 00 00 57 45 42 50 56 50 38 20 5c d5 00 00 50 23 04 9d 01 2a 8a 07 58 02 3e 6d 36 97 49 24 22 aa 2a a2 14 b9 61 50 0d 89 67 6e ff a4 65 8f 45 66 d6 3c 61 6e 82 68 7d 78 fc eb fe 37 2d 7f 25 d9 9f f9 3d ca 3f c6 fa 26 fa 32 68 db 40 cf f5 5e 98 07 99 e8 55 ff 77 a2 f1 9e 54 4b 0b eb 45 5e 7d 77 a1 9f 8f 7f 5f e6 23 f0 1e b6 ff 2e bd 3a 7f 48 f3 83 f5 51 ff bb d9 3f f7 6f 44 bf d2 3f de fa cb 7a 8a ff 1d ea 01 fd 57 fd 07 ae 0f ac 47 f8 af 50 ef da ef 5a 1f fd df bb bf 11 7f e1 bf ef 7e e7 7b 55 ff e6 f6 00 ff ff ea 01 ff d3 ac bf 93 bf 95 5e 6a 7f 98 ff 35 fe 4f f7 03 fc 8f ac 3f 91 7d 6f f9 7f f0 7f e5 7f db ff 7c fd b7 fb c4 c6 bf c0 7f 8b e6 97 f3 2f c0 3f b4 ff 09 fb b5 fe 53 e6 4f f8 7f f5 3f d5 7e e5 fa 43 f2 0b fd 8f f3 1f bb 9f 01 df 97 7f 35 ff 37 fd fb f7 63 fc 57 ac 4f d9 af 21 fd c3 fd ff a0 47 b6 7f 58 ff a3 fe 03 fc df ff 0f f6 9f 02 df 5b ff 63 fd 0f ab 5f ba ff 90 ff bd fe 73 f2 47 ec 0b fa 87 f6 7f f8 7f e3 7f 7b 3e 42 ff b1 e2 c9 f7 bf fa 1f b5 3f 00 9f d0 7f c3 7f [TRUNCATED] Data Ascii: RIFFhWEBPVP8 \P#X>m6I$"aPgneEf<anh}x7-%=?&2h@^UwTKE^}w_#.:HQ?oD?zWGPZ~{U^j5O?}o\|/?SO?~C57cWO!GX[c_sG{>B?]s7o?s_{ro??4\0_P%gkW'+(4_(M<f9e]t36.e'w/N4^IE$b*,qPC$.$R:oh A6#}nuhzL%5u!{t&Q$GDRNrh RB3"uIle"do!Y0zr]!OH+r 3l@'66fr^R.yhS-W1I+1LJ,xU0]Qv~kxaoR2D!.Ve}j
Nov 26, 2024 08:20:02.221143007 CET	224	IN	Data Raw: 6f 24 39 27 10 09 de a9 2f 6c 58 17 86 fa 9c 8c 08 6f d0 74 20 fa 44 c1 d3 df a2 ff eb 9f b7 bf 26 87 93 f7 c6 22 b8 ab 53 ff b9 1f ad 05 8a aa ab 1f bc 38 a2 f2 68 bf f1 69 9c 33 f1 ef fa ea f6 ab 98 8a 9b de 66 68 e5 a8 a8 1e 18 3c df 0f 40 6b Data Ascii: o$9'/lXot D&"S8hi3fh<@k-\HvK"ee2%idDD!s'StGkKWRun=KY!2_Dd4E27H*`mLRA)i
Nov 26, 2024 08:20:02.221155882 CET	1236	IN	Data Raw: 7a 12 a9 7f af ef 52 bf ed 7e 77 de 7c 64 b0 31 7a 77 25 c8 31 ec 76 99 50 02 c5 3e 5c 65 ad 43 c1 cd e3 48 4e 9e 20 05 10 5d 2e 3d 84 9a 4e 2f ac 30 50 27 48 ee 61 40 ef 71 e4 a9 75 8c 3f 76 27 60 e4 c6 5a e6 d5 9c 78 dd 7c 80 18 5e ff 45 6d e7 Data Ascii: zR~w\|d1zw%1vP>\eCHN ].=N/0P'Ha@qu?v'`Zx\|^Em^3Z 'fv=3qUn\Fl^0WEqx8#n0Ky83\.sm,T,f+!Jd]yB~Yhz OFAT/
Nov 26, 2024 08:20:02.221182108 CET	1236	IN	Data Raw: df 52 cd 23 b1 ca a1 e4 b8 71 c1 a1 5b d4 2a 77 89 34 00 e7 7f e7 c6 71 06 2d 92 1b c3 fe 1a b9 df c6 77 da 37 f3 20 05 6e e9 90 73 f4 d5 f0 53 4d 81 bc c7 4b 47 4c a4 76 6f e5 5d 75 a4 4d 80 7d a3 c5 c4 0a 6d 1e a6 98 61 0d fd 00 40 a3 f1 50 cc Data Ascii: R#q[*w4q-w7 nsSMKGLvo]uM}ma@PYs_~-B4v2^n}v}wReoc02ZDBG$mi{\|)5&Lu A,v$,@1{G#]qz}Zg%Ja0
Nov 26, 2024 08:20:02.221187115 CET	1236	IN	Data Raw: a3 cd 2a 70 3d 2a 06 9e 0a 90 b5 9a 38 d9 2d b6 bf 4f 1c b2 c0 74 e1 33 bf f7 1d 93 72 f9 ac 69 71 73 ce c0 31 93 0c 35 9b 3b 4f 89 3a 7d 39 7a e8 8c 8d dd 18 bc 43 0a 57 47 4c 80 ac 22 09 cc c2 e0 09 87 da 77 08 a3 ff fb 16 ef 50 9e 12 9b bd e5 Data Ascii: p=8-Ot3riqs15;O:}9zCWGL"wPZ9&d\|sdG$AH5.4SmV~zo@cTG4xxD-1d6IyHQ`zI~u3/o8,1#s%&bzD`<]
Nov 26, 2024 08:20:02.221287966 CET	1236	IN	Data Raw: c8 99 72 ea 95 3b 25 58 89 27 3f 91 68 99 b7 31 c3 1c 8a 1b fd e8 47 c3 89 06 e6 a5 c4 7b f5 e0 49 ae 6a c9 cb e5 07 08 fb 0c 96 17 cb cd c0 cd 01 94 79 3c 6e 8d 77 aa da 8b c3 85 a0 63 f8 46 ec b3 d0 75 de ad d2 f1 a8 65 94 f2 67 e4 44 a5 33 52 Data Ascii: r;%X'?h1G{Ijy<nwcFuegD3R7xnp<Xc#E{M gw{zdeK]hZ+5rFi^(qXh7[3h+:P:&[b,G#<KkfqTF.9v^]<Y] ~RSk~JP{<
Nov 26, 2024 08:20:02.221299887 CET	1236	IN	Data Raw: b1 0f b4 df 28 15 fb c4 17 82 59 c1 d3 eb 53 32 de 27 4e 49 3d 15 a2 86 11 e9 34 ca bb 11 98 18 96 b6 ff 90 e8 87 b9 f5 17 74 75 25 bd be 5e c7 f7 67 b0 73 be fb a0 3a f9 04 f0 95 f7 52 bb ba 07 6a 2a 9a a1 ad 82 f4 49 33 13 35 6e 28 58 1a 1c e6 Data Ascii: (YS2'NI=4tu%^gs:Rj*I35n(X6~RI(E`ea"V#T\4{8'==Cl#/=bY;\|csbBsl?~Ej]+Ow-Rf`99H0J^XQVm//xd'7srCpd)
Nov 26, 2024 08:20:02.221306086 CET	1236	IN	Data Raw: e6 c7 ed df de 71 96 a6 7b 82 92 85 97 9e 59 1d 3d 97 bd 4b 6f fb 24 e9 d1 8f fb 4e 82 d6 19 4f 31 f1 57 8f e6 7e fc 93 5c bc 35 59 db 17 d5 8e 62 8e a7 b7 78 e1 74 d6 aa 29 4e 95 e9 cf c8 a9 57 87 b0 92 64 73 61 b6 35 b6 6c b9 44 ee 0b 5f e2 17 Data Ascii: q{Y=Ko$NO1W~\5Ybxt)NWdsa5lD_F-2:5aDe[?8@@=WQAZoi_9gsj-z@>hi/?lHFz\S@?b5qln1my9>gC@\|ph
Nov 26, 2024 08:20:02.221312046 CET	1236	IN	Data Raw: c4 47 e7 b9 84 93 f0 3d 62 38 f1 30 12 6a 70 7e cc 8f db a4 a3 09 1f 15 0b f9 3d 7c da fe c9 6f 0a 4b e5 24 96 aa 97 8b f9 9f 2f ad 03 fd 6d 6a 77 45 71 43 28 bf 43 d5 53 06 64 65 ec 11 fb 52 cc f8 9e f6 0f 4e b0 9e 16 da 1f 49 b8 92 14 00 fe a6 Data Ascii: G=b80jp~=\|oK$/mjwEqC(CSdeRNI\|gf6tj\|Qrw,AMjJ.X^)p5rxMye`wZy^n^=t!.~^WHd<V$04mJ/(fZ
Nov 26, 2024 08:20:02.221323013 CET	1236	IN	Data Raw: 69 69 92 9c be fa 29 0c be 7e 4d d2 4d 92 92 03 eb 27 39 8c 83 d4 68 8c c8 41 93 f0 a3 30 d5 4d 31 e8 72 58 96 54 eb 3b f7 ae d7 3a 0e 2c fc e1 bc 1b 84 c7 1b 0e f9 ec bf fc 56 c8 fe a9 cd 1b 1f fa b3 9e e0 e2 9d dc 58 1b 33 0b 6a 2c 83 76 9b c1 Data Ascii: ii)~MM'9hA0M1rXT;:,VX3j,vf`X?\@N?Nu%J^=M?DEnD~*jPv\|#V^]jtl&-(^.QG R82DhwE`L&
Nov 26, 2024 08:20:02.341530085 CET	1236	IN	Data Raw: 4c 97 ac 3a 6f a2 f3 76 31 e3 3c cd 34 7d ff bd 41 25 ea 90 2f 57 33 8c 4f f7 e0 37 e7 7b d4 45 ef 9c f6 b1 9c 65 96 dd 16 56 23 16 73 17 09 48 d8 d1 5a 6b 4c 3d 7b 83 72 a4 1c 7f 2e 91 f7 70 3f 8c 02 93 ba eb df df 9d 8c 68 f0 d1 ff 58 d0 2e 57 Data Ascii: L:ov1<4}A%/W3O7{EeV#sHZkL={r.p?hX.W<U/IG5lpXgXeN_DmpfTtgdzfE7+RPj*G3(mR,',&PM~V:75NR\|ykXQ5tz"4}>~
Nov 26, 2024 08:20:02.810717106 CET	421	OUT	GET /2/ABUIABACGAAglYiFjAYo6LX7oAIwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.230088949 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: image/jpeg Content-Length: 130434 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAglYiFjAYo6LX7oAIwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i32019_c12732, i2103119_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 52 49 46 46 7a fd 01 00 57 45 42 50 56 50 38 20 6e fd 01 00 50 e9 07 9d 01 2a 8a 07 58 02 3e 6d 32 94 47 a4 22 a6 bb 27 54 fa fb 60 0d 89 4d ce 61 f6 0f 46 3f d0 3c 83 b7 ff f5 79 97 ff f9 e9 fa be ff e9 f1 00 e7 71 d1 ef e2 bc f9 7c 9e e7 fe c5 37 6f 39 60 e3 6f 16 db 72 c9 e7 b6 da 9f c9 bf e7 f2 d9 e4 7d cf ff 0b dd 67 d4 13 cf 7b 21 af f2 f5 04 ff c3 e8 e5 99 c5 0c 3c de bf 4d e9 5f e3 43 fb 3c 14 2e 1b f3 ff e0 ec e9 92 fe 5b fd 7f f4 1e 90 3c 9f df 2f d5 ff 09 fe 7b db 53 f8 9f b6 ff fa 7c 5e f4 3f f7 9f b8 5e a7 5e 7b fc d7 a1 bf fb 1e b3 7f b8 ff b4 f6 13 fe db f9 49 fe 8b e3 57 fe 4f de 1f 76 7f f1 ff ef fa 9a fd db fd ec f7 63 ff bf fb a9 ff 2f e1 ff f6 af f9 5f bb 7f f6 7e 41 ff bf 7f a6 ff e5 ed 87 ff b3 ff ff fe 1f 87 8f f1 1f fa bf fe ff e6 f8 2c fd d1 ff ff ff 3b de 6f ff 9f b3 57 f7 4f fb 3f bd 5f fc 7e 1c bf d1 7f ff ff 97 ff ff e0 03 ff f7 b6 4f f0 0f ff 7d 3f fe 49 ff 9b bd bf dd 2f cc ef 46 ff 34 fb c7 f8 7f 9c 1f e4 7e 4d ff 96 ff ab cb d7 ad ff a7 ff b7 d1 2f e7 5f 96 ff 99 fe [TRUNCATED] Data Ascii: RIFFzWEBPVP8 nP*X>m2G"'T`MaF?<yq\|7o9`or}g{!<M_C<.[</{S\|^?^^{IWOvc/_~A,;oWO?_~O}?I/F4~M/_C'G?~KU@G+O//~]}S?o/OC~K[ek}WfbIvVQ1o$=k/L<Ap,;4_y&jkj'{Fh;lBI%f-2e6.[;"NQ\|1giB#2Yonn;vV\|\|)fue~_$psN!}57v__]AlMWms3:}c[3g53#]K+3m&MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49777	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:00.879637957 CET	416	OUT	GET /4/ABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:02.176506042 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: image/png Content-Length: 29451 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:56 GMT Server: F-WEB Content-Disposition: filename=ABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i63250_c21843, i2103125_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 24 00 00 00 97 08 06 00 00 00 bc d0 26 83 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 72 a0 49 44 41 54 78 5e ed 7d 05 40 55 4b 17 ee 7b ef af 5b 5e 1b 45 45 14 05 bb 45 51 50 42 44 c1 6e 25 04 14 bb 3b b0 5b af dd dd dd dd dd 5d 28 8d 74 77 97 fa bd b5 66 9f 03 87 14 14 ef ef bd ff fe 74 71 76 cc 9e 3d 7b f6 cc b7 d7 9a 58 f3 7f 20 43 86 0c 19 3f 08 64 42 92 21 43 c6 0f 03 99 90 64 c8 90 f1 c3 40 26 24 19 32 64 fc 30 90 09 49 86 0c 19 3f 0c 64 42 92 21 43 c6 0f 03 99 90 64 c8 90 f1 c3 40 26 24 19 32 64 fc 30 90 09 49 86 0c 19 3f 0c 64 42 92 f1 3f 87 cf 2a 22 e3 c7 82 4c 48 32 fe a7 a0 4a 46 32 29 fd 78 90 09 49 c6 9f 00 ae f6 9f 14 f2 df a3 00 65 2a 3e aa c8 7f 37 45 32 b2 43 26 24 19 7f 02 8a 9e 90 38 96 2f 89 20 9f cf 9f 11 13 97 04 1f bf 10 bc 78 e5 82 4b 57 ef e2 f8 e9 4b 38 76 ea 22 ae dd 7a 80 37 ef 5c 11 1a 16 89 d4 d4 34 0a [TRUNCATED] Data Ascii: PNGIHDR$&sRGBgAMAapHYs%%IR$rIDATx^}@UK{[^EEEQPBDn%;[](twftqv={X C?dB!Cd@&$2d0I?dB!Cd@&$2d0I?dB?"LH2JF2)xIe>7E2C&$8/ xKWK8v"z7\4-dPg"?!>!QERr?}S(\|'p_@tnaa^<y11q2Ed0Pj6yCZGDG'W8yg )yTxDM]ncnz(Sj4Do0<`~$)%%Qn`w"n{Wbp;4QI5LPtG_=ao{_ &V&2!aPPBZzwBz&rY`j\=+>j6FaU$.^OYx KO&2!3F lummPY+4z(WYQ4zQF*hT
Nov 26, 2024 08:20:02.176512003 CET	1236	IN	Data Raw: ce ee 7e 44 42 d1 88 89 4d 44 62 52 2a d2 d2 3f e1 33 93 91 4c 48 3f 04 64 42 92 f1 03 83 59 e2 13 09 a9 30 2c 9f d2 68 37 0d c9 c9 69 78 fa fc 3d e6 2e dc 88 96 46 bd 50 a3 5e 5b 34 6f dd 1b 1d 7b 0c c7 e0 51 f3 31 6b d1 36 d8 0d 9d 8d 66 ad fb Data Ascii: ~DBMDbR*?3LH?dBY0,h7ix=.FP^[4o{Q1k6fwhsoF`hhfQ2!q!((sR!?7o=)0h_\pua%{8tb>>J@&$_]}LB)i/Qn#RryW#<2)
Nov 26, 2024 08:20:02.176525116 CET	1236	IN	Data Raw: eb d2 3f 69 bf f0 50 3c 9b 32 46 65 44 5f 17 99 8c 7c 20 13 92 12 5c ce a8 bc bd a5 c2 7d f0 f0 59 2c 5b b9 1d 4b 56 ee c0 b2 d5 7b f0 07 c9 72 c5 ef b2 35 7b b0 64 c5 76 ac 5c b7 1b fb 0f 9f 83 0b 91 d7 47 fa 8a 67 29 9b 99 35 e1 9b 11 18 14 86 Data Ascii: ?iP<2FeD_\| \}Y,[KV{r5{dv\Gg)5[wU;t.NHN:F8#P0)e'B2}-I3MWqh&6I#j==q3f0{&YYpY7%{Zy#
Nov 26, 2024 08:20:02.176558018 CET	1236	IN	Data Raw: b1 30 73 2d ba 0f c3 a4 19 ab 70 e6 d2 43 7c f0 0b 2b 90 29 27 e3 cf 81 4c 48 0c 95 92 98 4c b5 f9 e9 2b 37 f4 1b 30 95 b4 a4 2e 64 9e b5 ce 41 48 fc 5b 96 88 aa b8 ba 1e da 74 1c 84 95 eb f7 8b 65 77 58 f7 11 50 96 ee ec 52 40 70 d0 b8 c4 54 b8 Data Ascii: 0s-pC\|+)'LHL+70.dAH[tewXPR@pTxbLCLW5FY-cR6HLKB4c;h4Do,[c'o?e`vfIgjQhP'kuU_X;Lqc#)
Nov 26, 2024 08:20:02.176589012 CET	896	IN	Data Raw: 1f bd 2a 50 f5 ce 0f 7c 6d 62 f2 47 5c bf fb 12 a6 9d 07 93 49 d8 81 2a 0b 55 3c 22 a2 72 5c 79 b2 a7 41 51 a9 b8 bb bb 54 25 43 34 d4 eb 85 c9 33 56 23 3c 2a 09 a9 bc e6 98 14 ed 37 42 e4 0a fd 70 23 36 69 81 7e 4f f0 e9 f2 4a f8 cc b3 c0 7b 87 Data Ascii: P\|mbG\IU<"r\yAQT%C43V#<7Bp#6i~OJ{ViB?I3%NklvohkrlDs=3g-tJqm:VN[hEK6TJ1Ky#mE)Eq#Gf-St1+W0(e\|2!e<&4s%rDHe)
Nov 26, 2024 08:20:02.176603079 CET	1236	IN	Data Raw: c3 a3 e1 ed 1f 8c 07 4f de 61 e7 be 73 18 3d 69 89 20 95 2a 64 86 15 57 6f 21 34 dd 5c df 63 16 21 82 67 f2 62 33 bd 6a 6b 18 9a f5 c7 ec f9 1b e0 e4 ec 87 24 d2 94 0a 92 9f 72 4f dc d7 41 26 a4 7c 10 1c 1a 83 13 67 6e a3 85 51 3f 68 e8 b0 f6 61 Data Ascii: Oas=i dWo!4\c!gb3jk$rOA&\|gnQ?haJ__XuRJz<z>\|F6$NkiD.-JKv^RJtnn}_EHX#EQj(>Eagd[F:! ]x5!\|D1qI=P<[
Nov 26, 2024 08:20:02.176615000 CET	1236	IN	Data Raw: 85 63 df 91 6b 68 d7 75 28 4a 09 57 1c 92 2f 26 d5 fb 14 44 58 63 2b c9 1a 5b 93 2e 18 31 61 09 7c 03 a3 91 a8 98 c9 9e 3f 38 04 91 11 9b 6b 29 21 48 7e 7f 01 c1 eb ed e0 31 a6 1e 3c ac 4a 20 c8 ea 17 84 92 79 c6 84 c4 12 64 f5 1f 78 59 17 c3 1b Data Ascii: ckhu(JW/&DXc+[.1a\|?8k)!H~1<J ydxY+5-B![4SgVO$Te4Z',q(Cd_4`;E 2!x4Nc'[t].9or$vy}l5&,m*Q
Nov 26, 2024 08:20:02.176629066 CET	1236	IN	Data Raw: 05 01 95 a5 f8 f8 74 dc ba fb 16 ed 3a 0f 81 56 5d 2a ac a4 d2 ab 76 c9 4b 6d 4a 52 97 fb ef ea cd d1 cf 7e 1a 8e 9e ba 85 84 e4 d4 2f 56 4f 2e ab 0f 1e bf c1 b4 39 6b a0 ae dd 9a 08 c6 08 6a 19 1e 2a 33 e3 67 9f d0 f5 9a f7 c2 84 19 eb 31 69 d6 Data Ascii: t:V]vKmJR~/VO.9kj3g1iF.r63AIa7m;L4g/$<&to_l 'x+oG:iSHVvs\xbdb<nb!ogkfkE}ce\|dB H.={9cm
Nov 26, 2024 08:20:02.176744938 CET	1236	IN	Data Raw: fc 6c 7e 21 02 fa 37 22 2c 59 33 e2 39 6b ec 27 fb 3f f8 d0 f7 17 7c 18 5d 1f a1 bb c7 03 11 ef 49 b3 52 b6 1d fd b8 5d fd 85 ed dd e2 d0 4c 26 71 89 69 78 e7 12 88 fe 0e 53 85 7f 29 d1 e3 96 ed e3 23 e5 6b 3b a1 3d f1 ea c1 bc be dc d8 29 2b c4 Data Ascii: l~!7",Y39k'?\|]IR]L&qixS)#k;=)+7&5C&WOmEL*l^Y RZp?t,!8\|6:2Yx).z31hrHJMC:E'UbZdX$.!xE_xB;R7
Nov 26, 2024 08:20:02.176754951 CET	1236	IN	Data Raw: 94 d6 0d cb a9 dd 28 5d 9a 74 eb 3b 12 57 6e 3e ce 58 45 84 85 dd a2 24 91 d5 b4 7c cd 6e e8 9b 58 89 76 24 ae 14 d9 e3 c8 14 73 22 24 0b 68 56 d5 47 23 cd 5a e8 a8 59 1a 2b db 56 c7 2d 6b 1d f8 d8 97 43 88 cd cf c2 13 a4 64 aa fd 43 34 6c b3 87 Data Ascii: (]t;Wn>XE$\|nXv$s"$hVG#ZY+V-kCdC4lH2k{)$)!%$B6\)IaL~H@a!W57/8VIfABWhVdmGz.O^,x[uk7Q+nwkYx3B
Nov 26, 2024 08:20:02.296998978 CET	1236	IN	Data Raw: de 70 95 24 a4 14 06 f7 fa dd 7d e4 84 2e bd c7 a0 7a 83 8e 74 3f 43 8a 27 2b 21 55 22 ed 4d b3 6a 6b 68 69 34 85 79 9d 7a 98 6f 52 0b 6f 1d 74 e0 df bf b8 20 21 55 61 42 f2 b5 fc 19 2e 03 35 f0 66 b2 21 a2 ef 6c 26 fb c5 89 58 38 86 6e ca 13 69 Data Ascii: p$}.zt?C'+!U"Mjkhi4yzoRot !UaB.5f!l&X8ni\|"shej#Lai\:m0vJR&LHFfQ==hB?X]G2XLuB-i9n(1W^9y`;rZz^VMacpT
Nov 26, 2024 08:20:02.811089993 CET	421	OUT	GET /2/ABUIABACGAAgl4iFjAYoubm42Qcwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.218580961 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: image/jpeg Content-Length: 97494 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAgl4iFjAYoubm42Qcwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i31795_c17589, i2103119_c25795, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 52 49 46 46 ce 7c 01 00 57 45 42 50 56 50 38 20 c2 7c 01 00 b0 fe 04 9d 01 2a 8a 07 58 02 3e 6d 36 96 48 a4 22 a2 a8 24 18 d9 11 00 0d 89 67 6e 73 ef 59 ef ed c3 1f ff ba d0 fe 58 ac 1f e7 fd d3 f1 07 cf 3f ee fa 1a ff ae f5 d6 cf e2 ed bf f2 f4 eb ff 67 a2 6f fe 58 2c 5f b6 8a 17 91 c3 fa ed 31 9a e9 6f 78 0f fd ff 8a 47 9b 7f a5 e8 c8 ff 23 b2 c7 fc 1f 61 4f ec 1f e9 3d 73 33 a4 ff 7f 6d 7e 7c 1f b8 3e 39 78 a8 a1 d3 b1 30 e9 93 1e 83 f5 0e 4c 1f e7 f0 d3 ed ff f2 f9 98 7c 27 f5 9e 7b ff f4 7a c7 ff 19 ea 2d fd df d1 6f ff 5f dd 6f 80 bf e2 bf f6 7a a0 fd c1 f5 9f ff c5 fb cb ef 4b fc 7f a8 47 f3 ff ef 7f fb 7d af ff 7f ff ff fc 35 7f 81 ff db ff ff dc cb f6 a3 ff 77 b5 77 ff 5f dd 4f fe 7f 32 7f e9 bf f4 fe e7 fb cf ff ce f5 00 ff ff ed ad fc 03 ff ff 58 3f 94 7f ec ff 13 f8 d9 e6 ef ed 6f e5 8f 9d fe 44 fd a1 fb f7 fa 6f fa 7f e1 7e 79 7f 36 fa ab cf af c6 7f 71 fb 4f ea 67 f3 cf c0 ff c1 ff 05 fe 83 f6 6f e6 8f f7 1f f2 ff d2 78 df f1 87 fc ff f1 de c0 bf 99 7f 44 ff 6f fd d3 f7 a7 fc d7 c4 4f [TRUNCATED] Data Ascii: RIFF\|WEBPVP8 \|X>m6H"$gnsYX?goX,_1oxG#aO=s3m~\|>9x0L\|'{z-o_ozKG}5ww_O2X?oDo~y6qOgoxDoO]+W\YOope~3#'?o??u_gog_%"EOj=d#6jLZK5EOiZ:K^O3yWZ;D?_f\|6m:J1r2=xY\!\j>s+eI.wP~Za]^}v/JCz)ak]}R~{?1kV]t{+'*ZNp3,8#]\|NuO/sR4{xI).xNK{WU_2D
Nov 26, 2024 08:20:03.520967960 CET	421	OUT	GET /2/ABUIABACGAAguoiFjAYohvfQqQUwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.945857048 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: image/jpeg Content-Length: 70244 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAguoiFjAYohvfQqQUwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i64624_c24843, i2103125_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 52 49 46 46 5c 12 01 00 57 45 42 50 56 50 38 20 50 12 01 00 90 9e 03 9d 01 2a 8a 07 58 02 3e 6d 36 97 49 24 22 a2 a2 22 76 29 28 80 0d 89 67 6e dc c3 b9 76 6d 36 af e0 bc 52 1b bc bc 33 a1 ff ff a7 fc 7f bf 7f 6f 6d 72 b9 3c 1c b3 4c fa 30 7b 47 8f 2f 4e ac c0 79 5f aa 76 af d8 cf 9c d2 ab cb b8 ee 3f cf e2 47 c5 ff de f3 b7 ea 2f 3e be 91 3f bf 7a 88 ff 98 f4 9b e9 2b cc af 9c ff fe 7f dd 8f 7a 7f e3 bd 40 3f b5 75 30 fe ef fb 09 fe e5 fa d3 ff f6 f6 72 ff 29 ff ab a8 03 ff ff b6 bf f0 0f ff fd 60 fe 7f fe 4b fb d7 e4 4f f6 6f 45 df b2 7f 69 fe e7 fe 53 fd 5f f5 df 57 ff 18 f9 cf ec 9f dd ff c5 ff 9e fe d7 fb 5d f8 37 f9 3f f8 fe 36 be 3b fa 8f fa 9f eb 3d 50 fe 43 f6 9f f1 5f da ff c8 7f d3 ff 0f f3 9b fa af f3 9f e5 bf 77 3f c3 7a 13 f8 f7 ee 9f e8 3f cc 7f 86 ff ab fe 57 e4 0b f1 5f e4 3f df 7f b3 7e e3 ff 7a f8 ed fb df fb bd be 3b f7 fa ff f4 5f eb bd 81 7d 7a f9 ef f9 4f ef 9f e8 7f ee 7f 8d f9 42 f7 5f f6 ff e2 3d 56 fe 47 fb cf fb 0f f0 9f e6 ff 67 fe c0 7f 99 7f 59 ff 69 fe 1f f2 4f e9 6f [TRUNCATED] Data Ascii: RIFF\WEBPVP8 PX>m6I$""v)(gnvm6R3omr<L0{G/Ny_v?G/>?z+z@?u0r)`KOoEiS_W]7?6;=PC_w?z?W_?~z;_}zOB_=VGgYiOo>CqgrODSoAQ{}-o7g1eqEUms[/;a9!.v;GgrB\T/KkExyoTaKU_\k\e~mCJX^wiT[/;-ZU6'UZU^w'5(K<#4#I/k,w;`ce.,-M?+U1eqEJ/;xJyvv{?!eY(UCi-UAT.t\|#,Qmc<&t('zEJyuQl:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49783	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.176991940 CET	314	OUT	GET /image/locater/national_text.png?v=202410141113 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:02.478455067 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: image/png Content-Length: 15879 Connection: keep-alive Expires: Sat, 14 Oct 2034 07:11:32 GMT Server: F-WEB Last-Modified: Mon, 14 Oct 2024 03:13:25 GMT ETag: "670c8c55-3e07" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC142_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC227_dx-obgp-guangdong-dongguan-22-cache-1, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f1 00 00 01 5c 08 06 00 00 00 19 3e 58 8d 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 81 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 [TRUNCATED] Data Ascii: PNGIHDR\>XtEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C22A46CA440A11EFB9D3B9225EEAF4C1" xmpMM:DocumentID="xmp.did:5997F33E852111EFB840B
Nov 26, 2024 08:20:02.478559971 CET	1236	IN	Data Raw: 35 31 37 32 41 37 30 35 30 42 45 22 20 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 35 39 39 37 46 33 33 44 38 35 32 31 31 31 45 46 42 38 34 30 42 35 31 37 32 41 37 30 35 30 42 45 22 20 78 6d 70 3a 43 72 65 61 74 Data Ascii: 5172A7050BE" xmpMM:InstanceID="xmp.iid:5997F33D852111EFB840B5172A7050BE" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2b340e22-2aed-a941-8f0a-692beb4e46ae" stRef:documentID="adobe:docid:phot
Nov 26, 2024 08:20:02.478570938 CET	1236	IN	Data Raw: 34 54 ef c0 96 a1 58 73 5c fb bb 71 60 ab 95 77 cf 46 75 11 ef ac df c6 8b 99 b3 be 7f 7d b7 5b 18 08 2b fa 69 af e4 22 d6 17 13 97 55 aa 58 0c 8c 65 6d 3c 9f 11 f2 51 cc 98 5f 50 b2 90 a6 9b cc 45 c4 38 45 c4 44 7c e6 4c a3 69 20 76 cc f1 5d 37 Data Ascii: 4TXs\q`wFu}[+i"UXem<Q_PE8ED\|Li v]7Ih5s1FZ:1rlL7;h0Vz9v]&,b1.M39V0_,01h3~g2Bgy(hNDx2Q}A&gq
Nov 26, 2024 08:20:02.478693962 CET	1236	IN	Data Raw: dd 59 42 ab 9d 90 54 04 cb 37 67 c1 a4 95 57 e0 ec ba 4e 0d f2 a5 b6 0a f3 a2 9e 4d 96 18 a0 6d b8 63 bd 6f c4 98 f9 eb a8 1c 58 19 97 2d 08 df 18 2e 75 81 3a cf f9 c9 41 46 b9 40 81 6a 77 39 39 f3 fe 83 55 6d 82 1d 58 ba 78 55 05 3f 9d 2a 64 a2 Data Ascii: YBT7gWNMmcoX-.u:AF@jw99UmXxU?*dscs2eLD\|!PVz".S0!=',x\UliO71&>RA2h.c=+]mwnn"LC?.0K#W)l\1{`
Nov 26, 2024 08:20:02.478708982 CET	896	IN	Data Raw: 5f 60 62 46 6b 8d 03 5c 52 83 96 76 46 a4 52 70 a3 6b 4e 2b d5 06 cb 26 3e 11 2a d4 d7 8c 5e 4b cd bb af f5 ae b7 1c e7 94 35 a9 f6 dc f2 c3 80 d3 44 18 e7 1e 4d 2c 65 f3 c2 38 78 75 f8 1c bf 3f 54 80 b7 38 ee c5 81 ac b9 cf 3a b1 d7 38 c0 75 eb Data Ascii: _`bFk\RvFRpkN+&>^K5DM,e8xu?T8:8uNt~p +(~{\7eviZ=vq~xlZ#6!h[O!} WnyctuxQw[x 0=za73kO llI5\|L6TX92P
Nov 26, 2024 08:20:02.478719950 CET	1236	IN	Data Raw: f5 74 12 b1 18 eb d0 50 c1 bd b6 76 74 64 d6 fa ce a5 4b 06 13 b1 55 a8 37 b8 c6 0c e7 83 78 47 07 b8 39 6a 0e 94 5f 4a 31 9a 88 c3 ec e5 f0 74 07 fe b3 0a cb 4a e1 c0 e1 5f 21 f3 4e 01 13 31 0a 1a f9 26 66 9c c8 7d 8e 6e 13 de 60 5f ea 67 b3 56 Data Ascii: tPvtdKU7xG9j_J1tJ_!N1&f}n`_gVBaq\|sX=tz;\|AwHBl!J/8qh_#>W(M_"XG@IFZZ6X#1&.:r3`m^[^F-]5q,z;?F6Z;I
Nov 26, 2024 08:20:02.478732109 CET	1236	IN	Data Raw: c3 ca e2 e2 e2 58 5d 29 d9 79 71 3f 3b 8e 68 d1 8f 1d 7f ba b8 57 a7 4e 73 7b 37 78 22 3c 1a 9e eb 3a 12 5e e9 3a 9e e5 65 15 e5 4a 7b 95 ac 38 cb e6 c2 09 d4 6d 24 77 e4 3f 03 2a 73 79 2b 5c a2 de 8d d1 fb 15 5e d4 98 50 b8 f8 1e 2c ab 96 76 f9 Data Ascii: X])yq?;hWNs{7x"<:^:eJ{8m$w?*sy+\^P,vZaaBol5{g.vRM'7&&&No6tI7%fg1~qi;T-;p\2G-lgk]gK{q=[yy}RhS':f"bt'M's_l=
Nov 26, 2024 08:20:02.478796959 CET	1236	IN	Data Raw: da b7 f2 92 b4 61 1e f1 0b a0 aa b0 18 2a d3 33 a0 20 ee 43 90 cf 78 0a 64 7d 7b b0 32 bb e0 16 da 7a 9b 56 40 75 61 11 14 ac 58 c3 ea c9 ba 77 02 87 9e 5d 25 6b c7 d8 78 fe a6 70 e4 df da c5 d8 8f 5d 3c 05 31 9f 4c 85 65 c3 5f 85 71 03 47 43 ef Data Ascii: a3 Cxd}{2zV@uaXw]%kxp]<1Le_qGCe#A)~qPGJ-:Ik{/@4Q>d#Iq$_%St;9(5fUg7Gltx$Y3+%{\f`Zl&lGY
Nov 26, 2024 08:20:02.478806973 CET	1236	IN	Data Raw: 06 80 ef b6 89 f3 86 0c e0 be 34 f5 35 7a e3 2d ee ba 14 88 cb 9f 79 0a e0 f9 31 d4 d3 cd 49 c4 bd fa 79 0a d6 75 03 64 42 68 1b 07 88 1e e6 63 dc 56 55 de 54 5b 9a ee 00 0a 3d 4b e0 2a ba 72 9d 75 15 40 f1 6f 00 2e 8f f3 79 c5 a7 d5 65 83 8c d7 Data Ascii: 45z-y1IyudBhcVUT[=K*ru@o.yeNxNwNQggp~ZYp[_wl}G"tn.\|HV]r;-k/3Z_eEExWOKpcSK01W-v\|E\|Z
Nov 26, 2024 08:20:02.478816986 CET	1236	IN	Data Raw: c0 b6 a1 be d2 0a 38 ef 03 5e c0 9c 38 2d 1d 27 73 df 5c 73 ce ea 66 f2 47 4d 10 5d 7e 95 17 30 52 f9 3b dc 2b 3d 07 16 f6 ed a9 97 9b 38 75 cf 13 a3 3b 8d a2 d5 24 8c 83 fd 5b f2 65 68 8d d1 ad 3e 7b c4 60 0d f3 72 b6 81 b9 e3 42 99 5b fd c3 2f Data Ascii: 8^8-'s\sfGM]~0R;+=8u;$[eh>{`rB[/:i]B_uf~A/_>\|['I)c%{VpQS#o'P7k#"y+Ba,>u62h}:JeOQYT&Noz
Nov 26, 2024 08:20:02.598519087 CET	1236	IN	Data Raw: 82 9e c1 56 46 6d dc ac e3 fc 72 b4 5b 07 b8 eb 2d cb ab 10 df 6c c6 07 da c3 8b 6d 15 06 69 cb dc b9 6f 41 7e be 78 79 dc 8e 1d db 71 31 e6 0d 9d 7c 0d f1 f1 cb 24 13 b2 86 23 27 d3 99 80 43 bd 6c e1 db f8 01 20 97 d9 08 65 07 2e 14 32 ab 8c 16 Data Ascii: VFmr[-lmioA~xyq1\|$#'Cl e.2F-mL:F[5?`^}zL+\nfEg"V*A; r);;>7pnu;>(r5ox^+ndoanc[8:9rKFnn?L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49782	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.177057028 CET	315	OUT	GET /image/locater/locater_Arrow3.png?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:02.525729895 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: image/png Content-Length: 964 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:05 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:44 GMT ETag: "6084db98-3c4" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC149_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC203_lt-obgp-fujian-xiamen-33-cache-2, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 08 00 00 00 04 08 03 00 00 00 84 13 8e c2 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 21 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRtEXtSoftwareAdobe ImageReadyqe<!iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:4A40B5008FD411E4A4309E08706D44C8" xmpMM:DocumentID=
Nov 26, 2024 08:20:02.525790930 CET	332	IN	Data Raw: 22 78 6d 70 2e 64 69 64 3a 34 41 34 30 42 35 30 31 38 46 44 34 31 31 45 34 41 34 33 30 39 45 30 38 37 30 36 44 34 34 43 38 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 Data Ascii: "xmp.did:4A40B5018FD411E4A4309E08706D44C8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A40B4FE8FD411E4A4309E08706D44C8" stRef:documentID="xmp.did:4A40B4FF8FD411E4A4309E08706D44C8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
Nov 26, 2024 08:20:47.535161972 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49781	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.177102089 CET	302	OUT	GET /image/site/left.png?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:02.478828907 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: image/png Content-Length: 1613 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:13:49 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:47 GMT ETag: "6084db9b-64d" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC174_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC202_lt-obgp-fujian-xiamen-33-cache-2, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 47 00 00 00 47 08 06 00 00 00 55 b0 5a 1f 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 21 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRGGUZtEXtSoftwareAdobe ImageReadyqe<!iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:C05A2478C5F011E390AA8612195784C7" xmpMM:DocumentID="
Nov 26, 2024 08:20:02.478840113 CET	980	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 43 30 35 41 32 34 37 39 43 35 46 30 31 31 45 33 39 30 41 41 38 36 31 32 31 39 35 37 38 34 43 37 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d Data Ascii: xmp.did:C05A2479C5F011E390AA8612195784C7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C05A2476C5F011E390AA8612195784C7" stRef:documentID="xmp.did:C05A2477C5F011E390AA8612195784C7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
Nov 26, 2024 08:20:47.483062029 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49780	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.177155972 CET	303	OUT	GET /image/site/right.png?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:02.485567093 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: image/png Content-Length: 1633 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:13:49 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:47 GMT ETag: "6084db9b-661" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC143_dx-lt-yd-jiangsu-yancheng-8-cache-16, BC203_lt-obgp-fujian-xiamen-33-cache-2, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 47 00 00 00 47 08 06 00 00 00 55 b0 5a 1f 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 21 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRGGUZtEXtSoftwareAdobe ImageReadyqe<!iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:41DEBE66001A11E494DCE9E6A4A189DB" xmpMM:InstanceID="xmp.iid:41DEBE65001A11E494DCE9E6A4A189DB" xmp
Nov 26, 2024 08:20:02.485610008 CET	1002	IN	Data Raw: 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 28 57 69 6e 64 6f 77 73 29 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 Data Ascii: :CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:66397EC4FC3A11E39614E69FBAB86579" stRef:documentID="xmp.did:66397EC5FC3A11E39614E69FBAB86579"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=
Nov 26, 2024 08:20:47.499228001 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49786	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.308444977 CET	289	OUT	GET /image/loading/dot.gif HTTP/1.1 Host: 0.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:02.658838034 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: image/gif Content-Length: 807 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:06 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:44 GMT ETag: "6084db98-327" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC169_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC196_lt-obgp-fujian-xiamen-33-cache-1, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 47 49 46 38 39 61 01 00 01 00 f7 00 00 ff ff ff ff ff cc ff ff 99 ff ff 66 ff ff 33 ff ff 00 ff cc ff ff cc cc ff cc 99 ff cc 66 ff cc 33 ff cc 00 ff 99 ff ff 99 cc ff 99 99 ff 99 66 ff 99 33 ff 99 00 ff 66 ff ff 66 cc ff 66 99 ff 66 66 ff 66 33 ff 66 00 ff 33 ff ff 33 cc ff 33 99 ff 33 66 ff 33 33 ff 33 00 ff 00 ff ff 00 cc ff 00 99 ff 00 66 ff 00 33 ff 00 00 cc ff ff cc ff cc cc ff 99 cc ff 66 cc ff 33 cc ff 00 cc cc ff cc cc cc cc cc 99 cc cc 66 cc cc 33 cc cc 00 cc 99 ff cc 99 cc cc 99 99 cc 99 66 cc 99 33 cc 99 00 cc 66 ff cc 66 cc cc 66 99 cc 66 66 cc 66 33 cc 66 00 cc 33 ff cc 33 cc cc 33 99 cc 33 66 cc 33 33 cc 33 00 cc 00 ff cc 00 cc cc 00 99 cc 00 66 cc 00 33 cc 00 00 99 ff ff 99 ff cc 99 ff 99 99 ff 66 99 ff 33 99 ff 00 99 cc ff 99 cc cc 99 cc 99 99 cc 66 99 cc 33 99 cc 00 99 99 ff 99 99 cc 99 99 99 99 99 66 99 99 33 99 99 00 99 66 ff 99 66 cc 99 66 99 99 66 66 99 66 33 99 66 00 99 33 ff 99 33 cc 99 33 99 99 33 66 99 33 33 99 33 00 99 00 ff 99 00 cc 99 00 99 99 00 66 99 00 33 99 00 00 66 [TRUNCATED] Data Ascii: GIF89af3f3f3ffffff3f3333f333f3f3f3f3ffffff3f3333f333f3f3f3f3ffffff3f3333f333f3ffffff3fffffff3fffffff3ffffffffffff3fff3f3f3f3ff33f3ffffff3f3333f3333333f3333333f3333f3f3f3ff3f33f33333333f333333333f333f3f3f3ffffff3f333
Nov 26, 2024 08:20:02.658849001 CET	173	IN	Data Raw: 00 33 66 00 33 33 00 33 00 00 00 ff 00 00 cc 00 00 99 00 00 66 00 00 33 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 3f333f3!,;
Nov 26, 2024 08:20:12.271888018 CET	313	OUT	GET /image/onlineMap/multi_only.png?v=201809101152 HTTP/1.1 Host: 0.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.690905094 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:12 GMT Content-Type: image/png Content-Length: 1311 Connection: keep-alive Expires: Thu, 16 Nov 2034 08:00:52 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:46 GMT ETag: "6084db9a-51f" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i91530_c21603, i2103121_c25795, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 1d 08 06 00 00 00 b0 ba ac 4b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 21 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRKtEXtSoftwareAdobe ImageReadyqe<!iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:82161B336FA311E98835E35E3D1000FD" xmpMM:DocumentID="xmp.did:82161B346FA311E98835E35E3D1000FD"> <xmpMM:
Nov 26, 2024 08:20:12.690974951 CET	628	IN	Data Raw: 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 38 32 31 36 31 42 33 31 36 46 41 33 31 31 45 39 38 38 33 35 45 33 35 45 33 44 31 30 30 30 46 44 22 20 73 74 52 65 66 3a 64 6f 63 75 Data Ascii: DerivedFrom stRef:instanceID="xmp.iid:82161B316FA311E98835E35E3D1000FD" stRef:documentID="xmp.did:82161B326FA311E98835E35E3D1000FD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>IDATx1KA7K La" ZXPQ%
Nov 26, 2024 08:20:57.702639103 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49785	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.367867947 CET	311	OUT	GET /image/loading/loading_2b.gif?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:02.658560038 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: image/gif Content-Length: 15551 Connection: keep-alive Expires: Sat, 04 Nov 2034 04:18:47 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:44 GMT ETag: "6084db98-3cbf" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i12301_c17987, i2103125_c25795, i1872274_c17483 X-Cache: HIT from i1872274_c17483(cloudsvr) Data Raw: 47 49 46 38 39 61 20 00 20 00 e6 76 00 fe fe fe fd fd fd fc fc fc fb fb fb fa fa fa f9 f9 f9 f7 f7 f7 f5 f5 f5 f8 f8 f8 f2 f2 f2 f3 f3 f3 f6 f6 f6 f4 f4 f4 f0 f0 f0 ef ef ef f1 f1 f1 8b 8b 8b 8d 8d 8d ed ed ed 8c 8c 8c 8e 8e 8e e7 e7 e7 ee ee ee 90 90 90 ec ec ec ea ea ea e9 e9 e9 91 91 91 e1 e1 e1 eb eb eb 8f 8f 8f 95 95 95 92 92 92 d9 d9 d9 97 97 97 db db db e4 e4 e4 d8 d8 d8 e3 e3 e3 e8 e8 e8 de de de dc dc dc 93 93 93 e6 e6 e6 94 94 94 e0 e0 e0 c1 c1 c1 c4 c4 c4 96 96 96 da da da ce ce ce d5 d5 d5 df df df e2 e2 e2 e5 e5 e5 be be be a2 a2 a2 a0 a0 a0 b2 b2 b2 9b 9b 9b d7 d7 d7 99 99 99 d2 d2 d2 d0 d0 d0 dd dd dd 98 98 98 b4 b4 b4 d4 d4 d4 a5 a5 a5 9c 9c 9c 9a 9a 9a ba ba ba 9e 9e 9e b8 b8 b8 c9 c9 c9 bc bc bc ca ca ca a8 a8 a8 cb cb cb cd cd cd c7 c7 c7 d3 d3 d3 c8 c8 c8 c3 c3 c3 ae ae ae 9d 9d 9d 9f 9f 9f bb bb bb c2 c2 c2 aa aa aa ac ac ac d1 d1 d1 b9 b9 b9 a6 a6 a6 c6 c6 c6 cc cc cc a7 a7 a7 cf cf cf bf bf bf c0 c0 c0 af af af a4 a4 a4 ab ab ab a3 a3 a3 b6 b6 b6 b7 b7 b7 ad ad ad b1 b1 b1 bd [TRUNCATED] Data Ascii: GIF89a v!NETSCAPE2.0!XMP DataXMP<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:
Nov 26, 2024 08:20:02.658571005 CET	1236	IN	Data Raw: 61 62 6f 75 74 3d 22 22 20 78 6d 6c 6e 73 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 52 65 66 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 Data Ascii: about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:bb7d30ad-7ace-ef4d-b5e2-f3c10caebc0b" xmpMM:Document
Nov 26, 2024 08:20:02.658582926 CET	1236	IN	Data Raw: fb c0 00 2a bb b5 a8 a1 c2 e4 6d 85 14 40 50 08 6f 51 ed 8b 72 2a 64 dc ac 49 41 55 42 88 18 23 a0 a3 e8 20 48 01 19 ec da 75 b4 69 71 53 02 8f 12 df c3 03 39 2c 28 4a f6 35 3a 84 b4 49 f3 c3 25 25 04 1c 0c 31 c3 7b f1 61 40 88 00 37 e0 a7 1f 1a Data Ascii: m@PoQrdIAUB# HuiqS9,(J5:I%%1{a@7IqQH`@K0/@O8B\F^.LR0al18DE/$1b<$,hd4^@Whb?JaPA' _J)_QiBRC A9!v,
Nov 26, 2024 08:20:02.658593893 CET	1236	IN	Data Raw: 48 cc 50 c3 44 f7 ef 27 a4 0f 0a e0 c4 fc 94 38 50 a4 38 41 e1 80 b6 1d 02 0a 9c 80 02 0d 2d b4 f7 5e 07 92 2c e0 05 16 f7 79 21 85 12 4e 3c 11 c6 16 51 cc c0 43 08 23 00 81 42 0b 1c 18 18 d9 24 0a 48 81 5e 7e 4c 7c 21 c3 84 15 5e 18 43 0a 40 10 Data Ascii: HPD'8P8A-^,y!N<QC#B$H^~L\|!^C@b@BhZXB(LD(Q&,`AV ?1AYPCr!G4@H!v, vv)XjH"0;ol!XH=A",* ,GNVE;.:VUF0
Nov 26, 2024 08:20:02.658607960 CET	1236	IN	Data Raw: 82 88 0e 4a 40 d0 24 a4 fd 60 21 86 30 8e c0 21 0d 34 82 88 a3 05 85 79 b4 42 2c 14 2e 66 18 82 90 28 10 59 83 09 36 dc a8 80 59 36 f0 e0 24 94 34 78 48 65 3b 86 3d 70 02 07 28 00 41 43 0d 15 48 70 40 4d 93 04 02 00 21 f9 04 05 03 00 76 00 2c 00 Data Ascii: J@$`!0!4yB,.f(Y6Y6$4xHe;=p(ACHp@M!v, v4^B]VHgdX)R`89E;F="0F7?MDg8pA,0/\M`De=** ]vsYo`]p9H0 FBZfY,A7TjoM]].(#I"*8"p;3oj?"t
Nov 26, 2024 08:20:02.658620119 CET	1236	IN	Data Raw: 03 0c b4 47 4b 20 00 21 f9 04 05 03 00 76 00 2c 00 00 00 00 20 00 20 00 00 07 ff 80 76 82 83 84 76 26 32 37 6b 66 6f 54 49 52 34 03 85 92 93 0c 3f 73 64 6a 5a 59 6f 60 5d 65 67 38 65 71 0f 93 93 01 25 68 3a 6b 64 54 9a 9c 9e 67 70 39 56 39 4c a5 Data Ascii: GK !v, vv&27kfoTIR4?sdjZYo`]eg8eq%h:kdTgp9V9LqhBskn`De8pVHUETbIimB:jD;F8.G\IhmU==9JKWiBN54cp$7f'-A ^2fa+(nC`44I(J,T., D%N
Nov 26, 2024 08:20:02.658632040 CET	776	IN	Data Raw: 66 54 4c 0a 93 92 40 63 4b 57 5c 49 9a 9c 64 6a 5a 59 6f 4d 4d 61 a5 83 06 4f 63 37 6c 57 47 ac 9b 9d 6a 66 59 4d 60 5d 44 6d 09 b7 52 58 2e 62 37 4b bf ad 6e 54 c3 b3 c8 65 67 59 12 92 06 4e 2f 53 58 63 62 bd 98 6d 3a d5 b1 c6 44 da 38 70 4d 92 Data Ascii: fTL@cKW\IdjZYoMMaOc7lWGjfYM`]DmRX.b7KnTegYN/SXcbm:D8pM>P^77[+5^o]aB&HE~yGI&\|aD8&nE<'9(";v`.IN#FzT0a~-T$i AReS* Q "`Cp;_UJ
Nov 26, 2024 08:20:02.658643961 CET	1236	IN	Data Raw: 43 4c 2c 25 34 66 87 57 23 46 b0 b4 28 c1 a3 ac 9c 07 5b 07 a1 00 db a3 2d 99 14 21 ff e2 86 28 91 96 50 90 bb 77 73 a4 18 c1 97 6f 5d 41 01 44 08 16 dc 03 48 8a c3 40 80 fc b5 13 e0 c3 07 18 90 83 70 40 41 99 06 8d c5 76 58 68 66 f1 a1 ca 0a 1a Data Ascii: CL,%4fW#F([-!(Pwso]ADH@p@AvXhf-Bs87XC&,m76A.l"$l . NdXI_2h:`0RF=lp0($X =LH~<_0@!H4`0P
Nov 26, 2024 08:20:02.658655882 CET	1236	IN	Data Raw: bc f9 0c 86 0c a0 3b 74 10 3c 58 01 12 2b a8 ad 80 71 d0 01 83 6b 09 05 32 d3 a8 42 1b 09 92 39 0c 24 e8 b6 60 a1 d4 63 31 3b 8a 08 af f2 a2 00 6f 07 0e 1a 3c 10 38 b8 88 11 23 3b 82 03 b1 d3 20 b9 f2 04 06 06 1f 09 d2 a3 c7 73 2b 82 16 5c 4f a0 Data Ascii: ;t<X+qk2B9$`c1;o<8#; s+\O2`A/`i]>>\|>q PU,X@v \~%T u@0Ax "$ `!h T=.$(5^ b;".j8$@
Nov 26, 2024 08:20:02.658668041 CET	1236	IN	Data Raw: 1c ea fc 0e 4e 80 40 ea b2 63 70 9c 29 53 fc 8d a0 01 cc 07 0c 10 c0 f9 68 94 1c 70 70 48 2f 03 65 50 73 ed 02 02 04 a8 83 73 06 12 2b 56 c0 e3 20 02 4e 90 00 f4 ea 01 d4 71 63 74 d2 95 1d 45 54 f1 1e 78 4f 14 12 40 7a 01 e8 47 07 04 1e a0 11 03 Data Ascii: N@cp)ShppH/ePss+V NqctETxO@zG!)\aDF(kDRG~AP "v1I(!"h0Xa]`PJu,a5)R0I'4h(eY!J!FP`PY-!v, vv1<3<#&
Nov 26, 2024 08:20:02.778691053 CET	1236	IN	Data Raw: 89 03 1f 78 17 81 7f 17 6c 00 82 0a 1f c0 10 44 0f 3b 14 81 84 15 39 e0 a0 20 11 6a a4 37 89 08 13 7a e0 41 85 20 b0 90 e1 86 46 14 51 05 12 08 8a a8 85 47 38 50 68 a1 0a 2e 6a d8 83 11 3b cc 08 22 1c 73 0c e8 d1 14 1b b0 c8 63 28 86 22 fc d8 e1 Data Ascii: xlD;9 j7zA FQG8Ph.j;"sc("8dK\|pa"d9bv`@)x!v, vv'$-4-&v6$54()#!%!6'+$&<r3C')1%<>[!6@%rCQ>?a>4@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49789	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.387375116 CET	609	OUT	GET /ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:04.585025072 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1017151014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:04.585032940 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:04.585052013 CET	1236	IN	Data Raw: 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 66 61 69 6d 61 Data Ascii: p://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508mallsys
Nov 26, 2024 08:20:04.585203886 CET	1236	IN	Data Raw: 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 69 63 6f 63 2e 69 6e 20 2a 2e 69 63 6f 63 2e 69 6e 20 69 63 6f 63 2e 6d 65 Data Ascii: om .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info *.mallfkw.info mallfk
Nov 26, 2024 08:20:04.585210085 CET	597	IN	Data Raw: 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 Data Ascii: allfkw.cn *.mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenP3P: CP=CAO PSA OURSet-Cookie: _siteStatReVisit=reVisit
Nov 26, 2024 08:20:18.147634029 CET	743	OUT	GET /ajax/setCookie_h.jsp?cmd=setWafCk_setCheckSiteLvBrowser HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true
Nov 26, 2024 08:20:18.744777918 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 77 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1018192014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:18.745007992 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:18.745043039 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:18.745079041 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:18.745115042 CET	456	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenP3P: CP=CAO PSA OURVary: Accep
Nov 26, 2024 08:20:32.866566896 CET	966	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Nov 26, 2024 08:20:33.467675924 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019319014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:33.467880011 CET	224	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtim
Nov 26, 2024 08:20:33.470156908 CET	1236	IN	Data Raw: 67 2e 63 6f 6d 20 2a 2e 67 74 69 6d 67 2e 63 6f 6d 20 66 61 69 64 65 76 2e 63 63 20 2a 2e 66 61 69 64 65 76 2e 63 63 20 68 75 67 65 64 6f 6d 61 69 6e 73 2e 63 6f 6d 20 2a 2e 68 75 67 65 64 6f 6d 61 69 6e 73 2e 63 6f 6d 20 67 6f 6f 67 6c 65 74 61 Data Ascii: g.com .gtimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com
Nov 26, 2024 08:20:44.964123011 CET	1243	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Nov 26, 2024 08:20:45.559350967 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020292014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:45.695422888 CET	1259	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605642710 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Nov 26, 2024 08:20:46.295516014 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 59 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020355014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:46.595156908 CET	1263	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605644548 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:47.202485085 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020446014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:47.477415085 CET	1254	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605645446 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:48.405889034 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020544014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:49.619307995 CET	1212	OUT	GET /en/ajax/module_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:50.232933998 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020699014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:50.768346071 CET	1226	OUT	GET /en/ajax/log_h.jsp?_v=1732605648714 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:51.366403103 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020834014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:54.228403091 CET	940	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:54.825368881 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021149014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.068085909 CET	1210	OUT	GET /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605662728
Nov 26, 2024 08:21:03.669487000 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021962014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.823184967 CET	1249	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605662728
Nov 26, 2024 08:21:04.419764996 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022028014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:04.505254030 CET	1263	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605662748 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:05.384342909 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022097014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.699536085 CET	964	OUT	GET /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:12.310517073 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022777014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:12.700196028 CET	1259	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605670273 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605672209
Nov 26, 2024 08:21:13.297821045 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 59 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022862014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49790	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.387820005 CET	595	OUT	GET /ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:04.330660105 CET	1236	IN	HTTP/1.1 404 Not Found Server: F-WEB Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1017152014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.n Data Raw: Data Ascii:
Nov 26, 2024 08:20:04.330688953 CET	1236	IN	Data Raw: 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c Data Ascii: t jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.
Nov 26, 2024 08:20:04.330701113 CET	1236	IN	Data Raw: 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f Data Ascii: .cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508
Nov 26, 2024 08:20:04.330805063 CET	1236	IN	Data Raw: 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 69 63 6f 63 2e 69 6e 20 2a 2e 69 63 6f 63 2e 69 6e 20 Data Ascii: aisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info *.mallfkw.info
Nov 26, 2024 08:20:04.330816031 CET	195	IN	Data Raw: 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 Data Ascii: .info mallfkw.cn *.mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopen
Nov 26, 2024 08:20:32.870788097 CET	929	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Nov 26, 2024 08:20:33.453547955 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019320014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:33.453610897 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:33.453622103 CET	1236	IN	Data Raw: 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 66 61 69 6d 61 Data Ascii: p://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508mallsys
Nov 26, 2024 08:20:33.453722954 CET	1236	IN	Data Raw: 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 69 63 6f 63 2e 69 6e 20 2a 2e 69 63 6f 63 2e 69 6e 20 69 63 6f 63 2e 6d 65 Data Ascii: om .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info *.mallfkw.info mallfk
Nov 26, 2024 08:20:33.453735113 CET	188	IN	Data Raw: 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 Data Ascii: allfkw.cn *.mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopen
Nov 26, 2024 08:20:33.462109089 CET	972	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Nov 26, 2024 08:20:34.047434092 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019353014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:34.047589064 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:34.051006079 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:34.331160069 CET	986	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605632371 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Nov 26, 2024 08:20:34.923434973 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019407014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:38.235009909 CET	995	OUT	GET /en/ajax/module_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Nov 26, 2024 08:20:38.824707031 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019711014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:40.060599089 CET	946	OUT	GET /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:40.652954102 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019829014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:40.666881084 CET	946	OUT	GET /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:41.254111052 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019889014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.148789883 CET	940	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:44.741446972 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020232014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.959336042 CET	1237	OUT	GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Nov 26, 2024 08:20:45.824506998 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020309014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:54.363766909 CET	1243	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654008
Nov 26, 2024 08:20:55.232702971 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021186014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.060785055 CET	1243	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605662728
Nov 26, 2024 08:21:03.932868004 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021971014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.951086998 CET	1263	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605661099 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:04.829104900 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022063014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:21:04.854370117 CET	940	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:05.445758104 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022107014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.688637972 CET	940	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:12.301136971 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022776014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49792	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.522003889 CET	631	OUT	GET /ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605599598 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:03.067274094 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 59 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1017073014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:03.067306042 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:03.067327023 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:03.067431927 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:03.067441940 CET	236	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:03.268150091 CET	59	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 00 ab 56 2a 2e 4d 4e 4e 2d 2e 56 b2 4a 4b cc 29 4e d5 51 ca 2d 4e 57 b2 52 7a da df f4 6c ea 86 97 53 66 be 58 bf 5e a9 16 00 4e c8 01 77 26 00 00 00 Data Ascii: V*.MNN-.VJK)NQ-NWRzlSfX^Nw&
Nov 26, 2024 08:20:03.402627945 CET	582	OUT	GET /ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:03.995002031 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1017148014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:03.995048046 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:03.995059967 CET	1236	IN	Data Raw: 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 66 61 69 6d 61 Data Ascii: p://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508mallsys
Nov 26, 2024 08:20:03.995131969 CET	1236	IN	Data Raw: 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 69 63 6f 63 2e 69 6e 20 2a 2e 69 63 6f 63 2e 69 6e 20 69 63 6f 63 2e 6d 65 Data Ascii: om .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info *.mallfkw.info mallfk
Nov 26, 2024 08:20:04.003448963 CET	188	IN	Data Raw: 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 Data Ascii: allfkw.cn *.mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopen
Nov 26, 2024 08:20:04.005045891 CET	626	OUT	GET /ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605601025 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:04.598941088 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1017176014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:04.599056005 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:18.145317078 CET	702	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true
Nov 26, 2024 08:20:18.732351065 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1018191014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:32.866980076 CET	946	OUT	GET /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Nov 26, 2024 08:20:33.455204010 CET	1236	IN	HTTP/1.1 404 Not Found Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019317014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.n Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.965847969 CET	1249	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Nov 26, 2024 08:20:45.558151960 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020291014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:54.414741993 CET	1223	OUT	GET /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654008
Nov 26, 2024 08:20:55.005697012 CET	1236	IN	HTTP/1.1 404 Not Found Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021168014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.n Data Raw: Data Ascii:
Nov 26, 2024 08:20:55.148293018 CET	1249	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654008
Nov 26, 2024 08:20:56.024070024 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021290014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:00.408298016 CET	1236	OUT	GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897 Data Raw: Data Ascii:
Nov 26, 2024 08:21:00.999572039 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021701014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:02.985949039 CET	964	OUT	GET /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:03.580194950 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021954014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.903527975 CET	1237	OUT	GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605671593
Nov 26, 2024 08:21:12.493823051 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022797014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:12.699758053 CET	1263	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605669970 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605672209
Nov 26, 2024 08:21:13.581912041 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022880014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49793	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.630055904 CET	308	OUT	GET /jssdk_1_1/js/hawkEye.min.js?v=202403151700 HTTP/1.1 Host: fe.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:02.926757097 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Mon, 06 Nov 2034 03:20:06 GMT Server: F-WEB Last-Modified: Tue, 02 Jan 2024 03:45:24 GMT Vary: Accept-Encoding ETag: W/"659386d4-b64a" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Content-Encoding: gzip X-Ser: i33513_c25891, i2103121_c25795, i1872278_c17483 X-Cache: HIT from i1872278_c17483(cloudsvr) Data Raw: 38 66 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dd 7d 6b 8f e3 c8 76 d8 5f 51 d3 6b 0d b9 62 ab 1f bb b3 7b 57 1a 4e 5b 2d a9 a7 b5 ad d7 48 ea 9e 99 db ad 15 d8 12 d5 62 b7 44 6a 45 4a ea 87 64 24 0e 10 38 37 76 90 04 36 02 38 70 80 1b c0 b0 3f d9 09 12 27 0b c7 89 ff cc de bd 37 9f f2 17 72 4e 3d c8 22 45 4a ea b9 bb 41 92 c1 a0 c5 aa 3a 75 ea 54 d5 a9 53 e7 9c 7a cd 4d ab 67 cf d3 27 b9 52 e7 34 f7 ee ac 53 fc 50 d4 76 76 e6 ab b1 47 11 71 99 a7 65 36 22 3a ed f4 ee 3a 33 63 e2 98 b6 a5 1d a4 0f 62 61 c6 43 dd ed db 93 91 26 8d bb 52 24 94 18 e8 34 8a f5 5a a3 d5 39 6f 94 b5 28 d8 5b 07 71 4e 8c b1 3d 71 3b d3 c9 30 16 61 ee eb dc fb 4e ab 54 29 d6 ce 5b 6b 30 e9 b7 fa 7d c7 35 47 86 3d 75 17 8b 83 7d f8 17 89 b2 37 9e 70 2c 3d 63 66 76 8d ba 79 6f 0c 1b ba 6b da 8b 05 4b 98 1b d7 77 a6 5b 88 4b 1e d9 8f ab 69 7e bb f5 c6 51 64 66 e5 fe d4 ea 02 a8 25 eb ea b5 f2 a4 a7 3b 85 e2 89 f6 d4 a9 d4 0a e7 65 e8 9c 4e eb 43 1d 7e ea 17 3c 66 5f ad 17 1b 27 b5 46 25 57 cd 17 79 e4 81 5a 7c 9f 2f d6 5b a5 5a [TRUNCATED] Data Ascii: 8f3}kv_Qkb{WN[-HbDjEJd$87v68p?'7rN="EJA:uTSzMg'R4SPvvGqe6"::3cbaC&R$4Z9o([qN=q;0aNT)[k0}5G=u}7p,=cfvyokKw[Ki~Qdf%;eNC~<f_'F%WyZ\|/[ZGr)b&VyBE~!tVw%UsR3gV#Sv^/YCiIQu$%P-%V_cM ]Q#XN#E2\Jhe.I8"u\Bk2ITIR;@HyFc:i$(T<)R5pf~&?Fy/1_F.8,5)zcJ#&r:7gb)Hgq}C\|RUr!u{]UerYDZ.U!,E+hEZ&~ 92ABc_iJP'L0,Ad6bh
Nov 26, 2024 08:20:02.926786900 CET	1236	IN	Data Raw: 76 1c 8f c6 7a 03 c3 20 e5 10 85 30 98 b0 57 69 e3 94 a1 df cf eb ac 39 60 68 f5 30 6f 2b 2f c4 b8 2e a1 e8 ed 79 b1 d9 f2 63 49 5f 1d 23 c7 16 ab 05 21 7a 8c f1 d8 36 f5 5c a3 59 14 f0 92 84 77 8d 52 0b 6a c6 e9 e5 89 73 42 f1 49 a9 01 25 84 d3 Data Ascii: vz 0Wi9`h0o+/.ycI_#!z6\YwRjsBI%(Zf1<zRFTO:\:_7[7'ost%xIJ,t=)gCIXOb$RO##&?x2l~J#@~rZ*H4[Hb
Nov 26, 2024 08:20:02.926800013 CET	1236	IN	Data Raw: 28 59 0f 47 cf 74 c6 ba db 1d d0 0c 7d 65 89 65 f4 34 cb 98 27 0a 80 5c 56 d2 37 86 db 32 47 f0 95 c5 24 c3 4f 92 0e f7 0f 0f f7 0e 0e f6 3e db 4f ec ef 67 c8 7f 29 0c 7f b3 02 7f b8 b7 ff 65 e2 30 0a 1e ea 2d f7 5e 1b 4a 32 29 f7 5e dd 28 a4 79 Data Ascii: (YGt}ee4'\V72G$O>Og)e0-^J2)^(yop IL`06{=Bzt@d[@R1WQ60S~[1j_:4/uuR?(K2d:D;R<G{*>p6p'Tzbbn]#4;
Nov 26, 2024 08:20:02.926815033 CET	1236	IN	Data Raw: 4f c6 56 c3 b8 29 de 8f 65 49 fe 66 91 50 a0 c8 94 a4 c9 97 df 64 db 9f 2a 72 76 f1 89 22 91 ae e9 09 82 8e a0 4b 8f c8 d4 db 57 bc 92 a7 96 01 b3 f9 18 3a f3 f2 b0 ad 04 3a 0d 7b 55 ec b7 5b c7 b6 3a 30 80 41 c8 99 fd 07 4d 0e 35 f1 40 ab 5d df Data Ascii: OV)eIfPd*rv"KW::{U[:0AM5@]]W$lM`jN~o=ji,iti\|\9Bo\|_k>~ZK>]Ty>-m{)4IFR]!}x LueK jKspr5gW
Nov 26, 2024 08:20:02.926827908 CET	1236	IN	Data Raw: b4 0b b2 93 fc bd 4d 49 a0 2d dc 81 d2 00 82 8d fc 1d a6 a4 34 4c 6c ca 0a bb 04 ad 16 2e 77 3c 0d 70 5f e2 b2 78 ff f0 73 22 db 5e f9 f3 2f 68 ff c7 c4 dd 61 bc 22 92 79 6c cf e5 9e 7a e8 69 f9 b2 b1 d7 c3 3a 9f 80 0d d2 03 05 35 25 9d ad 82 7f Data Ascii: MI-4Ll.w<p_xs"^/ha"ylzi:5%&V0}{#-CKwfHqkC*`FWebus!L;Y&S\%W-5w`:f3R2n:>$Ufl13=]{8YUXo
Nov 26, 2024 08:20:02.926840067 CET	1236	IN	Data Raw: d0 87 02 fc 0e e6 01 f8 05 55 38 7a ef 95 4a e3 02 5b b0 70 9b 0d 6e 2b 1b 18 1d b2 39 56 0b ba ce 64 ee 53 a0 07 6b d2 74 27 2d ba 45 59 26 a7 3b 31 c7 6e 07 7d 79 54 37 f0 bd 7e d3 09 fa e7 9a 04 20 99 8c 8e 47 27 a0 40 82 80 2d 1e de 1b d8 1e Data Ascii: U8zJ[pn+9VdSkt'-EY&;1n}yT7~ G'@-kp'A9iRU-3;6\|6.sdt>?&>q_Yyt\fPYL?jF~]=Pi}Txav[8FkA\|:= \
Nov 26, 2024 08:20:02.926852942 CET	1236	IN	Data Raw: 91 b1 4b 8e 37 90 63 f7 74 1c 2c 16 f5 8d 30 31 18 45 77 30 3a 80 93 49 21 11 98 ce f3 c7 fe e8 75 0f 5f 1f e2 49 bb 16 8e 17 e9 ff 44 89 5b 8c ff a6 5a 17 c6 7f d3 1f ff cf 51 45 a6 d6 40 b7 7a 43 a3 37 31 6e a9 d2 2a e8 25 67 54 df 28 6b 67 50 Data Ascii: K7ct,01Ew0:I!u_ID[ZQE@zC71n%gT(kgP0dGke8\|aR6'<r:2G1IDyp\_Q6@"l]t!;RtSlmEW$-+>7Sa-+}60x>6jY=#Y\|gkgp
Nov 26, 2024 08:20:02.926866055 CET	1000	IN	Data Raw: 5d 6d b6 1a 74 c5 52 0d 47 28 ec 9c 6d 9d 85 97 e4 12 2a 68 62 7f 55 cf 31 26 b8 d1 e5 9d 3d b9 33 26 c9 e4 aa 17 05 e3 c6 b6 e3 56 a8 cb 20 99 e4 17 1e 18 43 74 15 fb 47 80 a9 fd 19 79 d4 4f 58 3b 79 c4 db 32 dc b1 93 f1 8e 37 e2 f5 22 96 c4 b6 Data Ascii: ]mtRG(m*hbU1&=3&V CtGyOX;y27"?=<F\\|0+Hanf/?D<%Sy\|~\gG?FU2:r)V_p+7'Rk]R^bpM<;Z!DEqdk&h[c
Nov 26, 2024 08:20:02.926879883 CET	1236	IN	Data Raw: 6d 8a 67 8b 78 b4 b1 fc 12 5f 16 e3 94 18 72 8a cc ed fc d3 13 03 25 05 49 19 8d d1 d7 f9 13 95 4e 91 8b 05 96 80 a0 89 4e 37 6c fe 14 65 0a f8 c5 62 b1 05 00 e2 27 29 92 e1 66 c5 b5 9e 67 da b5 7e 7c d3 8e 3c b8 f2 71 0a 7e 43 d8 04 d1 f2 3c 00 Data Ascii: mgx_r%INN7leb')fg~\|<q~C<{:JK+2RJNy=Zh8/sQa,K?w_WI# co?~<Wftd#+kSx3Q44*rSG
Nov 26, 2024 08:20:02.926893950 CET	1236	IN	Data Raw: a1 57 16 38 89 0b 29 8a cd bb 43 b3 7b 27 f4 f1 83 f2 c4 32 ce b5 58 f7 1a c8 be 29 40 2e 97 ea e7 c4 69 16 89 b9 77 3d 8c 44 4e 97 48 ba 43 43 9f 70 ec 73 25 4b f0 f9 bc 19 e2 cc 98 fa 70 fe 08 b1 6d 7c 9d e8 26 2a 60 d4 47 b2 6a fd 80 7f d9 4a Data Ascii: W8)C{'2X)@.iw=DNHCCps%Kpm\|&`GjJ7F[c4>xq tJb+Q-yB2yJn~{;f<<(\|C`89joR$m([[fsR`nbe+r@d\|.
Nov 26, 2024 08:20:03.046900034 CET	1236	IN	Data Raw: 6a 3a a7 50 37 7c 78 21 43 6a a6 2e d7 a8 05 8f e2 da 91 b7 77 f2 41 3b c8 e2 de 4f 3d ed 93 ef e7 2c 50 ce 7b 5c 69 e2 15 2d 01 74 8b 3c b4 bb 8a 7e 52 15 5d a3 ea 29 db 04 02 82 e5 f8 a7 be 36 98 9f 67 f7 ce 20 6d 3e ea 03 f5 2a 92 da ed d1 2c Data Ascii: j:P7\|x!Cj.wA;O=,P{\i-t<~R])6g m>*,L,LE7msl<drod_C#[d{BMlsc.&d>D@ISm701yFSNgV?`Q~[yZl8(Tf?)sxQI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49794	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:01.644871950 CET	621	OUT	GET /ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:03.229186058 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1017088014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:03.229204893 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:03.229218960 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:03.229311943 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:03.229326010 CET	287	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:03.403858900 CET	635	OUT	GET /ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605599277 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:05.843018055 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 115 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1017242014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:05.843036890 CET	1236	IN	Data Raw: 7a 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 Data Ascii: zfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com
Nov 26, 2024 08:20:05.843096018 CET	1236	IN	Data Raw: 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d Data Ascii: ogo.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*
Nov 26, 2024 08:20:05.843106985 CET	1236	IN	Data Raw: 69 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 Data Ascii: isys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.
Nov 26, 2024 08:20:05.843281984 CET	352	IN	Data Raw: 6c 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e Data Ascii: lfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:07.942032099 CET	616	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780
Nov 26, 2024 08:20:08.522981882 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1017448014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:08.523076057 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:08.527122974 CET	1236	IN	Data Raw: 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 66 61 69 6d 61 Data Ascii: p://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508mallsys
Nov 26, 2024 08:20:18.122165918 CET	711	OUT	GET /ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D
Nov 26, 2024 08:20:18.701253891 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 57 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1018190014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:32.868535042 CET	953	OUT	GET /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Nov 26, 2024 08:20:33.443970919 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019315014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:33.464720011 CET	986	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605631122 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Nov 26, 2024 08:20:34.049525023 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019351014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:34.311950922 CET	929	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Nov 26, 2024 08:20:34.889774084 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019404014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:34.920959949 CET	977	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605633116 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Nov 26, 2024 08:20:35.497562885 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019424014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:38.174267054 CET	1027	OUT	GET /en/ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170
Nov 26, 2024 08:20:38.748550892 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 57 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019699014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:40.938868999 CET	1020	OUT	GET /en/ajax/log_h.jsp?_v=1732605638909 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:41.515948057 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019908014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:41.541754961 CET	1236	OUT	GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs= Data Raw: Data Ascii:
Nov 26, 2024 08:20:42.116981983 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019956014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.147610903 CET	964	OUT	GET /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605633170; _reqArgs=
Nov 26, 2024 08:20:44.726437092 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020230014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.960947037 CET	1223	OUT	GET /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Nov 26, 2024 08:20:45.537396908 CET	1236	IN	HTTP/1.1 404 Not Found Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020290014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.n Data Raw: Data Ascii:
Nov 26, 2024 08:20:54.421200037 CET	1210	OUT	GET /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654008
Nov 26, 2024 08:20:55.001332045 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021169014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:55.144345999 CET	1263	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605652387 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654008
Nov 26, 2024 08:20:56.011804104 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021289014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:56.035135031 CET	940	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:56.645998955 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021340014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:00.403354883 CET	1212	OUT	GET /en/ajax/module_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:00.979351044 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021700014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.043157101 CET	1237	OUT	GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605662728
Nov 26, 2024 08:21:03.901536942 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021969014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:04.080374956 CET	940	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:04.658160925 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022048014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.902411938 CET	1243	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605671593
Nov 26, 2024 08:21:12.758061886 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022822014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49796	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:02.054339886 CET	301	OUT	GET /image/v2/mbg01.png?v=202407221109 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.351382017 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: image/png Content-Length: 654573 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:22:21 GMT Server: F-WEB Last-Modified: Mon, 22 Jul 2024 03:09:31 GMT ETag: "669dcd6b-9fced" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC202_dx-lt-yd-jiangsu-taizhou-4-cache-12, BC198_lt-obgp-fujian-xiamen-33-cache-1, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0d 77 00 00 06 da 08 06 00 00 00 34 ff a5 87 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6f 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 [TRUNCATED] Data Ascii: PNGIHDRw4tEXtSoftwareAdobe ImageReadyqe<oiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF" xmpMM:DocumentID="xmp.did:8100E979434211EF9671A8786
Nov 26, 2024 08:20:03.351392984 CET	1236	IN	Data Raw: 44 38 35 42 32 41 44 22 20 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 38 31 30 30 45 39 37 38 34 33 34 32 31 31 45 46 39 36 37 31 41 38 37 38 36 44 38 35 42 32 41 44 22 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f Data Ascii: D85B2AD" xmpMM:InstanceID="xmp.iid:8100E978434211EF9671A8786D85B2AD" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d4e9ec8f-bc07-9342-a86a-28d0735f5686" stRef:documentID="xmp.did:E069EA6EB8A9
Nov 26, 2024 08:20:03.351511002 CET	1236	IN	Data Raw: 47 f1 86 38 c5 fb c4 32 de bb c4 df 56 c6 63 97 78 f2 8a 69 0f 5e 72 73 14 61 4f 5d c6 2c aa e7 b9 46 b6 06 5e a7 0f 5b 3c b3 86 6c d5 c2 37 d1 15 3c 27 45 0a 71 57 d4 80 b8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: G82Vcxi^rsaO],F^[<l7<'EqW6m)%E#^QvD54c8m:iO]XGB'I{\|l=clG=c>anCI;5Lv_%-zA1b8O'ckekWKn
Nov 26, 2024 08:20:03.351524115 CET	1236	IN	Data Raw: 59 e7 ee b8 60 0d 55 cc 3a f9 78 fe f9 e7 3d b7 df 6a ab ad 54 31 eb f4 90 46 25 da d3 ac fd f2 b1 e1 61 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e b3 2d db 1c b6 7f b0 9d ce d6 6e e2 f7 66 fb ab 99 7e 8f 4d 3a 9e 8b 7f 8d af 50 64 25 e3 fc Data Ascii: Y`U:x=jT1F%a~-nf~M:Pd%(JfJZpV=J!,Nxi~lDI{vo'y<jH$V$}x6O8~lSyC\|<X}T)J\#Nhhh}#%
Nov 26, 2024 08:20:03.351535082 CET	1236	IN	Data Raw: bc 16 36 36 24 c4 ab cf 7f 5b 5a 93 1f b9 16 2d 47 d1 f5 9a 42 7e 43 0a a3 c0 eb 14 d2 de 85 44 d8 f5 61 04 ce d3 07 94 2d f0 ba 3c 44 c7 2e 02 90 cb d8 5e 63 bb 84 ed 1f a4 85 9b 23 d8 76 67 3b 93 ed 13 b6 ad d9 a6 90 f6 c6 07 82 c5 fa a4 45 4e Data Ascii: 66$[Z-GB~CDa-<D.^c#vg;ENr.PvO.H$M&cN$--ODy:Yl:T-YFxRizC1),~I'J[9l(b\|@/1)O;;:BV"rUm
Nov 26, 2024 08:20:03.351685047 CET	1236	IN	Data Raw: b5 48 28 44 31 73 66 cd 58 78 f8 b8 09 83 d8 36 e5 e9 57 c3 de 36 54 5b d8 e5 a8 f3 56 6b 4b ab 53 e0 d5 79 1c 53 27 9d 94 11 e4 e6 11 7c 55 e4 f8 a8 67 81 57 60 eb f0 b4 99 d7 76 bb d6 26 8d 3f b6 33 42 44 3c 41 16 76 09 b1 98 f7 23 e7 94 e9 57 Data Ascii: H(D1sfXx6W6T[VkKSyS'\|UgW`v&?3BD<Av#WXO<)G^yM=j fEU.TSUSU4UFo_U$O]C[~=:}}?Nwrp4!l@Ha=y}{SSSDzd6
Nov 26, 2024 08:20:03.351696014 CET	1236	IN	Data Raw: d9 0d d6 d9 a7 e9 7a eb 14 76 e5 e3 e2 cb ae c9 08 bb a6 5d 7e 6d 10 ce 99 42 5d 28 a8 7c 2c 57 a8 2a 78 5e 14 e5 f7 3c e5 b7 d7 4d ab 42 f7 42 af 76 2b aa a3 67 55 0c 88 b7 2a 47 2e 01 57 19 84 5d 20 1c a8 00 de 67 01 00 00 00 00 a2 46 ae 01 8f Data Ascii: zv]~mB](\|,Wx^<MBBv+gUG.W] gF 477K(##:xU4CLo(<l5]2}\|V4`9/OuYJvW<GwT!aa'ipcLOx5(P "z&ovr!^t
Nov 26, 2024 08:20:03.351706028 CET	1236	IN	Data Raw: 99 7c f0 36 dd e2 ab 2d f8 b2 1d 77 5d 70 e9 d5 d6 39 a7 1f 5f 9c b0 eb 4f b3 ac b3 4f 1b d7 b9 cd 25 7f 9e 6d 9d 79 4a c5 85 00 56 98 ea 82 a9 03 9e a2 f3 0a d5 05 2f 11 52 b5 ef c5 5e c7 51 0e 61 97 b3 4d a9 94 c0 2b ec a8 6a 3e 43 41 d8 55 1d Data Ascii: \|6-w]p9_OO%myJV/R^QaM+j>CAUl] HbK.D!O\|1emKla=W/k/a{C{[AK+U!gBxAz>P)Qle%F,g2lSp?b3I_XqW:@KG\HwVLD3;
Nov 26, 2024 08:20:03.351715088 CET	1236	IN	Data Raw: 52 a7 98 87 d7 7d 48 44 5d 1c ca f6 22 ee 79 d0 2c af da 0f 33 75 14 a7 89 a7 1c 53 b4 b0 6b d2 29 c7 76 6e 73 d1 65 b3 ac b3 4f 1d 57 ab cf 51 bd aa 0b a4 85 5d 76 9d ae 54 5d 08 da 39 b2 ca f8 de a0 2a 5c 16 2a 08 75 d0 c7 fd 59 35 fa 8c 04 00 Data Ascii: R}HD]"y,3uSk)vnseOWQ]vT]9\uY5p-W 9rPQo^5WP_}K*#?~s%B1'&:?]#Q>,{,RM%rBO0qOIw,T&#h'i8_9W<
Nov 26, 2024 08:20:03.351726055 CET	1236	IN	Data Raw: bb 6e 2d f6 80 cb e8 45 4f e1 3a 09 1c a2 d2 3f 67 ce ac 19 f7 7a 2c 3b 99 f4 28 6d 59 f0 ba f2 83 c6 8d 87 8f 9b 20 cb 64 74 80 0b ab 9d 89 32 8b b3 7a 8d b4 87 53 a7 5d 11 e6 6b 42 05 f9 98 0b 14 f3 08 b7 1b b3 3c 84 80 55 cf 4f 3c 1e 2f fe 21 Data Ascii: n-EO:?gz,;(mY dt2zS]kB<UO</!54]2:kR^Hoy?=zZ7h"DB<tFz{PVY\nw#f^ Fnb1Ly\|r\c=EI7'NC
Nov 26, 2024 08:20:03.471597910 CET	1236	IN	Data Raw: a4 6f 43 24 37 60 f9 d0 94 cb c5 c8 cb 66 9d d6 2a 54 0d b7 e8 cf ed 95 90 2a 50 67 82 44 60 f3 32 67 d6 8c 97 0f 1f 37 41 46 97 fb 3d 87 6b 92 1e 2d 45 46 b3 92 11 0b f7 e5 e5 1d 68 e9 4a 47 04 54 38 3e ff 38 f2 a0 fd 54 94 ae cf 63 0f fd 25 9e Data Ascii: oC$7`fTPgD`2g7AF=k-EFhJGT8>8Tc%Q.O.aqY6<';.ojjzS"3#oVl`wo~XG@g8=m)82ZH8-i!lWH3M(vf~;
Nov 26, 2024 08:20:05.361962080 CET	301	OUT	GET /image/v2/mbg01.png?v=202011021234 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:05.674196005 CET	301	OUT	GET /image/v2/mbg01.png?v=202011021234 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:05.779616117 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:05 GMT Content-Type: image/png Content-Length: 654573 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:09:54 GMT Server: F-WEB Last-Modified: Mon, 22 Jul 2024 03:09:31 GMT ETag: "669dcd6b-9fced" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC70_dx-lt-yd-zhejiang-huzhou-3-cache-3, BC94_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC202_lt-obgp-fujian-xiamen-33-cache-2, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0d 77 00 00 06 da 08 06 00 00 00 34 ff a5 87 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6f 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 [TRUNCATED] Data Ascii: PNGIHDRw4tEXtSoftwareAdobe ImageReadyqe<oiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E069EA6EB8A911EDA940840BB41BE7CF" xmpMM:D
Nov 26, 2024 08:20:07.734158993 CET	308	OUT	GET /image/onlineMap/close.png?v=202104251101 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:08.140947104 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:07 GMT Content-Type: image/png Content-Length: 1198 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:21:43 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:46 GMT ETag: "6084db9a-4ae" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC168_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC195_lt-obgp-fujian-xiamen-33-cache-1, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 14 00 00 00 14 08 06 00 00 00 8d 89 1d 0d 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 33 38 20 37 39 2e 31 35 39 38 32 34 2c 20 32 30 31 36 2f 30 39 2f 31 34 2d 30 31 3a 30 39 3a 30 31 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRtEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C1C0FC2CC0A511E8B3D7C46EC7D88036" xmpMM:InstanceID="xmp.iid:C1C0FC2BC0A511E8B3D7C46EC7D88036" xmp:C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49798	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:02.209007978 CET	605	OUT	GET /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:03.788566113 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1017133014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:03.788613081 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:03.788625002 CET	1236	IN	Data Raw: 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 66 61 69 6d 61 Data Ascii: p://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508mallsys
Nov 26, 2024 08:20:03.788727999 CET	1236	IN	Data Raw: 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 69 63 6f 63 2e 69 6e 20 2a 2e 69 63 6f 63 2e 69 6e 20 69 63 6f 63 2e 6d 65 Data Ascii: om .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info *.mallfkw.info mallfk
Nov 26, 2024 08:20:03.788738012 CET	188	IN	Data Raw: 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 Data Ascii: allfkw.cn *.mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopen
Nov 26, 2024 08:20:03.790440083 CET	635	OUT	GET /ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605600361 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:04.378525972 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1017167014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:04.378618956 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:04.378624916 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:04.378635883 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:04.378640890 CET	292	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:32.870713949 CET	933	OUT	GET /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Nov 26, 2024 08:20:33.446357012 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019314014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:33.446366072 CET	176	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdi
Nov 26, 2024 08:20:33.448493004 CET	1236	IN	Data Raw: 6d 67 2e 63 6f 6d 20 2a 2e 62 64 69 6d 67 2e 63 6f 6d 20 67 74 69 6d 67 2e 63 6f 6d 20 2a 2e 67 74 69 6d 67 2e 63 6f 6d 20 66 61 69 64 65 76 2e 63 63 20 2a 2e 66 61 69 64 65 76 2e 63 63 20 68 75 67 65 64 6f 6d 61 69 6e 73 2e 63 6f 6d 20 2a 2e 68 Data Ascii: mg.com .bdimg.com gtimg.com .gtimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top *.we
Nov 26, 2024 08:20:33.468636990 CET	982	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605631424 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Nov 26, 2024 08:20:34.038889885 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 59 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1019352014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:44.962654114 CET	1210	OUT	GET /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Nov 26, 2024 08:20:45.536437988 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020289014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:45.550904036 CET	940	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Nov 26, 2024 08:20:46.128151894 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020338014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:49.980103016 CET	946	OUT	GET /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:50.552972078 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020739014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:50.573395014 CET	946	OUT	GET /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:51.147200108 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020805014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:54.308756113 CET	1237	OUT	GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654008
Nov 26, 2024 08:20:55.172463894 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021182014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:55.206746101 CET	1259	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605652686 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:56.059200048 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 59 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021292014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:56.105614901 CET	1263	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getAuthReportInfo&_v=1732605654057 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:56.965796947 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 56 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021370014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:56.988354921 CET	1254	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605654961 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:57.571768999 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021457014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:58.487736940 CET	946	OUT	GET /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:59.062808037 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021569014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:59.092354059 CET	946	OUT	GET /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:20:59.670006037 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021628014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:00.401283026 CET	1244	OUT	GET /en/ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897
Nov 26, 2024 08:21:00.975498915 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 57 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021698014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.053606987 CET	1223	OUT	GET /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605662728
Nov 26, 2024 08:21:03.626188040 CET	1236	IN	HTTP/1.1 404 Not Found Server: F-WEB Date: Tue, 26 Nov 2024 07:21:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021960014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.n Data Raw: Data Ascii:
Nov 26, 2024 08:21:03.893496990 CET	1259	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getClueTicket&_v=1732605661453 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605662728
Nov 26, 2024 08:21:04.749020100 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 59 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022057014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:05.382067919 CET	1254	OUT	GET /en/ajax/mgClue_h.jsp?cmd=getWafNotCk_getCliid&_v=1732605663355 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo+hcfjF4ryq+iggJNs+paFs%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:06.233081102 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 72 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022166014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:07.586930990 CET	946	OUT	GET /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:08.168414116 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022339014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:08.186815977 CET	946	OUT	GET /ajax/setCookie_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:08.765021086 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022409014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:09.064713001 CET	1236	OUT	GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626 Data Raw: Data Ascii:
Nov 26, 2024 08:21:09.642926931 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022474014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.688591957 CET	1223	OUT	GET /en/ajax/ajaxLoadModuleDom_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:12.281763077 CET	1236	IN	HTTP/1.1 404 Not Found Server: F-WEB Date: Tue, 26 Nov 2024 07:21:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022775014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.n Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49797	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:02.209079027 CET	615	OUT	GET /ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:03.836826086 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1017137014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:03.836875916 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:20:03.836889029 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:20:03.836973906 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:20:03.836986065 CET	299	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:20:03.861520052 CET	581	OUT	GET /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatVisitTime=1732605600555
Nov 26, 2024 08:20:04.462271929 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1017172014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:04.462321997 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:04.462330103 CET	1236	IN	Data Raw: 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 66 61 69 6d 61 Data Ascii: p://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508mallsys
Nov 26, 2024 08:20:04.462431908 CET	1236	IN	Data Raw: 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 69 63 6f 63 2e 69 6e 20 2a 2e 69 63 6f 63 2e 69 6e 20 69 63 6f 63 2e 6d 65 Data Ascii: om .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info *.mallfkw.info mallfk
Nov 26, 2024 08:20:04.462436914 CET	188	IN	Data Raw: 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 Data Ascii: allfkw.cn *.mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopen
Nov 26, 2024 08:20:18.170949936 CET	705	OUT	GET /ajax/module_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true
Nov 26, 2024 08:20:18.752156973 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1018194014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:18.752212048 CET	1236	IN	Data Raw: 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 6d 61 6c 6c 66 6b 77 2e 69 6e 66 Data Ascii: .info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com .gtimg.com faidev.cc *.faidev.cc huge
Nov 26, 2024 08:20:18.756474972 CET	1236	IN	Data Raw: 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 66 61 69 6d 61 Data Ascii: p://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.508mallusr.com 508mallsys
Nov 26, 2024 08:20:28.146359921 CET	959	OUT	GET /ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; _siteStatVisitTime=1732605603780; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true
Nov 26, 2024 08:20:28.729012966 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1018958014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:32.864059925 CET	960	OUT	GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visited HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _siteStatVisitTime=1732605632504
Nov 26, 2024 08:20:33.445178032 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1019316014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:45.043142080 CET	1263	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getCookiePolicyOpen&_v=1732605642413 HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605644053
Nov 26, 2024 08:20:45.647229910 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 117 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020295014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz Data Raw: Data Ascii:
Nov 26, 2024 08:20:49.982249022 CET	1244	OUT	GET /en/ajax/siteDomain_h.jsp?cmd=wafNotCk_checkFaiDomain HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:50.801230907 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 57 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1020768014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:20:51.118119001 CET	1236	OUT	GET /en/ajax/statistics_h.jsp?cmd=wafNotCk_visitTime HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY%3D; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548 Data Raw: Data Ascii:
Nov 26, 2024 08:20:51.987910986 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1020882014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:20:54.223339081 CET	964	OUT	GET /ajax/log_h.jsp?cmd=wafNotCk_siteLogDog HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605645548
Nov 26, 2024 08:20:54.810018063 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1021148014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.985668898 CET	1210	OUT	GET /en/ajax/site_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605671593
Nov 26, 2024 08:21:12.571718931 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive FAI-W-FLOW: 1022805014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfk Data Raw: Data Ascii:
Nov 26, 2024 08:21:12.693247080 CET	1249	OUT	GET /en/ajax/login_h.jsp?cmd=wafNotCk_checkMemberSameTimeLogin HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605672209
Nov 26, 2024 08:21:13.561970949 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 51 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022879014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49801	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:02.701200008 CET	318	OUT	GET /4/ABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:04.052074909 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: image/png Content-Length: 29451 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:56 GMT Server: F-WEB Content-Disposition: filename=ABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i63250_c21843, i2103125_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 24 00 00 00 97 08 06 00 00 00 bc d0 26 83 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 72 a0 49 44 41 54 78 5e ed 7d 05 40 55 4b 17 ee 7b ef af 5b 5e 1b 45 45 14 05 bb 45 51 50 42 44 c1 6e 25 04 14 bb 3b b0 5b af dd dd dd dd dd 5d 28 8d 74 77 97 fa bd b5 66 9f 03 87 14 14 ef ef bd ff fe 74 71 76 cc 9e 3d 7b f6 cc b7 d7 9a 58 f3 7f 20 43 86 0c 19 3f 08 64 42 92 21 43 c6 0f 03 99 90 64 c8 90 f1 c3 40 26 24 19 32 64 fc 30 90 09 49 86 0c 19 3f 0c 64 42 92 21 43 c6 0f 03 99 90 64 c8 90 f1 c3 40 26 24 19 32 64 fc 30 90 09 49 86 0c 19 3f 0c 64 42 92 f1 3f 87 cf 2a 22 e3 c7 82 4c 48 32 fe a7 a0 4a 46 32 29 fd 78 90 09 49 c6 9f 00 ae f6 9f 14 f2 df a3 00 65 2a 3e aa c8 7f 37 45 32 b2 43 26 24 19 7f 02 8a 9e 90 38 96 2f 89 20 9f cf 9f 11 13 97 04 1f bf 10 bc 78 e5 82 4b 57 ef e2 f8 e9 4b 38 76 ea 22 ae dd 7a 80 37 ef 5c 11 1a 16 89 d4 d4 34 0a [TRUNCATED] Data Ascii: PNGIHDR$&sRGBgAMAapHYs%%IR$rIDATx^}@UK{[^EEEQPBDn%;[](twftqv={X C?dB!Cd@&$2d0I?dB!Cd@&$2d0I?dB?"LH2JF2)xIe>7E2C&$8/ xKWK8v"z7\4-dPg"?!>!QERr?}S(\|'p_@tnaa^<y11q2Ed0Pj6yCZGDG'W8yg )yTxDM]ncnz(Sj4Do0<`~$)%%Qn`w"n{Wbp;4QI5LPtG_=ao{_ &V&2!aPPBZzwBz&rY`j\=+>j6FaU$.^OYx KO&2!3F lummPY+4z(WYQ4zQF*hT
Nov 26, 2024 08:20:04.052086115 CET	1236	IN	Data Raw: ce ee 7e 44 42 d1 88 89 4d 44 62 52 2a d2 d2 3f e1 33 93 91 4c 48 3f 04 64 42 92 f1 03 83 59 e2 13 09 a9 30 2c 9f d2 68 37 0d c9 c9 69 78 fa fc 3d e6 2e dc 88 96 46 bd 50 a3 5e 5b 34 6f dd 1b 1d 7b 0c c7 e0 51 f3 31 6b d1 36 d8 0d 9d 8d 66 ad fb Data Ascii: ~DBMDbR*?3LH?dBY0,h7ix=.FP^[4o{Q1k6fwhsoF`hhfQ2!q!((sR!?7o=)0h_\pua%{8tb>>J@&$_]}LB)i/Qn#RryW#<2)
Nov 26, 2024 08:20:04.052098989 CET	1236	IN	Data Raw: eb d2 3f 69 bf f0 50 3c 9b 32 46 65 44 5f 17 99 8c 7c 20 13 92 12 5c ce a8 bc bd a5 c2 7d f0 f0 59 2c 5b b9 1d 4b 56 ee c0 b2 d5 7b f0 07 c9 72 c5 ef b2 35 7b b0 64 c5 76 ac 5c b7 1b fb 0f 9f 83 0b 91 d7 47 fa 8a 67 29 9b 99 35 e1 9b 11 18 14 86 Data Ascii: ?iP<2FeD_\| \}Y,[KV{r5{dv\Gg)5[wU;t.NHN:F8#P0)e'B2}-I3MWqh&6I#j==q3f0{&YYpY7%{Zy#
Nov 26, 2024 08:20:04.052155018 CET	1236	IN	Data Raw: b1 30 73 2d ba 0f c3 a4 19 ab 70 e6 d2 43 7c f0 0b 2b 90 29 27 e3 cf 81 4c 48 0c 95 92 98 4c b5 f9 e9 2b 37 f4 1b 30 95 b4 a4 2e 64 9e b5 ce 41 48 fc 5b 96 88 aa b8 ba 1e da 74 1c 84 95 eb f7 8b 65 77 58 f7 11 50 96 ee ec 52 40 70 d0 b8 c4 54 b8 Data Ascii: 0s-pC\|+)'LHL+70.dAH[tewXPR@pTxbLCLW5FY-cR6HLKB4c;h4Do,[c'o?e`vfIgjQhP'kuU_X;Lqc#)
Nov 26, 2024 08:20:04.052166939 CET	1236	IN	Data Raw: 1f bd 2a 50 f5 ce 0f 7c 6d 62 f2 47 5c bf fb 12 a6 9d 07 93 49 d8 81 2a 0b 55 3c 22 a2 72 5c 79 b2 a7 41 51 a9 b8 bb bb 54 25 43 34 d4 eb 85 c9 33 56 23 3c 2a 09 a9 bc e6 98 14 ed 37 42 e4 0a fd 70 23 36 69 81 7e 4f f0 e9 f2 4a f8 cc b3 c0 7b 87 Data Ascii: P\|mbG\IU<"r\yAQT%C43V#<7Bp#6i~OJ{ViB?I3%NklvohkrlDs=3g-tJqm:VN[hEK6TJ1Ky#mE)Eq#Gf-St1+W0(e\|2!e<&4s%rDHe)
Nov 26, 2024 08:20:04.052198887 CET	1236	IN	Data Raw: fd 49 a5 c2 be 79 e7 51 98 75 76 40 49 32 19 b8 e2 64 27 24 d5 34 64 4f 0f 4f b6 d5 a8 d1 06 ba 06 3d 70 f0 d8 75 44 c6 a4 8a 4a 5a 68 88 d9 fb c9 54 bb 63 f0 29 d2 19 71 f7 76 c0 6b 96 19 dc 06 69 89 ee fd 10 32 cd c2 48 33 8a b0 fc 7f 08 ef f7 Data Ascii: IyQuv@I2d'$4dOO=puDJZhTc)qvki2H3[7;5^1k0Zs);(#p@F'JyKVn50#(4se2!n/pv)+XI5mPf$b>at9)
Nov 26, 2024 08:20:04.052212954 CET	1236	IN	Data Raw: d0 ae 67 8e d2 ec 6e 46 e4 7b ee 79 cb 63 c2 78 a0 6a f9 ea c6 e8 61 35 0e 87 8e 5d a1 bc 25 d3 ed 07 78 ae bf 03 64 42 fa 02 b8 a0 71 37 ef ee 03 a7 61 d1 6d 30 a9 ec ad c4 2c ff 1c 84 a4 63 2e 5c 68 54 ab db 0e 56 76 93 84 8f 9d 34 ba b8 a0 b7 Data Ascii: gnF{ycxja5]%xdBq7am0,c.\hTVv4Y{9%a;K#_Oln7j,a.j}a/?;Lgl_n@4%6wg5WG1p#p?!!eAy
Nov 26, 2024 08:20:04.052356005 CET	1236	IN	Data Raw: 3c ee 22 fc c8 6c 38 0d d2 81 b7 4d 49 04 29 66 f2 4b 84 c4 f2 4f f8 5a fd 02 d7 01 15 f0 7a b4 2e 62 ce 2d 06 7c ef 2b 7a d6 52 28 ae bf 28 1b 29 c0 a9 4f 4e 4d c3 93 97 ae 98 3e 67 3d b4 ea 50 3e b2 49 ac f0 ab 94 9b 70 19 e0 25 aa 8c cd ed e9 Data Ascii: <"l8MI)fKOZz.b-\|+zR(()ONM>g=P>Ip%}H[F`Djk+3ST:J#(AdE/1HK'w=R#B2B0LNP\75\|dGdd0$Bb->\|uxP@P#n[#(\1_"#
Nov 26, 2024 08:20:04.052366972 CET	1236	IN	Data Raw: 42 2a 4d 5f 54 c9 f9 ff 60 9c be 70 5b 8c c4 16 26 92 02 bc c9 71 79 78 07 62 e9 ea fd 30 68 6b 8b 92 15 f5 c5 08 ec 0a e2 ab ab 8c 8b 1d cf 1b 8b f5 cb 78 59 a4 33 97 ee 13 29 a6 67 5c bb 72 e3 11 b4 32 b3 15 93 71 25 f3 31 6f 52 62 d3 8f 47 99 Data Ascii: B*M_T`p[&qyxb0hkxY3)g\r2q%1oRbGkkuFp# KDH?)#) 52$Rc!%u +eF%eg1}bSBC&\W\>syPID\|3"a/<JAN4B#-r^
Nov 26, 2024 08:20:04.052377939 CET	1236	IN	Data Raw: 85 cd 76 7e df 3a a4 21 cd 98 b7 11 7e 01 a4 21 a9 10 92 8c 82 41 26 a4 af 00 17 d6 80 e0 08 ec 3e 70 19 16 5d 87 8b 35 e5 d5 79 92 65 16 42 92 7a b5 d8 95 6c 8d 46 9d e1 30 62 0e 91 58 70 86 23 2f 26 93 f3 97 ef d2 f1 d9 50 d3 34 10 bd 75 e5 aa Data Ascii: v~:!~!A&>p]5yeBzlF0bXp#/&P4uV64m+;7ov0x.\?)J#HI=4L:WZP6#=m</nF}4Pml\|"vw3Z}$YnGh>3e\Xy@4U+C~
Nov 26, 2024 08:20:04.173135996 CET	1236	IN	Data Raw: 21 3c 04 ed fa e6 64 76 e5 3e 96 28 c3 f9 7f 3d 33 ac d9 7c 1c 0f 5e 78 63 dd f6 0b 30 e9 38 04 a5 78 52 2c 5f c3 64 94 41 48 8a f9 6b 15 f5 60 3f 6c 0e ce 5c 7a 80 54 76 59 99 47 d9 e6 14 f1 30 84 65 6b f6 93 f9 68 2d da 3b c4 94 13 15 52 aa ac Data Ascii: !<dv>(=3\|^xc08xR,_dAHk`?l\zTvYG0ekh-;RezUjY{+"-)>^#vWp>4j%s-omLNi4q;[W%ILHJ!8~/Zr>Z92&}c-5!0OUL
Nov 26, 2024 08:20:04.376827002 CET	323	OUT	GET /2/ABUIABACGAAglIiFjAYojfzulQEwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:04.796221972 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: image/jpeg Content-Length: 82150 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAglIiFjAYojfzulQEwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i15429_c17989, i2103119_c25795, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 52 49 46 46 de 40 01 00 57 45 42 50 56 50 38 20 d2 40 01 00 b0 40 07 9d 01 2a 8a 07 58 02 3e 6d 34 96 49 24 22 a7 ae a2 11 aa 11 d0 0d 89 67 6d 7e 81 b6 55 e7 3a 2e 8d b6 92 ff 3a ff 3f af e1 f0 7d 9d 79 b6 ff 64 72 eb e7 ff e2 7b d7 fe 37 ff 0f f8 7f 2c 3f 34 fe f9 ff 93 fc 47 c0 07 f2 af e8 ff f5 fd 70 7f cc f0 6c ef bf f3 bd 80 bf 68 fd 46 ff 91 e6 87 40 7f fc 9e 8a 1f 64 f5 09 ff 5f cb 07 ef ff f5 70 07 39 f6 e0 5d c3 2e 7c ab b9 b7 ae 0e 53 3d 6b fe bf 44 df 71 ef 6b ff a7 d7 f7 f4 df 51 0f ec fe 8a bf f4 7b 2a ff 0d ff ab d5 37 ee c7 ac f7 a6 0f f1 1e a0 1f e7 7a 9f 7f 76 ff ff ff ff f8 37 f3 98 ff eb fb d3 f1 17 fe 1f ff 8f b3 47 f9 0f fc 7e a0 1f ff fd bf 39 ef fc 5f ff 57 a0 8f 94 ff 97 ff 63 ed db c9 a7 ba bf f4 3f b8 bf e2 bf 6d fe ee 3f d5 ba a7 fc cd 56 7e a9 fa cb f6 bf 9b 3f e5 7e 27 ff b3 f9 9f fe 4b dc 9f ab 5f f2 fd c5 7c 8a 7e 61 fc e3 fd 4f f7 ff dd 9f ee df 26 7d e3 f4 63 e2 bf ea 7e db 7b 10 7b df f6 6f f8 7f e2 ff 7a ff d7 fc 6c fe a7 fc bf 56 7f 8b ff 75 ff 07 dc 0f fa 97 f5 [TRUNCATED] Data Ascii: RIFF@WEBPVP8 @@X>m4I$"gm~U:.:?}ydr{7,?4GplhF@d_p9].\|S=kDqkQ{7zv7G~9_Wc?m?V~?~'K_\|~aO&}c~{{ozlVu~?1On~}m?{t2}l]g>m-'& '1$GDWa;+P/[A~vwC/uN{by[p"f,^s=Hr^H.g=(Q/bFiqM3{#%3t#swCx{sVL='j%w&Te~s?XP ;_isT6Nn)?\|=,B`~]E{xGze};7T[_zw@A`=dH#mdV[k#^E:9J}mQ{%wJgLDKG?9-]^<lF(frHr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49803	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:02.795927048 CET	322	OUT	GET /2/ABUIABACGAAgj4iFjAYonO_WGjCKDzjYBA.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:04.053250074 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: image/jpeg Content-Length: 54640 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAgj4iFjAYonO_WGjCKDzjYBA.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i31813_c17589, i2103119_c25795, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 52 49 46 46 68 d5 00 00 57 45 42 50 56 50 38 20 5c d5 00 00 50 23 04 9d 01 2a 8a 07 58 02 3e 6d 36 97 49 24 22 aa 2a a2 14 b9 61 50 0d 89 67 6e ff a4 65 8f 45 66 d6 3c 61 6e 82 68 7d 78 fc eb fe 37 2d 7f 25 d9 9f f9 3d ca 3f c6 fa 26 fa 32 68 db 40 cf f5 5e 98 07 99 e8 55 ff 77 a2 f1 9e 54 4b 0b eb 45 5e 7d 77 a1 9f 8f 7f 5f e6 23 f0 1e b6 ff 2e bd 3a 7f 48 f3 83 f5 51 ff bb d9 3f f7 6f 44 bf d2 3f de fa cb 7a 8a ff 1d ea 01 fd 57 fd 07 ae 0f ac 47 f8 af 50 ef da ef 5a 1f fd df bb bf 11 7f e1 bf ef 7e e7 7b 55 ff e6 f6 00 ff ff ea 01 ff d3 ac bf 93 bf 95 5e 6a 7f 98 ff 35 fe 4f f7 03 fc 8f ac 3f 91 7d 6f f9 7f f0 7f e5 7f db ff 7c fd b7 fb c4 c6 bf c0 7f 8b e6 97 f3 2f c0 3f b4 ff 09 fb b5 fe 53 e6 4f f8 7f f5 3f d5 7e e5 fa 43 f2 0b fd 8f f3 1f bb 9f 01 df 97 7f 35 ff 37 fd fb f7 63 fc 57 ac 4f d9 af 21 fd c3 fd ff a0 47 b6 7f 58 ff a3 fe 03 fc df ff 0f f6 9f 02 df 5b ff 63 fd 0f ab 5f ba ff 90 ff bd fe 73 f2 47 ec 0b fa 87 f6 7f f8 7f e3 7f 7b 3e 42 ff b1 e2 c9 f7 bf fa 1f b5 3f 00 9f d0 7f c3 7f [TRUNCATED] Data Ascii: RIFFhWEBPVP8 \P#X>m6I$"aPgneEf<anh}x7-%=?&2h@^UwTKE^}w_#.:HQ?oD?zWGPZ~{U^j5O?}o\|/?SO?~C57cWO!GX[c_sG{>B?]s7o?s_{ro??4\0_P%gkW'+(4_(M<f9e]t36.e'w/N4^IE$b*,qPC$.$R:oh A6#}nuhzL%5u!{t&Q$GDRNrh RB3"uIle"do!Y0zr]!OH+r 3l@'66fr^R.yhS-W1I+1LJ,xU0]Qv~kxaoR2D!.Ve}j
Nov 26, 2024 08:20:04.053308964 CET	1236	IN	Data Raw: 6f 24 39 27 10 09 de a9 2f 6c 58 17 86 fa 9c 8c 08 6f d0 74 20 fa 44 c1 d3 df a2 ff eb 9f b7 bf 26 87 93 f7 c6 22 b8 ab 53 ff b9 1f ad 05 8a aa ab 1f bc 38 a2 f2 68 bf f1 69 9c 33 f1 ef fa ea f6 ab 98 8a 9b de 66 68 e5 a8 a8 1e 18 3c df 0f 40 6b Data Ascii: o$9'/lXot D&"S8hi3fh<@k-\HvK"ee2%idDD!s'StGkKWRun=KY!2_Dd4E27H*`mLRA)izR~w\|d1zw%
Nov 26, 2024 08:20:04.053320885 CET	1236	IN	Data Raw: 47 20 b8 f7 50 86 77 f6 2a 9f ff 2e 1b e4 c9 ff d2 2d 43 f5 51 d5 a6 1a 49 8e 04 52 1f 40 b6 fb 25 ef bc f3 ab 32 b1 16 a0 02 98 af c1 2b 8a 27 3a 97 46 57 6e dd 6c 66 4c 47 4c e9 cd 73 7a 78 5d bd b2 0a 32 8e 48 2c 7a c2 c8 de fc 50 04 6d f2 3f Data Ascii: G Pw.-CQIR@%2+':FWnlfLGLszx]2H,zPm?/{a#E WKf.r^\cPTB8S'S7rXwXXjt~\|r\|OFIo#a!ONGCK1\R#q[*w4
Nov 26, 2024 08:20:04.053365946 CET	1236	IN	Data Raw: 1c 28 74 fb 45 2f 10 e0 e8 b0 87 18 8c 00 1f 5f 46 29 44 e1 6f 1f 8e 45 b9 3a cb 7e bf 47 33 ce a6 97 cd 9a 1b bb 91 9f 38 8f f2 f9 6f e0 6a 1f 2c d3 6c 57 2d e3 80 29 f0 15 47 ab e8 75 bf 81 f5 5b af 50 f1 de 98 69 e9 cd ab c0 5a 60 c2 19 6f 97 Data Ascii: (tE/_F)DoE:~G38oj,lW-)Gu[PiZ`oa4}H<&P<W{7)n%t_``A4B6\M7"h)P\|I"Sz7)swy6{~xFrJBg`(ap=8-O
Nov 26, 2024 08:20:04.053379059 CET	1236	IN	Data Raw: 9d 6f a1 1f a2 3f fe 28 78 be 26 40 aa 1e c0 16 99 0f e9 20 06 fa bd 0d 78 b2 61 52 75 bb d7 fc f1 f7 fc 06 76 e0 64 c9 ca dc 0d 6c c7 91 55 49 b3 16 02 ac 06 66 d4 47 4c a7 6c bd 0b 1b 3a 9c c3 49 e5 fa d3 28 c8 53 77 7a c3 b6 7e ef d1 da a0 e0 Data Ascii: o?(x&@ xaRuvdlUIfGLl:I(Swz~PaZK9t-2.kIIN$B#X:5YAIXn3Jb_>nPec>n!U`WIsCfd\#5S5rg9r;%X'?h1
Nov 26, 2024 08:20:04.053390026 CET	1236	IN	Data Raw: d9 15 57 aa 5b 84 8c f2 f7 74 88 e9 fc dd ea d1 1a 79 2f 89 40 93 f7 01 cb 96 c6 00 a5 22 61 ab 8d fd a7 56 52 21 b1 e1 3c 46 c8 49 ae 12 58 dd eb 31 41 d7 2f da 89 82 de 4e 6a 01 84 e0 db 2f 4e 36 b6 dc ea c5 ba ea 0c d8 cc f5 46 69 c0 29 6f 76 Data Ascii: W[ty/@"aVR!<FIX1A/Nj/N6Fi)ovj1OM7Y]0CH{q8bB)'MqOb&`qj_X~GeHbnKD9StDNx-xg:t`Ic(LQJ(YS2'N
Nov 26, 2024 08:20:04.053407907 CET	1236	IN	Data Raw: 48 0e f7 0b 34 35 b7 13 90 bb db d0 80 2b 1a 0e 6b 1a 17 7f 11 2c 52 61 69 60 16 1e 4b 97 04 f9 0e da 27 9c 50 59 69 53 a7 fa 35 d0 1d 54 38 be 03 02 41 80 cb 9a 3b 06 ea 0d 57 bb fe 3d 35 7d 0c 16 64 61 c5 b9 08 9d f3 3c 29 3b f7 b0 54 b8 49 dd Data Ascii: H45+k,Rai`K'PYiS5T8A;W=5}da<);TI3o(8ccM9@FtU.CNn74<fy71X(-s29K3Z1.}.zL-N#g"h[ =/N<&Kw>c]$& Vq{Y=
Nov 26, 2024 08:20:04.053476095 CET	1236	IN	Data Raw: e0 4d d0 4e b4 f8 e4 14 7c 50 54 f1 12 dd c1 53 c4 4d fa 0e 4b 62 2a 9b b8 2a 07 73 1d 3e f1 68 d2 d8 14 58 95 60 b0 ad af 2d bd d2 ac 16 15 c0 60 51 a6 da e0 3d a8 fa 49 49 1d b5 60 c6 56 0a 2e 8b 66 32 b0 51 5d 58 31 95 82 8b a2 d9 8c ab d6 92 Data Ascii: MN\|PTSMKb*s>hX`-`Q=II`V.f2Q]X1^EN%ESmv,wP;hzFG/J2QV_A1ElVjD"79u?pY9?ExAlEUKb*C;Y+yc)G=b80jp~
Nov 26, 2024 08:20:04.053487062 CET	1224	IN	Data Raw: b4 d7 8e b0 fa b6 3e 7e d4 01 41 b0 cf c0 94 de 83 81 89 f3 4e fd 4b 7e fc 44 82 fa 27 b5 9c 5a 68 bb 30 36 7e 24 70 d8 12 38 15 92 46 8d a2 92 b5 80 fb 5a 9c 03 76 fd fa 65 e8 47 dc 48 6a f0 ee ab 11 3b a4 7c 3b 9b bc a1 4e e6 7d fd b3 5b fe e5 Data Ascii: >~ANK~D'Zh06~$p8FZveGHj;\|;N}[l^8wo3bZeG+p9At{Kt\|r~{ere2??2TDAJQxI;14B+Eo6M~hQ:Afn!',Hfii)~MM'9
Nov 26, 2024 08:20:04.053498983 CET	1236	IN	Data Raw: 17 de 40 42 54 db f3 4e 86 4f a4 01 a4 fd 82 b0 09 1f 6b a2 5c 91 59 c5 d3 cb f8 13 52 42 18 07 66 8c 4f aa 83 1e 39 67 26 52 85 c3 02 c0 32 4c 74 23 65 b1 f6 91 0c 09 13 96 1e 43 72 82 be 48 5d fd 43 02 61 1e 83 7e b2 6c 48 93 35 b0 0c 7b af 5e Data Ascii: @BTNOk\YRBfO9g&R2Lt#eCrH]Ca~lH5{^-rL5A]:-m)AbjIQi6MNd5!+YwZU7C>kzGo*c!Epe\4xX9HLwi%,e"L:o
Nov 26, 2024 08:20:04.174238920 CET	1236	IN	Data Raw: 52 25 58 83 71 fa f6 d5 6a d4 dc d9 29 2e 96 02 37 c1 a5 9e 78 3e 05 88 45 f9 1a c4 8f 75 f1 e6 56 82 0b 74 d0 77 51 d6 47 1f 56 01 14 47 7c f1 52 a1 b6 9f a1 eb 07 7d b3 d9 f6 21 5b 2c 98 4d 55 f4 f1 af 7f 3f 8a 88 98 d6 90 b6 4c e5 78 25 c8 14 Data Ascii: R%Xqj).7x>EuVtwQGVG\|R}![,MU?Lx%)GP :%Ag}#JxW9fXJ\kWXd^x]Ls*o&[.TW6ncv5a\RGy\?Q.v?a8r6xk-j'E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49778	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:03.407479048 CET	421	OUT	GET /2/ABUIABACGAAglIiFjAYojfzulQEwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:03.823962927 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: image/jpeg Content-Length: 82150 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAglIiFjAYojfzulQEwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i15429_c17989, i2103119_c25795, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 52 49 46 46 de 40 01 00 57 45 42 50 56 50 38 20 d2 40 01 00 b0 40 07 9d 01 2a 8a 07 58 02 3e 6d 34 96 49 24 22 a7 ae a2 11 aa 11 d0 0d 89 67 6d 7e 81 b6 55 e7 3a 2e 8d b6 92 ff 3a ff 3f af e1 f0 7d 9d 79 b6 ff 64 72 eb e7 ff e2 7b d7 fe 37 ff 0f f8 7f 2c 3f 34 fe f9 ff 93 fc 47 c0 07 f2 af e8 ff f5 fd 70 7f cc f0 6c ef bf f3 bd 80 bf 68 fd 46 ff 91 e6 87 40 7f fc 9e 8a 1f 64 f5 09 ff 5f cb 07 ef ff f5 70 07 39 f6 e0 5d c3 2e 7c ab b9 b7 ae 0e 53 3d 6b fe bf 44 df 71 ef 6b ff a7 d7 f7 f4 df 51 0f ec fe 8a bf f4 7b 2a ff 0d ff ab d5 37 ee c7 ac f7 a6 0f f1 1e a0 1f e7 7a 9f 7f 76 ff ff ff ff f8 37 f3 98 ff eb fb d3 f1 17 fe 1f ff 8f b3 47 f9 0f fc 7e a0 1f ff fd bf 39 ef fc 5f ff 57 a0 8f 94 ff 97 ff 63 ed db c9 a7 ba bf f4 3f b8 bf e2 bf 6d fe ee 3f d5 ba a7 fc cd 56 7e a9 fa cb f6 bf 9b 3f e5 7e 27 ff b3 f9 9f fe 4b dc 9f ab 5f f2 fd c5 7c 8a 7e 61 fc e3 fd 4f f7 ff dd 9f ee df 26 7d e3 f4 63 e2 bf ea 7e db 7b 10 7b df f6 6f f8 7f e2 ff 7a ff d7 fc 6c fe a7 fc bf 56 7f 8b ff 75 ff 07 dc 0f fa 97 f5 [TRUNCATED] Data Ascii: RIFF@WEBPVP8 @@X>m4I$"gm~U:.:?}ydr{7,?4GplhF@d_p9].\|S=kDqkQ{7zv7G~9_Wc?m?V~?~'K_\|~aO&}c~{{ozlVu~?1On~}m?{t2}l]g>m-'& '1$GDWa;+P/[A~vwC/uN{by[p"f,^s=Hr^H.g=(Q/bFiqM3{#%3t#swCx{sVL='j%w&Te~s?XP ;_isT6Nn)?\|=,B`~]E{xGze};7T[_zw@A`=dH#mdV[k#^E:9J}mQ{%wJgLDKG?9-]^<lF(frHr
Nov 26, 2024 08:20:03.824043989 CET	1236	IN	Data Raw: 8b a2 7f 7e 36 a2 7f f8 d5 18 1e 08 d2 18 63 50 7e 62 b5 8c 43 a2 a3 80 77 31 66 b5 3a 6a 04 a6 19 64 c9 36 d6 98 56 00 7a 7e ec 69 fe da c5 c2 68 41 c3 2b 98 b7 43 43 73 9d b3 6e da 53 de 2a d3 23 f0 ce 79 59 5f 16 fe a4 fc 4c 25 45 4a dd 84 90 Data Ascii: ~6cP~bCw1f:jd6Vz~ihA+CCsnS#yY_L%EJ}/\|k\|P !}t7(z@rTslz#O6=~^U#z`!1#WgP=j>M9ltt1GQn:V_<X87wnBnw5+ug+
Nov 26, 2024 08:20:03.824057102 CET	1236	IN	Data Raw: de 8b 11 89 83 11 83 e3 3b c0 d0 aa 50 07 62 ed 94 0b 48 16 0c ac 1e 96 5f dc d0 92 ce 36 23 93 41 df ab f6 5b e4 4a 7c 46 35 0a 0a 5b 83 87 85 28 fc 16 0d 9c 0e cb 6f 1f 55 18 7c 38 9a 63 3d 89 e5 a6 17 bb 0c 2d 06 42 d5 9f 7c b9 03 88 09 b0 67 Data Ascii: ;PbH_6#A[J\|F5[(oU\|8c=-B\|g,\|#MNu!N}=pb`RQX.x2%WAWLC])9,v9/n) ^YwU0H.SMT&?JS8^I-"yy
Nov 26, 2024 08:20:03.824115992 CET	1236	IN	Data Raw: 4c 63 a6 a5 bd 21 f0 8c 2e 9f f8 97 ff ea f0 9e 3f 7a 7d 48 9b 34 74 2b 9f 57 87 99 81 0c 0b d5 24 84 7b be f4 7c 6c 33 24 b9 6b fc 32 2d 7a b5 f7 f9 1f f7 85 40 22 b0 3e 28 3d a8 c1 6d 08 01 4b d5 c1 41 81 02 95 fa b2 a1 f1 5f bf f2 3a bf b1 e3 Data Ascii: Lc!.?z}H4t+W${\|l3$k2-z@">(=mKA_:jPMlvKd;0G.FoKn_k(Nr"x6/_7:,8U*jdR<zS~NB1'6$`9d@s%L)nK[H0
Nov 26, 2024 08:20:03.824127913 CET	1236	IN	Data Raw: 00 30 e3 1f 68 a7 a5 32 49 41 3e f0 80 98 ff 9a 86 26 d6 f4 f0 3f 09 ee b4 7e d7 7c 05 a6 01 ef a0 93 2f ff 52 84 49 2a 1d 01 8b 0c cf 4d 9c 4c e7 0d e7 78 1e c0 ae 62 c8 83 df 27 c4 04 3f 9e 2f 4f 79 a1 79 2e be b4 7b 6c 3f dc 00 78 b4 9f 58 f6 Data Ascii: 0h2IA>&?~\|/RI*MLxb'?/Oyy.{l?xXeA+#~Q}_5=lWms;D3iE[Z8s9=sww{ZSHSW,e2SVarn$\|oFb4}Qj&;x"os"
Nov 26, 2024 08:20:03.824140072 CET	1236	IN	Data Raw: 8a 3d ac 4d 41 7f 5a 62 78 b4 ed ff 43 55 44 91 9f f7 e4 ed b8 bc b2 15 14 6b f5 43 19 1a f9 0b 1b 34 42 23 3d 60 4c 0f e6 33 f9 73 9f ba 6b e5 99 70 58 18 d8 15 4d 91 ea dd 39 31 d6 06 a6 00 86 dc f9 43 ae 0b 7c e7 9a a1 1a 07 43 d6 bb 08 25 86 Data Ascii: =MAZbxCUDkC4B#=`L3skpXM91C\|C%dc[#zRkW}3AnVxH{q }4]E7(PcU:$98H4"gdxos)%H&]A!'Bj5K{CCjcYOv"+mQH
Nov 26, 2024 08:20:03.824170113 CET	1236	IN	Data Raw: bd 08 bd a9 cb 3c 91 64 47 62 7e c5 4f f4 98 86 3e e3 4d bf 9a 98 c9 06 d9 d4 14 96 f8 4b 3f 4a da 7c 66 5c b4 4b 6a ab 1c a3 8f a8 1d bf 87 82 1d 56 7e 5d 1f d9 8a cd eb bf 5b 6a 08 60 ab cf c6 74 f3 1d aa bc f1 c5 4f a5 b7 17 fc 3e 0b a1 b5 cb Data Ascii: <dGb~O>MK?J\|f\KjV~][j`tO>j+x5:WvT+RmI[@=7a]7nR(p:nRu~:c(;NKb{M=ELD%ZCpkarmvN!S )
Nov 26, 2024 08:20:03.824182987 CET	1236	IN	Data Raw: b4 5c 1a d3 bd d4 44 9a b9 16 25 61 a6 7e 0f 33 63 4b 0d 98 8a 31 7e b6 4a d0 c3 92 c2 4d 0f 7d db 7c d0 f1 95 52 57 21 62 87 7e a6 dc 3e e0 7c b6 91 c9 c5 fa 52 85 93 c6 c7 c1 d7 b0 1f 54 a7 4b f1 e1 a3 81 e2 66 ef ce ef 66 5a ac 8e a5 44 ab b7 Data Ascii: \D%a~3cK1~JM}\|RW!b~>\|RTKffZDCEa{(BGxcO"U1\FwB@CG!3NS8XYUX)[*aWH9QrGS7gMy[%b!F
Nov 26, 2024 08:20:03.824194908 CET	1236	IN	Data Raw: c1 28 1a 19 77 05 8e 7a 2e 56 aa f1 af 39 57 b8 b3 3f ad c6 f3 de e2 a3 68 c3 27 a1 48 b9 b8 12 4c e9 4b c0 7e ef 18 01 3a 93 da 63 ec eb 74 ea cb d3 78 21 34 c7 d6 9b fb 30 26 bd fc e5 c5 69 6e 2a 9a a9 fc 63 08 8c 9d 99 46 e7 3b 8c f7 30 1b a5 Data Ascii: (wz.V9W?h'HLK~:ctx!40&incF;0M@(s:>n0_\Zw47ps14e);5u`m$-7]i-[GZYKRk{$;m8L]l\|RG.+Z{
Nov 26, 2024 08:20:03.824208021 CET	1236	IN	Data Raw: 3c 45 fe 8a da 96 ea fb be 00 a4 f5 1f 7a a6 62 3f e0 7e 4d 10 00 0f 59 0e 79 b8 58 b1 37 b0 58 a6 d8 e3 0a 21 9c 16 bf 80 6b 83 cc a8 50 90 70 93 18 30 02 7a 0e 61 1d 1a cd 34 81 70 f1 8f b5 c6 81 0d df e3 90 bc 31 2f 63 1e b8 e8 b5 00 8c ca 3f Data Ascii: <Ezb?~MYyX7X!kPp0za4p1/c?F/-=hhtUP29!&9zH\|WK<r5Tq+t52!z1@&Bp}D=&gp+G!YeR~l`p[\xE>Y
Nov 26, 2024 08:20:03.944330931 CET	1236	IN	Data Raw: 31 d5 75 e5 e0 7c fa 84 b3 00 87 7b 3e 6b da a1 13 ee e8 f2 85 a0 2d 01 61 66 27 a8 98 ae 7b bd 25 34 82 11 25 db 81 70 f0 da 77 c3 e6 32 35 67 b6 02 36 f0 f6 32 ef ff 89 ec 5a 61 7e e8 35 c7 8f 82 c1 e5 38 be db 22 af 10 49 3e 6a 1e 41 6b dc 43 Data Ascii: 1u\|{>k-af'{%4%pw25g62Za~58"I>jAkCe&Fe5+.-=L$3S:@7c[}xWY>~8N_gWw]:aO;[8{5!O^#S}x8q/Rmdj[@WP:s%X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49806	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:03.527189970 CET	421	OUT	GET /2/ABUIABACGAAgloiFjAYokPLbwgcwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:04.857785940 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: image/jpeg Content-Length: 270234 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAgloiFjAYokPLbwgcwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i63246_c21843, i2103119_c25795, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 52 49 46 46 92 1f 04 00 57 45 42 50 56 50 38 20 86 1f 04 00 d0 39 0c 9d 01 2a 8a 07 58 02 3e 6d 2c 91 46 a4 22 a1 a1 2c d7 6c b8 80 0d 89 62 6c cf c0 db 9f 54 c4 ff f1 7a 6d fe 8a c4 e1 35 e8 8d 8c 39 03 71 92 06 1d ca 32 d1 7f 8b f0 06 ea ff 9c 07 02 ef f4 1e c0 1f ab 5c a4 6d 01 4f 67 ca 17 d6 d6 f0 9d 77 de e8 fd 92 7e 25 fe af f5 3e 93 5c a7 e0 b7 da 7f 1b fe 97 ff b7 c5 c7 f5 7b 6c f8 4f fa 3e 69 de cf fd 47 ea af 69 df f6 7f 70 7d e1 ff 6e ff 79 ec 21 fd bf fd 67 ed 47 af 57 ef 17 bf 6f f1 ff fb 3f 2a be 0e 7f 60 ff 9d fb bd ff df e1 c7 fe c7 ee a7 fc df 88 1f df 7f e6 fe e6 ff c2 f9 07 fe fd fe cf ff e7 b5 c7 ff 0f ff ff fa 3e 18 ff bd ff db ff ff ff 23 ff 77 c8 f7 f4 5f f6 3f fd 3f e3 7b ce 7f f4 fd eb ff cd f2 ed fe 03 ff 27 ef 17 fe ef 87 7f f9 7f ff bf e3 7b 80 7f fc f6 c4 fe 01 ff c3 a6 9f cd 3c 6e fc eb f9 9f f9 ff 99 fe 6d f9 b4 f9 57 f0 ff e8 ff e5 7f 8f fd c5 fb 8e fd 53 fe 0f f6 5e 20 fd eb fc 4f fb bf ec ff dc ff f4 f7 27 fa 37 e6 af de ff 8e ff 3b ff 8b fc 5f cc df ef bf f3 ff b8 [TRUNCATED] Data Ascii: RIFFWEBPVP8 9X>m,F",lblTzm59q2\mOgw~%>\{lO>iGip}ny!gGWo?`>#w_??{'{<nmWS^ O'7;___~o??_g@<_=_?aO{sg_}=?O?]~`og_Ys_yuakExW'Gq,\8Au^_BgC8WZkCt{oZXw"Mz^qWzJCMMgflCfEiR0UP0w>xW@6-O%dfH<pO\2;6*>'$A;T2m,PNC?bOy
Nov 26, 2024 08:20:04.857836008 CET	1236	IN	Data Raw: 89 de c0 e1 f2 c4 6d e3 cf df 0c f3 9b ef eb e7 71 81 6b 54 4d 88 5e ce 6b 0c 83 61 ef 0f f3 08 d6 28 49 01 fd c5 dc 3e ea dc c1 a6 46 a6 80 f8 50 3e c0 9d 1b 6e 06 2d 47 42 41 26 e1 d0 f2 bc 2b 2b cf bb cf b7 b2 d0 0c 4f 32 ed 52 4f 68 d0 8e 04 Data Ascii: mqkTM^ka(I>FP>n-GBA&++O2ROh]`e5-KOq;Cp<D%$}4:YiNz%Ucv+^z_V>ZKh7=QsiDWol2HD/N7
Nov 26, 2024 08:20:04.857842922 CET	1236	IN	Data Raw: 91 12 4c 4f 9f 00 26 ea d4 c4 db 60 b2 e3 91 0a ce 63 71 71 73 d0 c8 0b 5b 48 08 6f c8 5b c4 4a 13 fe be d2 87 f9 37 d8 89 48 94 a4 18 d8 9a 28 f4 77 39 02 74 b6 b8 fd 23 4c d7 02 b2 24 6f 3f a4 e9 af 95 78 e5 81 7a a9 b8 e8 3d be ba 97 76 a1 c0 Data Ascii: LO&`cqqs[Ho[J7H(w9t#L$o?xz=vmNcH+C%C<w7@f_$VLoydG9i\|\c;DN_ /Q2iOt"\55odAp`-&7s>;FX4pk
Nov 26, 2024 08:20:04.857850075 CET	1236	IN	Data Raw: 68 40 c3 02 4f 7c 27 78 86 6e 47 8e be c3 4a 06 7d 4d ca 24 0f 2e 12 7c 4f f8 0f 3a e1 d6 ec 21 70 fd 48 62 52 c1 f9 99 b0 c3 bb 7a 00 33 15 5b ce 8b e8 3b b8 28 fc 26 1a 5e b6 93 f2 4d 7b ea a0 15 cc 72 da 25 bb 41 5e fe e4 08 92 ec 7e 3e b0 3e Data Ascii: h@O\|'xnGJ}M$.\|O:!pHbRz3[;(&^M{r%A^~>>lu"yuxK6HaNrn}"t<!u/4{7q\D_P2smkozp6 i\3zH_Q^$xQ&4;d>l&
Nov 26, 2024 08:20:04.857922077 CET	1236	IN	Data Raw: 00 96 ab 6a 13 4d e4 10 10 57 58 bb 1e 8b 71 15 73 14 59 4a 3d 82 a5 2b 60 ab 4e 85 63 91 36 9f d1 d3 5c 35 f1 e3 bd e8 ae c3 fe f7 a0 d1 d1 ba a7 b6 aa 3b fe ff e1 d9 f0 61 d2 4b 05 14 3b 29 1d 8a bf b4 0e 5e 6c d2 6c 0b 1f 5d 19 a7 bd cc d0 ca Data Ascii: jMWXqsYJ=+`Nc6\5;aK;)^ll]HlM#YS'.Mtwt9r$&< WZ5{cmecn~(:6tBa;]p</;>6e}Yka
Nov 26, 2024 08:20:04.857929945 CET	1236	IN	Data Raw: 20 68 b6 4c c0 b1 a5 59 cc a3 58 f1 90 af 00 5b f2 4a 0d c9 e4 5e 8e ed a0 03 df c1 51 ae 39 16 41 6d 38 4c 14 f2 2a 12 a2 d6 65 e5 7d ce d2 ed 2a d4 0c a7 85 a3 f8 f3 d6 39 b1 f3 3a a2 f4 96 1d 39 91 8d fb ab 41 04 25 ec 46 43 e5 19 3f 31 ca 5e Data Ascii: hLYX[J^Q9Am8Le}9:9A%FC?1^Q BVTYex&:`qG)>j~#;n"^70oc?v_o+EsBds3#}\|gb<Z\5B\Sqt\wACS8{
Nov 26, 2024 08:20:04.857940912 CET	1236	IN	Data Raw: e7 b6 ae 5a e2 ef 30 61 85 98 b2 c1 2f b9 a8 b1 5b bb c7 6f d0 4d 71 79 bb 5d d8 e0 dc f5 39 89 5e 40 e2 8a c3 e2 4d 0c eb b1 04 5b 63 75 0d b6 09 0a 26 37 05 6f 8f a0 9d d5 19 5f b0 84 fc 91 91 0f fe 2d 5c cb 40 cb 1d 18 12 42 e2 9e ce 7b 6f b4 Data Ascii: Z0a/[oMqy]9^@M[cu&7o_-\@B{o(tq6]8nl42.DPhnEa*/:LTB[2T9m;='YEv}(Fl:%pl+.m&o.yg8KrI'wCW\(p\|w
Nov 26, 2024 08:20:04.858028889 CET	1236	IN	Data Raw: 97 cf 75 19 f8 41 71 fa 4c bc dd 4c fe 4f d4 cb ed c5 ad b9 13 f6 f9 e4 7a 2a 8c bd 28 d0 d4 76 62 30 d8 a5 f7 d1 fe ee 2c d7 f5 3f aa f5 08 55 78 41 c6 09 ca 88 ac 0b 1a 67 dd 4e c2 a7 1d 1c 7c 46 38 b1 f9 a3 e8 ed b8 94 cb 15 3f 54 3c 91 3a 40 Data Ascii: uAqLLOz(vb0,?UxAgN\|F8?T<:@+8\|$)hOXX-h\|W00"(<b>E+uibL-l!iQ"bOvyzVa+D"01>=)?m&'w>!y
Nov 26, 2024 08:20:04.858033895 CET	1236	IN	Data Raw: c1 72 fd 24 6b cd d6 85 85 66 8e 8b 0f 7b ca c7 f8 94 39 58 df cf f7 68 c3 27 61 03 ff c3 1c bd 8c 73 d0 ac f1 31 a6 05 6a 7b 48 df d5 ab 7d e9 36 2d f7 45 e3 11 55 59 5a e2 bd 4e 90 f9 de 9e 63 99 1a 3e 42 1e f4 b2 8e 47 9d 74 c0 00 f2 2a 60 df Data Ascii: r$kf{9Xh'as1j{H}6-EUYZNc>BGt`n'{GEB^/m94[ZjeZ4IQ[Pj;:U&xmO*dA)-zSp!6pSxC"J :$1F'LW,I14
Nov 26, 2024 08:20:04.858047009 CET	1236	IN	Data Raw: d3 60 f4 6b cf 38 77 d1 2b 4a 00 ef 97 29 da 6d 2e aa 27 7b b8 ab 24 4d 9c 0e 57 f0 1e c9 48 ab 5d bf 58 c2 21 f6 d8 ca 9a d9 81 a3 8a f2 cd 94 ee 0a 56 82 f0 d9 15 58 30 be f7 14 94 45 50 16 df f6 7b d1 4a 1e 95 11 ef 7b 85 fe 1a cc 56 72 e5 14 Data Ascii: `k8w+J)m.'{$MWH]X!VX0EP{J{Vr1jQljc\|Oak:oxL`?h=qnm<'}I~W]GvX_&+\,qMzdt`/W#FeZwGFSzfz*Sk
Nov 26, 2024 08:20:04.978286982 CET	1236	IN	Data Raw: aa 98 c0 10 4a 68 48 9f c3 7b 5c 05 cb a7 ff c2 1a 38 8f 14 f1 24 b3 8b 0b 60 88 2c f1 83 19 b0 3b c4 74 11 f4 a5 ef 02 07 cd 90 74 e4 24 0d 04 c1 a1 1f 7c 86 25 60 75 91 4d 28 ee 47 47 00 6f 4d ea 76 dd 3d be 1f 05 8a 5a 9f 53 79 22 c7 f9 1f 7c Data Ascii: JhH{\8$`,;tt$\|%`uM(GGoMv=ZSy"\|++fX!aO/V(3\{]q[Qq2G4Rp[6Mdju%42mZ`F5IK$,y'2WK65/a6s-MTe;v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49808	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:03.635790110 CET	420	OUT	GET /2/AD0IidHSCRACGAAg_Ofz6gUogJ7O9QEwgA84kwc.jpg HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:04.986109018 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: image/jpeg Content-Length: 48652 Connection: keep-alive Expires: Thu, 23 Nov 2034 06:11:28 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg_Ofz6gUogJ7O9QEwgA84kwc.jpg Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i14957_c17987, i2103119_c25795, i1872280_c17483 X-Cache: HIT from i1872280_c17483(cloudsvr) Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 50 00 00 ff e1 03 2f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 [TRUNCATED] Data Ascii: ExifII*DuckyP/http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0C7967EDC3E611E9BCD0B6F55407B5FA" xmpMM:DocumentID="xmp.did:0C7967EEC3E611E9BCD0B6F55407B5FA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0C7967EBC3E611E9BCD0B6F55407B5FA" stRef:documentID="xmp.did:0C7967ECC3E611E9BC
Nov 26, 2024 08:20:04.986129999 CET	1236	IN	Data Raw: 44 30 42 36 46 35 35 34 30 37 42 35 46 41 22 2f 3e 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 3c 3f 78 70 61 63 6b 65 74 20 65 6e 64 3d 22 72 22 3f 3e ff ee Data Ascii: D0B6F55407B5FA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Adobed
Nov 26, 2024 08:20:04.986136913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:20:04.986205101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:20:04.986211061 CET	1236	IN	Data Raw: a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 ae df 9f b5 3e 1d c1 85 87 df f7 a3 bf 7e a0 fa 5a 73 e3 1c f7 f5 07 40 00 00 00 00 00 00 02 a6 e7 9f b3 6f 0e e0 cc d0 8c d1 97 f2 e7 8f 50 3e 47 de f7 bf 1e 7c 7d 01 6f e3 7d df 0b 7b 9c f1 e9 c8 Data Ascii: >~Zs@oP>G\|}o}{4\|{# L\|W;
Nov 26, 2024 08:20:04.986222982 CET	1236	IN	Data Raw: 6f b1 78 d5 8c 9c 7e 53 00 a3 a7 b5 96 f9 fc 6d 3c c4 fa 02 4f 90 d9 c9 4b 45 69 3e 20 b5 a7 9e f9 30 cd ad d6 62 3b 83 32 37 73 7b dd f9 8e 78 e0 17 f7 76 6f 8f 1d 26 bd 26 d1 d6 41 17 c7 ec 64 c9 79 ad e7 90 6c 80 00 00 e3 25 a6 94 b5 a3 bc 40 Data Ascii: ox~Sm<OKEi> 0b;27s{xvo&&Adyl%@>zw3Nhs;\|9'Z#_o-V&g91V1~{Z9/L]lxW\|v{<zZkLqi
Nov 26, 2024 08:20:04.986227989 CET	776	IN	Data Raw: 37 b5 b3 64 cb e5 58 e6 01 6b 0e 0c 95 d6 b5 27 9f 29 8e 80 cf c5 a9 b1 19 6b 33 13 c4 4f 59 05 cd fc 19 2f 5a cd 7d 3b 83 cd 0c 19 2b 16 f2 e9 13 d8 15 73 6a ec 5b 3c cc 73 c4 cf 70 68 e5 c3 92 75 62 91 fb f0 0a 5a 7a d9 a3 2c 5a dc c4 47 70 75 Data Ascii: 7dXk')k3OY/Z};+sj[<sphubZz,ZGpu&O*1\|k8f9 Zuu SbsZkId,cRLkDGpK3%0Z-LtfFb9ZV'GPv5ZcdE::>~U
Nov 26, 2024 08:20:04.986233950 CET	1236	IN	Data Raw: ac c7 49 05 ad 9d c8 d7 8a fe 3c f9 76 07 ba bb 71 b3 cc 44 71 30 0b 9c 47 7e 01 06 c6 c4 60 a7 94 c7 20 ad ad bd 19 ef e1 e3 c0 3c d8 df 8c 19 3c 3c 79 fb 82 7c 7b 55 be 19 cb c7 48 f4 05 4a 7c 9d 6d 78 af 8f 49 9e 22 41 ab d2 62 3e e0 f2 66 2b Data Ascii: I<vqDq0G~` <<<y\|{UHJ\|mxI"Ab>f+Y;.'4dGi;c~0[&z~N-)gAogj5[q8c&_<OxsX #6H=mn<\1#)rxA[yV-{Z)Y*~R"
Nov 26, 2024 08:20:04.986259937 CET	1236	IN	Data Raw: 8f 04 4f 8c f3 32 08 b2 e9 62 be 4f 39 b4 44 cc f6 05 8b 60 c7 6c 5e dc fe bc 77 05 7c 3a 58 71 df ca 26 26 63 b0 3a d8 d4 c7 9a 7c ad 31 12 09 b0 60 a6 2c 73 4a f5 89 ee 0a b1 a3 8b dd f3 f2 8e 79 e7 80 5a cf 82 99 69 15 b4 f1 11 db 90 43 af a7 Data Ascii: O2bO9D`l^w\|:Xq&&c:\|1`,sJyZiCVyqG33qc*Ek;V{LH=Gm>s7cy
Nov 26, 2024 08:20:04.986294985 CET	1236	IN	Data Raw: 0a 5e 2b 7a c5 a7 ea 0b 38 f3 62 9c 53 78 fd 63 bc 02 a6 3d ad 79 c9 c4 56 22 66 7a 48 2c 6d 66 c5 8e b1 e7 11 6e 7d 01 e6 a6 6c 59 2b 33 48 f1 e3 b8 2b e5 d9 d7 ae 6f 1b 53 99 fa 83 4a 96 ad eb 13 5e c0 ec 00 00 05 3d bc d8 f1 57 f3 8f 2f b0 3c Data Ascii: ^+z8bSxc=yV"fzH,mfn}lY+3H+oSJ^=W/<$qH!\Z3 l/~o>s@_.<#c[9g)y}A\|O)CL-JL3k/H}Agk6<UQ=lY)3H6/X
Nov 26, 2024 08:20:05.106297016 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 'wnXOlm{w(?/l{3[ c.<GJO_{.LI2W1ZWIGX39c,OG>H6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49809	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:03.636010885 CET	420	OUT	GET /2/AD0IidHSCRACGAAg_Ovz6gUo67PL4AIwoAY4sAM.jpg HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:04.893899918 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: image/jpeg Content-Length: 122466 Connection: keep-alive Expires: Thu, 23 Nov 2034 06:11:28 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg_Ovz6gUo67PL4AIwoAY4sAM.jpg Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i35690_c25891, i2103125_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 50 00 00 ff e1 03 2f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 [TRUNCATED] Data Ascii: ExifII*DuckyP/http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:2C7DF338C3E711E9931DCFC8BEE002E6" xmpMM:DocumentID="xmp.did:2C7DF339C3E711E9931DCFC8BEE002E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C7DF336C3E711E9931DCFC8BEE002E6" stRef:documentID="xmp.did:2C7DF337C3E711E99
Nov 26, 2024 08:20:04.893943071 CET	1236	IN	Data Raw: 33 31 44 43 46 43 38 42 45 45 30 30 32 45 36 22 2f 3e 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 3c 3f 78 70 61 63 6b 65 74 20 65 6e 64 3d 22 72 22 3f 3e ff Data Ascii: 31DCFC8BEE002E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Adobed
Nov 26, 2024 08:20:04.893955946 CET	1236	IN	Data Raw: 28 e5 e9 43 88 20 3e 3b 82 3a 1c 50 48 c7 38 34 35 a1 18 02 42 29 8f cf 19 68 a4 94 53 8c 80 c4 35 80 e5 91 4e 58 10 7e 1f 4d 48 24 0a 81 40 7e 1e 18 85 24 e2 97 e3 88 c1 21 0d d4 91 30 78 a4 68 df a6 a5 25 4d 0f c4 62 14 a8 ee fc 0f 8d 6f 17 a3 Data Ascii: (C >;:PH845B)hS5NX~MH$@~$!0xh%Mboxn)PlZmn5R$%@{FWqkwr'0Y/Sg-lwq1@3x$tp!b8 J'S$w^cL\~
Nov 26, 2024 08:20:04.893963099 CET	1236	IN	Data Raw: 48 02 0d 5d ea 0f c3 1a 21 20 17 56 aa f8 f9 a9 d3 2e f8 a4 05 91 5d 09 3a 4e 9e b4 1e 07 04 53 da 80 01 d7 e9 ee 7c 31 a4 65 84 50 69 05 4e 5e 18 10 51 54 96 9a 98 a4 a3 bf 70 3e 3f 0c 10 34 a6 e7 b0 ee 37 57 a9 77 c9 77 08 f7 9b e8 3c d6 d6 d0 Data Ascii: H]! V.]:NS\|1ePiN^QTp>?47Www<al{xSN<YZ$1,IUJ$33::5t@[Cs)$QA\5/7ZK7eT3/^tx,3HkK=i}q0gO4Os+Y
Nov 26, 2024 08:20:04.893968105 CET	1236	IN	Data Raw: d0 ac 9e 16 98 2f 1e d6 fb c7 cc 7d a2 be 93 fb 19 8b 74 e3 9b 8c c2 5d f7 87 5e 92 2d 67 7e 8d 3d bb 8c ed ae 29 96 b5 c9 ba 3a 9c 48 34 8f a5 7e dd fb 8d b0 fb 95 b3 b6 ed c5 66 7b c8 ed 11 46 f1 69 39 09 79 65 70 c3 ff 00 87 b8 86 a5 87 f9 5c Data Ascii: /}t]^-g~=):H4~f{Fi9yep\UXf84IK/U4SYU88E(i4Sk$@RAE'S$%^o,kpV(d0{PghyM-u ?0q-EbwSpDe7{cn@\|oS+t
Nov 26, 2024 08:20:04.893975973 CET	1236	IN	Data Raw: 22 ff 00 34 f1 b5 52 9f 31 5c 73 e9 e4 5e a2 01 76 6d b2 f2 26 48 2e 9b 8e de 16 67 8e 27 0d 3e da e5 fa ea 8c d5 e1 f9 a5 40 f0 c6 5d 4a 99 5b bd db 27 db 23 a6 f7 60 f6 8b 2b 69 b6 dd a3 7f 56 c6 46 1d 3d 39 56 a8 6b d6 8c 41 c6 60 d2 63 db 2e Data Ascii: "4R1\s^vm&H.g'>@]J['#`+iVF=9VkA`c.llRLkdS1_K8&Z[G]~D<))lH,Y\|T'2+(4\MA?m*9i}&{-,<2@2L[r{s>jl
Nov 26, 2024 08:20:04.894110918 CET	1236	IN	Data Raw: 34 4d e6 52 3c 08 38 a4 18 ba b0 d8 37 30 4c f6 87 6b b9 3d 6e ed 00 55 3f ef a7 d2 47 d9 8c ba 26 6e b7 68 ab ee 3c 3f 70 89 3d 4d bc 47 ba da 9e af 6c 6b 20 1e 0d 1b 1f e0 71 c9 ed 34 75 5b 95 7a e0 a7 bd a9 8a 47 8c ab 41 3c 59 48 8c a5 58 78 Data Ascii: 4MR<870Lk=nU?G&nh<?p=MGlk q4u[zGA<YHXxTcQSI6Y~Y$JQKe0@[2HOAJQAV&HE&I9D"r`:A_F+(k^!b`MB#r2906FQ8dhtCR
Nov 26, 2024 08:20:04.894115925 CET	1236	IN	Data Raw: 49 20 23 3c 42 8e b8 8e 78 24 b4 b9 8a 2b bb 49 bf ad 69 3a 2c b1 37 fb d1 b8 2a 4f 81 a6 00 a0 1e 01 fd a6 e5 b7 1f 6e b9 0d cf 02 bf 39 c9 b7 2e bb ad aa 62 3e 90 f0 39 67 45 04 96 21 75 6a 3d 46 2c 91 a7 c0 9d 4f 73 39 17 19 d1 17 b8 9c 4a 54 Data Ascii: I #<Bx$+Ii:,7*On9.b>9gE!uj=F,Os9JT"c"X7sRhxkla-kGP@YjzTgIzz@$QO{p){(GjqJgU3=0 UjIY#`"09AyW6OYIv6
Nov 26, 2024 08:20:04.894126892 CET	1236	IN	Data Raw: 33 a8 15 1a a4 19 fc 69 5c 73 dc fd 4c 95 c5 51 ba 79 cf 24 d9 f8 c7 14 b1 de b9 56 c9 2e fd b2 d9 ef 36 56 b1 2d a4 df 97 bc b6 37 e5 e2 33 db 4b 50 56 45 d3 5a 54 2b 0c 9a a3 19 aa 9c 12 b8 73 c8 d5 5c 9f d9 9e 3d ce 78 e5 e7 27 e0 33 a7 27 d8 Data Ascii: 3i\sLQy$V.6V-73KPVEZT+s\=x'3' vZ@B/!cXG]eSrnJIej"+Xid?ml<2n[p[.en#pbH$^WTu3}AD~`A#caOhI
Nov 26, 2024 08:20:04.894133091 CET	1236	IN	Data Raw: c9 e2 94 0d 47 ed 20 83 f6 8c 48 06 0e cb b0 ee a0 8d ae e1 b6 ab c6 e9 69 2f 9a 3f b1 49 a8 1f ee 9f b3 1c ad b4 9e 86 d6 eb e2 56 77 2d 9b 70 da 18 fe 6e d4 a4 64 90 2e 93 cf 15 3e 2e 3e 9f b4 0c 71 b5 1d 4e ca ca da 11 61 c1 02 be 72 73 0c 0f Data Ascii: G Hi/?IVw-pnd.>.>qNarsL5$)'sS`) ;Q"94#hx*j. I+5#Jd(d.!@!F,ufQaCCq HdE7JCC1Z3Dd
Nov 26, 2024 08:20:05.015546083 CET	1236	IN	Data Raw: ff 00 e7 1d be 07 3c 5e a2 74 f2 17 6b b2 4b 33 12 8f 09 03 eb 21 d7 20 32 e8 09 c6 95 83 ab d4 9a 82 41 b5 c1 2d ba c8 b7 10 c8 a5 67 87 b7 4a 64 70 6a 46 84 3a 73 14 b1 22 2d b3 63 8e 56 06 8b 34 a4 90 0f c0 60 aa 44 cb 05 af 21 dd 66 81 65 e4 Data Ascii: <^tkK3! 2A-gJdpjF:s"-cV4`D!fe3[7K9Fi$[\K"r ?t-C@$H"Z jnJC.NSA}))BHE?CZ[ys(p bIC#q1%RIP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49810	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:03.675338984 CET	424	OUT	GET /2/AD0IidHSCRACGAAg1_Hz6gUos_moVjC6BDjHAw.jpg.webp HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:05.018201113 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: image/jpeg Content-Length: 21142 Connection: keep-alive Expires: Tue, 21 Nov 2034 15:23:07 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg1_Hz6gUos_moVjC6BDjHAw.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i62708_c21843, i2103125_c25795, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 52 49 46 46 8e 52 00 00 57 45 42 50 56 50 38 20 82 52 00 00 b0 b2 01 9d 01 2a 3a 02 c7 01 3e 6d 34 96 48 24 23 22 29 a3 53 2a f9 30 0d 89 67 6e 2d d1 3a f1 ee aa 89 a2 72 43 94 b9 e8 c7 62 93 ce af c2 13 cd 3f af 74 a6 31 57 34 ca 7c f6 54 04 fd 0a 32 de 72 6e 7d e3 b7 ac 86 3a de cd 9d df ce f7 ca f4 bf fd df a4 4f e3 37 c2 df eb dd 18 1e 9d 3f db 7a 7f f5 4a ff 57 e9 b3 f4 bb f5 c0 cb f4 f3 bd f3 ff f1 bc 0f fc e3 dd bf 74 2c 47 fd b7 83 5f d8 bb 6c 76 db fb 17 f4 fe 83 5e d5 f4 06 8f d7 4e 68 23 f4 8f f0 ff f4 3e e7 3e 50 bf 3b cf 3f e3 ff ce fb 01 70 f4 fd ef fe 67 b0 3f f4 ff f3 5e b2 9f f0 f9 d2 fd 97 d4 7b a6 81 37 bb be 48 b5 23 6e 10 2f 5f fd e1 ff 6c 46 02 4b dd 0d 7d 21 3d 80 6f c7 6c 38 4d 0c 7e 21 eb 05 21 ec 69 af 30 18 26 07 e3 72 0f 99 31 1b 88 5d 96 fa fd bd d0 79 9d 15 cd 21 2f dd ae b7 63 5b 2c ff 22 21 f6 e3 90 8b 32 92 8c da d6 e9 75 a7 e6 6c d6 9a 03 f9 45 f3 05 9a bd df e9 87 0b c5 66 a5 b7 db 8e 78 58 bb b5 fb 9a 0d 93 bb 63 7c e4 6f 5a af 70 e1 d3 2f 2a 87 fd b1 7f b7 1d d2 [TRUNCATED] Data Ascii: RIFFRWEBPVP8 R:>m4H$#")S0gn-:rCb?t1W4\|T2rn}:O7?zJWt,G_lv^Nh#>>P;?pg?^{7H#n/_lFK}!=ol8M~!!i0&r1]y!/c[,"!2ulEfxXc\|oZp/3\|1r4aY\;24sZ#j$n/a<_We8LEq=V8NR8()&@[G_jFvOI5.mNuki\|PHfu?#^p-D:IxdjT1xPZKb;n}cMuF GQ2=bAYF__{=lDp?>,FSv6hs&=z{O/suKmu%9u8Yjs]?-;LLt D~/b1qx"mI%96gnENDl27L6FR&[
Nov 26, 2024 08:20:05.018255949 CET	1236	IN	Data Raw: 5a ca c1 89 55 d0 ed 88 dd 69 4e 76 1a 7e f2 6c c2 a6 82 9b 49 97 77 16 66 cc 42 d9 be c8 01 2b 38 28 0d 90 51 96 a2 1b 84 c2 51 33 20 29 d5 50 f8 c7 6e ad ff 0b 22 fa 67 98 96 3b 76 4b 74 77 51 ad 05 b6 9b 04 47 74 04 e1 45 a3 04 f5 72 d0 17 f1 Data Ascii: ZUiNv~lIwfB+8(QQ3 )Pn"g;vKtwQGtErN\|l^$)q?Ih1?-Oo>zb[\BnvIm`?`25-wC,>vo9swujGsI3-t#]}NY
Nov 26, 2024 08:20:05.018263102 CET	1236	IN	Data Raw: 98 77 6c 25 b5 0e 08 80 b3 a9 16 85 e9 dd 34 dd 0d 33 e2 92 a3 e8 2f 6b 2a d5 af b9 e1 3f 7f b3 de 84 95 41 ec ed 72 91 42 58 83 e5 66 8e 0d 79 5a a4 1d 46 2b a9 bc b6 92 dc e7 f6 54 4b 86 ef 4a d6 c9 e7 2a 3f 6d 07 83 2c cf fd dc 87 86 dd f5 cd Data Ascii: wl%43/k?ArBXfyZF+TKJ?m,PDEM/81(65n)p"%sxmug]ZRvzJv(b)\1k:/c! 7BS5<&~Y'9*,KLiQuDA
Nov 26, 2024 08:20:05.018274069 CET	1236	IN	Data Raw: e0 8c ed 3c 11 c7 39 1e 80 dd aa af 56 75 64 e0 58 87 02 3a 18 a0 cf 38 07 d7 29 7e a5 d7 fd 87 6c 87 3e 32 e2 2a a5 53 b9 be 7e 56 ae 33 21 f3 d9 dc c8 52 2d d3 56 da 03 75 e4 a6 11 d1 2d 6d d4 0a 06 0c 71 f4 c8 59 34 18 12 54 52 84 47 d2 53 1b Data Ascii: <9VudX:8)~l>2S~V3!R-Vu-mqY4TRGStXg;T\|CanLYH]V(en/Wc@{#;dW6kl?f0?7sm*;35\4_B}BL?sXQ1cNS-Wi`ZqYBE65zvwiC
Nov 26, 2024 08:20:05.018280029 CET	1236	IN	Data Raw: 7d 6b cf a5 8c 4e d2 aa e0 1d 7d 39 74 b7 36 1b b9 c6 8a 23 cd d8 16 61 9f 0b 09 7b 5a 30 0a 41 ea 89 cd de eb 9e eb a2 87 03 10 12 86 3c 67 e5 86 0b 08 8a 2d 14 b3 3e bf 3c 5f d5 ef a2 21 72 f4 46 dc 13 f0 57 42 ff 53 11 b0 31 f7 02 e2 7e 2f de Data Ascii: }kN}9t6#a{Z0A<g-><_!rFWBS1~/k($)dXh6QV;<z5Eh==\vT,qTB`IsO8S&\|PJ71~9xU%ViZ}yo@66l}&FG#njW>
Nov 26, 2024 08:20:05.018352032 CET	1120	IN	Data Raw: 35 fa 28 2d fa 4d 0b cd 19 85 1b 74 e2 62 45 3c c6 6c c1 eb 3f 29 e3 ea 63 88 18 fe 30 70 f6 3d a6 09 56 e2 b9 0b c6 65 fa b0 4f 10 fc f4 fe a1 a6 a2 e3 61 64 9a fa 44 e1 79 4b 6d c7 be ef de e5 57 75 ee 37 7a 5e 8c 29 cc 00 40 48 27 1d 77 1c 2d Data Ascii: 5(-MtbE<l?)c0p=VeOadDyKmWu7z^)@H'w-P_\5cKUb3h%KGsPiK-4IOs{<a.$h"FCS]'&3)=ri(ryq~7g_zWW"5i6(Pp.}3`[
Nov 26, 2024 08:20:05.018414974 CET	1236	IN	Data Raw: 23 46 a8 0d fe 63 0f d7 a8 ff 5f d2 c9 3b b8 df ab b9 2a 28 d1 c7 e7 a9 95 42 b7 de d3 1e 10 4e dd b1 bd cd 0e 18 17 a1 da 8f 57 6f f3 bd d3 72 68 bb 88 89 98 85 fe 27 3d a6 e6 93 bd 5e 5d 84 e7 22 ae 6c e8 d2 fa ba 48 a0 ab be 58 0d 6a 8e 1c bc Data Ascii: #Fc_;(BNWorh'=^]"lHXjMl8XLFEdZE=zih:sj+43F?QRP:zi$&_Qb+i$$hl0KM*^Hk\|_m?(}wnEP[c[~aUKN\|8FQs
Nov 26, 2024 08:20:05.018425941 CET	1236	IN	Data Raw: 11 47 62 ab 5e 73 d1 53 98 74 e9 29 1e ec af 16 e5 f9 db a1 b9 65 10 d7 ff 38 1c b2 03 9d 51 c5 1e 6e e6 f3 4a d8 c3 00 ba 09 d1 6f 77 bd c8 82 28 63 37 a3 43 dc 6a dd 72 cc 44 f4 99 d9 22 6d f7 b0 5a 26 78 05 4f fb b7 bd c8 26 4c 2e 8d 24 46 bc Data Ascii: Gb^sSt)e8QnJow(c7CjrD"mZ&xO&L.$F;}?5K7CZA)#qbhh9S"iH/YAmUMy'Q#%]>6#cY4.]e0Bg5hJ;_To?#V]@QYg
Nov 26, 2024 08:20:05.018431902 CET	1236	IN	Data Raw: fc 0a 70 b4 61 ae 59 dd 16 f3 03 11 de 54 49 5d bd b1 5c a6 6f 03 54 ae 36 01 a8 e6 1f 19 d6 1c fa c2 d2 35 c1 a7 95 04 32 89 06 2b 51 4d 6c 41 01 17 c8 8a 88 ff 0e dd db ca 3f ef 3d 51 a9 8c bc 9a 21 ce 25 0b 0e 5b 33 38 b7 1b fb 1f 1f 04 ff 9c Data Ascii: paYTI]\oT652+QMlA?=Q!%[38n~p_}U\j#mDX+-si#`!:7\|LH@M!R?T8*\x\T@W60(e-Cx3@'=\|$`bhSm%jIJu
Nov 26, 2024 08:20:05.018438101 CET	1236	IN	Data Raw: 4d e0 ec 52 2d 2b 8a 56 4e 85 ce 97 77 44 1e b0 94 21 db 9e e0 ba c9 a3 05 7e 4a 3c 4d 4f 30 95 31 45 40 74 38 df 0b fe 7e 6c c3 8f 65 f2 5f 7c 51 ed 8d 92 78 29 22 d9 43 06 29 c2 e5 89 d7 74 ec d1 b0 56 e2 13 a2 1a 25 17 fa b0 5e c5 b9 80 4c 48 Data Ascii: MR-+VNwD!~J<MO01E@t8~le_\|Qx)"C)tV%^LHWrU6md~3W@vc*2A7}(_Mp7)DG#?x+.(0zTbe^6(;BFp=`\|Z&RNJ&1pgP9NA4QN
Nov 26, 2024 08:20:05.138473988 CET	1236	IN	Data Raw: 14 80 ed 17 77 86 b4 75 5f d1 6e 45 c7 e1 78 bb e8 03 57 cb 1f 04 96 c9 f1 ca 08 28 32 33 3b ab 47 fb 92 d6 4d 9c 02 b7 b7 7e ba 54 2b 2b 44 9c 8c b6 9d c4 03 33 77 89 73 31 94 2a 69 73 55 ac e5 a1 58 56 49 eb 56 50 3f 18 44 7c 43 d0 9d 18 43 21 Data Ascii: wu_nExW(23;GM~T++D3ws1isUXVIVP?D\|CC! J=<SE<__yB+b>VYxXkXslOrzH-r<!!}NRBet1Z{-^<84^:?1ZCX)5Q-bXxb_
Nov 26, 2024 08:20:05.298023939 CET	425	OUT	GET /2/AD0IidHSCRACGAAg1_Hz6gUo4NKP5wQwugQ4xwM.jpg.webp HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:05.779408932 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:05 GMT Content-Type: image/jpeg Content-Length: 14146 Connection: keep-alive Expires: Wed, 22 Nov 2034 13:30:35 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg1_Hz6gUo4NKP5wQwugQ4xwM.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i15413_c17987, i2103127_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 52 49 46 46 3a 37 00 00 57 45 42 50 56 50 38 20 2e 37 00 00 50 63 01 9d 01 2a 3a 02 c7 01 3e 6d 34 95 47 a4 23 27 2a a7 55 19 f9 50 0d 89 67 6e 73 cb 3a 63 92 f5 3a 85 22 e3 33 9b aa 70 8c 36 86 8f 9b f4 33 b1 7b 6c 34 6a 28 f7 46 7c 7b f7 8b e8 e4 1e cc 83 bc 70 a0 c1 5f a7 ee 6f 9e af 3c e5 f9 eb f9 c8 f4 fe 7a ce 74 4e 7a da ff 98 c1 ec f4 17 ea 5d a7 b5 8b d2 25 86 3f ed 39 37 e7 3b cc 7f a2 fc e4 f9 88 f2 33 ab 6b f1 bd 07 7d ad fb 57 fd af f0 9e ed d3 b9 fe 7f 47 9e 9e f8 7f 1e 23 fd bf 37 ba 18 07 b9 00 ae 30 5f 55 07 b6 66 d9 7e c3 54 95 9f 02 23 d8 11 ab 60 fd af 33 6b 1c 0e af d0 8c 4a 8e 63 dc f6 03 2d 50 3d 50 3c ea b9 0a 6b e0 e6 d2 39 c5 96 ce a1 bf 6b db 17 c4 2d 41 71 10 fb f9 75 28 1e c2 bb 55 e6 fa 2f da 60 46 e6 47 fc 42 2c 81 1f eb b7 a1 4b ae 12 aa 0d 9d 02 28 8b bd aa a0 df fc 0d f7 e6 58 ef eb bb d5 5f 48 e8 a1 9f 1c 54 4b bb ad 87 e7 c3 ec 51 d6 3b 3e 16 f3 cd 1a d0 dd a6 71 de 8b 73 b3 48 4d bf 24 df 56 c8 75 2f 4e 49 3b 63 b5 9a 85 bc 4a e8 92 d9 31 3b db 2f 23 29 da 42 93 [TRUNCATED] Data Ascii: RIFF:7WEBPVP8 .7Pc:>m4G#'UPgns:c:"3p63{l4j(F\|{p_o<ztNz]%?97;3k}WG#70_Uf~T#`3kJc-P=P<k9k-Aqu(U/`FGB,K(X_HTKQ;>qsHM$Vu/NI;cJ1;/#)BUK&$~O6%t}"v9EK!d$}+K.&HkMBiBq Fl=got}uM2^1xEKjMp/1?]\L3~r@hVw]Wp0lr=Jz&]4?h9us8?x%Dm=K0~85xfsVnt\|o?"VMK8;:Ki=#Z:0Nfa)!exVu^)81E(GgcN6oA)C$Y893yT>G5*'L}^ K+-;
Nov 26, 2024 08:20:10.496414900 CET	425	OUT	GET /2/AD0IidHSCRACGAAg1_Hz6gUopJONngIwugQ4xwM.jpg.webp HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.925591946 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Type: image/jpeg Content-Length: 68702 Connection: keep-alive Expires: Wed, 22 Nov 2034 13:30:39 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg1_Hz6gUopJONngIwugQ4xwM.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i34696_c4672, i2103127_c25795, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 52 49 46 46 56 0c 01 00 57 45 42 50 56 50 38 20 4a 0c 01 00 d0 99 02 9d 01 2a 3a 02 c7 01 3e 6d 2c 90 45 a4 22 a1 97 ae 05 5c 40 06 c4 b1 b3 bc bb 99 23 60 50 ca ed 3f c7 8d a1 98 64 51 2e c8 e1 c4 20 f8 1d d7 1c 41 d2 0b 60 5c 81 38 03 9f 27 76 e0 64 da 4a f3 ed b6 d5 bd 0d 79 af 1b e6 2d bd 05 97 ff b8 f7 f4 ff b9 ec 47 fb bf fb 1f 60 3f ec 1e 5c be bf 3f 78 bd 4b 7e de fa b7 7f da fd d2 f7 a9 fd d3 d4 03 fa af fb 9f 5b 5f fc 9e cf 3f e5 7f ec fb 08 fe e1 fa cc 7a b3 ff 8c ff d9 d4 01 ff ff db 63 9a 9f cc bc 88 7c e3 fa 0f f6 ff 96 9e 75 f9 4b f7 2f f0 5f e7 7f eb ff 89 f7 39 ff 8b fc e7 90 0f 61 fe d7 ff 87 fa 8f 52 3f 99 fd ef fd b7 f7 cf 6e 3f d7 7f e3 ff 49 e3 bf eb bf d2 7f e7 f5 05 fc bf fa 9f fc 8f f0 be bb 3f 53 ff a3 fd 47 fc 8e fd bd c7 fc ff fd cf f3 3f eb 3d c1 7d a7 fb 17 fd 5f f1 3f ea bf 71 3e 03 3e 7f fe d7 fa af 54 ff 57 ff 15 ff 33 fc 9f e6 17 d8 0f f2 df ea bf f2 7f c1 fe 54 7c cf ff 13 f6 d7 c9 db ef 3f ec ff f7 7f ab ff 4b f2 03 fc e7 fb 87 fe af f2 3f e9 ff 77 be 9b bf bc ff [TRUNCATED] Data Ascii: RIFFVWEBPVP8 J:>m,E"\@#`P?dQ. A`\8'vdJy-G`?\?xK~[_?zc\|uK/_9aR?n?I?SG?=}_?q>>TW3T\|?K?w?g}E_=z=#\dfZ]=~\ peFP 1^zpe~SBT}jk'U%JoA{C&Reqj?]SoW\|S~%pavfrNnG}]<z\|D^\|o8/A?/>U,}dSt$Sj?FY-j)&=g*3Y[ZC2qIR[b -Pe+e)Z@(p43mHEpyqa[#R=dRh.\N~uwxptAU&fG)=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49804	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:03.708029032 CET	323	OUT	GET /2/ABUIABACGAAgl4iFjAYoubm42Qcwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:04.114484072 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: image/jpeg Content-Length: 97494 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAgl4iFjAYoubm42Qcwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i31795_c17589, i2103119_c25795, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 52 49 46 46 ce 7c 01 00 57 45 42 50 56 50 38 20 c2 7c 01 00 b0 fe 04 9d 01 2a 8a 07 58 02 3e 6d 36 96 48 a4 22 a2 a8 24 18 d9 11 00 0d 89 67 6e 73 ef 59 ef ed c3 1f ff ba d0 fe 58 ac 1f e7 fd d3 f1 07 cf 3f ee fa 1a ff ae f5 d6 cf e2 ed bf f2 f4 eb ff 67 a2 6f fe 58 2c 5f b6 8a 17 91 c3 fa ed 31 9a e9 6f 78 0f fd ff 8a 47 9b 7f a5 e8 c8 ff 23 b2 c7 fc 1f 61 4f ec 1f e9 3d 73 33 a4 ff 7f 6d 7e 7c 1f b8 3e 39 78 a8 a1 d3 b1 30 e9 93 1e 83 f5 0e 4c 1f e7 f0 d3 ed ff f2 f9 98 7c 27 f5 9e 7b ff f4 7a c7 ff 19 ea 2d fd df d1 6f ff 5f dd 6f 80 bf e2 bf f6 7a a0 fd c1 f5 9f ff c5 fb cb ef 4b fc 7f a8 47 f3 ff ef 7f fb 7d af ff 7f ff ff fc 35 7f 81 ff db ff ff dc cb f6 a3 ff 77 b5 77 ff 5f dd 4f fe 7f 32 7f e9 bf f4 fe e7 fb cf ff ce f5 00 ff ff ed ad fc 03 ff ff 58 3f 94 7f ec ff 13 f8 d9 e6 ef ed 6f e5 8f 9d fe 44 fd a1 fb f7 fa 6f fa 7f e1 7e 79 7f 36 fa ab cf af c6 7f 71 fb 4f ea 67 f3 cf c0 ff c1 ff 05 fe 83 f6 6f e6 8f f7 1f f2 ff d2 78 df f1 87 fc ff f1 de c0 bf 99 7f 44 ff 6f fd d3 f7 a7 fc d7 c4 4f [TRUNCATED] Data Ascii: RIFF\|WEBPVP8 \|X>m6H"$gnsYX?goX,_1oxG#aO=s3m~\|>9x0L\|'{z-o_ozKG}5ww_O2X?oDo~y6qOgoxDoO]+W\YOope~3#'?o??u_gog_%"EOj=d#6jLZK5EOiZ:K^O3yWZ;D?_f\|6m:J1r2=xY\!\j>s+eI.wP~Za]^}v/JCz)ak]}R~{?1kV]t{+'*ZNp3,8#]\|NuO/sR4{xI).xNK{WU_2D
Nov 26, 2024 08:20:04.114533901 CET	1236	IN	Data Raw: 1c 18 67 d5 2b 22 3f 69 62 f6 07 20 1e 4d 5a f0 cd 79 ff 75 77 33 e6 b1 78 d3 88 78 5b 2c 40 3a 48 4e 5e 9f 8a 70 62 64 c8 e5 e3 21 d5 5d b6 dd d6 83 3c a2 24 73 52 b9 89 c2 45 d7 51 ef 24 37 4a a7 25 9a a0 ab 42 05 90 ab 0c d2 6f 16 97 3b c2 92 Data Ascii: g+"?ib MZyuw3xx[,@:HN^pbd!]<$sREQ$7J%Bo;*rr~)_P.!/E9_ek^<$aAx);M I5m6q"8gnE)cp6^5TZK >+e~}B;nMdd>1ayM-YRZ7@b
Nov 26, 2024 08:20:04.114547014 CET	1236	IN	Data Raw: 39 ae a8 bb dc d7 06 8d b9 f9 23 2b c0 ae 7c 8e d5 d0 1b b1 8f f8 e7 7e ee e0 5c 22 11 71 3a c2 65 40 e8 8a 8b 32 75 86 af d9 dd 87 61 b6 a4 c5 b7 d2 25 1d 62 59 38 d6 dd 4f 05 0c 83 b1 6e 59 69 37 c6 ce 0f 88 94 b4 ea b9 f5 3c ab dc 9f df c2 f8 Data Ascii: 9#+\|~\"q:e@2ua%bY8OnYi7<`)wqliXSI/g$Ze.`K;LBDj(g9'O=7UJR?-\EJ_gR zu![\kDpi'Y?Y0lqbh3fkrWr=
Nov 26, 2024 08:20:04.114593029 CET	1236	IN	Data Raw: 4b 59 61 1f bc 75 9e 5b 65 23 6f 0d ae f0 28 8f 60 98 dd 14 ed 4f 34 2d ac 27 b3 a1 1c 9a bf 92 d7 8a f4 22 de 99 fd f9 6e 4f c4 ab 48 df 7b 7f e8 af 18 ff 47 1d 74 8d d9 8e 7f 60 70 3d 30 ab f6 18 b1 58 e0 1f 3d 31 43 c9 62 d6 5f 5f e3 cd a3 af Data Ascii: KYau[e#o(`O4-'"nOH{Gt`p=0X=1Cb__JW1Y]s+F\E#2'T! )vCEzAWauME6AU6jf?C#Q,VUcHRB0><~.guC]">ggTt])ftK]%
Nov 26, 2024 08:20:04.114609957 CET	1236	IN	Data Raw: 90 ca 4f b4 b1 dd bb c2 ea 54 83 a7 b8 54 7e 6c 2e ed 4b dd 77 99 6a 79 72 a7 22 8c 70 e9 7c 28 c7 bc cf 93 44 98 be 1f 47 81 41 1f eb ad c0 39 82 73 fb bb 83 45 e5 55 e1 30 14 3a 6f 1d 9d d2 74 d8 70 51 4b 8e 7f da ac ee d5 bb 23 b5 06 5f 6e df Data Ascii: OTT~l.Kwjyr"p\|(DGA9sEU0:otpQK#_n6+k"N(jM3\|hlf't<ZrbqtnKyDr!O`/ZS)K(wV"P6Sl<;WRQY_(J\#@;
Nov 26, 2024 08:20:04.114620924 CET	1236	IN	Data Raw: 09 11 35 6b 95 0b 2d d0 bf 62 4b 79 95 cf 2e 4b 79 75 bc 33 a8 e3 75 d4 ab 00 74 ea ca cf ca 54 d3 d4 7d 6b 86 18 f7 66 35 9f f0 2b b6 d4 13 07 00 ff 42 e4 96 4b af 8c e3 75 73 29 25 82 f3 c9 5c 3d 5e a3 33 93 a9 63 ce b1 cc 88 c0 b4 25 e6 b1 e7 Data Ascii: 5k-bKy.Kyu3utT}kf5+BKus)%\=^3c%;TVFE8HotYM"fT3Nx8[3{k5U:B'48f88\|%MS;h_`s'I`U\|0eRTz~Wd
Nov 26, 2024 08:20:04.114633083 CET	1236	IN	Data Raw: ad fd 02 c2 ea a8 4c a6 7d ca ec 8d 94 4d a3 70 3d 2b b7 a2 07 0e 2e ad a1 64 92 9b 09 15 3c 31 db 5e 86 cf 04 b7 3c ee d8 f4 8d 0a 47 5c b2 ab 80 31 3d 18 f4 4b 59 6b bb 56 ae 4f 84 12 0d f6 8d e7 4e cb e5 ae a3 52 54 45 56 94 97 2a ad da 20 f2 Data Ascii: L}Mp=+.d<1^<G\1=KYkVONRTEV* EN3X4lp=(tr2H_t\q_U/OF!Kh'L\Kl7e RmwD{kv5d[-\|^@p^EpYlPXDyL12D*JH2!
Nov 26, 2024 08:20:04.114675999 CET	1236	IN	Data Raw: ec 6f 5b 91 8d 5f 3a c0 fb 6e 95 d8 35 b8 66 63 e2 55 cb 31 e7 f8 c0 0d 71 48 e4 f2 18 d4 25 c9 d9 4c dd f2 b8 22 e0 fb 15 55 29 28 73 82 63 71 01 f7 6b a2 fd 11 8d bb c5 3c 40 6a f8 84 df 52 59 4d 49 50 e4 f3 1c 09 9a 2e bf 40 c9 e3 e6 84 17 be Data Ascii: o[_:n5fcU1qH%L"U)(scqk<@jRYMIP.@ia,5^'Q_Bb7#WT*?O!x6]uu?%>oj;sv`FUb xSC-?\|2NAr,t}K{[4oGK%%$:
Nov 26, 2024 08:20:04.114701033 CET	1236	IN	Data Raw: 0d 8c 71 28 ee 0f f8 4c 14 8d 3b 57 98 98 d4 2c e0 60 1d eb 2b 1d ac 3e be 6f 94 e9 4d bc df 55 c4 17 78 c5 7a 88 3b 3e a5 29 34 a2 f8 03 f5 c2 91 a7 60 4b 6a d8 01 97 65 1a 8f fd 0c e7 72 f6 37 cb 40 10 25 5e 3e d4 83 e1 2b c0 5f c0 9c 9c d0 d4 Data Ascii: q(L;W,`+>oMUxz;>)4`Kjer7@%^>+_t4:az$TNKS"PdMem=.R.-I&G$wek!RyCQnlFS9@b=G:@@'3URZN}6~0l(1
Nov 26, 2024 08:20:04.114712000 CET	1236	IN	Data Raw: 1a 5e 2b 8a be f1 b3 15 20 70 29 e2 8f 9b c7 fb af f1 0a cb ef 38 2e ce 22 b4 4c eb 43 0c 83 ad 06 fe b6 2a 1f 2a 6c ae cd 2c 8a 67 df a1 ed 76 f1 eb 01 61 86 43 d1 4a 80 2d eb 1c b4 8d 38 3a e5 16 aa c0 ad f1 05 dd f2 b0 9b 6e 8c 73 6d 87 3c 51 Data Ascii: ^+ p)8."LC**l,gvaCJ-8:nsm<Qr+f"[=COKFn~;13^`n}hf'0rbJ\~Ck"a,=67%\J(;kq<5+[94vc\|sUoh\|{B8)%
Nov 26, 2024 08:20:04.234709978 CET	1236	IN	Data Raw: 0c 79 8d 91 99 a8 00 7a 0a b4 7c 18 97 ff cb dd cf 6d 33 b9 c9 62 04 72 71 f3 7e 76 17 ac 13 75 92 bb 33 13 7a ae 22 10 c9 6d f8 e9 a2 b7 07 ba d6 8e 4e a9 db 01 d8 7f e9 9a 09 44 f8 6e 35 27 11 a2 3d 26 89 02 22 29 06 97 de 57 70 24 96 c4 33 77 Data Ascii: yz\|m3brq~vu3z"mNDn5'=&")Wp$3w$t03PIB=81ecKJ0//^L!UmGyv[d._0ETrvp*kR`uE#2!6&YsR:e/\`C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49814	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:03.829062939 CET	379	OUT	GET /api?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=onlineMapCallBack HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:05.776978970 CET	1174	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 398 Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:05 GMT Expires: Wed, 27 Nov 2024 07:20:05 GMT Http_x_bd_logid: 1205165646 Http_x_bd_logid64: 1205165153880178698 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=5708682521ECBFF0E08D91B3FF8FFEE0:FG=1; expires=Wed, 26-Nov-25 07:20:05 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=4F312217E12805855D837D6E84247F00:FG=1; expires=Wed, 26-Nov-25 07:20:05 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12051656462862561290112615 Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 77 69 6e 64 6f 77 2e 42 4d 61 70 5f 6c 6f 61 64 53 63 72 69 70 74 54 69 6d 65 20 3d 20 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 20 77 69 6e 64 6f 77 2e 42 4d 61 70 3d 77 69 6e 64 6f 77 2e 42 4d 61 70 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 42 4d 61 70 2e 61 70 69 4c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 77 69 6e 64 6f 77 2e 42 4d 61 70 2e 61 70 69 4c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 6f 6e 6c 69 6e 65 4d 61 70 43 61 6c 6c 42 61 63 6b 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 6f 6e 6c 69 6e 65 4d 61 70 43 61 6c 6c 42 61 63 6b 28 29 7d 7d 3b 76 61 72 20 73 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 73 2e 73 72 63 3d 27 68 74 74 70 3a 2f 2f 61 70 69 2e 6d 61 70 2e 62 61 69 64 75 2e 63 6f 6d 2f 67 65 74 73 63 72 69 70 74 3f 76 3d 32 2e 30 26 61 6b 3d 4b 66 4e 53 4c 78 75 47 70 79 6b 39 42 42 59 48 6e 53 71 5a 73 59 6f 4b 78 6e 37 4d 55 47 78 58 26 73 65 [TRUNCATED] Data Ascii: (function(){ window.BMap_loadScriptTime = (new Date).getTime(); window.BMap=window.BMap\|\|{};window.BMap.apiLoad=function(){delete window.BMap.apiLoad;if(typeof onlineMapCallBack=="function"){onlineMapCallBack()}};var s=document.createElement('script');s.src='http://api.map.baidu.com/getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958';document.body.appendChild(s);})();
Nov 26, 2024 08:20:05.823055983 CET	1174	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 398 Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:05 GMT Expires: Wed, 27 Nov 2024 07:20:05 GMT Http_x_bd_logid: 1205165646 Http_x_bd_logid64: 1205165153880178698 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=5708682521ECBFF0E08D91B3FF8FFEE0:FG=1; expires=Wed, 26-Nov-25 07:20:05 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=4F312217E12805855D837D6E84247F00:FG=1; expires=Wed, 26-Nov-25 07:20:05 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12051656462862561290112615 Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 77 69 6e 64 6f 77 2e 42 4d 61 70 5f 6c 6f 61 64 53 63 72 69 70 74 54 69 6d 65 20 3d 20 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 20 77 69 6e 64 6f 77 2e 42 4d 61 70 3d 77 69 6e 64 6f 77 2e 42 4d 61 70 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 42 4d 61 70 2e 61 70 69 4c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 77 69 6e 64 6f 77 2e 42 4d 61 70 2e 61 70 69 4c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 6f 6e 6c 69 6e 65 4d 61 70 43 61 6c 6c 42 61 63 6b 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 6f 6e 6c 69 6e 65 4d 61 70 43 61 6c 6c 42 61 63 6b 28 29 7d 7d 3b 76 61 72 20 73 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 73 2e 73 72 63 3d 27 68 74 74 70 3a 2f 2f 61 70 69 2e 6d 61 70 2e 62 61 69 64 75 2e 63 6f 6d 2f 67 65 74 73 63 72 69 70 74 3f 76 3d 32 2e 30 26 61 6b 3d 4b 66 4e 53 4c 78 75 47 70 79 6b 39 42 42 59 48 6e 53 71 5a 73 59 6f 4b 78 6e 37 4d 55 47 78 58 26 73 65 [TRUNCATED] Data Ascii: (function(){ window.BMap_loadScriptTime = (new Date).getTime(); window.BMap=window.BMap\|\|{};window.BMap.apiLoad=function(){delete window.BMap.apiLoad;if(typeof onlineMapCallBack=="function"){onlineMapCallBack()}};var s=document.createElement('script');s.src='http://api.map.baidu.com/getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958';document.body.appendChild(s);})();
Nov 26, 2024 08:20:06.217607975 CET	385	OUT	GET /getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:06.792840004 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:06 GMT Expires: Wed, 27 Nov 2024 07:20:06 GMT Http_x_bd_logid: 1206502565 Http_x_bd_logid64: 1206502222374229258 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=FFBA50218D99168BC7F617D15D383A34:FG=1; expires=Wed, 26-Nov-25 07:20:06 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=632090C60EA6B1FB567B4CEEF5B92CA1:FG=1; expires=Wed, 26-Nov-25 07:20:06 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12065025651288513802112615 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 32 36 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 79 57 db ca b2 ef 57 71 74 b2 78 d6 46 08 49 9e ed 28 3c e6 90 00 21 40 a6 4d 38 ac d6 60 23 f0 84 07 66 bf cf fe 7e 55 dd 92 25 db 90 ec 7b cf 5d ef 9f 97 7d 0e 6e f5 58 5d 5d 5d 53 4f 77 51 37 e8 dd 99 a7 7b fb db 17 df b6 8f 4f f6 3e 1f ba 4f 5a 10 8d c6 5a fd 49 eb f6 06 1d d1 a6 d0 6d 38 18 46 bd ae 56 d7 ac 6a 55 33 b4 71 3f 10 a3 70 0b ff 47 94 63 39 45 db b6 6a da c4 d0 86 88 6a b7 23 8a cf 94 42 ea 2b a5 64 43 a7 03 d1 6c 46 fe 6c 7b f6 1f b5 f7 42 e1 c2 6b 85 3b a2 ff f1 24 5b c2 b6 8a 7f d4 dc c9 68 10 86 a3 7f d4 5a 28 06 a3 cb 6f a1 3f ea 0d 66 91 f3 4a 17 51 f0 2e f4 44 bf 4f 65 2e a3 d6 e5 c5 c2 51 b1 5e c5 52 bb 77 17 0e 5e 28 e8 bc da b6 e8 47 17 cd de e0 a2 d3 f3 a2 b6 1a d4 45 3d 70 5e 6b 5e 16 d9 f3 29 ef 9f 37 3e 69 dc 49 ea dc 38 58 3f ba 58 ff 7a fa 61 fb f0 74 6f f3 e2 d3 f6 4f 57 fb d4 3c 3c d9 bf 1f ef f6 1f ae 6b 1b 1b 3f 3f 74 4f 6e fe 1e fe ec 7d ba ef 56 0e be ee de ff d0 1a f9 e6 b8 eb 8f d0 50 5e 7f 8a 83 39 21 f2 42 [TRUNCATED] Data Ascii: 264}yWWqtxFI(<!@M8`#f~U%{]}nX]]]SOwQ7{O>OZZIm8FVjU3q?pGc9Ejj#B+dClFl{Bk;$[hZ(o?fJQ.DOe.Q^Rw^(GE=p^k^)7>iI8X?XzatoOW<<k??tOn}VP^9!B]zw9AEA2zqmoFRjh<RN&IQKL^
Nov 26, 2024 08:20:06.792886972 CET	213	IN	Data Raw: bc 49 8c 2a 91 ca 1f 8a 57 0b 88 09 77 a3 29 8c 96 70 cf ce a7 50 5f be 5e ae 25 d0 8c 09 c2 6a 3f e4 a9 51 43 0c 5a e3 4e d8 1d 0d f5 54 e3 11 2a 31 bc 6c 21 f4 86 5a bc 12 c6 bd 7b 25 dc fb e7 e7 27 35 a6 98 3f 66 c1 2c 6a 93 c6 bd e9 09 57 7b Data Ascii: IWw)pP_^%j?QCZNT1l!Z{%'5?f,jW{FbRwq~v$:N:<9OK1\|=`87oh`dMwYQ9,p$>}pZ{f
Nov 26, 2024 08:20:06.792901993 CET	1236	IN	Data Raw: 33 32 65 38 0d 0a 2b 1c 6d b7 43 0a 6e 3c ec 05 a8 a8 2e 96 96 84 d9 ed 05 e1 a1 e8 84 80 c5 76 5d f9 7d 8a 1a 9f 9f 6b e9 4f 7d 4d d4 fb 04 cd 5b 40 b6 ed bb 0c 16 03 f7 35 03 9c 90 29 08 36 a2 66 5e b8 ae db d7 e3 8e 35 84 39 1c 3d b4 43 33 88 Data Ascii: 32e8+mCn<.v]}kO}M[@5)6f^59=C3xp_W.\AAgr TrdG2G=hFQ6n!W@~\qb1t%qpfn<lpH!&Fu})!W>M@d9-DK]M8lm
Nov 26, 2024 08:20:06.792918921 CET	1236	IN	Data Raw: 9a 50 72 42 e0 3d 08 ef 3f 37 89 ca 97 fd b3 e6 39 e5 d6 df 59 52 37 5b 4e a2 c1 16 d2 53 23 c8 a0 ea 54 42 7b 2a b8 2f 57 9b ae fc 99 9a 06 6d d9 1b 48 07 a8 78 32 68 36 a3 36 88 61 6e ea c4 7d 0b 00 70 a8 8a 19 cd 46 d3 0d cf 82 f3 46 00 98 81 Data Ascii: PrB=?79YR7[NS#TB{/WmHx2h66an}pFF$aF&GGd1cbxzrq~opTur]v{`eJMk$Q6XQ}ZF)Eu(EV(On
Nov 26, 2024 08:20:06.792943954 CET	1236	IN	Data Raw: 1c 2d 6d 26 15 63 b0 be a0 26 0d e6 41 bc 0e b3 b4 84 26 56 cf fe fd eb ee d7 4a ec 5f a2 15 1e 21 f2 b4 cc 41 63 11 88 41 90 bb 0e 1f ea b0 fb 20 cc 30 ad 3e 8e 5c 7f 92 b2 94 88 b9 bf 71 c9 42 14 2e 7d 2c 43 22 a8 a6 82 33 71 0e be 2b 51 af 91 Data Ascii: -m&c&A&VJ_!AcA 0>\qB.},C"3q+QI+^^<<n%7PLH!7Pi}p1awphNwkn4H1`JCcKx.6\|za;9Bw!F%wx!b7%G41GWUY'x"%q)bf
Nov 26, 2024 08:20:06.792959929 CET	1236	IN	Data Raw: 01 c4 7c b2 ad 77 bc ae 20 bc 61 3e ff 67 78 d0 57 14 de f4 e7 e7 74 71 7f 45 21 48 d7 63 14 f7 26 06 08 6b 01 98 2a c3 f3 73 3e b5 ff 4d 0e a4 62 0a fc a3 e9 06 b9 10 a2 91 8a 1c d1 66 b4 1b a3 a7 67 89 30 63 99 b3 b1 9d 49 5e c4 98 5e c5 fe 8b Data Ascii: \|w a>gxWtqE!Hc&ks>Mbfg0cI^^">=HK]0QD{Pd2S@,'l\A@&yIno]z0hWsLKnNaR+E}Z0jvYoW,kB@i
Nov 26, 2024 08:20:06.792975903 CET	1236	IN	Data Raw: 3c 8b 08 18 fc 8a 47 f1 55 6f 41 d1 52 93 08 bb 56 a1 29 2e 1b c9 39 96 55 d7 d6 8f 8e 5e aa 77 fd 53 0c 27 fa d8 a4 bf 4d c0 5f ae fa 56 3c 43 4a 76 15 e5 6a b6 1f 50 6a 90 c0 ef d0 f8 70 cd d5 aa f0 e2 81 aa d4 aa 76 3c 44 a5 52 b9 3c cd ed 64 Data Ascii: <GUoARV).9U^wS'M_V<CJvjPjpv<DR<drW<:P"8hV.gKTii\f=QT_UZjLAwT!(DB,)~Kh.2%,9IjhWt\q)KEej7U]shO0Mj$R#&Z5TZB\vyB2Mr
Nov 26, 2024 08:20:06.792995930 CET	836	IN	Data Raw: 0e dd 1f 74 f2 92 f3 dc 7b 6a 98 7a 64 55 36 77 99 e1 d1 48 b9 ee b1 58 5a 3a 11 f9 07 21 3f 4f e5 e7 23 3e bf 89 fc 77 91 b7 e9 6c ec 99 16 6f 0f d2 0c 0d b3 07 36 ac 76 2e 0b fc 10 20 30 2e b8 26 0b 14 0c 87 0a f0 76 0e e4 1e 88 21 9f 11 d4 eb Data Ascii: t{jzdU6wHXZ:!?O#>wlo6v. 0.&v!q]IKF"(n#0D$=&)yHv>v\|_>C.M$Wl8HI&r17x4w\Hq$7Od<q Cib?`<vA7R)kzypyq7'L
Nov 26, 2024 08:20:06.799846888 CET	1236	IN	Data Raw: 8d 9b 7c 99 11 6b 5c fe 34 76 d3 8f 31 78 e0 ab 5e 80 52 65 bf 88 ce 56 9d 15 28 04 6a a7 03 93 13 c7 3c c8 98 63 2f 5d ba 17 af 5f ff 0e 0f e4 58 a2 ad 28 13 e3 b3 5f 9f 5b 4d fc d4 e2 c5 aa 0f bb 0b 93 14 3e 96 73 b6 41 b9 f6 5e cd b5 22 33 6d Data Ascii: \|k\4v1x^ReV(j<c/]_X(_[M>sA^"3mFsf.1-)%1\|"c"RmblHk%j7TQHc9e+@=~0>"jbt>/U.j_YfbBU,dHNkFNVZA7*
Nov 26, 2024 08:20:06.799926043 CET	1236	IN	Data Raw: f9 5e 52 a4 9f f5 c3 a8 bc ca 15 a3 80 f9 5d 13 37 d3 8a c9 13 40 ea 7e b6 42 4a 51 26 06 b7 d8 4f 66 49 6a 95 74 41 dd 9f b6 62 f0 bd 7b a5 e2 7b f2 c6 bc fc 14 ba df 56 71 33 5f c5 57 2a 7f d9 5f 90 ff b2 1f 37 29 7a 31 96 44 8f d9 43 e4 e5 9f Data Ascii: ^R]7@~BJQ&OfIjtAb{{Vq3_W_7)z1DCI4$s.tBi1#oVqo7O'q&I/\|2\|L>c3DWq5zLY%/@uqoOq>\-A%Jf^0<0`-
Nov 26, 2024 08:20:06.808284998 CET	1236	IN	Data Raw: 23 49 c4 3b 92 c4 79 7a 71 83 f7 25 a1 75 b1 60 c1 f5 d4 73 63 27 ab cc 7c 75 4f 11 3f f6 f3 c9 b4 c8 0a 5e 35 75 d2 5c ad eb c5 e6 16 a6 54 5b 71 7c d6 2a 41 a9 5b 61 53 8c db a3 4d de 50 35 df 3e ed af 72 73 6a 4d 24 de 84 15 57 b7 78 53 56 52 Data Ascii: #I;yzq%u`sc'\|uO?^5u\T[q\|A[aSMP5>rsjM$WxSVRN,Rv^@ju=KKYz>tbrJ^ ]V\Mn%>mIG/.s&x0x/eo4FsMaQj2d6ab:YC9GwUw6aK>II
Nov 26, 2024 08:20:07.310651064 CET	387	OUT	GET /images/openhand.cur HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:07.868189096 CET	955	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 326 Content-Type: application/octet-stream Date: Tue, 26 Nov 2024 07:20:07 GMT Etag: "6731c229-146" Expires: Wed, 27 Nov 2024 07:20:07 GMT Http_x_bd_logid: 1207589150 Http_x_bd_logid64: 1207589793410182410 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:57 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=B4F2A0FA824D34AFE6A360B58C2ECA6B:FG=1; expires=Wed, 26-Nov-25 07:20:07 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 00 00 02 00 01 00 20 20 02 00 08 00 08 00 30 01 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 01 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f0 00 00 03 f0 00 00 07 f0 00 00 0f f8 00 00 1f f8 00 00 1f fc 00 00 3f fc 00 00 77 fc 00 00 67 fe 00 00 07 f6 00 00 0d b6 00 00 0d b2 00 00 19 b0 00 00 19 b0 00 00 01 80 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f8 07 ff ff f8 07 ff ff f0 07 ff ff e0 03 ff ff c0 03 ff ff c0 01 ff ff 80 01 ff ff 00 01 ff ff 00 00 ff ff 90 00 ff ff e0 00 ff ff e0 00 ff ff c0 05 ff ff c0 07 ff ff e4 0f ff ff fe 7f ff ff Data Ascii: 0( @?wg
Nov 26, 2024 08:20:09.425826073 CET	446	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk86802&v=2.1&seckey=-1%2C-1&timeStamp=1732605606170&sign=8c783803c2fb HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.006165028 CET	875	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:09 GMT Expires: Wed, 27 Nov 2024 07:20:09 GMT Http_x_bd_logid: 1209708385 Http_x_bd_logid64: 1209708261592145930 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=FD4866419ED0B8C8FAB453162B7F2657:FG=1; expires=Wed, 26-Nov-25 07:20:09 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=2FD7DA72827CC9A2565DE0B98BD001C8:FG=1; expires=Wed, 26-Nov-25 07:20:09 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12097083851820473354112615 Content-Length: 93 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 36 38 30 32 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 36 38 30 32 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk86802 && BMap._rd._cbk86802({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:20:10.013607979 CET	573	OUT	GET /getmodules?v=2.0&t=20140707&mod=map_5t4s3f,scommon_qzcf2k,mapclick_u1fb2e,oppc_dwynzr,navictrl_cgpeke,canvablepath_4aihkt,common_qliwoy,symbol_1t1tgb,marker_doq5jl,vectordrawlib_wqglq1,style_exrf4k,tile_znc1s3&seckey=-1%2C-1&timeStamp=1732605606185&sign=8cfb777cfc75 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.593308926 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:10 GMT Expires: Wed, 27 Nov 2024 07:20:10 GMT Http_x_bd_logid: 1210301747 Http_x_bd_logid64: 1210301000210477834 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=8662854DDA47E5BFF6C11044A611A3DC:FG=1; expires=Wed, 26-Nov-25 07:20:10 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=F02462B1150DFCFC1D33C3BCCEB30387:FG=1; expires=Wed, 26-Nov-25 07:20:10 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12103017472676045834112615 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 63 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d4 bd 69 77 db 38 b2 30 fc fd f9 15 0a 67 ae 23 b5 69 1a e0 4e 29 8c 4f f6 4e 77 b6 4e d2 9d ce 76 72 b8 ca 74 b4 45 8b 97 d8 fe ef 6f 55 01 a4 48 89 50 96 99 79 ef dc c9 b4 45 12 60 a1 50 28 d4 86 02 78 f8 cb 2f 87 9f 4e 16 a3 69 94 9a 7b 7b e5 55 f7 e6 38 9a dd d4 3b 37 2f 62 63 36 9f 2e a7 cb 8b 59 66 24 d1 24 c9 46 61 11 75 99 9e af 26 c9 b2 98 4e ba bd cb e5 71 b1 30 be 2e f6 f6 92 51 16 cd 5f 17 e3 6c ba 5a 76 e5 d3 de 80 2e ee df 09 e9 77 7a 2a ee e3 af 21 bb ee 0d 3a 77 8d b7 59 b7 82 15 f5 2e 8b bc 7b 23 32 ee 5e 5d e1 5f 63 79 d1 bb 8c 8c 2f 17 dd de 51 f7 f7 21 94 eb 4f e8 ef 53 fc db eb 47 46 94 a6 0f 4e b3 c9 f2 49 b1 58 66 93 6c de d5 10 7f ad 8e 1e bc 87 4d f6 06 4f ca 8b a7 f2 02 10 88 8c ec 38 d4 3e 7c 58 d9 99 99 c2 8f e3 e6 a9 06 4f 1f 2d 42 8d 6b 83 d3 68 de 89 c3 cb 57 f7 fb 53 3d 8b fb 35 a8 80 67 6c bc ba df bb c4 bf e1 97 c1 22 5b 96 3d af d5 8a 8d f1 b0 db bb d6 1d c6 7a d7 d7 fa 78 58 07 81 c0 93 30 32 7e 4f bb 3d 3d 85 8b 61 04 [TRUNCATED] Data Ascii: cbciw80g#iN)ONwNvrtEoUHPyE`P(x/Ni{{U8;7/bc6.Yf$$Fau&Nq0.Q_lZv.wz*!:wY.{#2^]_cy/Q!OSGFNIXflMO8>\|XO-BkhWS=5gl"[=zxX02~O==aYX8_rL2#-$HV9SR,/df]r+,nMqFdp
Nov 26, 2024 08:20:10.884031057 CET	384	OUT	GET /images/blank.gif HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:11.446026087 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:11 GMT Etag: "6731c229-31" Expires: Wed, 27 Nov 2024 07:20:11 GMT Http_x_bd_logid: 1211165380 Http_x_bd_logid64: 1211165543410182410 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:57 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=99E94B63B081BCE4C5522C41A1A72279:FG=1; expires=Wed, 26-Nov-25 07:20:11 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:11.863590956 CET	390	OUT	GET /images/mapctrls2d0.png HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.425436974 CET	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 11596 Content-Type: image/png Date: Tue, 26 Nov 2024 07:20:12 GMT Etag: "6731c218-2d4c" Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212146035 Http_x_bd_logid64: 1212146000234628874 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:40 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=14BB4BB2C162D54EC941392B3002C03F:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2c 00 00 01 d0 08 06 00 00 00 da a3 88 d7 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 66 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDR,tEXtSoftwareAdobe ImageReadyqe<fiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0180117407206811B71BEFA893479FCC" xmpMM:DocumentID="xmp.did:5F55D253175711E1A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49815	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:03.837943077 CET	323	OUT	GET /2/ABUIABACGAAglYiFjAYo6LX7oAIwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:05.174865007 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: image/jpeg Content-Length: 130434 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAglYiFjAYo6LX7oAIwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i32019_c12732, i2103119_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 52 49 46 46 7a fd 01 00 57 45 42 50 56 50 38 20 6e fd 01 00 50 e9 07 9d 01 2a 8a 07 58 02 3e 6d 32 94 47 a4 22 a6 bb 27 54 fa fb 60 0d 89 4d ce 61 f6 0f 46 3f d0 3c 83 b7 ff f5 79 97 ff f9 e9 fa be ff e9 f1 00 e7 71 d1 ef e2 bc f9 7c 9e e7 fe c5 37 6f 39 60 e3 6f 16 db 72 c9 e7 b6 da 9f c9 bf e7 f2 d9 e4 7d cf ff 0b dd 67 d4 13 cf 7b 21 af f2 f5 04 ff c3 e8 e5 99 c5 0c 3c de bf 4d e9 5f e3 43 fb 3c 14 2e 1b f3 ff e0 ec e9 92 fe 5b fd 7f f4 1e 90 3c 9f df 2f d5 ff 09 fe 7b db 53 f8 9f b6 ff fa 7c 5e f4 3f f7 9f b8 5e a7 5e 7b fc d7 a1 bf fb 1e b3 7f b8 ff b4 f6 13 fe db f9 49 fe 8b e3 57 fe 4f de 1f 76 7f f1 ff ef fa 9a fd db fd ec f7 63 ff bf fb a9 ff 2f e1 ff f6 af f9 5f bb 7f f6 7e 41 ff bf 7f a6 ff e5 ed 87 ff b3 ff ff fe 1f 87 8f f1 1f fa bf fe ff e6 f8 2c fd d1 ff ff ff 3b de 6f ff 9f b3 57 f7 4f fb 3f bd 5f fc 7e 1c bf d1 7f ff ff 97 ff ff e0 03 ff f7 b6 4f f0 0f ff 7d 3f fe 49 ff 9b bd bf dd 2f cc ef 46 ff 34 fb c7 f8 7f 9c 1f e4 7e 4d ff 96 ff ab cb d7 ad ff a7 ff b7 d1 2f e7 5f 96 ff 99 fe [TRUNCATED] Data Ascii: RIFFzWEBPVP8 nP*X>m2G"'T`MaF?<yq\|7o9`or}g{!<M_C<.[</{S\|^?^^{IWOvc/_~A,;oWO?_~O}?I/F4~M/_C'G?~KU@G+O//~]}S?o/OC~K[ek}WfbIvVQ1o$=k/L<Ap,;4_y&jkj'{Fh;lBI%f-2e6.[;"NQ\|1giB#2Yonn;vV\|\|)fue~_$psN!}57v__]AlMWms3:}c[3g53#]K+3m&MT
Nov 26, 2024 08:20:05.174951077 CET	1236	IN	Data Raw: 1b ff ed 84 b7 d2 c3 55 02 c2 ae 2d 17 f8 fe af f8 f4 6f e3 12 17 46 c3 15 80 c8 bb 82 1c f1 bf 45 f4 5f 84 eb 98 c0 20 68 83 7f fb 31 fe 0e b2 a1 e1 6c 87 0e f5 ec 45 99 08 01 cd 40 df ce 44 d4 e9 93 46 2d 91 55 e3 4f 26 18 be 01 b0 8a 2a 42 66 Data Ascii: U-oFE_ h1lE@DF-UO&*Bf\|5;q=e3\Hp{VTo$KO<]7}QQqE^wy4"7_Jg9Q/'_vH2cJ_\|&8Pe~oCGZ!FxR>gE.n-&E5S{o7
Nov 26, 2024 08:20:05.174962997 CET	1236	IN	Data Raw: ab 25 4b 59 d6 e5 ea 7c f3 7e 77 e3 ea 80 89 8d a3 48 f1 16 4f 80 97 bb e7 e5 d1 36 0f 3d be 09 09 55 05 03 be 62 c7 4d c8 53 a5 0c ee 96 62 a6 56 96 04 96 68 e3 f3 c1 9f a3 92 85 52 71 6d 81 7d 34 77 38 2b 0e 1a 02 ad 60 d8 c1 90 51 8d 02 ad da Data Ascii: %KY\|~wHO6=UbMSbVhRqm}4w8+`Q)N<2czF/ko:<0iX8COF(&Gocv6,'3{e,!$ZUq8@#pJY5`[gSxE8
Nov 26, 2024 08:20:05.174968958 CET	1236	IN	Data Raw: a3 24 e2 0e 9d 95 53 bc e3 af e6 16 21 5f ee be 4e aa 71 56 c7 dc 43 3f 2e ac 5b 15 97 26 a4 96 e8 f2 2b 2a b8 c6 27 76 f7 5a f9 d6 4f 4f 4c 48 f2 b0 cc c0 cd be ee ed 0d 1a 14 eb d8 e0 4e 85 70 d7 3a ad 76 29 c4 39 fa 56 56 b8 dc c7 69 42 d9 4f Data Ascii: $S!_NqVC?.[&+*'vZOOLHNp:v)9VViBOp#Hin=PcHp`sh9PM~DL4guE?orAl6\ZP=?JiMNf"Z;@xBCv[822%)}i[
Nov 26, 2024 08:20:05.174973965 CET	1236	IN	Data Raw: f1 79 bf 8e fb 1c c4 7f 7a 4f 93 ae be f1 2f 9e cf 0f 34 7a 67 db 79 30 02 cf 69 ba b1 a8 da ab 09 e2 db ed 49 8f cd ac 5f 5b 2d 27 13 99 fe 9f 23 d0 80 03 8e fd cc 2d f1 8b 13 f4 c7 57 8e 5c 44 7f fc 17 72 05 78 2c 6d af 63 67 5d 8a f7 d1 30 a8 Data Ascii: yzO/4zgy0iI_[-'#-W\Drx,mcg]07z~hy.1xFZgpBgPRS,FyD\[mNsWs~/qlM8:u,O\|s<IHh_f#sy&$i2@Yo&]*N69o~Q>
Nov 26, 2024 08:20:05.174979925 CET	1236	IN	Data Raw: 3e 8d 16 1e ca 52 e1 66 aa ac a1 86 b3 27 1e 52 d5 fe 01 5b c2 7f 89 76 fc 4c c5 b9 6b 06 04 ee c5 2a fd 54 c1 03 ec 54 77 31 db bf fb 59 9b fe d2 a7 7a 49 cd 43 1a dd 5b e1 e5 24 48 0d 6e dc 36 fb 23 9f 54 f4 5f b9 19 dd bb cb ac 14 e9 bd fd 6b Data Ascii: >Rf'R[vLk*TTw1YzIC[$Hn6#T_k5NB<&_v?n!VZ5"m<0y`J#_r:[ME\n^5LD"t /P;>VIvZTJUR(Hm=<g2b2
Nov 26, 2024 08:20:05.174992085 CET	1236	IN	Data Raw: ea 34 6f b7 9c c2 80 fc 13 7f d9 5d c7 87 85 35 32 5b ae f6 0e 4c 61 a0 07 1e 2e 0a 88 f8 e1 9f 46 15 49 ff ec 03 22 f0 68 c1 01 a5 0f 7b 58 07 09 6f d5 a0 74 09 0c 93 56 7b 89 bb de d0 41 86 33 44 52 59 48 bf 25 2c ae 8e e9 e5 d5 8e 8c 3b 13 0a Data Ascii: 4o]52[La.FI"h{XotV{A3DRYH%,;oh[x#pG[T4~Ub~>Pw]9^9A`bWu\|;sz4fiY!$S^A6].gVCX'1!h1g
Nov 26, 2024 08:20:05.175061941 CET	1236	IN	Data Raw: b7 ac 6d 84 ef 96 3e b9 f7 48 7a 62 df 24 bd ff 21 7d d6 3b a1 f4 a1 9d ce d9 a9 70 b3 bb 00 72 9a 21 95 fe 91 23 66 b3 24 52 01 88 bb 01 a2 82 3a 20 30 ac 57 d9 ad 51 d7 d4 a5 38 31 3d 13 9d 88 a1 0d 2f c3 fc ad 6e 2f ea 21 a9 42 03 a7 fa 2a b7 Data Ascii: m>Hzb$!};pr!#f$R: 0WQ81=/n/!BM(7sB4Q%YSk.;<a7yC9Yo:ho4]0@OnE\OS\Z,j}EeS@ut,V}Q=3!Xwzk1=v>Ri
Nov 26, 2024 08:20:05.175067902 CET	1236	IN	Data Raw: 79 f3 52 76 41 da d7 02 e0 e1 30 86 c9 17 f9 fe a6 75 da be 1b 9b fc 7c 12 67 95 33 95 b7 bc 37 6c 80 31 b7 b4 91 c3 28 d1 50 23 78 42 59 77 5c b5 49 84 f7 08 63 40 a2 f2 66 94 68 e2 81 bd 8b 01 04 ee bd 7f 30 82 f6 9a 78 7b 82 37 9b b1 09 b4 28 Data Ascii: yRvA0u\|g37l1(P#xBYw\Ic@fh0x{7(Hf^"*l<'2':9W_i(-)5b%XKKRZ^Sh+f1b~n.eLBFm8S?6N()d9Tg4d{S'C4Xj2}.
Nov 26, 2024 08:20:05.175075054 CET	1236	IN	Data Raw: b4 d6 b6 8c 4e 7d c9 ac fd 86 9d 19 ed ab c6 4a d1 0c fc 4d c7 95 07 82 7b 63 4f 98 d0 2a 6a 4e 2a a3 e0 e0 32 30 c7 48 42 b6 8a 10 48 bc 5d f2 a1 f6 b5 c3 19 dc 28 ec d3 78 7b 49 ad 2a 1f 1e 41 12 3e 00 5e 3d f8 b1 06 92 ad d7 14 90 0c c6 5b a1 Data Ascii: N}JM{cOjN20HBH](x{I*A>^=[2f=>D~Z( e@AZ1U{h{6!=fU~:x<'S3IU2F6EC,D044)x.SD+$H65vHL6<cil~`Yn
Nov 26, 2024 08:20:05.295100927 CET	1236	IN	Data Raw: 23 5c b8 92 42 a2 da 80 51 5f a7 75 59 ab ff e5 6b eb 29 5d 8b a1 fe b5 9b 66 2a 3b 84 f1 b9 93 07 a3 0e bd ee 66 cb 7d 83 3e 20 6b ec 9c 82 ff c4 1e 2c cf 2a a7 ab 8c 26 86 35 1c a7 da 01 10 07 9c 9d 40 70 ca f5 6e 9f 66 40 c6 2b 9f ae 07 40 c3 Data Ascii: #\BQ_uYk)]f;f}> k,&5@pnf@+@nhS_3u&1]`\2T;QvYPzYA)iNfYLPOUMwuQtmngY0?`j(Ykhl@#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49817	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:04.141772032 CET	323	OUT	GET /2/ABUIABACGAAguoiFjAYohvfQqQUwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:05.657682896 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:05 GMT Content-Type: image/jpeg Content-Length: 70244 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAguoiFjAYohvfQqQUwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i64624_c24843, i2103125_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 52 49 46 46 5c 12 01 00 57 45 42 50 56 50 38 20 50 12 01 00 90 9e 03 9d 01 2a 8a 07 58 02 3e 6d 36 97 49 24 22 a2 a2 22 76 29 28 80 0d 89 67 6e dc c3 b9 76 6d 36 af e0 bc 52 1b bc bc 33 a1 ff ff a7 fc 7f bf 7f 6f 6d 72 b9 3c 1c b3 4c fa 30 7b 47 8f 2f 4e ac c0 79 5f aa 76 af d8 cf 9c d2 ab cb b8 ee 3f cf e2 47 c5 ff de f3 b7 ea 2f 3e be 91 3f bf 7a 88 ff 98 f4 9b e9 2b cc af 9c ff fe 7f dd 8f 7a 7f e3 bd 40 3f b5 75 30 fe ef fb 09 fe e5 fa d3 ff f6 f6 72 ff 29 ff ab a8 03 ff ff b6 bf f0 0f ff fd 60 fe 7f fe 4b fb d7 e4 4f f6 6f 45 df b2 7f 69 fe e7 fe 53 fd 5f f5 df 57 ff 18 f9 cf ec 9f dd ff c5 ff 9e fe d7 fb 5d f8 37 f9 3f f8 fe 36 be 3b fa 8f fa 9f eb 3d 50 fe 43 f6 9f f1 5f da ff c8 7f d3 ff 0f f3 9b fa af f3 9f e5 bf 77 3f c3 7a 13 f8 f7 ee 9f e8 3f cc 7f 86 ff ab fe 57 e4 0b f1 5f e4 3f df 7f b3 7e e3 ff 7a f8 ed fb df fb bd be 3b f7 fa ff f4 5f eb bd 81 7d 7a f9 ef f9 4f ef 9f e8 7f ee 7f 8d f9 42 f7 5f f6 ff e2 3d 56 fe 47 fb cf fb 0f f0 9f e6 ff 67 fe c0 7f 99 7f 59 ff 69 fe 1f f2 4f e9 6f [TRUNCATED] Data Ascii: RIFF\WEBPVP8 PX>m6I$""v)(gnvm6R3omr<L0{G/Ny_v?G/>?z+z@?u0r)`KOoEiS_W]7?6;=PC_w?z?W_?~z;_}zOB_=VGgYiOo>CqgrODSoAQ{}-o7g1eqEUms[/;a9!.v;GgrB\T/KkExyoTaKU_\k\e~mCJX^wiT[/;-ZU6'UZU^w'5(K<#4#I/k,w;`ce.,-M?+U1eqEJ/;xJyvv{?!eY(UCi-UAT.t\|#,Qmc<&t('zEJyuQl:
Nov 26, 2024 08:20:05.776659966 CET	1236	IN	Data Raw: b6 7b 2f 3b 8e b4 aa 2d 97 9e a7 81 72 e7 4f d1 58 99 a1 90 20 e6 48 3b e6 17 16 1f fa 53 f1 fa bf 01 7c eb 71 ac 7a 1d 54 10 fa 2d 65 75 45 c8 12 08 ff fe 18 b9 b8 0f 89 c7 ec 2f ea 47 d8 bd 43 69 c9 c8 0e 99 4c 00 81 8b 5b 65 9d 7c ef 5a 3c c8 Data Ascii: {/;-rOX H;S\|qzT-euE/GCiL[e\|Z<Ai-3b[Zxr4-ZU*eqEME/;,m$"Ed4WOH(Ye}.&M\|Jf8{5HgR
Nov 26, 2024 08:20:05.776844978 CET	1236	IN	Data Raw: 8a 68 05 a8 c1 86 88 94 55 65 2e c6 06 b1 d2 bc 02 ab 0d 52 a6 f5 cf d5 ee 72 83 b6 27 eb f5 f5 b8 23 1d 09 25 6f 88 d7 7c 67 ea 78 22 00 c2 2c 5f 9a 1f 4b de b5 dc ca ea 09 1e 1e 88 0e 3a e0 51 0e 3f 4b f0 90 a5 d3 6c 14 03 d0 c7 e3 c1 93 d7 60 Data Ascii: hUe.Rr'#%o\|gx",_K:Q?Kl`g?] :kE=V`]7k#'-J0>"yuQl3@_F[5N}EJB5qV\' C/pvQT=s5MX=PbG}s#
Nov 26, 2024 08:20:05.776861906 CET	1236	IN	Data Raw: 20 99 29 04 e5 a5 d7 c3 c2 dd ba d6 0f 23 47 28 80 86 9d f6 4b f3 fd e1 a2 3d 56 5f c4 4d 6e 16 6d 76 36 2d 9e cb ce e3 ad 2a 8b 65 e7 6f 2f 58 6d fd ff e3 e1 6d e4 5b 97 d9 37 4a 2e 22 86 2b d7 45 9e 3e ce 0b 2f 3b 8e b4 aa 2d 9d 07 81 aa c7 aa Data Ascii: )#G(K=V_Mnmv6-eo/Xmm[7J."+E>/;-Ldht9~-g.q~\|AjF3y]Mynt0+CKxB)`AzG<3[B5WTL\|5u5q\|Q9 >
Nov 26, 2024 08:20:05.776873112 CET	1236	IN	Data Raw: fb 23 9c 82 a9 c6 6b 4f 10 8e bd df cb f2 a4 cc 1b d2 90 49 a9 ff a4 ea 37 5a ba ad d3 11 1b 42 b5 8f f5 e0 97 87 3a f7 92 35 b0 f0 f6 66 b9 39 95 ee cd 99 fe f4 e2 51 b7 7b b1 1c 73 6e ca 75 63 a2 d3 29 b9 44 97 87 cd b5 7b 4a 89 e2 68 32 d5 b6 Data Ascii: #kOI7ZB:5f9Q{snuc)D{Jh2j1#'H{^N\gD'\Z cT0;wC.Vl:=?s\|HwR$t,/#7;GLN KGJiK@<VU$D"SAk$83&`S
Nov 26, 2024 08:20:05.776886940 CET	1236	IN	Data Raw: a4 68 e4 a4 74 d2 40 fb 3f c3 c5 7e c3 6a 76 66 00 cd 52 63 4a a2 d9 79 dc 75 a5 51 6c bc ea ac 7a a4 c6 95 45 b2 f3 b8 e9 2c 26 14 e2 e0 ea 34 1f f3 8d 80 d6 51 ff fb 5f 4a a1 b9 56 3a 75 bf 16 fe 60 cb a0 4b 58 56 4a 26 7f 8d b4 50 1c 61 36 41 Data Ascii: ht@?~jvfRcJyuQlzE,&4Q_JV:u`KXVJ&Pa6Aj%xakNVw?7fh/L"bIh=F.O^hUp2L==-0bYa0UzzFn$ uI*ecJ)1%FMUIf`JQq))H
Nov 26, 2024 08:20:05.776907921 CET	1236	IN	Data Raw: fb 17 8a c3 0a 53 99 c7 97 96 7b 3c ea d3 30 8e 80 b1 52 26 ae 58 5d de 22 58 28 31 4b db 2a e4 75 8a 88 02 fc fc 3c 95 fc f0 b7 c8 73 49 00 03 bb d6 cf ea 47 be b9 60 36 ac 71 1e 45 93 e2 81 2f df 06 65 a6 9d b1 fd 33 1b 3d fb 91 ea a5 0b 09 41 Data Ascii: S{<0R&X]"X(1Ku<sIG`6qE/e3=AiAyuQl)_b1!QKbNggr:CvTZjw)5v[Gr}\I{SoO<}U>Nls6]J(?<Vig(b!1y61
Nov 26, 2024 08:20:05.776920080 CET	1236	IN	Data Raw: f1 28 b1 6a 44 8f 70 5c 78 4b 60 ed 14 78 64 15 52 bc 09 35 20 82 b6 b2 47 ae 42 06 f9 b3 c3 c8 b0 ef 24 16 d5 75 1b a3 fe da a0 00 00 00 09 ef 9c 48 71 72 ba 01 6e fa b1 0c c8 02 5d 91 ec 9b b1 ae 96 da f4 65 02 d5 9a 64 3f a4 22 07 55 d5 6a 5b Data Ascii: (jDp\xK`xdR5 GB$uHqrn]ed?"Uj[\|Ca3g(qsM5 5)r%oiB/]Hc00ih=I>AZ"*x?/0hY%WYPk-t%TPD-qO-5N
Nov 26, 2024 08:20:05.776932001 CET	1236	IN	Data Raw: da ad 43 59 99 a9 98 f5 8a 3e 7e d2 32 24 59 fa bc 19 12 29 56 dd 17 eb 85 72 93 7a d2 48 9c 0f d8 5a af d9 a5 09 b1 d1 d0 2f 30 1c 2c 7c 85 60 63 90 f5 d5 d1 77 6b 31 cc f6 8f 69 69 d8 d3 63 8f 56 10 9f ca 45 63 74 b3 4b 12 c9 a5 cf c8 23 f3 96 Data Ascii: CY>~2$Y)VrzHZ/0,\|`cwk1iicVEctK#lV>hM;5+:J7yU.%UNzFjLNM0Hj5D5^=#!g=k5vX'\|x+caj+BDy14-`=]
Nov 26, 2024 08:20:05.776945114 CET	1236	IN	Data Raw: bc 59 58 39 c3 e7 d9 15 23 94 84 e8 ca 6c 2d 0f a3 23 5f c9 41 42 44 bf c5 58 de 2c 4f 3b 74 b1 2f f1 22 59 fc 3a 2e 2f 2c 0a db 14 50 76 6b 42 24 5c 0a 9c 39 22 ce d6 8a c3 d1 23 3c 8b 40 bd 76 a6 f4 6a 54 5e 7f e3 d0 75 84 7d 84 78 29 c8 6a a9 Data Ascii: YX9#l-#_ABDX,O;t/"Y:./,PvkB$\9"#<@vjT^u}x)j/&J !.5l}MUv9%t#MMAkasPb<aBl5;7RL!8/ SLC*{Oq}f0<\|z?:K9$gqGiA6O\\
Nov 26, 2024 08:20:05.779448986 CET	1236	IN	Data Raw: 37 72 14 c3 6d f3 53 7b 09 2f e3 5d 11 4d 4c 0f 0b ad 45 9b 32 d9 f3 81 37 d7 a6 51 0f ae 83 2d 8a 05 31 77 fa 7d 6e 05 e8 f7 d6 15 79 bb 00 16 fb 90 ed 99 d5 e2 76 5f 11 90 7b 81 08 1b f9 01 b8 80 bf 25 00 f5 0a 8f 4b 7a 63 7b 05 27 b3 8c d1 fb Data Ascii: 7rmS{/]MLE27Q-1w}nyv_{%Kzc{'*p-:}\:WsJ hZGS)o..L(`iXqH[5TZ?xt<uM8$A%9:-+Vr2b(UWgZ
Nov 26, 2024 08:20:06.237725973 CET	323	OUT	GET /2/ABUIABACGAAgloiFjAYokPLbwgcwig842AQ.jpg.webp HTTP/1.1 Host: 28088389.s21i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:06.647469044 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: image/jpeg Content-Length: 270234 Connection: keep-alive Expires: Fri, 24 Nov 2034 01:36:58 GMT Server: F-WEB Content-Disposition: filename=ABUIABACGAAgloiFjAYokPLbwgcwig842AQ.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i63246_c21843, i2103119_c25795, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 52 49 46 46 92 1f 04 00 57 45 42 50 56 50 38 20 86 1f 04 00 d0 39 0c 9d 01 2a 8a 07 58 02 3e 6d 2c 91 46 a4 22 a1 a1 2c d7 6c b8 80 0d 89 62 6c cf c0 db 9f 54 c4 ff f1 7a 6d fe 8a c4 e1 35 e8 8d 8c 39 03 71 92 06 1d ca 32 d1 7f 8b f0 06 ea ff 9c 07 02 ef f4 1e c0 1f ab 5c a4 6d 01 4f 67 ca 17 d6 d6 f0 9d 77 de e8 fd 92 7e 25 fe af f5 3e 93 5c a7 e0 b7 da 7f 1b fe 97 ff b7 c5 c7 f5 7b 6c f8 4f fa 3e 69 de cf fd 47 ea af 69 df f6 7f 70 7d e1 ff 6e ff 79 ec 21 fd bf fd 67 ed 47 af 57 ef 17 bf 6f f1 ff fb 3f 2a be 0e 7f 60 ff 9d fb bd ff df e1 c7 fe c7 ee a7 fc df 88 1f df 7f e6 fe e6 ff c2 f9 07 fe fd fe cf ff e7 b5 c7 ff 0f ff ff fa 3e 18 ff bd ff db ff ff ff 23 ff 77 c8 f7 f4 5f f6 3f fd 3f e3 7b ce 7f f4 fd eb ff cd f2 ed fe 03 ff 27 ef 17 fe ef 87 7f f9 7f ff bf e3 7b 80 7f fc f6 c4 fe 01 ff c3 a6 9f cd 3c 6e fc eb f9 9f f9 ff 99 fe 6d f9 b4 f9 57 f0 ff e8 ff e5 7f 8f fd c5 fb 8e fd 53 fe 0f f6 5e 20 fd eb fc 4f fb bf ec ff dc ff f4 f7 27 fa 37 e6 af de ff 8e ff 3b ff 8b fc 5f cc df ef bf f3 ff b8 [TRUNCATED] Data Ascii: RIFFWEBPVP8 9X>m,F",lblTzm59q2\mOgw~%>\{lO>iGip}ny!gGWo?`>#w_??{'{<nmWS^ O'7;___~o??_g@<_=_?aO{sg_}=?O?]~`og_Ys_yuakExW'Gq,\8Au^_BgC8WZkCt{oZXw"Mz^qWzJCMMgflCfEiR0UP0w>xW@6-O%dfH<pO\2;6*>'$A;T2m,PNC?bOy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49820	111.180.138.108	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:04.655267000 CET	397	OUT	GET /4/418/AKIDCAQQi_WOvgUY4fSTngQ.png HTTP/1.1 Host: 1.s60i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://jzs.508sys.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:06.287040949 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: image/png Content-Length: 931 Connection: keep-alive Expires: Tue, 17 Oct 2034 17:57:09 GMT Server: F-WEB Content-Disposition: filename=AKIDCAQQi_WOvgUY4fSTngQ.png Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Age: 1 X-Via: 1.1 PSzjnbsxsy229:0 (Cdn Cache Server V2.0), 1.1 PS-TSN-01iPM72:4 (Cdn Cache Server V2.0), 1.1 PS-WDS-01zXZ71:6 (Cdn Cache Server V2.0) x-ws-request-id: 674576a6_PS-WDS-01wST72_13938-20032 Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 05 00 00 00 10 08 02 00 00 00 51 16 22 9a 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 31 31 20 37 39 2e 31 35 38 33 32 35 2c 20 32 30 31 35 2f 30 39 2f 31 30 2d 30 31 3a 31 30 3a 32 30 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRQ"tEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:E503FA083E7611E69EC0AEAB23E3D8E1" xmpMM:DocumentID="xmp.did:E503FA093E7611E69EC0AEAB23E3D8E1"> <xmpMM:DerivedFro
Nov 26, 2024 08:20:06.287167072 CET	233	IN	Data Raw: 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 45 35 30 33 46 41 30 36 33 45 37 36 31 31 45 36 39 45 43 30 41 45 41 42 32 33 45 33 44 38 45 31 22 20 73 74 52 65 66 3a 64 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d Data Ascii: m stRef:instanceID="xmp.iid:E503FA063E7611E69EC0AEAB23E3D8E1" stRef:documentID="xmp.did:E503FA073E7611E69EC0AEAB23E3D8E1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>+IDATxb<F <HIENDB`
Nov 26, 2024 08:20:32.106775999 CET	397	OUT	GET /4/427/AKsDCAQQy_iOvgUY0eC-vgY.png HTTP/1.1 Host: 1.s60i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://jzs.508sys.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:32.694860935 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:32 GMT Content-Type: image/png Content-Length: 935 Connection: keep-alive Expires: Sun, 15 Oct 2034 17:21:41 GMT Server: F-WEB Content-Disposition: filename=AKsDCAQQy_iOvgUY0eC-vgY.png Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Age: 1 X-Via: 1.1 PSzjnbsxkx232:1 (Cdn Cache Server V2.0), 1.1 PS-TSN-01hw176:5 (Cdn Cache Server V2.0), 1.1 PS-WDS-01m0q70:4 (Cdn Cache Server V2.0) x-ws-request-id: 674576c0_PS-WDS-01wST72_13938-21394 Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 05 00 00 00 10 08 02 00 00 00 51 16 22 9a 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 31 31 20 37 39 2e 31 35 38 33 32 35 2c 20 32 30 31 35 2f 30 39 2f 31 30 2d 30 31 3a 31 30 3a 32 30 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRQ"tEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1C5084813E7711E69D37E03DE81AE9D8" xmpMM:DocumentID="xmp.did:1C5084823E7711E69D37E03DE81AE9D8"> <xmpMM:DerivedFro
Nov 26, 2024 08:20:32.694881916 CET	237	IN	Data Raw: 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 31 43 35 30 38 34 37 46 33 45 37 37 31 31 45 36 39 44 33 37 45 30 33 44 45 38 31 41 45 39 44 38 22 20 73 74 52 65 66 3a 64 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d Data Ascii: m stRef:instanceID="xmp.iid:1C50847F3E7711E69D37E03DE81AE9D8" stRef:documentID="xmp.did:1C5084803E7711E69D37E03DE81AE9D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^%IDATxbf@L`C~IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49822	14.215.182.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:05.210752964 CET	321	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:06.873226881 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:20:06 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:20:33.416229963 CET	321	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:33.990434885 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:20:33 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:20:44.860291004 CET	321	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:45.434245110 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:20:45 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:20:55.134885073 CET	321	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:55.709129095 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:20:55 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:21:03.888068914 CET	321	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:04.462726116 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:21:04 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:21:12.527803898 CET	321	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:13.101669073 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:21:12 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49824	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:06.106950045 CET	326	OUT	GET /2/AD0IidHSCRACGAAg1_Hz6gUos_moVjC6BDjHAw.jpg.webp HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:07.075592995 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: image/jpeg Content-Length: 21142 Connection: keep-alive Expires: Tue, 21 Nov 2034 15:23:07 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg1_Hz6gUos_moVjC6BDjHAw.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i62708_c21843, i2103125_c25795, i1872258_c17483 X-Cache: HIT from i1872258_c17483(cloudsvr) Data Raw: 52 49 46 46 8e 52 00 00 57 45 42 50 56 50 38 20 82 52 00 00 b0 b2 01 9d 01 2a 3a 02 c7 01 3e 6d 34 96 48 24 23 22 29 a3 53 2a f9 30 0d 89 67 6e 2d d1 3a f1 ee aa 89 a2 72 43 94 b9 e8 c7 62 93 ce af c2 13 cd 3f af 74 a6 31 57 34 ca 7c f6 54 04 fd 0a 32 de 72 6e 7d e3 b7 ac 86 3a de cd 9d df ce f7 ca f4 bf fd df a4 4f e3 37 c2 df eb dd 18 1e 9d 3f db 7a 7f f5 4a ff 57 e9 b3 f4 bb f5 c0 cb f4 f3 bd f3 ff f1 bc 0f fc e3 dd bf 74 2c 47 fd b7 83 5f d8 bb 6c 76 db fb 17 f4 fe 83 5e d5 f4 06 8f d7 4e 68 23 f4 8f f0 ff f4 3e e7 3e 50 bf 3b cf 3f e3 ff ce fb 01 70 f4 fd ef fe 67 b0 3f f4 ff f3 5e b2 9f f0 f9 d2 fd 97 d4 7b a6 81 37 bb be 48 b5 23 6e 10 2f 5f fd e1 ff 6c 46 02 4b dd 0d 7d 21 3d 80 6f c7 6c 38 4d 0c 7e 21 eb 05 21 ec 69 af 30 18 26 07 e3 72 0f 99 31 1b 88 5d 96 fa fd bd d0 79 9d 15 cd 21 2f dd ae b7 63 5b 2c ff 22 21 f6 e3 90 8b 32 92 8c da d6 e9 75 a7 e6 6c d6 9a 03 f9 45 f3 05 9a bd df e9 87 0b c5 66 a5 b7 db 8e 78 58 bb b5 fb 9a 0d 93 bb 63 7c e4 6f 5a af 70 e1 d3 2f 2a 87 fd b1 7f b7 1d d2 [TRUNCATED] Data Ascii: RIFFRWEBPVP8 R:>m4H$#")S0gn-:rCb?t1W4\|T2rn}:O7?zJWt,G_lv^Nh#>>P;?pg?^{7H#n/_lFK}!=ol8M~!!i0&r1]y!/c[,"!2ulEfxXc\|oZp/3\|1r4aY\;24sZ#j$n/a<_We8LEq=V8NR8()&@[G_jFvOI5.mNuki\|PHfu?#^p-D:IxdjT1xPZKb;n}cMuF GQ2=bAYF__{=lDp?>,FSv6hs&=z{O/suKmu%9u8Yjs]?-;LLt D~/b1qx"mI%96gnENDl27L6FR&[
Nov 26, 2024 08:20:07.075624943 CET	224	IN	Data Raw: 5a ca c1 89 55 d0 ed 88 dd 69 4e 76 1a 7e f2 6c c2 a6 82 9b 49 97 77 16 66 cc 42 d9 be c8 01 2b 38 28 0d 90 51 96 a2 1b 84 c2 51 33 20 29 d5 50 f8 c7 6e ad ff 0b 22 fa 67 98 96 3b 76 4b 74 77 51 ad 05 b6 9b 04 47 74 04 e1 45 a3 04 f5 72 d0 17 f1 Data Ascii: ZUiNv~lIwfB+8(QQ3 )Pn"g;vKtwQGtErN\|l^$)q?Ih1?-Oo>zb[\BnvIm`?`25-wC,>vo9swujGsI3-t#
Nov 26, 2024 08:20:07.075680971 CET	1236	IN	Data Raw: f1 5d 7d 4e ae f3 d4 59 95 ab d8 f2 e1 f8 b4 9a a5 f2 85 d7 1f 32 f0 86 97 de 3a 57 18 6f 0f 5d 67 fe 96 ce bf 1d cc d1 9a 32 8e 8d 91 a0 b8 72 f6 04 70 6a a4 1d cf 83 c4 ea c1 84 17 9d 7f 38 6b cc 46 6a c1 17 4a f2 e7 4c 01 57 91 b7 c3 9a 9e 0a Data Ascii: ]}NY2:Wo]g2rpj8kFjJLWU"iX,#8?oT:9"tbEw{#1D9b3@Gwjxe]Eu0QA8@K&REZnr4,k+u
Nov 26, 2024 08:20:07.075697899 CET	1236	IN	Data Raw: 09 f6 13 69 19 91 51 fa f9 75 0c ee 44 ef c8 d2 83 41 b0 1c d3 32 a9 ee 10 54 aa 0d c1 a3 ea d0 c5 2f 1b d9 6e 77 09 0e ab 1b 79 a0 11 83 24 0b 4a 15 d1 00 ef 53 15 d2 40 22 de 8a 05 33 a4 ba 42 d4 9f 95 57 c7 4e c5 e9 e5 fe e0 81 73 e5 4e 89 04 Data Ascii: iQuDA2T/nwy$JS@"3BWNsNZ#6{\xF- V]MtqU<@r\az\|AU!Nhe3'/2gOT@1@+wB(utpcr2[cun4kzN
Nov 26, 2024 08:20:07.075787067 CET	1236	IN	Data Raw: 5a 71 59 b9 42 45 36 9b f2 ec 35 7a 76 77 ab d8 69 eb 43 60 71 5c 84 4d d3 32 27 26 00 00 00 fe f8 7d 94 45 ff d8 9f b1 df 98 1b 44 14 44 32 a4 01 10 c1 35 40 f1 11 43 51 d8 b5 60 02 e7 99 23 2d b1 26 33 b5 43 55 3d 1c 41 ad f4 82 04 00 fa 0e 52 Data Ascii: ZqYBE65zvwiC`q\M2'&}EDD25@CQ`#-&3CU=ARs$(=G-V@irzS9D Ny8cODSjI;AgT@#v:k2$`:jv?))pljM/d}<q;C
Nov 26, 2024 08:20:07.075839043 CET	1236	IN	Data Raw: de 46 47 f3 87 c8 e6 f7 23 6e 6a 04 8e f4 57 14 e8 3e b2 c4 36 19 07 f6 88 d2 9c 63 25 be 44 fa c5 76 a1 2d fe bc 2b 47 ca 08 89 58 c4 cc 95 32 a4 83 72 bd e2 99 ed 99 c1 01 3e 89 fc 73 12 76 52 87 e5 2b a0 7d 82 61 64 3b 1e 09 48 3d ea 96 44 59 Data Ascii: FG#njW>6c%Dv-+GX2r>svR+}ad;H=DY#^u-D"2Qg's'mR~.._e;eL.o}%n^vjy8le=.K4"0N1(.c+kV1-MNOUT\y_
Nov 26, 2024 08:20:07.075890064 CET	1236	IN	Data Raw: 91 e4 be fb ca 70 ef 2e af 7d 33 60 80 c4 ab bd c0 5b a5 f1 ce 6e 22 f5 14 51 18 dc 12 f8 55 07 31 47 dc 14 bd 93 7d 6e 1c 9c 9d b3 08 76 1d 4c d9 8d 31 8d cc c7 3e 9a 9f 0b dd 46 a8 50 53 d3 f4 6b 6a 43 60 ec 4d 29 19 a8 7f 30 86 c6 e3 22 a8 19 Data Ascii: p.}3`[n"QU1G}nvL1>FPSkjC`M)0".WP@e51HN<Sdd[^/9/NZ;=`IUT}gv~K3d0!dS2IWo\Yg"t[vt=<9S~w-~g30!x
Nov 26, 2024 08:20:07.075925112 CET	1236	IN	Data Raw: d5 ba 88 2d 96 af 9f 46 5b 6e 0e 18 8d b8 c6 4f 67 32 c6 b4 7e 0a 08 e9 ff 3d 4f 54 4e f5 6c aa 3f 8e 1f d4 5e 6d 18 13 7c d7 f5 0f 16 13 a2 4f 9c 0b 3d c2 29 de 3c 22 7a 24 b1 da da 9e dd b6 de e1 04 99 93 4c 1d 55 cd 29 4f 8c 0f 05 e1 73 19 3f Data Ascii: -F[nOg2~=OTNl?^m\|O=)<"z$LU)Os?QK\TS/!\09R;_[@J>1[5(s"QHtq&lJ(Rd+a#`?J$?]mmvf8V#g4&TVQO;{(HN#k
Nov 26, 2024 08:20:07.075958967 CET	1236	IN	Data Raw: 65 fb 12 2f 54 0a 90 5c 36 67 3e 43 27 9f 16 e1 39 22 77 2e e7 3b 11 93 33 e3 b1 1e 22 ff 68 f1 b1 e1 6b 4b 36 b1 e4 83 ac 58 68 0f 9d 9f 11 b9 c7 a4 fa 70 65 ec ed 94 74 ff c7 52 35 aa 00 8a 58 e1 68 45 aa 65 eb 2d ec 5c 4f 35 75 2b b6 99 59 9a Data Ascii: e/T\6g>C'9"w.;3"hkK6XhpetR5XhEe-\O5u+Y1cP1?WV}T:GJ_*1lfW]CX\|;AP'B$y_+Rt^5XhNq$Q!eNm-IT^`mFls<CAn?
Nov 26, 2024 08:20:07.076006889 CET	1236	IN	Data Raw: a4 67 aa 06 91 4a 68 59 fa d0 2a 8c d7 4f 87 c2 6c 41 67 cb 29 94 cd e7 ec 91 71 c7 11 3c 4b d9 05 58 93 2b f8 bd 77 29 78 85 2b 28 78 44 dd 67 a8 d5 9a 17 96 fb e0 80 fb 0e 73 66 43 83 96 32 69 c4 c4 71 dd 3b 1d af ee 92 1f bd 9a 43 59 a2 bc f1 Data Ascii: gJhY*OlAg)q<KX+w)x+(xDgsfC2iq;CYI\|pl=>";Xyk%SOT7\|D,5o1~r`0RW&_E;tN9zQZW'b??cO=w(Ou!acn
Nov 26, 2024 08:20:07.196446896 CET	1236	IN	Data Raw: 5c cb a5 b3 2f f5 08 f9 e7 2d 70 1f 22 09 fb ea e8 55 bb ac fe 3a db ef 46 12 2a 1b ec 86 c6 34 2b 9f fa bd 86 4d 07 7a 8b 8b 58 83 1c 5f c3 e0 bb dd f4 ef 74 02 a1 5d d8 2a a9 ee 7f 12 32 4c 4b 3d b3 8f 13 da 8e a6 6d b7 d6 3a 01 2f ed 7c 9c 60 Data Ascii: \/-p"U:F4+MzX_t]2LK=m:/\|`?z1^u\|`(mXII=ZK"O6c=Ay#By/H#%u-"T]BT]%B9g<"PK#K\|bB!<d-&OT'g0,SNT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49825	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:06.107223988 CET	429	OUT	GET /css/newInnerFontsIco/icomoon.ttf?-2mgmdr&v=70 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive Origin: http://www.wheel-done.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://2.ss.508sys.com/css/dist/styles/fontsIco.min.css?v=202404081140 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:07.083167076 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: application/octet-stream Content-Length: 101044 Connection: keep-alive Expires: Sun, 30 Jul 2034 22:04:17 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:43 GMT ETag: "6084db97-18ab4" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Access-Control-Allow-Origin: * Accept-Ranges: bytes Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC168_dx-lt-yd-zhejiang-jinhua-5-cache-6, BC195_lt-obgp-fujian-xiamen-33-cache-1, i1872256_c17483 X-Cache: HIT from i1872256_c17483(cloudsvr) Data Raw: 00 01 00 00 00 0b 00 80 00 03 00 30 4f 53 2f 32 0f 12 1d 28 00 00 00 bc 00 00 00 60 63 6d 61 70 1a 6f 2c 58 00 00 01 1c 00 00 02 68 67 61 73 70 00 00 00 10 00 00 03 84 00 00 00 08 67 6c 79 66 03 1a c3 b8 00 00 03 8c 00 01 7c f0 68 65 61 64 19 d5 c3 52 00 01 80 7c 00 00 00 36 68 68 65 61 08 49 05 9d 00 01 80 b4 00 00 00 24 68 6d 74 78 56 97 22 bd 00 01 80 d8 00 00 05 60 6c 6f 63 61 af 41 51 da 00 01 86 38 00 00 02 b2 6d 61 78 70 01 74 03 46 00 01 88 ec 00 00 00 20 6e 61 6d 65 99 4a 09 fb 00 01 89 0c 00 00 01 86 70 6f 73 74 00 03 00 00 00 01 8a 94 00 00 00 20 00 03 03 ff 01 90 00 05 00 00 02 99 02 cc 00 00 00 8f 02 99 02 cc 00 00 01 eb 00 33 01 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 ff ff 03 c0 ff c0 00 40 03 c0 00 40 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 06 00 00 00 03 00 00 00 34 00 00 00 04 00 00 00 6c 00 01 00 03 00 00 00 34 00 01 00 04 00 00 00 6c 00 03 00 01 00 00 00 34 00 03 00 0a 00 00 00 6c 00 04 [TRUNCATED] Data Ascii: 0OS/2(`cmapo,Xhgaspglyf\|headR\|6hheaI$hmtxV"`locaAQ8maxptF nameJpost 3@@@ 4l4l4l8 ? ?) ??!)08@IPY!`i+py5?I )S09]@IgPYq`i{py
Nov 26, 2024 08:20:07.083223104 CET	1236	IN	Data Raw: 01 80 00 0b 01 89 00 00 00 8f 00 0b 01 90 00 0b 01 99 00 00 00 99 00 0b 02 00 00 0b 02 09 00 00 00 a3 00 0b 02 10 00 0b 02 19 00 00 00 ad 00 0b 02 20 00 0b 02 29 00 00 00 b7 00 0b 02 30 00 0b 02 39 00 00 00 c1 00 0b 02 40 00 0b 02 49 00 00 00 cb Data Ascii: )09@IPY`ipy )09%@I/PY9`fCiiJp
Nov 26, 2024 08:20:07.083292961 CET	1236	IN	Data Raw: ca 14 26 0e 0a 1c 09 09 02 0a 02 09 07 0a 15 0b 1c 21 21 1d 0a 15 0a 07 09 02 0a 02 09 09 1c 0a 0e 26 14 21 26 25 22 03 5d aa 4d 37 fe f7 36 4e a9 0c 16 1c 03 18 1b 16 0b d6 0a 01 09 09 1c 0a 05 15 11 1c 42 26 26 42 1d 10 16 05 0a 1b 0a 09 01 0a Data Ascii: &!!&!&%"]M76NB&&B#Q..Q")"/1rAAs0/"8KJ8d6767>81'1'81.76.'&'.767>73>7601
Nov 26, 2024 08:20:07.083353996 CET	1236	IN	Data Raw: 01 01 01 01 01 01 6b 04 09 04 05 06 02 01 01 07 07 22 0c 17 0b 1c 31 15 15 21 0c 0c 0c 0c 0c 0c 21 15 15 31 1c 1c 3c 1f 1f 3d 1c a4 03 02 25 02 03 1f 02 02 25 02 03 46 09 0e 0e 09 46 03 02 25 02 02 1f 03 02 25 02 03 25 07 13 07 04 03 04 03 3d 3d Data Ascii: k"1!!1<=%%FF%%%==%I(7~03"&#8313!2654&#!"!"3!2654&#!"3!2654&#4'.'&#"2367>767>767:1261>726767>7651"
Nov 26, 2024 08:20:07.083405972 CET	1236	IN	Data Raw: 36 35 34 26 05 21 32 36 35 34 26 23 21 15 01 c5 3d 4d 12 13 3f 2b 2a 30 31 2a 2b 3f 12 13 4d 3d 39 30 30 46 13 14 02 cb 13 14 46 30 30 39 02 27 fe 13 01 01 01 01 ce 08 0b 0b 08 de 01 02 fb 09 0b 0b 09 67 fe f8 01 08 09 0b 0b 09 fe f8 01 08 08 0c Data Ascii: 654&!2654&#!=M?+01+?M=900FF009'gvsG0+??+0Gs !Z88==88Z! H\|'''85EZ!547>763232654'.'&#""3!2654
Nov 26, 2024 08:20:07.083452940 CET	1236	IN	Data Raw: 3d 01 34 26 23 05 1c 01 31 14 06 2b 01 22 26 3d 01 34 36 3b 01 32 16 15 38 01 15 14 36 35 3c 01 31 34 26 2b 01 22 06 1d 01 14 16 3b 01 32 36 35 30 34 35 34 22 15 25 26 27 2e 01 27 26 27 3e 01 35 34 27 2e 01 27 26 23 22 07 0e 01 07 06 15 14 17 1e Data Ascii: =4&#1+"&=46;2865<14&+";2650454"%&'.'&'>54'.'&#"347>76303:321SF((,?HO55<<55O)"'I :P?++0MMMMXD
Nov 26, 2024 08:20:07.083499908 CET	1236	IN	Data Raw: 37 3e 01 35 34 27 2e 01 27 26 23 22 07 0e 01 07 06 15 14 16 17 1e 01 07 0e 01 07 06 07 0e 01 07 06 15 14 06 23 22 26 35 34 37 3e 01 37 36 37 2e 01 35 34 37 3e 01 37 36 33 32 17 1e 01 17 16 15 14 06 07 16 17 1e 01 17 16 15 14 06 07 03 e7 10 12 17 Data Ascii: 7>54'.'&#"#"&547>767.547>7632D''"-Q558855R-"'(EH++((+`?@II@@_+((++HB22e*'k;855RP449;h'+f22&43i0//u?I@@__@@I?u//0i34&
Nov 26, 2024 08:20:07.083534956 CET	1236	IN	Data Raw: 9c 4d 43 43 65 1d 1d 1d 1d 65 43 43 4d 4c 44 43 64 1d 1d 1d 1d 64 43 44 4c 00 00 02 00 0e ff ab 03 ef 03 a3 00 29 00 45 00 00 05 27 3e 01 37 36 27 2e 01 27 26 27 26 07 0e 01 07 06 07 06 17 1e 01 17 16 17 16 37 3e 01 37 36 37 17 1e 01 17 16 36 37 Data Ascii: MCCeeCCMLDCddCDL)E'>76'.'&'&7>7676764%&'.'&767>76(7dLL]^YY33cLL]433_,,&N??S+zJJNM??S+yKJ-o?]YY33dLK^]YZ33 +yJJNN??S+
Nov 26, 2024 08:20:07.083570957 CET	1236	IN	Data Raw: 4f 4e 75 22 22 fd b9 08 15 06 67 1b 01 06 09 01 20 1b 1a 25 09 0a 02 04 21 21 6d 48 47 50 52 48 48 6c 1f 1f 02 01 22 22 6e 47 47 4a 27 59 16 5e 28 5c 37 34 76 28 29 1e 64 2b 2a 62 18 01 03 07 04 4c 20 02 01 01 01 02 01 06 0b 01 01 1f 13 02 26 2d Data Ascii: ONu""g %!!mHGPRHHl""nGGJ'Y^(\74v()d+*bL &-'@MEDffDEM+((H R9fDD+LD%%%I>?\_?@I?=<_l;f%>5.'"09'.1"0"'"&'32677>
Nov 26, 2024 08:20:07.083626032 CET	1236	IN	Data Raw: 29 09 c4 09 15 0e 02 3f 06 06 6a 03 03 6a 0f 08 16 0a 24 1b df 09 1b 06 9f 13 2e 16 16 1d 04 20 02 11 08 cb 18 1b 1b 18 cb 08 11 02 20 04 1d 16 16 2f 13 9d 06 1c 09 df 1b 24 0a 0d 0e a3 06 05 67 05 03 0b 05 10 0a df 17 35 11 9f 04 18 0a 0b 11 02 Data Ascii: )?jj$. /$g5 )m@>'././.#"326?>323267>/&6?#"&/.#"#"&'.?6&/.7>?>
Nov 26, 2024 08:20:07.204737902 CET	1236	IN	Data Raw: 07 0e 01 15 11 14 06 23 03 21 22 26 35 34 36 33 21 32 16 15 14 06 07 21 22 26 35 34 36 33 21 32 16 15 14 06 01 14 06 23 22 26 35 34 36 33 32 16 05 14 06 23 22 26 35 34 36 33 32 16 02 cb fd f4 4f 70 70 4f 01 de 0f 15 15 0f fe 22 31 5b 5b 32 02 0c Data Ascii: #!"&5463!2!"&5463!2#"&54632#"&54632OppO"1[[21Y"@#oO.PPXioOOoZ11ZZ1-I>ROo3BQ]i
Nov 26, 2024 08:20:10.574878931 CET	424	OUT	GET /css/newFontsIco/icomoon.ttf?-2mgmdr&v=49 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive Origin: http://www.wheel-done.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://2.ss.508sys.com/css/dist/styles/fontsIco.min.css?v=202404081140 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.984991074 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Type: application/octet-stream Content-Length: 373156 Connection: keep-alive Expires: Fri, 28 Jul 2034 11:08:06 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:43 GMT ETag: "6084db97-5b1a4" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Access-Control-Allow-Origin: * Accept-Ranges: bytes Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: BC72_dx-lt-yd-zhejiang-huzhou-3-cache-3, BC77_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC198_lt-obgp-fujian-xiamen-33-cache-1, i1872280_c17483 X-Cache: HIT from i1872280_c17483(cloudsvr) Data Raw: 00 01 00 00 00 0b 00 80 00 03 00 30 4f 53 2f 32 0f 12 1d 29 00 00 00 bc 00 00 00 60 63 6d 61 70 07 19 67 fe 00 00 01 1c 00 00 06 98 67 61 73 70 00 00 00 10 00 00 07 b4 00 00 00 08 67 6c 79 66 18 81 d4 2c 00 00 07 bc 00 05 86 60 68 65 61 64 19 e8 a8 f0 00 05 8e 1c 00 00 00 36 68 68 65 61 07 c8 07 e8 00 05 8e 54 00 00 00 24 68 6d 74 78 a6 00 79 2d 00 05 8e 78 00 00 10 b0 6c 6f 63 61 0a 4f b6 e8 00 05 9f 28 00 00 10 b4 6d 61 78 70 04 45 02 2d 00 05 af dc 00 00 00 20 6e 61 6d 65 99 4a 09 fb 00 05 af fc 00 00 01 86 70 6f 73 74 00 03 00 00 00 05 b1 84 00 00 00 20 00 03 04 00 01 90 00 05 00 00 02 99 02 cc 00 00 00 8f 02 99 02 cc 00 00 01 eb 00 33 01 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 ff ff 03 c0 ff c0 00 40 03 c0 00 40 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 06 00 00 00 03 00 00 00 34 00 00 00 04 00 00 00 7c 00 01 00 03 00 00 00 34 00 01 00 04 00 00 00 7c 00 03 00 01 00 00 00 34 00 03 00 0a 00 00 00 7c 00 04 [TRUNCATED] Data Ascii: 0OS/2)`cmapggaspglyf,`head6hheaT$hmtxy-xlocaO(maxpE- nameJpost 3@@@ 4\|4\|4\|H S S SS!)09@IPY$`i.py8B
Nov 26, 2024 08:20:12.270540953 CET	422	OUT	GET /css/fontsIco/icomoon.ttf?-2mgmdr&v=182 HTTP/1.1 Host: 2.ss.508sys.com Connection: keep-alive Origin: http://www.wheel-done.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://2.ss.508sys.com/css/dist/styles/fontsIco.min.css?v=202404081140 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.680922985 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:12 GMT Content-Type: application/octet-stream Content-Length: 262140 Connection: keep-alive Expires: Sun, 12 Nov 2034 03:12:16 GMT Server: F-WEB Last-Modified: Sun, 25 Apr 2021 03:01:43 GMT ETag: "6084db97-3fffc" Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Access-Control-Allow-Origin: * Accept-Ranges: bytes Access-Control-Allow-Headers: x-requested-with Access-Control-Allow-Credentials: true X-Ser: i34714_c4672, i2103125_c25795, i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr) Data Raw: 00 01 00 00 00 0b 00 80 00 03 00 30 4f 53 2f 32 0f 12 08 65 00 00 00 bc 00 00 00 60 63 6d 61 70 ea b9 a4 39 00 00 01 1c 00 00 00 74 67 61 73 70 00 00 00 10 00 00 01 90 00 00 00 08 67 6c 79 66 69 93 a2 10 00 00 01 98 00 03 e0 b4 68 65 61 64 17 26 24 72 00 03 e2 4c 00 00 00 36 68 68 65 61 09 a8 09 32 00 03 e2 84 00 00 00 24 68 6d 74 78 c1 a9 f1 dd 00 03 e2 a8 00 00 0d c4 6c 6f 63 61 06 bc 8a c8 00 03 f0 6c 00 00 0d c8 6d 61 78 70 03 8a 03 05 00 03 fe 34 00 00 00 20 6e 61 6d 65 99 4a 09 fb 00 03 fe 54 00 00 01 86 70 6f 73 74 00 03 00 00 00 03 ff dc 00 00 00 20 00 03 04 02 01 90 00 05 00 00 02 99 02 cc 00 00 00 8f 02 99 02 cc 00 00 01 eb 00 33 01 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 eb 39 03 c0 ff c0 00 40 03 c0 00 40 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 03 00 00 00 03 00 00 00 1c 00 01 00 03 00 00 00 1c 00 03 00 01 00 00 00 1c 00 04 00 58 00 00 00 12 00 10 00 03 00 02 00 01 00 20 e7 2b e7 33 e7 78 e8 00 [TRUNCATED] Data Ascii: 0OS/2e`cmap9tgaspglyfihead&$rL6hhea2$hmtxlocalmaxp4 nameJTpost 3@9@@ X +3x9 0w67797979pP0(4X3!267>5!">32>754&"&5463214'.'&#!"1!2113265045:"[G<UUB''&&<7$%'F8]Dp:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49826	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:06.107336044 CET	322	OUT	GET /2/AD0IidHSCRACGAAg_Ofz6gUogJ7O9QEwgA84kwc.jpg HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:07.076040983 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: image/jpeg Content-Length: 48652 Connection: keep-alive Expires: Thu, 23 Nov 2034 06:11:28 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg_Ofz6gUogJ7O9QEwgA84kwc.jpg Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i14957_c17987, i2103119_c25795, i1872280_c17483 X-Cache: HIT from i1872280_c17483(cloudsvr) Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 50 00 00 ff e1 03 2f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 [TRUNCATED] Data Ascii: ExifII*DuckyP/http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0C7967EDC3E611E9BCD0B6F55407B5FA" xmpMM:DocumentID="xmp.did:0C7967EEC3E611E9BCD0B6F55407B5FA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0C7967EBC3E611E9BCD0B6F55407B5FA" stRef:documentID="xmp.did:0C7967ECC3E611E9BC
Nov 26, 2024 08:20:07.076097012 CET	1236	IN	Data Raw: 44 30 42 36 46 35 35 34 30 37 42 35 46 41 22 2f 3e 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 3c 3f 78 70 61 63 6b 65 74 20 65 6e 64 3d 22 72 22 3f 3e ff ee Data Ascii: D0B6F55407B5FA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Adobed
Nov 26, 2024 08:20:07.076136112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:20:07.076188087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:20:07.076225042 CET	1236	IN	Data Raw: a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 ae df 9f b5 3e 1d c1 85 87 df f7 a3 bf 7e a0 fa 5a 73 e3 1c f7 f5 07 40 00 00 00 00 00 00 02 a6 e7 9f b3 6f 0e e0 cc d0 8c d1 97 f2 e7 8f 50 3e 47 de f7 bf 1e 7c 7d 01 6f e3 7d df 0b 7b 9c f1 e9 c8 Data Ascii: >~Zs@oP>G\|}o}{4\|{# L\|W;
Nov 26, 2024 08:20:07.076239109 CET	1236	IN	Data Raw: 6f b1 78 d5 8c 9c 7e 53 00 a3 a7 b5 96 f9 fc 6d 3c c4 fa 02 4f 90 d9 c9 4b 45 69 3e 20 b5 a7 9e f9 30 cd ad d6 62 3b 83 32 37 73 7b dd f9 8e 78 e0 17 f7 76 6f 8f 1d 26 bd 26 d1 d6 41 17 c7 ec 64 c9 79 ad e7 90 6c 80 00 00 e3 25 a6 94 b5 a3 bc 40 Data Ascii: ox~Sm<OKEi> 0b;27s{xvo&&Adyl%@>zw3Nhs;\|9'Z#_o-V&g91V1~{Z9/L]lxW\|v{<zZkLqi
Nov 26, 2024 08:20:07.076272964 CET	776	IN	Data Raw: 37 b5 b3 64 cb e5 58 e6 01 6b 0e 0c 95 d6 b5 27 9f 29 8e 80 cf c5 a9 b1 19 6b 33 13 c4 4f 59 05 cd fc 19 2f 5a cd 7d 3b 83 cd 0c 19 2b 16 f2 e9 13 d8 15 73 6a ec 5b 3c cc 73 c4 cf 70 68 e5 c3 92 75 62 91 fb f0 0a 5a 7a d9 a3 2c 5a dc c4 47 70 75 Data Ascii: 7dXk')k3OY/Z};+sj[<sphubZz,ZGpu&O*1\|k8f9 Zuu SbsZkId,cRLkDGpK3%0Z-LtfFb9ZV'GPv5ZcdE::>~U
Nov 26, 2024 08:20:07.076308966 CET	1236	IN	Data Raw: ac c7 49 05 ad 9d c8 d7 8a fe 3c f9 76 07 ba bb 71 b3 cc 44 71 30 0b 9c 47 7e 01 06 c6 c4 60 a7 94 c7 20 ad ad bd 19 ef e1 e3 c0 3c d8 df 8c 19 3c 3c 79 fb 82 7c 7b 55 be 19 cb c7 48 f4 05 4a 7c 9d 6d 78 af 8f 49 9e 22 41 ab d2 62 3e e0 f2 66 2b Data Ascii: I<vqDq0G~` <<<y\|{UHJ\|mxI"Ab>f+Y;.'4dGi;c~0[&z~N-)gAogj5[q8c&_<OxsX #6H=mn<\1#)rxA[yV-{Z)Y*~R"
Nov 26, 2024 08:20:07.076343060 CET	1236	IN	Data Raw: 8f 04 4f 8c f3 32 08 b2 e9 62 be 4f 39 b4 44 cc f6 05 8b 60 c7 6c 5e dc fe bc 77 05 7c 3a 58 71 df ca 26 26 63 b0 3a d8 d4 c7 9a 7c ad 31 12 09 b0 60 a6 2c 73 4a f5 89 ee 0a b1 a3 8b dd f3 f2 8e 79 e7 80 5a cf 82 99 69 15 b4 f1 11 db 90 43 af a7 Data Ascii: O2bO9D`l^w\|:Xq&&c:\|1`,sJyZiCVyqG33qc*Ek;V{LH=Gm>s7cy
Nov 26, 2024 08:20:07.076379061 CET	1236	IN	Data Raw: 0a 5e 2b 7a c5 a7 ea 0b 38 f3 62 9c 53 78 fd 63 bc 02 a6 3d ad 79 c9 c4 56 22 66 7a 48 2c 6d 66 c5 8e b1 e7 11 6e 7d 01 e6 a6 6c 59 2b 33 48 f1 e3 b8 2b e5 d9 d7 ae 6f 1b 53 99 fa 83 4a 96 ad eb 13 5e c0 ec 00 00 05 3d bc d8 f1 57 f3 8f 2f b0 3c Data Ascii: ^+z8bSxc=yV"fzH,mfn}lY+3H+oSJ^=W/<$qH!\Z3 l/~o>s@_.<#c[9g)y}A\|O)CL-JL3k/H}Agk6<UQ=lY)3H6/X
Nov 26, 2024 08:20:07.196645021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 'wnXOlm{w(?/l{3[ c.<GJO_{.LI2W1ZWIGX39c,OG>H6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49827	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:06.233370066 CET	322	OUT	GET /2/AD0IidHSCRACGAAg_Ovz6gUo67PL4AIwoAY4sAM.jpg HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:07.129729033 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: image/jpeg Content-Length: 122466 Connection: keep-alive Expires: Thu, 23 Nov 2034 06:11:28 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg_Ovz6gUo67PL4AIwoAY4sAM.jpg Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i35690_c25891, i2103125_c25795, i1872264_c17483 X-Cache: HIT from i1872264_c17483(cloudsvr) Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 50 00 00 ff e1 03 2f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 [TRUNCATED] Data Ascii: ExifII*DuckyP/http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:2C7DF338C3E711E9931DCFC8BEE002E6" xmpMM:DocumentID="xmp.did:2C7DF339C3E711E9931DCFC8BEE002E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C7DF336C3E711E9931DCFC8BEE002E6" stRef:documentID="xmp.did:2C7DF337C3E711E99
Nov 26, 2024 08:20:07.129781961 CET	1236	IN	Data Raw: 33 31 44 43 46 43 38 42 45 45 30 30 32 45 36 22 2f 3e 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 3c 3f 78 70 61 63 6b 65 74 20 65 6e 64 3d 22 72 22 3f 3e ff Data Ascii: 31DCFC8BEE002E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Adobed
Nov 26, 2024 08:20:07.129853964 CET	1236	IN	Data Raw: 28 e5 e9 43 88 20 3e 3b 82 3a 1c 50 48 c7 38 34 35 a1 18 02 42 29 8f cf 19 68 a4 94 53 8c 80 c4 35 80 e5 91 4e 58 10 7e 1f 4d 48 24 0a 81 40 7e 1e 18 85 24 e2 97 e3 88 c1 21 0d d4 91 30 78 a4 68 df a6 a5 25 4d 0f c4 62 14 a8 ee fc 0f 8d 6f 17 a3 Data Ascii: (C >;:PH845B)hS5NX~MH$@~$!0xh%Mboxn)PlZmn5R$%@{FWqkwr'0Y/Sg-lwq1@3x$tp!b8 J'S$w^cL\~
Nov 26, 2024 08:20:07.129889011 CET	672	IN	Data Raw: 48 02 0d 5d ea 0f c3 1a 21 20 17 56 aa f8 f9 a9 d3 2e f8 a4 05 91 5d 09 3a 4e 9e b4 1e 07 04 53 da 80 01 d7 e9 ee 7c 31 a4 65 84 50 69 05 4e 5e 18 10 51 54 96 9a 98 a4 a3 bf 70 3e 3f 0c 10 34 a6 e7 b0 ee 37 57 a9 77 c9 77 08 f7 9b e8 3c d6 d6 d0 Data Ascii: H]! V.]:NS\|1ePiN^QTp>?47Www<al{xSN<YZ$1,IUJ$33::5t@[Cs)$QA\5/7ZK7eT3/^tx,3HkK=i}q0gO4Os+Y
Nov 26, 2024 08:20:07.129923105 CET	1236	IN	Data Raw: 0a 54 38 26 a5 5c 35 43 0a e7 42 08 f8 63 6b 42 71 92 db b6 49 6b 7f ac a4 06 ca 75 19 98 00 0a 48 35 25 a2 3e 5f 9e 92 bf 0c 62 c9 04 a4 96 46 9e 25 32 10 25 86 b4 33 c5 53 4a 7f cc 42 03 a1 f9 8a 7c 71 96 a0 a9 a6 4a 5b de 02 a0 86 05 5b a1 ad Data Ascii: T8&\5CBckBqIkuH5%>_bF%2%3SJB\|qJ[[A]t$>vRTpH1 6YCZG5\1 bAC"0A!>3h_-}dJGe6]12;zi(kDRuWcR[
Nov 26, 2024 08:20:07.129971981 CET	1236	IN	Data Raw: c5 e9 dc a1 49 02 2c 8d 4a 78 d7 a8 fb 71 59 99 24 9f 27 3a 4e 96 5f a4 78 53 14 0d 3c eb 20 68 91 c7 ac 05 74 0a 6a 15 ee 46 08 02 23 c9 1b 11 2b 2b 2d 68 ac 17 f6 d7 ff 00 0c 6c 81 d1 15 a6 90 72 1d 01 ff 00 03 e1 84 11 b1 d6 4f 53 ea 24 38 fa Data Ascii: I,JxqY$':N_xS< htjF#++-hlrOS$8_~#&kk<Sla-W.$!ZY"qDrrF\|cow4{v\|_q#/nB$hR`,u{CY$9iLsP/ukvu9wV\nD:4
Nov 26, 2024 08:20:07.130004883 CET	1236	IN	Data Raw: a0 e5 73 70 9b b7 ab 27 15 df 3d 5d cb 69 ad 7e 98 a7 d5 f9 a8 14 0e 80 b4 80 7f 2e 35 d4 59 34 27 05 f6 13 dc 4f 67 37 ad d3 93 7b 8b c6 2e 76 db db 41 fd bb 65 dc f6 e9 da ef 6e 68 89 0e 6e 9a e2 de 82 87 a2 2c ca 0a e7 55 07 1c 37 8e bb 50 d9 Data Ascii: sp'=]i~.5Y4'Og7{.vAenhn,U7PUw4ZH2\|uhgW%YV}Uexn4s+3v:\|9=-.rP5:xW(0wrO_4ei^,@;Q7jf#66.mS
Nov 26, 2024 08:20:07.130038977 CET	1236	IN	Data Raw: ab 77 b7 8a 54 9e ef 6e 7a 67 a7 1d 6b 63 91 b2 37 0e 1e 91 d9 ae f9 b7 5d da ef 9c 72 e7 2b 5e 4d b5 48 2e 2c 9a a3 a4 d4 a3 40 ff 00 e5 90 29 f8 9c 6e 48 bd 0a ee e5 b7 59 dd db 44 64 7f fa d8 07 a7 12 27 d6 ec 05 34 d3 bd 71 cd 61 9b 48 ae 7e Data Ascii: wTnzgkc7]r+^MH.,@)nHYDd'4qaH~mCe76u4CID1GfnZ4"xk'\FuSm!66WQ$2IZ:~_Kmjn`?P1i}m}7;),-T~^i\Z[pI6xF
Nov 26, 2024 08:20:07.130090952 CET	1236	IN	Data Raw: d1 77 ea 28 49 3f 12 35 a6 95 af f0 ec 2b 8b 00 75 7f 08 ad c5 9d db 44 cb 90 88 1d 2c b5 cc d0 1c 8d 7b e2 17 52 62 db 7d 96 20 16 f5 3d 40 48 02 45 19 81 de b8 dd 77 5a 39 db 6d 3d 0b 0d b6 e1 65 74 a1 a1 b8 53 5c bd 36 f2 b0 f9 83 8e f5 dc 4c Data Ascii: w(I?5+uD,{Rb} =@HEwZ9m=etS\6L#TlccGf`.y:op{<h3fOPZ[w2ZzmSUsZh<$B\|=q4+53U5i2@$m3#Ef@5i'cAWQ0[,U\mKeW(i
Nov 26, 2024 08:20:07.130125999 CET	1236	IN	Data Raw: b2 a4 77 0a 01 8a b7 31 b6 63 4a d2 4a 0e a7 45 4e a1 f1 52 7e 58 e6 ea 6e 50 74 37 20 8a 86 06 9d 47 86 21 20 94 8a e4 65 9d 7c 30 35 82 46 29 f2 c8 fd 98 10 90 8e e3 e3 8a 03 62 9e a6 9f b3 02 20 f8 64 a9 a5 69 80 25 23 9c f7 38 14 3a 39 eb 4c Data Ascii: w1cJJENR~XnPt7 G! e\|05F)b di%#8:9LHjKZ\|!I/LHai.$!d$9+JH;2Uad/p\~mK,l trq_Me_FiMIXjNF_q^cmw:aDWK]
Nov 26, 2024 08:20:07.250195026 CET	1236	IN	Data Raw: f2 71 88 68 fa 31 c7 ed 35 ef bc 86 ef b4 9b bc ec 40 3d 0b 15 cf e4 71 ca ff 00 a8 c7 02 f5 ee 4f 1c de f9 97 b7 f3 6c 3c 6a d8 ee 3b aa 6e bb 65 fc 76 0d 22 87 9a 1b 37 77 91 63 2e 40 69 0e a1 41 5c f1 6b 09 91 32 83 fa 73 b9 bb b5 f7 a6 de d6 Data Ascii: qh15@=qOl<j;nev"7wc.@iA\k2sx{7]6A,BJ9_I(HWji&_s3>5f0cnKW~jGyI"f-Re<Aw^vR(Mh\Xi+\|{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49829	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:06.359554052 CET	327	OUT	GET /2/AD0IidHSCRACGAAg1_Hz6gUo4NKP5wQwugQ4xwM.jpg.webp HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:07.655064106 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:07 GMT Content-Type: image/jpeg Content-Length: 14146 Connection: keep-alive Expires: Wed, 22 Nov 2034 13:30:35 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg1_Hz6gUo4NKP5wQwugQ4xwM.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i15413_c17987, i2103127_c25795, i1872270_c17483 X-Cache: HIT from i1872270_c17483(cloudsvr) Data Raw: 52 49 46 46 3a 37 00 00 57 45 42 50 56 50 38 20 2e 37 00 00 50 63 01 9d 01 2a 3a 02 c7 01 3e 6d 34 95 47 a4 23 27 2a a7 55 19 f9 50 0d 89 67 6e 73 cb 3a 63 92 f5 3a 85 22 e3 33 9b aa 70 8c 36 86 8f 9b f4 33 b1 7b 6c 34 6a 28 f7 46 7c 7b f7 8b e8 e4 1e cc 83 bc 70 a0 c1 5f a7 ee 6f 9e af 3c e5 f9 eb f9 c8 f4 fe 7a ce 74 4e 7a da ff 98 c1 ec f4 17 ea 5d a7 b5 8b d2 25 86 3f ed 39 37 e7 3b cc 7f a2 fc e4 f9 88 f2 33 ab 6b f1 bd 07 7d ad fb 57 fd af f0 9e ed d3 b9 fe 7f 47 9e 9e f8 7f 1e 23 fd bf 37 ba 18 07 b9 00 ae 30 5f 55 07 b6 66 d9 7e c3 54 95 9f 02 23 d8 11 ab 60 fd af 33 6b 1c 0e af d0 8c 4a 8e 63 dc f6 03 2d 50 3d 50 3c ea b9 0a 6b e0 e6 d2 39 c5 96 ce a1 bf 6b db 17 c4 2d 41 71 10 fb f9 75 28 1e c2 bb 55 e6 fa 2f da 60 46 e6 47 fc 42 2c 81 1f eb b7 a1 4b ae 12 aa 0d 9d 02 28 8b bd aa a0 df fc 0d f7 e6 58 ef eb bb d5 5f 48 e8 a1 9f 1c 54 4b bb ad 87 e7 c3 ec 51 d6 3b 3e 16 f3 cd 1a d0 dd a6 71 de 8b 73 b3 48 4d bf 24 df 56 c8 75 2f 4e 49 3b 63 b5 9a 85 bc 4a e8 92 d9 31 3b db 2f 23 29 da 42 93 [TRUNCATED] Data Ascii: RIFF:7WEBPVP8 .7Pc:>m4G#'UPgns:c:"3p63{l4j(F\|{p_o<ztNz]%?97;3k}WG#70_Uf~T#`3kJc-P=P<k9k-Aqu(U/`FGB,K(X_HTKQ;>qsHM$Vu/NI;cJ1;/#)BUK&$~O6%t}"v9EK!d$}+K.&HkMBiBq Fl=got}uM2^1xEKjMp/1?]\L3~r@hVw]Wp0lr=Jz&]4?h9us8?x%Dm=K0~85xfsVnt\|o?"VMK8;:Ki=#Z:0Nfa)!exVu^)81E(GgcN6oA)C$Y893yT>G5*'L}^ K+-;
Nov 26, 2024 08:20:07.655093908 CET	1236	IN	Data Raw: 8c ae c8 11 ee f1 5a 5d e3 4f 22 a1 e6 7d 8e 5d 24 04 c7 a7 da 11 5d ac 25 cf cc 04 9a 45 51 0f 0c 41 f8 d7 e0 01 de ba 29 14 3b 05 1b 05 73 94 b1 1a bd 4e 42 2c 9c 67 93 df 58 c8 08 bd 77 a5 84 41 9d 06 58 2e 4f 92 75 0d 89 c1 b2 0c f9 4c 19 a7 Data Ascii: Z]O"}]$]%EQA);sNB,gXwAX.OuLgVv%<2h$s[fY2Dl W5,A]\|m]0Sf#=mz~`\RNXpnt2z?{KgtWrx#8b0tQ9AsyeRnkJ/f
Nov 26, 2024 08:20:07.655112028 CET	1236	IN	Data Raw: 18 e6 60 1d 6a b7 4a 00 1c ce 0f ba d5 d2 9a 45 15 df 52 cb 00 6f 40 e0 84 9f b1 0e 69 5d 83 71 29 0e c5 22 aa 2d 55 bd d7 bf f9 fb 54 13 b7 cb 51 94 89 9d 81 f4 c6 56 4a 35 fb 61 cd bf b3 96 99 f6 23 6e 3b f0 97 f4 d9 65 39 08 53 77 f9 11 e0 ff Data Ascii: `jJERo@i]q)"-UTQVJ5a#n;e9SwT]0Ip0E *ozP;OsSd9'i@bn]b#]\f&DE/>?1k-'9gma{YwG+9g$A}Kh2")
Nov 26, 2024 08:20:07.655201912 CET	1236	IN	Data Raw: a0 af dd 96 98 fc 40 f4 13 e6 07 11 0d f4 9b 06 8a ab 5d 5d 32 3f 79 c5 02 7f 55 f6 8b 5b 43 6a e9 6d 84 79 5c b8 52 e8 3d 09 79 7d 9c e0 04 90 59 7d 56 7c 14 cb 75 78 c2 48 c5 3c 1a e6 34 e8 35 a9 70 ec 8a 79 92 59 f0 4e 4c 8c eb a5 bb 5d 38 fa Data Ascii: @]]2?yU[Cjmy\R=y}Y}V\|uxH<45pyYNL]8ag[c0F:`#TC mMvI&3Jgf7Z15ypRKP]xe>*="?&9g&JJ $Q1(uO'S^6906<"H:9T
Nov 26, 2024 08:20:07.655211926 CET	1236	IN	Data Raw: f8 53 9c ba e6 97 e9 5d 0c bf b9 22 45 f7 b7 f6 6f 42 9b 54 65 cc c0 47 bd 9c 21 4e 08 25 42 17 dd 50 01 4b d3 6b a9 c8 f6 38 e8 e9 a7 ea 69 10 c8 f5 6d 04 d0 74 bd 72 80 11 e6 ef 1c cd 1d 76 b4 19 89 d4 02 11 3f 29 59 1b 61 f6 81 c2 54 a2 0a 98 Data Ascii: S]"EoBTeG!N%BPKk8imtrv?)YaTPA~e[LH71E~xdfq!gw9KU*zV6CGH+HeNuo#1)HpK<@B1J`(g}
Nov 26, 2024 08:20:07.655227900 CET	1236	IN	Data Raw: 66 d8 91 38 ca 61 61 99 56 50 9d fd 7d be 69 5c 27 3d 2a 4b e5 99 8a a2 5e 5b 9d 9d 66 62 a9 c1 3e 8c 8d aa dd 69 2d 84 41 3d de 5b 2f 25 05 b1 13 e1 a7 8d 50 45 89 fd 4a b9 c9 cb 03 fe 45 c9 0b 2e c4 36 0f c5 a2 25 fa c8 c2 b0 8f d8 4e a7 0b 2d Data Ascii: f8aaVP}i\'=K^[fb>i-A=[/%PEJE.6%N-hpgv&"D^\|$]?Mv\|~B6$lKSl"m/og'mRmII7no$.fm$ijVA6)uye;*V3/6]hI
Nov 26, 2024 08:20:07.655246973 CET	1236	IN	Data Raw: 57 4f 79 33 11 06 d9 dc 0c 29 92 f3 a4 5d 14 41 ee 31 6a 64 8d b4 d2 a7 09 be 9f 1a c3 42 29 2c 09 d0 05 40 da af 3c 2e 1b ff bf 4a c3 12 79 10 53 8a de ae 3c 35 fd da 69 36 1c dc ef ce 07 22 72 e0 8c 61 4c 0d a4 36 f7 ee c3 65 cc b6 0d 97 e0 f7 Data Ascii: WOy3)]A1jdB),@<.JyS<5i6"raL6evwY>#ER$b_S&z0nD"ppkSY~vJ[h0BIz]qO6M\S"T-.N15Zok*LJ&{t_nLln\B
Nov 26, 2024 08:20:07.655289888 CET	1236	IN	Data Raw: 17 c1 e4 31 cb 89 7f 54 3d a2 9a 94 f8 c4 dd bf c6 3f 26 70 0f c9 b7 e0 35 32 47 2b c2 55 10 d7 b4 ed 8d f2 de 77 d3 e0 4a 4f 28 26 3b 3e a4 52 f0 cb d2 28 c4 72 e5 ef 83 55 85 89 2a 7b 56 54 ba c7 ae b2 6e fb dd 0d 81 c0 16 28 7f 74 f0 36 40 16 Data Ascii: 1T=?&p52G+UwJO(&;>R(rU{VTn(t6@g+Hcg/"=rKMY?Z+Q`]sl&SX$)WMB&>`).AN"&z$YQOK}}7AqcLe<p?:jxo)lK>snUCZ(;A
Nov 26, 2024 08:20:07.655306101 CET	1236	IN	Data Raw: 63 85 96 39 87 72 5f c1 a0 8b 02 99 8e ca b7 cd 50 76 48 a7 01 23 84 c7 d5 b6 b0 fd c0 0b 62 76 7f c0 7f 47 b3 01 3b c0 02 a0 14 bb 87 d6 53 4e 51 db 9c 5b c0 55 a2 9d 24 1c f5 dd ae 81 12 10 95 39 a0 e7 f1 48 3c 29 13 4a de 0f 55 f1 63 23 74 47 Data Ascii: c9r_PvH#bvG;SNQ[U$9H<)JUc#tGH0PnOG_V\|SSs39M$29^VldeMTo$S=WslF\|-_OP;BqX&Wg/xhQ`qN!R}8_[^7U{GLR
Nov 26, 2024 08:20:07.655323029 CET	1236	IN	Data Raw: 38 45 91 cb a8 27 40 7a d3 d2 d4 64 84 3c 54 ea d6 bb 52 88 7f b2 64 a6 6e fe c2 25 b6 22 1e 92 76 6b 55 d2 a0 28 a1 e5 fe 08 8f 98 b3 32 98 69 79 1e 63 ff 8c 7c b8 27 a1 d4 f4 43 b3 63 77 67 46 43 3b 0c fd 5a fe 95 fa 23 8a f2 9f 40 bd 2b 25 5c Data Ascii: 8E'@zd<TRdn%"vkU(2iyc\|'CcwgFC;Z#@+%\+e@Y[{N=qw1Gy#C>)TLSx\|x;_bk\ 0Ku[B7k06RPj5A[.%qV #,G+cL~'S;Mv6
Nov 26, 2024 08:20:07.775428057 CET	1236	IN	Data Raw: 0a 58 89 70 ed 8a ca 46 c5 0c cb aa e1 98 b1 4d 4f 4e 2c b3 90 16 d3 eb 17 f0 25 5c e2 80 92 e8 b4 6d 41 95 bc 93 f7 2c 68 56 40 5c cb bd 0b 24 ee e5 11 f5 b9 56 f6 a8 cf 03 db 45 bd c0 29 4c 55 7d ee 45 7c 43 f4 d5 69 f4 55 57 ca 2a 8e c4 2b ef Data Ascii: XpFMON,%\mA,hV@\$VE)LU}E\|CiUW+pBx[a.u'/xm)jBMwctXtJGDOv"m!_{.mi>%`CsUcQLSbE'.QD
Nov 26, 2024 08:20:11.188698053 CET	327	OUT	GET /2/AD0IidHSCRACGAAg1_Hz6gUopJONngIwugQ4xwM.jpg.webp HTTP/1.1 Host: 20228233.s61i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:11.595160007 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: image/jpeg Content-Length: 68702 Connection: keep-alive Expires: Wed, 22 Nov 2034 13:30:39 GMT Server: F-WEB Content-Disposition: filename=AD0IidHSCRACGAAg1_Hz6gUopJONngIwugQ4xwM.jpg.webp Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 X-Ser: i34696_c4672, i2103127_c25795, i1872268_c17483 X-Cache: HIT from i1872268_c17483(cloudsvr) Data Raw: 52 49 46 46 56 0c 01 00 57 45 42 50 56 50 38 20 4a 0c 01 00 d0 99 02 9d 01 2a 3a 02 c7 01 3e 6d 2c 90 45 a4 22 a1 97 ae 05 5c 40 06 c4 b1 b3 bc bb 99 23 60 50 ca ed 3f c7 8d a1 98 64 51 2e c8 e1 c4 20 f8 1d d7 1c 41 d2 0b 60 5c 81 38 03 9f 27 76 e0 64 da 4a f3 ed b6 d5 bd 0d 79 af 1b e6 2d bd 05 97 ff b8 f7 f4 ff b9 ec 47 fb bf fb 1f 60 3f ec 1e 5c be bf 3f 78 bd 4b 7e de fa b7 7f da fd d2 f7 a9 fd d3 d4 03 fa af fb 9f 5b 5f fc 9e cf 3f e5 7f ec fb 08 fe e1 fa cc 7a b3 ff 8c ff d9 d4 01 ff ff db 63 9a 9f cc bc 88 7c e3 fa 0f f6 ff 96 9e 75 f9 4b f7 2f f0 5f e7 7f eb ff 89 f7 39 ff 8b fc e7 90 0f 61 fe d7 ff 87 fa 8f 52 3f 99 fd ef fd b7 f7 cf 6e 3f d7 7f e3 ff 49 e3 bf eb bf d2 7f e7 f5 05 fc bf fa 9f fc 8f f0 be bb 3f 53 ff a3 fd 47 fc 8e fd bd c7 fc ff fd cf f3 3f eb 3d c1 7d a7 fb 17 fd 5f f1 3f ea bf 71 3e 03 3e 7f fe d7 fa af 54 ff 57 ff 15 ff 33 fc 9f e6 17 d8 0f f2 df ea bf f2 7f c1 fe 54 7c cf ff 13 f6 d7 c9 db ef 3f ec ff f7 7f ab ff 4b f2 03 fc e7 fb 87 fe af f2 3f e9 ff 77 be 9b bf bc ff [TRUNCATED] Data Ascii: RIFFVWEBPVP8 J:>m,E"\@#`P?dQ. A`\8'vdJy-G`?\?xK~[_?zc\|uK/_9aR?n?I?SG?=}_?q>>TW3T\|?K?w?g}E_=z=#\dfZ]=~\ peFP 1^zpe~SBT}jk'U%JoA{C&Reqj?]SoW\|S~%pavfrNnG}]<z\|D^\|o8/A?/>U,}dSt$Sj?FY-j)&=g*3Y[ZC2qIR[b -Pe+e)Z@(p43mHEpyqa[#R=dRh.\N~uwxptAU&fG)=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49830	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:06.511251926 CET	342	OUT	GET /api?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=onlineMapCallBack HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:08.137547016 CET	1174	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 398 Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:07 GMT Expires: Wed, 27 Nov 2024 07:20:07 GMT Http_x_bd_logid: 1207840396 Http_x_bd_logid64: 1207840982354175242 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=6DE43C5838FE199165296962B4EE0ECE:FG=1; expires=Wed, 26-Nov-25 07:20:07 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=F80DDEF6519320447317E1803479E854:FG=1; expires=Wed, 26-Nov-25 07:20:07 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12078403961288513802112615 Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 77 69 6e 64 6f 77 2e 42 4d 61 70 5f 6c 6f 61 64 53 63 72 69 70 74 54 69 6d 65 20 3d 20 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 20 77 69 6e 64 6f 77 2e 42 4d 61 70 3d 77 69 6e 64 6f 77 2e 42 4d 61 70 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 42 4d 61 70 2e 61 70 69 4c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 77 69 6e 64 6f 77 2e 42 4d 61 70 2e 61 70 69 4c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 6f 6e 6c 69 6e 65 4d 61 70 43 61 6c 6c 42 61 63 6b 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 6f 6e 6c 69 6e 65 4d 61 70 43 61 6c 6c 42 61 63 6b 28 29 7d 7d 3b 76 61 72 20 73 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 73 2e 73 72 63 3d 27 68 74 74 70 3a 2f 2f 61 70 69 2e 6d 61 70 2e 62 61 69 64 75 2e 63 6f 6d 2f 67 65 74 73 63 72 69 70 74 3f 76 3d 32 2e 30 26 61 6b 3d 4b 66 4e 53 4c 78 75 47 70 79 6b 39 42 42 59 48 6e 53 71 5a 73 59 6f 4b 78 6e 37 4d 55 47 78 58 26 73 65 [TRUNCATED] Data Ascii: (function(){ window.BMap_loadScriptTime = (new Date).getTime(); window.BMap=window.BMap\|\|{};window.BMap.apiLoad=function(){delete window.BMap.apiLoad;if(typeof onlineMapCallBack=="function"){onlineMapCallBack()}};var s=document.createElement('script');s.src='http://api.map.baidu.com/getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958';document.body.appendChild(s);})();
Nov 26, 2024 08:20:11.872582912 CET	350	OUT	GET /images/copyright_logo.png HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:12.426436901 CET	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 2586 Content-Type: image/png Date: Tue, 26 Nov 2024 07:20:12 GMT Etag: "6731c226-a1a" Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212146688 Http_x_bd_logid64: 1212146361665351946 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:54 GMT Server: apache Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4d 00 00 00 20 08 06 00 00 00 57 63 f5 34 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 09 bc 49 44 41 54 78 da e4 5a 7b 50 54 d7 19 3f fb 00 b2 12 d8 05 79 58 56 84 99 d0 28 42 29 49 d3 82 fe 81 36 d1 69 9d 04 d2 c1 4e 9d 69 46 a4 74 e2 4c ff 90 51 52 42 c7 f8 24 e4 8f a6 89 8d 8f 4e 6b 3b c6 3c 74 5a 6b 70 3a e8 8c 6d 74 0c e0 48 13 9d a9 c8 00 be a2 bc 41 09 84 85 95 d7 b2 8f 7e bf c3 39 cb dd bb 77 71 31 88 1d fb cd 7c 73 ef 3d f7 9c 73 bf f3 3b df f3 ec ea d8 03 90 c7 e3 61 b3 49 3a 22 79 8b e9 c5 37 66 f7 23 b3 29 ef a3 04 4d 80 65 20 0e 25 0e 23 0e 11 a0 4d 10 8f 11 3b 45 57 bd 90 d5 4d ec 12 98 7a fe ef 40 13 80 01 ac 27 89 a3 89 a3 b6 6e dd 9a d1 d3 d3 63 3f 7c f8 f0 0d 7a 1e 24 1e 15 32 86 0a e0 00 e6 88 60 07 40 fc 5f d6 48 3f d0 be 29 0b ad 8a 25 7e e6 fc f9 f3 c7 3b 3a 3a 6e 7b 04 d1 fd cd 8d 1b 37 16 d3 bb e7 0b 89 8e 1d 3b b6 b7 ba ba fa f8 9e 3d 7b b6 46 47 [TRUNCATED] Data Ascii: PNGIHDRM Wc4tEXtSoftwareAdobe ImageReadyqe<IDATxZ{PT?yXV(B)I6iNiFtLQRB$Nk;<tZkp:mtHA~9wq1\|s=s;aI:"y7f#)Me %#M;EWMz@'nc?\|z$2`@_H?)%~;::n{7;={FGGgS"a6dyAk"jjj%Xc~p8&vutbbQP___-[~IcqZf-*\|mo})q{\|~abYAsgtb&8=[%AY\|38UK9mSs8)vCCnvq}Q7e]~~MLLLKw}\f!N:}#c51~mW5>>nHWJ\|C&@jj2"&&EF",Yk"8h~/0[leVU?XDoE#^Zn]0Eu5A/T<B\|<V0'@(}txFBK:}a`}#Kj\|@f>'J\;&2
Nov 26, 2024 08:20:12.426448107 CET	634	IN	Data Raw: 2c b2 f5 7b 22 63 77 c9 7a 51 c3 8f 3d 29 1c ff b7 bb ba ba fe 90 90 90 b0 20 77 75 a7 d7 2f 49 7a 63 77 0c fb c5 ab e6 c0 be 8d 02 42 a4 59 cf ac 89 21 ec 95 b5 dd de f1 d0 c8 a3 95 09 2c 35 2d 8c 9d 3a 75 ea 68 6e 6e ee ef a8 f9 ae ca 4c e5 e6 Data Ascii: ,{"cwzQ=) wu/IzcwBY!,5-:uhnnLDEV"Hs(Z^(..~;wt49rC.Qs/)J0kmm,S:r%\JSU{w"s"RW;\p4GNp$!!=x("
Nov 26, 2024 08:20:12.636780024 CET	1138	IN	Data Raw: d9 b1 d6 f0 82 42 a6 37 5b d8 04 f5 09 cb 59 e1 27 db 60 c5 6e 6f 7f 52 88 95 74 69 0e 98 dc 02 b0 b8 33 e7 7c da b0 7b f6 fd ef 79 9f 21 e8 f0 c7 1f f9 8d 35 90 82 99 b7 ed 60 00 8c 07 91 da 1a ef bb 86 86 06 38 54 96 91 91 11 25 9d 7b d9 96 5e Data Ascii: B7[Y'`noRti3\|{y!5`8T%{^x%+VEw<x,e!9\x.)\|}zkEJ?vE=h?\|mm~}8NnOh_!5=OfN&H3dA<@*<-z8\|}d4'j
Nov 26, 2024 08:20:12.775327921 CET	448	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53093328&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:13.326008081 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:13 GMT Etag: "6731c229-31" Expires: Wed, 27 Nov 2024 07:20:13 GMT Http_x_bd_logid: 1213047797 Http_x_bd_logid64: 1213047811464025354 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:57 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:13.327023983 CET	495	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605610720&callback=BMap.logCbk6219177233&sign=0c25ae630a48 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:13.883332014 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:13 GMT Expires: Wed, 27 Nov 2024 07:20:13 GMT Http_x_bd_logid: 1213600076 Http_x_bd_logid64: 1213600191262560266 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12136000760198846218112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 32 31 39 31 37 37 32 33 33 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 32 31 39 31 37 37 32 33 33 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk6219177233 && BMap.logCbk6219177233({"result":{"error":0}})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49831	111.180.138.108	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:06.552978039 CET	303	OUT	GET /4/418/AKIDCAQQi_WOvgUY4fSTngQ.png HTTP/1.1 Host: 1.s60i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:08.183022022 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:07 GMT Content-Type: image/png Content-Length: 931 Connection: keep-alive Expires: Tue, 17 Oct 2034 17:57:09 GMT Server: F-WEB Content-Disposition: filename=AKIDCAQQi_WOvgUY4fSTngQ.png Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Age: 1 X-Via: 1.1 PSzjnbsxsy229:0 (Cdn Cache Server V2.0), 1.1 PS-TSN-01iPM72:4 (Cdn Cache Server V2.0), 1.1 PS-WDS-01zXZ71:6 (Cdn Cache Server V2.0) x-ws-request-id: 674576a7_PS-WDS-01wST72_11436-40198 Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 05 00 00 00 10 08 02 00 00 00 51 16 22 9a 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 31 31 20 37 39 2e 31 35 38 33 32 35 2c 20 32 30 31 35 2f 30 39 2f 31 30 2d 30 31 3a 31 30 3a 32 30 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRQ"tEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:E503FA083E7611E69EC0AEAB23E3D8E1" xmpMM:DocumentID="xmp.did:E503FA093E7611E69EC0AEAB23E3D8E1"> <xmpMM:DerivedFro
Nov 26, 2024 08:20:08.183092117 CET	233	IN	Data Raw: 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 45 35 30 33 46 41 30 36 33 45 37 36 31 31 45 36 39 45 43 30 41 45 41 42 32 33 45 33 44 38 45 31 22 20 73 74 52 65 66 3a 64 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d Data Ascii: m stRef:instanceID="xmp.iid:E503FA063E7611E69EC0AEAB23E3D8E1" stRef:documentID="xmp.did:E503FA073E7611E69EC0AEAB23E3D8E1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>+IDATxb<F <HIENDB`
Nov 26, 2024 08:20:32.698785067 CET	303	OUT	GET /4/427/AKsDCAQQy_iOvgUY0eC-vgY.png HTTP/1.1 Host: 1.s60i.faiusr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:33.273356915 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:32 GMT Content-Type: image/png Content-Length: 935 Connection: keep-alive Expires: Sun, 15 Oct 2034 17:21:41 GMT Server: F-WEB Content-Disposition: filename=AKsDCAQQy_iOvgUY0eC-vgY.png Access-Control-Allow-Origin: * Origin-Agent-Cluster: ?0 Cache-Control: max-age=315360000 Age: 1 X-Via: 1.1 PSzjnbsxkx232:1 (Cdn Cache Server V2.0), 1.1 PS-TSN-01hw176:5 (Cdn Cache Server V2.0), 1.1 PS-WDS-01m0q70:4 (Cdn Cache Server V2.0) x-ws-request-id: 674576c0_PS-WDS-01wST72_11436-41577 Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 05 00 00 00 10 08 02 00 00 00 51 16 22 9a 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 31 31 20 37 39 2e 31 35 38 33 32 35 2c 20 32 30 31 35 2f 30 39 2f 31 30 2d 30 31 3a 31 30 3a 32 30 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDRQ"tEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1C5084813E7711E69D37E03DE81AE9D8" xmpMM:DocumentID="xmp.did:1C5084823E7711E69D37E03DE81AE9D8"> <xmpMM:DerivedFro
Nov 26, 2024 08:20:33.273483992 CET	237	IN	Data Raw: 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 31 43 35 30 38 34 37 46 33 45 37 37 31 31 45 36 39 44 33 37 45 30 33 44 45 38 31 41 45 39 44 38 22 20 73 74 52 65 66 3a 64 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d Data Ascii: m stRef:instanceID="xmp.iid:1C50847F3E7711E69D37E03DE81AE9D8" stRef:documentID="xmp.did:1C5084803E7711E69D37E03DE81AE9D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^%IDATxbf@L`C~IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49838	182.61.244.229	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:07.176692963 CET	284	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:08.788846016 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:20:08 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:20:34.002167940 CET	339	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:34.573780060 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:20:34 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:20:45.439169884 CET	339	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:45.995907068 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:20:45 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:20:55.715948105 CET	339	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:56.283380032 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:20:56 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:21:04.473059893 CET	339	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:05.037826061 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:21:04 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Nov 26, 2024 08:21:13.106312990 CET	339	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:13.669641018 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Tue, 26 Nov 2024 07:21:13 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49835	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:07.290936947 CET	348	OUT	GET /getscript?v=2.0&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&services=&t=20240731110958 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:08.145649910 CET	830	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:07 GMT Expires: Wed, 27 Nov 2024 07:20:07 GMT Http_x_bd_logid: 1207870279 Http_x_bd_logid64: 1207870381471253770 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=6DE43C5838FE19911D5F584BD85928F7:FG=1; expires=Wed, 26-Nov-25 07:20:07 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=B4F2A0FA824D34AF13C5DC7AC4D071E9:FG=1; expires=Wed, 26-Nov-25 07:20:07 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12078702791288513802112615 Vary: Accept-Encoding Transfer-Encoding: chunked
Nov 26, 2024 08:20:08.145687103 CET	1236	IN	Data Raw: 63 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 79 57 db ca b2 ef 57 71 74 b2 78 d6 46 08 49 9e ed 28 3c e6 90 00 21 40 a6 4d 38 ac d6 60 23 f0 84 07 66 bf cf fe 7e 55 dd 92 25 db 90 ec 7b cf 5d ef 9f 97 7d 0e 6e f5 58 5d 5d 5d 53 4f 77 51 37 Data Ascii: cbc}yWWqtxFI(<!@M8`#f~U%{]}nX]]]SOwQ7{O>OZZIm8FVjU3q?pGc9Ejj#B+dClFl{Bk;$[hZ(o?fJQ.DOe.Q^Rw^(G
Nov 26, 2024 08:20:08.145733118 CET	1236	IN	Data Raw: 50 24 63 de 99 21 bf 57 e1 99 11 08 b2 1e 94 f3 8d 79 01 f0 56 b6 f3 96 da f1 db 44 6b 6d a6 b5 b4 f6 40 75 89 d4 3c 3d c3 ec fc f5 6b f4 eb d7 bd b0 7e fd 1a 17 2c cb 3a 5f d6 9f f3 67 ea 43 25 50 9e f3 65 cc 62 43 6b 31 92 fd b6 89 fe 76 dc b4 Data Ascii: P$c!WyVDkm@u<=k~,:_gC%PebCk1v ak9jR\$)L#``>Bj>K#?T8+&?nv]{{oW,_ISmO_,"~=5dew F"vT@MfTS
Nov 26, 2024 08:20:08.145750046 CET	1236	IN	Data Raw: 88 88 3f a8 f0 b4 d7 cf d6 87 88 04 42 f9 b3 32 5f d6 e7 ee 50 d3 aa 65 fe fb 62 46 d4 d9 00 43 91 ed 40 1f 82 8d 3c 0c f7 a0 3b f0 f0 48 1b 91 2a fb 1e 05 a3 4b f0 8c 46 b0 30 0b aa 49 72 b0 3a 9f 8c 96 fe 94 85 38 1f 81 6d 1d 82 1b ac 39 75 4f Data Ascii: ?B2_PebFC@<;H*KF0Ir:8m9uOJ`$G/[r5Pf$PD~A5b=T/S`(-Uz$sM.#R+>-$f@_qnh^j!S8fCv897vzm\c24V?
Nov 26, 2024 08:20:08.145770073 CET	1236	IN	Data Raw: 2a c8 7b 47 12 af ac d5 f0 df 25 b9 62 8d d6 87 be 98 e4 37 fb e3 e1 65 fe 49 a1 a9 9e 64 26 4e a4 22 0d 85 a6 45 89 3f 0d d5 d5 6c a2 8a 54 89 3f 17 25 fe 34 78 3c b2 49 1c c5 09 3f e7 13 7e 1a 39 c9 bd b3 49 32 ce 88 02 80 13 35 a3 70 90 4d 9e Data Ascii: *{G%b7eId&N"E?lT?%4x<I?~9I25pMO#%tlL},gfM^Q;g/"z>G3,B\|1RC@n&g9M/,{qfE)/$LCwQp8,JCfP.(~RKKg>&!
Nov 26, 2024 08:20:08.145848036 CET	1236	IN	Data Raw: 9e 56 e2 49 41 25 ba 7c 0d 64 bd a1 26 66 6f 3c 4a ef 1e 5d b0 8d 3d bd 1f fc 12 6d 69 3a 09 01 d1 ef 83 df c8 fa 3c da 06 d7 9f 18 b6 24 d3 1f 77 98 2a a2 1f ed 03 c6 e7 e7 19 4e 98 cc 95 a5 a5 24 f8 de b5 cd 52 56 e7 36 2f 88 1f 9d 84 fe 78 10 Data Ascii: VIA%\|d&fo<J]=mi:<$w*N$RV6/x6{fZZz9xppa@5[h j>,ikK{#f(Rs.CGiLPqU-qY~+j_ZQZ&V8g\?EY)
Nov 26, 2024 08:20:08.145855904 CET	1236	IN	Data Raw: bc a9 fe 99 a8 e7 67 35 a6 f3 09 90 f7 bb f5 5a cd 78 0c 25 b4 6a eb 74 df 18 fc 8d 88 76 af d5 a3 b3 21 83 5e 1b 8a 50 ee 66 ed 06 d0 1e 7f ab 9f 9d 1b e2 1e e9 1e 1f 3a 61 58 e8 d8 3c 95 fb b4 95 80 b9 11 3d ae 8f 47 97 fb a8 84 36 88 71 e1 1b Data Ascii: g5Zx%jtv!^Pf:aX<=G6q%bJIa3/#h&*8F^IiRg#eq}z-O3&`~Z61v;fl{!1eooTwf[vS2w%
Nov 26, 2024 08:20:08.145864010 CET	1236	IN	Data Raw: 40 f6 c9 31 28 58 17 63 a7 fe b1 d9 ee b8 b4 00 45 b6 cf ad 68 e7 09 d9 46 d5 d2 31 ef 87 d7 f5 ec be 0c 43 2d b0 85 ee 54 56 3c f8 52 39 6e 91 c8 87 f6 c4 1f 87 81 d1 72 7b 0d 1f 42 cb fc be 2d ef 14 52 1b eb 95 ac c4 04 e8 b6 0c fc 15 40 7d cb Data Ascii: @1(XcEhF1C-TV<R9nr{B-R@}Q8P"X5/uSOM_&kYP7`6e5@LOf9Y:*r])=8bPD:uD%~Pb/\|}\|k\4v1x^ReV
Nov 26, 2024 08:20:08.145972013 CET	1236	IN	Data Raw: b2 15 35 e7 eb 9e af 56 92 36 d8 14 51 07 5f 09 95 51 f2 39 8f 11 2c 68 7a 8e 52 e2 05 90 cb 3e 4d cf cb 7e 9e 98 e4 70 6f 4e 55 81 01 7a 08 82 4a c2 dc e0 a5 97 b7 93 7b e9 72 49 da c4 c8 81 81 84 a3 b9 4a c0 11 a4 40 de 52 06 cd 16 84 39 ed f4 Data Ascii: 5V6Q_Q9,hzR>M~poNUzJ{rIJ@R9e@Ztlsn`kSY"Y[\'"Z2_I[1!?o'?^O>igL;i7;)@5t c4/(^R]
Nov 26, 2024 08:20:08.145981073 CET	1236	IN	Data Raw: e7 67 c7 b2 e4 a5 8b 8f 72 4b 9b 5a f6 22 77 a4 32 36 62 5f 2a 6d be 4c af ca be 70 ae 2a 24 2f ac af 80 30 9e 82 f1 40 7a 62 1d db 22 ee 1a 28 ef 58 6c 4d 27 39 25 04 a4 54 34 49 6f fa 9b ec ff ce e5 4b fa f0 b1 d9 8b 37 12 51 d0 fc 86 c1 59 4b Data Ascii: grKZ"w26b_mLp$/0@zb"(XlM'9%T4IoK7QYK>#[h+@lYh,y%,x./7}Uu`~uRo5DQN%fYp<(E?^zozw;UnrOo*4zbNMN/E}w"#I;yzq%u`
Nov 26, 2024 08:20:08.265995026 CET	1236	IN	Data Raw: ee 38 51 c6 4e 0b 44 fc 14 2b e2 22 da a6 4c 96 02 1f 14 6a 34 5d 71 16 9e f3 4e 7f f5 ec 56 53 72 8b c1 b0 a1 74 9b 69 44 b2 8b bd 69 b4 74 b5 aa 8f 9a d4 7b 85 d2 b0 a0 87 6e e8 a5 2a ba c2 35 85 7f 0d a4 1b e9 ad d8 c4 88 ce 97 b5 3a 3f d2 83 Data Ascii: 8QND+"Lj4]qNVSrtiDit{n*5:?z&J]]<Zq: Ferlk\yJHY@/'+GO44#^%~.zGG!&cL]c7}0[pkkdX
Nov 26, 2024 08:20:11.046446085 CET	466	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=95963881&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:11.585304976 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:11 GMT Etag: "6731c1a2-31" Expires: Wed, 27 Nov 2024 07:20:11 GMT Http_x_bd_logid: 1211315771 Http_x_bd_logid64: 1211315042520917002 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:34:42 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:11.871983051 CET	341	OUT	GET /images/blank.gif HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:12.410720110 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:12 GMT Etag: "6731c1c4-31" Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212139892 Http_x_bd_logid64: 1212139080450897674 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:16 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:12.431776047 CET	473	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk73838&seckey=-1%2C-1&timeStamp=1732605609720&sign=021634ea5dfa HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:12.972044945 CET	518	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:12 GMT Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212696613 Http_x_bd_logid64: 1212696060557982730 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12126966131820473354112615 Content-Length: 121 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 33 38 33 38 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 33 38 33 38 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk73838 && BMap._rd._cbk73838({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})
Nov 26, 2024 08:20:12.973345995 CET	551	OUT	GET /?qt=cen&b=12703713.02%2C2560839.99%3B12704353.11%2C2561320.07&l=17&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk87276&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=-1%2C-1&timeStamp=1732605610224&sign=6e8c8dfcda44 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:13.531018972 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:13 GMT Expires: Wed, 27 Nov 2024 07:20:13 GMT Http_x_bd_logid: 1213238567 Http_x_bd_logid64: 1213238750282076170 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12132385672739232266112615 Transfer-Encoding: chunked Data Raw: 35 32 32 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 37 32 37 36 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 37 32 37 36 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 522/**/BMap._rd._cbk87276 && BMap._rd._cbk87276({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49840	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:07.855967045 CET	1077	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:09.417856932 CET	313	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:09 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:12.823240042 CET	1077	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:13.440356016 CET	313	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:13 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:18.140197039 CET	1164	OUT	GET /js/report?b_pi=03675761c4b29133&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=0&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2F&u_ru=&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=1552&pe_tt=121&pe_rt=2350&pe_rpt=3790&pe_dpt=17303&pe_wst=8986&pe_fst=26288&pe_drt=9120&pe_ft=26302&pe_hreqt=2064&pe_hrest=286&pe_fet=22227&pe_jst=6585&pe_csst=4918&pe_imgt=7389&pe_ajaxt=1910&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605606177&pe_css_url=http%3A%2F%2F2.ss.508sys.com%2Fcss%2Fdist%2Fstyles%2FfontsIco.min.css%3Fv%3D202404081140&pe_img_url=http%3A%2F%2F28088389.s21i.faiusr.com%2F4%2FABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fajax%2Flog_h.jsp&b_ct=1732605616480&b_rt=1&b_dl=1.3&b_et=3g&b_dc=1090& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:18.748790026 CET	457	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:18 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Set-Cookie: _faiHeDistictId=64d9d5ea448b9b8d; HttpOnly; Max-Age=31536000 Set-Cookie: _faiHeSessionId=64d9d5ea448b877f; HttpOnly; Max-Age=3600 Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:38.299154997 CET	843	OUT	GET /js/report?b_pi=036757da3bf4da65&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=http%3A%2F%2Fwww.wheel-done.com%2F&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=036757da3bf4da65&b_ct=1732605637152&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1191& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:38.912673950 CET	512	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:38 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Set-Cookie: _faiHeDistictId=64d9d5fdf38bae98; HttpOnly; Max-Age=31536000 Set-Cookie: _faiHeSessionId=64d9d5fdf38b9633; HttpOnly; Max-Age=3600 Set-Cookie: _faiHeSesPvStep=1; HttpOnly; Max-Age=3600 Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:47.475873947 CET	1079	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRFwSulxsNHzxX%2FM7CSWzpCF1jWmNnk4sxvMmbG7ZmuMw%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:48.086522102 CET	313	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:47 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:49.947563887 CET	1426	OUT	GET /js/report?b_pi=0367580668186ff6&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=0&pe_tt=0&pe_rt=1134&pe_rpt=921&pe_dpt=4968&pe_wst=2833&pe_fst=7800&pe_drt=2891&pe_ft=7811&pe_hreqt=848&pe_hrest=286&pe_fet=6605&pe_jst=3211&pe_csst=1074&pe_imgt=1157&pe_ajaxt=1837&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605643770&pe_css_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fjzcusstyle.jsp%3Fid%3D-1%26colId%3D2%26extId%3D0%26_csw%3D0%26clientSupportWebp%3Dtrue&pe_img_url=http%3A%2F%2Fapi.map.baidu.com%2Fimages%2Fblank.gif%3Fproduct%3Djsapi%26sub_product%3Djsapi%26v%3D2.0%26sub_product_v%3D2.0%26t%3D31034223%26code%3D5000%26da_src%3D5000%26device_pixel_ratio%3D1%26platform%3DWin32&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fajax%2FmgClue_h.jsp%3Fcmd%3DgetWafNotCk_getClueTicket%26_v%3D1732605642710&b_ct=1732605647424&b_ [TRUNCATED] Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:50.565217972 CET	457	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Set-Cookie: _faiHeDistictId=64d9d609574bd8f6; HttpOnly; Max-Age=31536000 Set-Cookie: _faiHeSessionId=64d9d609574bd959; HttpOnly; Max-Age=3600 Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:21:00.287743092 CET	853	OUT	GET /js/report?b_pi=0367582d98b4c0db&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=0367582d98b4c0db&b_ct=1732605658927&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1191& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49841	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:07.994944096 CET	289	OUT	GET /images/openhand.cur HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:09.609731913 CET	955	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 326 Content-Type: application/octet-stream Date: Tue, 26 Nov 2024 07:20:09 GMT Etag: "6731c1c4-146" Expires: Wed, 27 Nov 2024 07:20:09 GMT Http_x_bd_logid: 1209330695 Http_x_bd_logid64: 1209330360210477834 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:16 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; expires=Wed, 26-Nov-25 07:20:09 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 00 00 02 00 01 00 20 20 02 00 08 00 08 00 30 01 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 01 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f0 00 00 03 f0 00 00 07 f0 00 00 0f f8 00 00 1f f8 00 00 1f fc 00 00 3f fc 00 00 77 fc 00 00 67 fe 00 00 07 f6 00 00 0d b6 00 00 0d b2 00 00 19 b0 00 00 19 b0 00 00 01 80 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f8 07 ff ff f8 07 ff ff f0 07 ff ff e0 03 ff ff c0 03 ff ff c0 01 ff ff 80 01 ff ff 00 01 ff ff 00 00 ff ff 90 00 ff ff e0 00 ff ff e0 00 ff ff c0 05 ff ff c0 07 ff ff e4 0f ff ff fe 7f ff ff Data Ascii: 0( @?wg
Nov 26, 2024 08:20:10.016359091 CET	464	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk86802&v=2.1&seckey=-1%2C-1&timeStamp=1732605606170&sign=8c783803c2fb HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:10.597755909 CET	489	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:10 GMT Expires: Wed, 27 Nov 2024 07:20:10 GMT Http_x_bd_logid: 1210291151 Http_x_bd_logid64: 1210291691464156426 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12102911513885119498112615 Content-Length: 93 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 36 38 30 32 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 36 38 30 32 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk86802 && BMap._rd._cbk86802({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:20:10.886476040 CET	591	OUT	GET /getmodules?v=2.0&t=20140707&mod=map_5t4s3f,scommon_qzcf2k,mapclick_u1fb2e,oppc_dwynzr,navictrl_cgpeke,canvablepath_4aihkt,common_qliwoy,symbol_1t1tgb,marker_doq5jl,vectordrawlib_wqglq1,style_exrf4k,tile_znc1s3&seckey=-1%2C-1&timeStamp=1732605606185&sign=8cfb777cfc75 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:11.453557968 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:11 GMT Expires: Wed, 27 Nov 2024 07:20:11 GMT Http_x_bd_logid: 1211161097 Http_x_bd_logid64: 1211161802623921418 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12111610974036966410112615 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 65 33 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d4 bd 69 77 db 38 b2 30 fc fd f9 15 0a 67 ae 23 b5 69 1a e0 4e 29 8c 4f f6 4e 77 b6 4e d2 9d ce 76 72 b8 ca 74 b4 45 8b 97 d8 fe ef 6f 55 01 a4 48 89 50 96 99 79 ef dc c9 b4 45 12 60 a1 50 28 d4 86 02 78 f8 cb 2f 87 9f 4e 16 a3 69 94 9a 7b 7b e5 55 f7 e6 38 9a dd d4 3b 37 2f 62 63 36 9f 2e a7 cb 8b 59 66 24 d1 24 c9 46 61 11 75 99 9e af 26 c9 b2 98 4e ba bd cb e5 71 b1 30 be 2e f6 f6 92 51 16 cd 5f 17 e3 6c ba 5a 76 e5 d3 de 80 2e ee df 09 e9 77 7a 2a ee e3 af 21 bb ee 0d 3a 77 8d b7 59 b7 82 15 f5 2e 8b bc 7b 23 32 ee 5e 5d e1 5f 63 79 d1 bb 8c 8c 2f 17 dd de 51 f7 f7 21 94 eb 4f e8 ef 53 fc db eb 47 46 94 a6 0f 4e b3 c9 f2 49 b1 58 66 93 6c de d5 10 7f ad 8e 1e bc 87 4d f6 06 4f ca 8b a7 f2 02 10 88 8c ec 38 d4 3e 7c 58 d9 99 99 c2 8f e3 e6 a9 06 4f 1f 2d 42 8d 6b 83 d3 68 de 89 c3 cb 57 f7 fb 53 3d 8b fb 35 a8 80 67 6c bc ba df bb c4 bf e1 97 c1 22 5b 96 3d af d5 8a 8d f1 b0 db bb d6 1d c6 7a d7 d7 fa 78 58 07 81 c0 93 30 32 7e 4f bb 3d 3d 85 8b 61 04 [TRUNCATED] Data Ascii: e3eiw80g#iN)ONwNvrtEoUHPyE`P(x/Ni{{U8;7/bc6.Yf$$Fau&Nq0.Q_lZv.wz!:wY.{#2^]_cy/Q!OSGFNIXflMO8>\|XO-BkhWS=5gl"[=zxX02~O==aYX8_rL2#-$HV9SR,/df]r+,nMqFdpyxZoV4a2;v:1x.ioT8fNfNg&B<[\aHv](;]MRT8J!r?F3$C]M!X.,z;KqD;WWO5{\fBJy.Xv`Q-Wqgyv+\|p3G@<Mx S[d7%^db-cR&]+%di%:J%nj(_}-&3c4kWr_hI,g^Rq1*kY6NcuwY!,5
Nov 26, 2024 08:20:11.453574896 CET	1236	IN	Data Raw: 4b e3 fc 0d ea 6c fc 15 23 05 0f 17 e7 62 74 e2 70 92 9d 75 9e 76 4d dd ec 21 99 80 fd 63 e3 ac 48 97 c7 a1 67 ea b1 71 9c 15 c3 e3 65 c8 7a 03 a1 1b b1 76 9e 76 2f a7 79 0e fa b5 1f eb b3 79 31 59 46 f1 28 eb 4f 09 f9 c5 79 98 5c 13 bd bb 44 70 Data Ascii: Kl#btpuvM!cHgqezvv/yy1YF(Oy\Dpr<kCH/LAj\|/)Qk-MkrNT PEYpY%"l=^{$`cSwzKMr=jcx_]m^z"
Nov 26, 2024 08:20:11.453588009 CET	1236	IN	Data Raw: 08 bd fd 1d 4a 3f bd c9 62 a4 ac 60 00 f9 b0 6c 78 d4 2e e1 ff b7 b9 4d f6 6f 34 4d a2 51 d9 43 63 79 76 18 c5 d3 d5 f2 70 fd 38 5a cc ce 49 91 b8 91 d0 20 71 64 3e c1 d2 5a 1f db 14 68 8b c2 eb fc 6f 6b bc b5 c2 1b 1a ab c9 e2 b8 c8 97 38 83 16 Data Ascii: J?b`lx.Mo4MQCcyvp8ZI qd>Zhok8hRp>]M~d,JSlflfTL]xQt,4%:ni1jcEz&W2%EQ3]`WYNb.3H_U,x-
Nov 26, 2024 08:20:11.453663111 CET	389	IN	Data Raw: 61 92 0a a9 f1 1a ba 23 92 7a 3c df 25 39 16 07 11 0e ce 76 36 45 32 2a 92 cf 1b a9 27 7f 52 e6 09 72 6d b6 66 d7 3c cc 24 bb e6 35 26 9b 67 c0 29 c5 29 8c 76 5e 32 19 8e 0e de 96 c2 b7 bc a7 5e 00 9f 30 c6 f0 16 47 e2 15 4e 19 8d 13 3f e7 c6 0b Data Ascii: a#z<%9v6E2*'Rrmf<$5&g))v^2^0GN?Z6 mIAcnl5e)y1_,\|N"w=87)}/4XD0C56SS#'p(&LF7BruIR#qU&z(z(M'q>95@x&-"sL
Nov 26, 2024 08:20:11.453674078 CET	1236	IN	Data Raw: 32 30 30 0d 0a a4 b1 75 cf 0d 1c b0 3b 99 ae 8d a7 ab 45 86 32 5e 6b 78 87 8f 63 d4 85 9b 7d ad c8 b2 7e 0b 1d 38 7d 13 dc 6a f9 13 d0 e0 25 04 06 5c fb 34 5b 73 6d a4 43 3f f5 54 e4 2f 15 8b 67 d1 33 98 3f d0 5b 71 19 e3 a5 98 41 92 5e 61 08 e4 Data Ascii: 200u;E2^kxc}~8}j%\4[smC?T/g3?[qA^a=xlOpj&1g>b=D\|BTx>-(A%;6CAopB%T %?SoCrvQKvE+qx`oP?T7hT4K},c
Nov 26, 2024 08:20:11.453686953 CET	1236	IN	Data Raw: f7 bc bd 94 43 69 95 0e 84 1e f9 62 54 24 59 17 a8 d3 d2 84 58 64 23 98 3a bd 7a bd a6 08 30 e6 ef 6f 1a 41 87 d2 c7 a7 a0 b4 8e 7b 35 1e 2c 68 87 ea 84 c1 68 47 c6 5f 6f f4 08 7e ee 3f 44 13 07 dd ad 78 ad 9f 84 28 8e 07 1c fc ab a3 7c 3f d4 0e Data Ascii: CibT$YXd#:z0oA{5,hhG_o~?Dx(\|?0DmN)^Z"?[NxYE"[8C93C]?$m>6B.!x{Ma>naz:Y(!.w1z6Q>X\|b;I4g2;K")5
Nov 26, 2024 08:20:11.453699112 CET	1236	IN	Data Raw: 7d 01 fc ba 9e 7f d5 41 ca 87 6d 91 4a 30 f2 93 0d 9b ad 48 c3 b2 ed e8 54 eb c8 85 f7 20 f8 1f 0d 73 05 16 a1 66 6a 2d 59 bb ff c8 a2 dc 94 a9 c1 6a e3 ed d6 32 9e a6 17 b7 d1 6c 43 4b b6 d6 74 da 11 26 19 e6 77 e0 6f d5 30 a6 95 74 c8 9e 03 7b Data Ascii: }AmJ0HT sfj-Yj2lCKt&wo0t{!a0SjFYB?`$AjDuv&I-M#<8eDIt-y1[OE JXR0!<E6ziuC&Til6^}}-^X
Nov 26, 2024 08:20:11.453720093 CET	1236	IN	Data Raw: 5f 11 97 b5 44 e2 e5 f4 15 cd 53 23 89 46 23 4c 91 3d 83 21 fb a9 37 1f 9e f6 60 66 9a 83 c5 59 b1 4c 8e b1 d7 09 88 c3 0e ca 30 98 15 22 6d e5 b3 f1 f4 02 59 02 4c 0d b0 dd c4 79 4c b2 d6 bd 2f b5 5a af 9e c9 5a c9 46 ad e8 14 6b c9 a4 26 e3 ec Data Ascii: _DS#F#L=!7`fYL0"mYLyL/ZZFk&IKVOUjPzWBUZgZ/kQ1a(B^IeLc$5x&+d~/yO?~rW^O-'d,#cxd!Xw`162AVo
Nov 26, 2024 08:20:11.462078094 CET	1236	IN	Data Raw: e3 7e da 78 c0 3f ee 67 d5 fc 65 eb be 4f 8a c6 ca 21 0c ed 3d f0 5a c5 4c 13 b5 b5 3b da 2d cc e2 d3 de 69 b7 c3 e8 28 3e 70 9d be 16 c9 67 5f e9 99 e9 ee c7 07 81 d7 d7 98 7c 1c d0 63 c7 84 c7 b6 df d7 f6 51 98 1e b9 66 5f 3b 14 57 32 1c a0 4a Data Ascii: ~x?geO!=ZL;-i(>pg_\|cQf_;W2J=G3Zn+sgU~mW}EJiXnX}qe\`-BMr-]NJOYkYx}X<wx;'b6]?73bA{>k5>]@_
Nov 26, 2024 08:20:11.462192059 CET	1236	IN	Data Raw: ed 22 fc 35 e9 4e c0 ca 39 ea 2e c2 7f 26 5d 30 de 22 f0 31 2f 7f 9b 51 76 df 64 3f d4 f6 b4 fd 45 af 8f 36 64 45 19 3c eb 48 1c a3 d4 09 3b 82 12 9f 96 c7 ab f1 24 2a 46 9f a0 10 7a 51 27 dc 66 59 85 5e 67 8d 9e 3c c3 05 de 60 50 23 1a 2d 77 d3 Data Ascii: "5N9.&]0"1/Qvd?E6dE<H;$FzQ'fY^g<`P#-w<<iB[PDkn_@WknS'?m9N9Wn~7sGcu\gR9uzPccfU^?}~g=:c['6l T>e4$oFL
Nov 26, 2024 08:20:11.470525980 CET	1236	IN	Data Raw: 20 49 51 68 a7 a5 78 a1 07 29 8a 14 12 0b df 2d 4c 52 14 26 19 7d ed 34 33 1e 15 5d 8c 49 84 ef 2f d7 39 cd e5 a6 b3 87 f0 bf 07 5c d3 85 3b 58 3e f5 ef e1 3f ad da a0 68 df c7 7f b8 77 b1 05 02 7b e8 3d 7c b8 09 c1 bb 73 c7 ba 57 83 60 9a f6 5d Data Ascii: IQhx)-LR&}43]I/9\;X>?hw{=\|sW`]}b50)d\|o/OJb]vCcCOv%(gR9/ZTt/Kv\hMbp(8>D2Rc]^?t__#qM0Z_k]
Nov 26, 2024 08:20:12.151042938 CET	493	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605607162&callback=BMap.logCbk4206044938&sign=8817e55d060a HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:12.709132910 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:12 GMT Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212424411 Http_x_bd_logid64: 1212424882940420362 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12124244112663654410112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 32 30 36 30 34 34 39 33 38 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 32 30 36 30 34 34 39 33 38 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk4206044938 && BMap.logCbk4206044938({"result":{"error":0}})
Nov 26, 2024 08:20:12.713517904 CET	434	OUT	GET /getmodules?v=2.0&t=20140707&mod=copyrightctrl_kneba2&seckey=-1%2C-1&timeStamp=1732605609767&sign=0aa625ac9280 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:13.286045074 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:13 GMT Expires: Wed, 27 Nov 2024 07:20:13 GMT Http_x_bd_logid: 1212998915 Http_x_bd_logid64: 1212998052412717066 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12129989154036966410112615 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 33 64 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 56 4d 73 db 36 10 bd f7 57 d0 3c 50 44 84 d0 72 67 7a 11 c5 cc d4 8a 35 4d 2a 79 9a 3a 39 39 1e cf e2 43 12 1a 8a 60 49 e8 cb 0a ff 7b 16 22 29 92 b6 92 36 17 8a 5c 2c 76 f7 bd b7 0b e8 f2 d5 ab cb c7 7f f2 58 83 f8 d5 f3 ea 37 bf c7 75 ba cf d4 62 69 b8 c9 e2 1e 75 7a bb 40 ee 8c 4c 84 3f 17 41 9a 69 a3 cd 3e 95 f4 b0 9f 0f e7 eb 84 1b a5 13 9f 1c cc 52 e5 c1 5b cf 3b fe be 93 7e f9 4d 0a aa 12 65 14 c4 ea 49 36 ee 40 0e d0 8a 15 34 3e 01 87 38 3e 6e a6 40 c2 63 90 6b f0 ab b7 f7 ba 7e 13 80 31 c2 4c 9a 75 96 38 47 cb b8 a0 02 3a 19 36 90 39 2c b2 8b 21 04 20 c4 cd 46 26 66 aa 72 84 22 33 df b5 68 5d da 42 c0 8e f1 0b 72 d6 7b a5 37 12 29 f8 ff 1b 9e b4 5e fd d4 86 15 a4 96 0b be 84 64 21 9f 6d 1b 7b 9e 8f cf 20 37 fb 18 29 d2 b1 ce 22 16 bc 0d 34 52 13 fc b5 f2 09 06 2d e8 35 b4 05 e9 10 7c 0d 0d b1 24 dc 05 7f 06 1f a1 94 68 4c dd eb 19 a4 8f 3c dd 8f 51 6f 97 84 96 37 88 2a 56 cb 94 58 30 5f 67 39 66 75 85 9c c3 3a 36 2e 9a b6 4b 65 e4 5d 0a 5c 46 [TRUNCATED] Data Ascii: 3ddVMs6W<PDrgz5My:99C`I{")6\,vX7ubiuz@L?Ai>R[;~MeI6@4>8>n@ck~1Lu8G:69,! F&fr"3h]Br{7)^d!m{ 7)"4R-5\|$hL<Qo7VX0_g9fu:6.Ke]\Fn:OrXrcieeW4ueu"NpU-9n6aXn~1EYA,Yg!X~v5t?aQ}./Q"N\|Nj9YNrN(m D4/U,2@8VCwc2F#WN+WSPPybs4H<P}H4r^V\|S%8\|M/96+N7ABIR_%=)m;bc.T~W}2t8@=U&*N>t\|YNVj@eGxZr"ffU" h/f]]BgY0&c
Nov 26, 2024 08:20:13.287847996 CET	347	OUT	GET /images/mapctrls1d3.gif HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:13.842730045 CET	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 899 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:13 GMT Etag: "6731c20e-383" Expires: Wed, 27 Nov 2024 07:20:13 GMT Http_x_bd_logid: 1213562074 Http_x_bd_logid64: 1213562942984851466 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:30 GMT Server: apache Data Raw: 47 49 46 38 39 61 35 00 4a 00 d5 1d 00 ce ce ce 7e 7e 7e 5c 8a e5 f5 f6 fa 88 a9 eb f4 f4 f4 be cf f2 cb cb cb c5 d4 f3 c6 c6 c6 f1 f1 f1 f8 f9 fa fe fe fe fe fd fd 9e 9e a0 9a 9a 9a 9d 9d 9d c2 c2 c2 90 90 90 a0 a0 a0 76 9c e8 f6 f6 f6 ca ca ca fd fd fd d8 0b 0b f7 f7 f7 b3 b3 b3 fa fa fa ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 1d 00 2c 00 00 00 00 35 00 4a 00 00 06 ff 40 8c 70 48 24 76 8e c8 a4 72 c9 6c 22 8b d0 a1 73 4a 75 4a 99 d7 aa b6 2a ec 60 96 df ee 76 6c fd 7a 93 66 31 79 8d 36 9f df 5e 37 9b ad c6 ca e7 e4 3a f8 8e df aa d3 4f 7c 7d 5c 80 4f 47 7a 83 84 70 86 88 89 53 59 4a 90 8e 54 51 51 93 7e 95 45 97 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad 6c 1a b0 b1 b2 b3 b4 b5 b6 b7 b7 [TRUNCATED] Data Ascii: GIF89a5J~~~\v!,5J@pH$vrl"sJuJ`vlzf1y6^7:O\|}\OGzpSYJTQQ~Eltpnu+-CLD@@j(:!Z]}t@Hu"S`5o&Fx$<j{H7.`[7FrY)X0m0?*N+FWaRkLJ`Y",(4BY}A-k\| {cwoc\WWqIWeL'p}CU1d[asgh36Q&Nosa6f8bfh+j (#^B(h"#^7#9#+(b,yAOBX$H0"(%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49842	112.34.113.148	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:08.336896896 CET	404	OUT	GET /s.gif?l=http://www.wheel-done.com/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:09.998174906 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:09 GMT
Nov 26, 2024 08:20:35.490324020 CET	444	OUT	GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2F&l=http://www.wheel-done.com/en/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:36.076210976 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:35 GMT
Nov 26, 2024 08:20:45.520937920 CET	449	OUT	GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:46.104830027 CET	161	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 23 Content-Type: image/gif Server: bfe Date: Tue, 26 Nov 2024 07:20:45 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:20:56.033003092 CET	449	OUT	GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:56.618776083 CET	161	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 23 Content-Type: image/gif Server: bfe Date: Tue, 26 Nov 2024 07:20:56 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:21:04.851126909 CET	449	OUT	GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:05.437665939 CET	161	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 23 Content-Type: image/gif Server: bfe Date: Tue, 26 Nov 2024 07:21:05 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49847	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:08.997005939 CET	451	OUT	GET /tile/?qt=vtile&x=24811&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline1.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.353584051 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Type: image/png Content-Length: 17665 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"f89481432950126aa3a91bdb90a68cc8" Cache-Control: max-age=2592000 Age: 1470233 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154328643 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo4.fra01.baidu.com [2], zhuzuncache55 [4], xaix210 [1] Ohc-File-Size: 17665 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 d3 d3 d6 ff ff ff f3 f1 ee f5 f3 f0 d8 d7 d8 db de e2 f7 f7 f8 d5 d8 dd da db dd e3 e3 e4 cc ce d3 c6 ca d3 e4 eb f2 8e 97 b1 99 a7 c4 dd e3 ea ec ee f1 e6 e8 ea d4 d5 da 91 d0 e5 68 cb df ca da e1 eb eb ec ce d1 d6 d9 e3 e7 d5 ec f3 e4 e6 eb ae db ea d5 db e2 f4 ec ea ce d3 d9 c8 c9 cd e1 f4 f9 cb d9 db e0 a2 9e cd 89 77 b3 ba c8 c8 5b 39 de 60 5a ee d3 d3 a7 ad b6 f8 f1 ef ea c0 c0 e1 e4 dc ea f2 f4 36 c9 d5 b2 de d6 2d b3 ce 4e b0 d1 6a bd d9 25 a5 c9 e1 22 3a ec 6a 77 65 64 69 e8 7a 85 f1 ef f8 93 d5 af 63 c8 8d 5b a1 95 e7 e4 f0 34 b5 78 3e bc 82 3f c0 7c 45 c5 7e 4e 0c f8 d5 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEhw[9`Z6-Nj%":jwedizc[4x>?\|E~NbKGD-pHYs~CIDATx}cYlH6IO;{Hdt-I43!88,gQw_7Qp6oZJ5/?\|euA"O<9$PmMA_NA\|#7.QTE@_5C21o1<JGh#Y}(p20\|IkDX>.\| * 2f0e2z,@JOP8jHY(D(<+'h&
Nov 26, 2024 08:20:10.353616953 CET	1236	IN	Data Raw: d9 fc 44 06 98 6f e1 13 b6 ce df 96 09 46 1c b0 03 44 27 39 60 96 8b 86 ac 62 73 f9 6b 00 28 94 3a c6 6e 64 83 04 ff d8 06 09 53 a7 31 00 69 8a 6d d7 2d 16 ab d5 2a 49 36 9b ec e3 87 0f 1f b7 db ad 80 e9 84 9b 50 2a cb b2 3c 17 51 5d e2 77 25 13 Data Ascii: DoFD'9`bsk(:ndS1im-I6P<Q]w%)(a5(KBzEQuTQ&!bQg'_~o`Gpbr<>\|@[\|#H{APuEEYT# 5TMSI_T+PR$HFAuUy
Nov 26, 2024 08:20:10.353626966 CET	388	IN	Data Raw: de ee 1f 6f f6 37 0c 40 9d f6 22 f0 20 0b 20 ed 0e 69 7d 00 66 b8 79 bc b9 83 3f 1e f7 84 d1 23 30 04 90 7e f9 70 73 79 93 e2 13 c0 14 06 00 05 a4 17 8d cf 8f 69 55 64 63 e7 90 a8 6b 8e 88 c0 4c d3 2f 77 ef 4f 0c a0 5f 57 a0 0b 3d ed 3f 11 00 12 Data Ascii: o7@" i}fy?#0~psyiUdckL/wO_W=?9}B@rK7nX@5 ) w7:LP37@V%eHX^&=ct1j@nLO#Ew4.QG79`:5w2/O>\|
Nov 26, 2024 08:20:10.356206894 CET	1236	IN	Data Raw: f0 84 7e 7f c4 f9 ff 7d 8f 7c 71 c3 00 00 18 73 89 e6 ee 31 bd 95 77 28 02 e0 30 00 67 dc de a1 52 78 94 0f a0 20 1e 6e 10 80 07 b0 10 69 0a fe 00 6a c0 22 94 57 ef 69 2e ea a4 c0 10 8c e6 94 a3 00 c4 64 3c 8b 82 f3 c3 6f 45 04 c7 00 54 6c 01 9a Data Ascii: ~}\|qs1w(0gRx nij"Wi.d<oETlM$X,oqsm0KPw `x$Jy4{sWVv4JfQ85*\nA\{.I`A`wd$#^!t6Q!%.M\|
Nov 26, 2024 08:20:10.356262922 CET	1236	IN	Data Raw: 2e 39 02 96 06 5c a3 cc a3 1a d7 44 71 5e 1c 09 93 86 be 98 d6 57 a5 d1 fa 29 68 c0 f0 9c cc 83 32 70 f5 c6 18 4d f2 f4 a2 d9 fb 3a 62 76 41 6a 80 1d 96 b0 e3 8e 21 31 41 2c 5e bf 1d 1d 9e 42 20 ef 95 5e 95 09 c7 7a 61 dd 86 e7 e1 57 be 0c bc 45 Data Ascii: .9\Dq^W)h2pM:bvAj!1A,^B ^zaWE+1URu\V#_T;HZfkQ;s(\|xz/'Ev6Ie>Q^U<QdE2n$Z"y/QoiHwgfb>dfFMo)
Nov 26, 2024 08:20:10.356389999 CET	388	IN	Data Raw: f2 b7 d4 8e 95 de a0 f3 04 4a 6a 74 d2 a6 46 ed 0d b2 b0 a7 85 4d 24 b9 0b 18 e6 92 a3 6a f0 f9 19 11 58 ca 0f 7f 00 18 7f 30 00 4f 80 c7 eb f2 ea 65 b9 96 17 af 9f 5f 2e 34 00 3c f1 2c 1f f0 fc eb 95 e1 80 d7 77 ec 04 1c 2b 3d ff 19 25 47 e5 1c Data Ascii: JjtFM$jX0Oe_.4<,w+=%GX$j`$btKZ^]\\<2C=p3N`:!zzkwbh.,@%PCp%?k^]9" 2r{AJY<zr3^(Y
Nov 26, 2024 08:20:10.358674049 CET	1236	IN	Data Raw: 03 22 2f 5e 5f 81 5e d0 f4 cb a7 8f 01 00 52 17 80 e5 7b b6 43 8f d5 60 df 0e a3 f2 6e fe ad b1 08 c6 ed bb b3 d4 d1 a3 2c 03 b4 10 a8 6b d2 37 60 85 06 9e 10 0f ed 07 11 03 ac 41 0f ae 5f 9f 40 04 d6 c0 e7 72 79 e1 02 f0 f2 bc b4 7e 80 16 81 8f Data Ascii: "/^_^R{C`n,k7`A_@ry~`SlV=T^`U/mq{<v)$\|fQ>i9\|Z j0K+Waq$Gh!?%]?kC<*yH1p(@nf` WAx~dEstt-).#
Nov 26, 2024 08:20:10.358700991 CET	1236	IN	Data Raw: 7b 98 6a 9d 81 e1 92 81 72 a8 75 96 8c 59 a0 7d 1f 0b 50 a7 b8 36 9c b1 16 6f 6a 00 de 7a 3d 22 db a1 b6 e6 1a ba 81 04 30 9f 6b 53 3f 6c 6e 54 50 71 02 35 bc 51 56 3a fb 3b 0c 58 42 a3 06 79 6d b8 60 ce 16 eb 93 00 58 29 75 3d 95 b3 11 6f 6a c0 Data Ascii: {jruY}P6ojz="0kS?lnTPq5QV:;XBym`X)u=ojG5kRn7,{!o;~A}eN8g#'\'IT82Ql=73#S5?.C97I@:j00A:}LcVTmdA&],
Nov 26, 2024 08:20:10.358711004 CET	388	IN	Data Raw: cd 7d 44 00 90 4e 39 48 5d e0 c1 92 21 d8 1d 36 78 14 19 d5 5e 6c ba f0 76 d1 c4 54 0b 19 2d 40 49 34 f6 39 28 22 f4 2b 00 70 77 02 c9 dd 96 45 40 1f e3 c0 0c 7e 5f 14 f7 86 d5 19 00 7a ef e1 7e 87 c4 52 c7 54 64 00 94 00 56 82 f7 5b 02 00 4c 22 Data Ascii: }DN9H]!6x^lvT-@I49("+pwE@~_z~RTdV[L"Kh<>6Hp[+pD6;;<4,@z@]U5"#p8@Tu_ofIl'D`q8gB^np:D
Nov 26, 2024 08:20:10.361303091 CET	1236	IN	Data Raw: 60 09 96 f4 fd 44 4d 21 4d 9a e8 9c cb 38 36 bf 50 a5 12 e8 57 12 00 e1 fe d3 ef 1c 0d 4b c0 99 0b 80 3e 29 e6 ec be ae 56 87 1d f7 8f 04 00 ea fb c3 e1 80 d3 9a ed 92 fb fb dd b6 90 05 f0 03 2d 8d b3 0e 39 83 52 b9 11 be cb 0c cd 03 5c 34 5b 30 Data Ascii: `DM!M86PWK>)V-9R\4[0'E^V;:qgm2"6NaiOwmE_v"zHvv({bOBG Q`4z5uhwr=)P_*;F"//c-x1Ki-
Nov 26, 2024 08:20:10.473784924 CET	1236	IN	Data Raw: 9e bd 37 a6 7e 53 92 a3 da 7c 44 00 a8 65 e1 60 c5 b8 b1 29 3c a3 ce 3d 6f b0 a6 c9 ab 6b 19 b7 dc a0 b5 2a b7 67 f6 e2 72 52 0b 2c 4c 2b e3 ae cc 44 cc 30 fe 1c 00 ee 6e 87 bc ed f7 e4 8d 58 c0 1e b5 d1 93 bf da da c4 5e b1 22 19 08 c4 0c 68 b5 Data Ascii: 7~S\|De`)<=ok*grR,L+D0nX^"hz2+y.Z.,wdf_9q12Ov;PK}OC=wV\|dwSYU5X]g0F#zz@oZkn+BI6jIvgkg9\d
Nov 26, 2024 08:20:34.266407967 CET	452	OUT	GET /tile/?qt=vtile&x=49625&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline1.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:34.690001011 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:34 GMT Content-Type: image/png Content-Length: 16612 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:53 GMT ETag: W/"567c169cce069f41679d8b5305867936" Cache-Control: max-age=2592000 Age: 866705 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0413146743 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:53 GMT Ohc-Cache-HIT: fra01-sys-jomo4.fra01.baidu.com [4], zhuzuncache61 [4], bdix61 [2] Ohc-File-Size: 16612 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 fe fe ff f5 f3 f0 e3 e3 e3 ec eb eb f4 e9 d6 ff e3 ad ff ec ba fb e9 c7 d7 d8 da fd da a5 fe e7 b5 e6 e7 e9 f6 f2 fe e4 eb f2 a7 d6 f3 ec eb f4 cc cf d4 db e3 e9 f4 f1 ed f9 f6 f4 db dd e2 f5 d9 b5 d1 ca b7 fc d7 9d ae b0 b4 f3 ee ea c6 c7 c9 92 93 94 92 9c ad f9 f6 fb f1 ee f6 b0 91 da c4 98 e5 9b 62 e2 a6 70 e7 cf e7 d8 b2 df ca a4 d9 bc 93 d5 af 8a d2 9f 69 c8 8f 53 c0 7f ec e5 b9 af d6 af d5 d5 a6 93 55 dd e5 d6 f0 d1 b0 ea d7 c8 eb b3 b8 c7 b8 cb cc a8 99 77 ce bb a5 74 86 ae e5 dd d2 6b 7b 9f 65 67 6c c6 b6 da b1 76 da ec 9c 56 f0 8a 32 78 90 c5 3d 40 43 24 27 2a 50 98 5e bc 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 3f 81 49 44 41 [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEbpiSUwtk{eglvV2x=@C$'P^pHYs~?IDATx}c8ls^ccC_6Ls!m7-q]MhE#B,v>c0Uc8-?R=oS1Dyt81?6'/0$A/-k~p\j7C\(26c%#}a&l~1IJ??NG!4 ,_[@MMK,?shg:AuIk22*mO@:udkNcU6%K5`,8hZ@qip`3Uue&t8n~hA
Nov 26, 2024 08:20:34.896589041 CET	452	OUT	GET /tile/?qt=vtile&x=49626&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline1.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.320301056 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 16186 Connection: keep-alive Expires: Sun, 08 Dec 2024 20:12:00 GMT ETag: W/"2136763c7036f6653fa4fd2567763d97" Cache-Control: max-age=2592000 Age: 1479611 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0720227432 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 20:12:00 GMT Ohc-Cache-HIT: fra01-sys-jomo2.fra01.baidu.com [4], zhuzuncache62 [1], csix70 [2] Ohc-File-Size: 16186 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f6 f2 fe e1 df e5 f9 f7 f4 c7 cb d8 66 7d b5 6b 83 bb 75 8d c2 dc dc e3 e4 e4 eb f4 f3 f4 ff ff ff f9 f6 fb d5 d4 db ed eb f3 e3 e2 e4 d9 d8 dc f3 f1 ee f3 ed eb ff e3 ac ff ec ba fa d8 ac 78 88 b0 9a a7 c9 f2 ed f9 e8 e7 ea e7 e9 f3 ec ec ec ff e7 b4 ad b5 cd f4 e4 d4 82 98 c8 7b 93 c8 f0 d9 d0 fc d5 9d ba c6 e1 d6 da e6 ef f1 f5 8a 96 b8 de e1 ea bb c3 d6 d1 cb e8 cb cb d3 a8 ae b7 e7 9f 5f df a8 a3 f2 94 16 ba 8c e5 c3 98 e5 9d 64 e3 a5 6f e7 e6 d4 f3 d0 ae ea b1 76 da 99 5e e0 c6 b5 d2 b9 86 dd 95 9b b0 93 55 dd e6 60 6d e8 1d 1f 64 61 62 ef 04 01 ef 51 18 e5 7c 86 f4 ae 78 d7 00 00 00 01 62 4b 47 44 0a 68 d0 f4 56 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEf}kux{_dov^U`mdabQ\|xbKGDhVpHYs~=IDATx]c6nHv7HfWo>$%JdI\|Ix Zi3O0~gga6\Tv~ZA/FZzmyn}';{;W8z?,z5IY.il!<i-\;$[X;(~B~\|qhWyhltS_]X"@s:'kZpFq=5i36770FGv9D Tr(28oSq\S)Avpa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49846	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:08.997164011 CET	451	OUT	GET /tile/?qt=vtile&x=24812&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline2.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.249455929 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Type: image/png Content-Length: 19363 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"5874f74f5ea1446c265929e54d83adb2" Cache-Control: max-age=2592000 Age: 1454505 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154446541 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo4.fra01.baidu.com [2], zhuzuncache52 [4], wzix83 [1] Ohc-File-Size: 19363 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f6 f8 f8 ff ff ff db db dc e4 eb f2 ce d2 d8 f5 f3 f0 d6 db e3 ec eb ec e3 e3 e4 d7 d8 db ec ee f1 dd e3 e8 e8 e8 e8 dc de e2 d3 d3 d6 d4 d5 d9 e4 e6 ea 93 93 94 9b a3 b1 af b0 b2 f3 f1 ee 99 d4 ff 71 73 76 ed f2 f3 f1 ee eb ac d6 ef d0 d1 ce b7 cc d2 ca d2 e3 ad b6 cd 99 a8 c9 c9 cd d5 e3 e6 f2 c7 c8 c9 79 91 c6 84 99 c8 71 85 b6 88 94 b4 d0 e8 f3 66 7d b4 9a d4 f3 71 c4 e8 91 cf ec 5a b8 dd e4 db d8 c2 50 5b d0 b2 af e6 bd c1 f8 ed f3 b3 df db 3a a4 a6 6d 79 94 d1 e6 da a6 da bb 8f d1 ae 69 c8 90 62 a6 94 f6 e9 d0 fb db ab ff ec ba ff e2 ac da cb b1 fd f7 e7 3f 9f 7c f7 22 5b 19 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEqsvyqf}qZP[:myib?\|"[bKGD-pHYs~J3IDATx}z8.@b/dDro]),,q^L@)hRF8R+"\I_Hw?rr29<b,e/)i>$?OYO_Z=+!2\|;Cjb+\|TV/>^"CD{xlV]!%b6z32RyH=.N4%zH\|$,ZfM2zy4Y:x}X-~L
Nov 26, 2024 08:20:10.249516010 CET	1236	IN	Data Raw: 08 00 b9 67 00 64 20 5f ac 4b 7c ec b5 8c 76 bc 2d 15 11 1f 97 55 95 26 6b fe 3a 0a 26 00 80 07 2b 8b 67 03 80 9f 20 02 8b 7c 10 ba b5 61 80 1c 65 d0 7d 03 fa d6 dd e1 08 6b 35 7f 52 06 e6 2d 6e 69 7c af be e4 f7 ed ba 84 f9 18 48 c4 8f 6c b5 0e Data Ascii: gd _K\|v-U&k:&+g \|ae}k5R-ni\|Hlgtu}WU_ &Jn`%W\|)uf@y!XbX.oT(M"k[kr>O0k\iCF% xcW5VF@&G(
Nov 26, 2024 08:20:10.249530077 CET	388	IN	Data Raw: e0 15 9a c1 63 1d 80 ae 21 3f 60 8f 1f b8 39 1d d8 0c 86 80 c0 b9 81 ef 8b bb b9 70 00 28 95 97 18 55 4b f4 7d 4d 2c 84 eb 01 c3 da 6e 25 f1 25 4c 5e d2 6f 48 d6 94 01 7e 1a ed 7c ef 11 58 68 d8 00 50 12 25 9e 3f 05 00 3a 0f 36 e9 65 5a a7 b9 8e Data Ascii: c!?`9p(UK}M,n%%L^oH~\|XhP%?:6eZ\|az;sp$ {/{mD`Toc&M3Q`P) aZY20O?RBvi3Y 5H~rGZ#(A]6Fi;b["@
Nov 26, 2024 08:20:10.251787901 CET	1236	IN	Data Raw: 02 c9 4d 21 c1 3f 0c 22 74 86 1b e3 fa 28 5e 5f 27 69 95 1a 5a ad fc e0 96 82 59 d4 d7 2a 7b 1a d5 01 58 81 87 37 6f 1e ae 03 00 a0 1c 7d 3f 9f 87 e0 8d 8c e3 3a 5a 1d 20 a0 d9 9f 3e bb bd bf f0 fe a0 c3 6b b6 e0 44 7e 41 76 10 19 ff ad 0c 21 18 Data Ascii: M!?"t(^_'iZY*{X7o}?:Z >kD~Av!K =^q/>P!6F1(Tb$(4}4(P"mTmfZgQm DJc88n[b,5D!'RMI?@?AEPsl~UA]!@$mQ4
Nov 26, 2024 08:20:10.251832008 CET	1236	IN	Data Raw: ac 42 59 7c f8 e3 fd fb ed fb f7 e0 08 e0 9e eb 1f c5 f1 68 b3 e3 06 d3 f4 f0 68 c0 53 3d b2 11 77 02 c8 ac 4f 41 91 18 22 26 f5 98 fe 17 6f 57 47 0e 87 c0 25 26 25 40 0f 2e 41 fb 81 1f 70 b3 58 c6 37 05 57 44 ea a7 00 20 39 c3 8f e9 9b 03 c8 36 Data Ascii: BY\|hhS=wOA"&oWG%&%@.ApX7WD 96NwR0#>-Iu@6`N5 U^<.=./noU~NA@$c&B=2!f@kBKjTRUn)XT=vX, v
Nov 26, 2024 08:20:10.251842976 CET	388	IN	Data Raw: ab f6 29 6f a2 45 91 2c 80 e5 21 1c 8e 82 4b 66 70 e2 e8 00 18 02 14 98 e8 3a 47 c8 da 51 99 6c 67 de 94 61 3d ee 36 54 b1 00 6b c0 da 2d 8c 53 4c 92 8e 34 e0 c3 f8 49 03 65 07 57 96 0c c8 9b d5 cd 62 47 d1 50 87 4d 2b ca 11 2a 3c 00 50 e7 c8 b8 Data Ascii: )oE,!Kfp:GQlga=6Tk-SL4IeWbGPM+<PIz+lwop1(13F@vW}'W7+ zR'G1REg'I\M`;%^( +wYO54YN=ArA\|Y~Y4n%!*)xf2C
Nov 26, 2024 08:20:10.254214048 CET	1236	IN	Data Raw: 70 8a f5 61 70 9e 50 32 4a bb 2c 8a 2e ba 50 f9 84 e7 01 50 52 e8 a1 3b a6 f3 f9 e3 bb 5b a7 f0 d7 bb 58 49 1a 12 cd 19 9d aa f5 99 40 ec 08 70 2a c1 c6 05 0c 52 ce d7 ea e7 c5 1a 10 fe 6d 9b 01 06 60 15 13 00 d8 24 1e 60 27 0a 3c 46 d3 c4 6e 85 Data Ascii: papP2J,.PPR;[XI@p*Rm`$`'<Fnd%<ULl'#\|e\"S9U3@Xu\|vhONj7fN#P?bW#\|\|F=lRcPblwPtvJou@c5V
Nov 26, 2024 08:20:10.254291058 CET	1236	IN	Data Raw: dc fc b9 61 00 e0 df b7 6f 60 bd c3 3f de b8 9e 12 a5 44 c6 67 23 e2 04 bb 9e d1 3a 87 10 5e 48 01 be b1 e7 78 18 aa b9 cc 1f 05 22 03 0c 52 97 36 00 ca 0e 76 7d 52 88 9e a1 46 af ca 3a 15 48 c6 be 52 39 e0 82 85 de 02 95 d4 4c 31 b0 13 e2 9d 90 Data Ascii: ao`?Dg#:^Hx"R6v}RF:HR9L1y;Iz-<sCN,UUO=S3j$E!1ICnM9LEqg-=7BUo$g&LTP'[mg\|7.3v$@LQ7
Nov 26, 2024 08:20:10.254301071 CET	388	IN	Data Raw: 9e 09 f4 e0 d0 d8 b7 6b 56 31 8f d7 7b 70 de e8 60 18 44 81 95 96 9c 11 00 b5 9a 95 36 5e 1e 0b b9 a5 c7 aa 04 76 38 96 f7 cf 00 80 cf fd 6a c2 5d ae 15 89 62 01 bb db 09 69 44 5d 4b 1a e0 f1 dd 5b 9b 01 26 da f8 46 df 05 01 20 15 13 77 4a 34 b8 Data Ascii: kV1{p`D6^v8j]biD]K[&F wJ4&4 OQy*N~_Xe$6sbri2;;z:DrA0}x&Num-m@+~\|0@ \|3TEA#PHY:;61{~\{-.!\\
Nov 26, 2024 08:20:10.256556988 CET	1236	IN	Data Raw: 6e 3c 33 1f 30 3c 1e 0d c7 87 78 90 00 88 97 11 a7 b6 a9 99 66 08 c0 f4 c9 c9 21 36 eb 58 99 73 c1 a9 ee 27 67 8a 0e 00 30 9f 9a 1c f4 08 f9 43 82 7e ef e0 c9 a9 14 32 62 00 f5 c3 d9 ed e3 9b 77 6f 6e 87 0d a2 95 2f 3c 86 78 b0 23 27 98 86 0c 83 Data Ascii: n<30<xf!6Xs'g0C~2bwon/<x#'G6lY\Ap GeXy!d$@A 0V-s(pgsc(Ks!`Csw`135"x26*Z/Jih=ClKRVNS
Nov 26, 2024 08:20:10.369579077 CET	1236	IN	Data Raw: 17 4e 86 ed ee eb a4 eb 70 3a ea f4 8d 50 22 00 7f 8f 60 6b da 72 f8 c3 28 6e 72 35 15 74 ce 56 60 49 a6 10 ad c0 09 c0 5a d6 d6 fb d6 3e c2 9d cb 83 9c c5 8f df 9e cc 08 f9 d4 f0 b6 68 c8 1d 40 eb 5a fa 19 20 b6 93 3e c5 4e 77 9b 24 ae 59 88 83 Data Ascii: Np:P"`kr(nr5tV`IZ>h@Z >Nw$Y&qT5d?[3E;pdg`PUw;w.!/k!>vmce[V2*^;?5fgE6bx\|t_<MVq3 tz,3PpJb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49845	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:08.997292042 CET	451	OUT	GET /tile/?qt=vtile&x=24813&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline2.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.298099041 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Type: image/png Content-Length: 17410 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"75e5cbff6f624c716c94cb5ebaa19542" Cache-Control: max-age=2592000 Age: 1515656 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154049220 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo2.fra01.baidu.com [2], zhuzuncache62 [1], czix115 [1] Ohc-File-Size: 17410 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 e4 e3 ec f2 ee fb c9 cc d6 67 7d b3 6b 83 bc 7b 93 c8 d4 d4 db e6 e9 ea ff ff ff da da de d3 d3 d8 f6 f6 fa d8 d8 e4 e2 e3 e5 ed ec f4 dd dc e3 f3 f3 f4 6a c8 90 dc e4 e7 ea e5 f3 f2 e8 f7 e8 e7 f2 e1 de e9 eb eb ed b7 ca d1 75 8d c2 eb f1 f4 c4 98 e3 d1 af ea bd 8f e3 b9 86 de e6 d3 f3 b1 76 da 79 8a b6 83 98 c8 b3 bb d1 a8 b1 cb d0 cc e7 9d 64 e2 ca cc d3 cf e2 d9 90 d1 ae a2 d8 b9 ca b9 cb aa b3 cb 99 a7 c9 d0 ab b2 89 96 b7 8d 99 b8 e7 53 3d 99 a3 ae d2 7c 81 77 86 ac e8 1d 1f 72 78 85 62 64 6b ef 04 01 fb 9a 00 66 a9 91 22 9f 50 a6 d6 e2 d4 ea f1 52 b2 d2 44 ab cd 26 8e eb 11 00 00 00 01 62 4b 47 44 08 86 de 95 7a 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEg}k{juvydS=\|wrxbdkf"PRD&bKGDzpHYs~BIDATx]6>vKp96W>fc<#xF#0TH'LJ4Jb.YOokJI9n-5ysm'KGrn!6Bb44$~)5HAatLtZ\|X#z-hFra?l65'_74&)tM>lxY"QZ C:Z~<5'I?\|^+=>=>n_o[f
Nov 26, 2024 08:20:10.298126936 CET	1236	IN	Data Raw: 42 b5 88 ea b1 80 e6 00 82 72 06 84 a4 0d d6 be b4 10 ee 03 80 7f 49 9f 60 a8 01 18 db 1f 82 6f 3e 6c b6 00 c2 1a b0 78 02 7e d0 00 3c 69 be 58 03 37 c8 e9 7a 03 3f 70 d2 47 72 bb a6 81 c4 af 81 13 f0 dd 87 8d 1c f9 c0 71 cb 74 f1 f8 3b 8f ed a3 Data Ascii: BrI`o>lx~<iX7z?pGrqt;yDjc7H^/-kg@^m7rx@n),8`)pv-!w[Mvzn;kD[~~/Xp,HY@aU-,5\;5`
Nov 26, 2024 08:20:10.298137903 CET	388	IN	Data Raw: 50 03 9a 6d 5b 13 83 00 80 7e db 22 ff 1f d6 8f 33 e0 80 47 ed 1a 02 f5 b3 e9 03 72 80 7a 32 00 18 0e 80 a7 5f db f4 6f 6c fe 4e e3 22 9a 8f ae 00 40 f8 60 a5 44 fd 0f 92 9a 43 ba e3 5a e1 2d 7d ed 68 fb d6 ca 68 03 e0 bb 00 f8 60 03 00 eb 1c 38 Data Ascii: Pm[~"3Grz2_olN"@`DCZ-}hh`8V2/@0>mXN$x.Ev)TM~a`R[e\Em#1}k0"r@gfQF?%0$\|p?IO,(3h
Nov 26, 2024 08:20:10.300483942 CET	1236	IN	Data Raw: b1 bd 9a 9e 44 4b 41 c7 87 02 57 50 08 2f 70 01 f0 42 00 2c 62 bd 9c 0e 24 04 41 16 6e 29 e0 c9 71 50 89 6c f0 b4 86 69 46 7b 67 f3 34 c3 80 d9 c3 fa e9 00 bf 1b 35 f8 84 bf 3f f0 ef 6b a9 8d e2 0b 7c ec 00 00 88 f7 c7 da 26 f5 a7 c3 97 b2 14 a4 Data Ascii: DKAWP/pB,b$An)qPliF{g45?k\|&;=KCt}"Rl0N1K$f`<s[`dvGEw[4H1\|LJ<-OZo,X7u"hdBJ5
Nov 26, 2024 08:20:10.300525904 CET	1236	IN	Data Raw: bf c0 22 40 00 fc 82 79 83 4c 64 06 e0 90 37 00 64 12 98 fb 58 11 7b 7b b0 f6 ab 6c ee 01 5b ec 5e e9 ab a2 3b 8f 65 04 00 50 c2 38 02 00 9c 1d 27 00 26 5d 00 1a 7a 83 41 6f 88 7d 9d c1 b9 b7 b8 24 e4 92 44 2a d8 68 98 c6 0f a3 44 c3 1d c5 5d 00 Data Ascii: "@yLd7dX{{l[^;eP8'&]zAo}$D*hD]`_O10P; :D(rpNyW%"eIq$Gs@ 0wQ?^)Dg6(G`Z,\|25E5%ClnFu3?%"i8zz_/C
Nov 26, 2024 08:20:10.300535917 CET	388	IN	Data Raw: fc 91 2c 3b fa ab 3b f3 9a e6 c2 62 72 04 63 a2 43 4e 5a 16 f8 ee 7d 4c 96 25 88 9c 1f b3 24 74 05 e2 18 01 bf 6b 48 0c 00 30 c3 b2 47 21 52 98 3c e6 95 66 14 3c f5 b6 62 7a 79 2f 6f 19 a0 23 d0 54 f1 1a 70 75 78 4c d5 fc e6 73 38 1c 29 61 35 30 Data Ascii: ,;;brcCNZ}L%$tkH0G!R<f<bzy/o#TpuxLs8)a50P%HERSW%KB&x+[_O6R1o4lRDF7j`(C8<?r#c$ty]lBN1Waf1nY~votD8(Ez6Bx;M
Nov 26, 2024 08:20:10.303015947 CET	1236	IN	Data Raw: 6a 46 cf 8a 85 80 b5 9a 74 72 ad 51 8b 1e ad 06 ad a8 f8 e8 7e a2 25 94 b1 82 fc e0 52 a6 be ed 28 87 ef ac 74 1d 31 01 b9 ef c4 6b 0c 00 88 e6 d4 65 ad a2 08 8d 97 6e 86 06 65 33 5e 5e d4 7a f5 a7 c1 3e 88 92 a1 87 b5 2c 42 2b 26 6a e6 f0 7e 7c Data Ascii: jFtrQ~%R(t1kene3^^z>,B+&j~\|1Zj }JX"]b`i$'/rRL0gN[)6%7Eg+%:;W(tUqVMW`qIPsp'=rd9\|?&
Nov 26, 2024 08:20:10.303119898 CET	1236	IN	Data Raw: c3 ef da 4e 56 c2 b2 dd e8 a3 60 57 36 f6 23 af 55 5b 42 b5 6f c2 2a fb dc d7 64 ba 6d 1c 8e 31 e9 25 72 69 f3 d2 1f 1f 19 80 cf 9f 19 80 8f 7f 84 b8 d7 cd 2a 94 ed 01 70 bb 1a 70 f3 4c b7 e3 43 51 d7 cf b7 d7 0d 7d a7 b0 ca 3e cb fa 65 b7 51 c2 Data Ascii: NV`W6#U[Bodm1%rippLCQ}>eQ"(nl"~),`[d=(5Kz3Vv7-a}6)/scT]kpN?e kq4q]Yh\|!/8Vk0u
Nov 26, 2024 08:20:10.303131104 CET	388	IN	Data Raw: 98 f1 4a c1 fc ca 67 f8 f0 1e 28 b9 f3 4e c0 04 ab 3c 3f ed f2 fc 78 cc 79 af 32 01 40 67 2f c0 38 6a d6 38 fa 3a 2f 56 12 c8 7a 27 bc 06 00 de 2f 45 29 08 00 f8 8a 93 3a cd 4f aa 0d 80 68 16 5a d6 58 55 ca 3f 07 40 da 6d bb ef eb e2 28 6d 2b e1 Data Ascii: Jg(N<?xy2@g/8j8:/Vz'/E):OhZXU?@m(m+X4!?\sU'#28c(o_V;?H}5G\resjd5c,0B'*Qy.K<81b{w3O
Nov 26, 2024 08:20:10.305588007 CET	1236	IN	Data Raw: b2 7a be 43 21 08 ee 74 24 23 a4 48 e0 02 00 81 28 77 25 02 20 4f 13 04 20 d7 3b 58 bd b2 f4 68 d9 56 12 0b 01 60 49 28 52 b6 7a 27 bc 50 64 08 e9 90 de 8e 00 80 5b 9f 2a 17 dd 20 cd c3 02 25 60 1a cb cb 83 77 76 b4 cd 00 5d 1c 65 97 09 d6 2d 65 Data Ascii: zC!t$#H(w% O ;XhV`I(Rz'Pd[* %`wv]e-e=#uu]d=Y&QD8WIz'#Ywdlc6nZ cr@Rwpq{?#5XGUH J?R`O$.n86%W
Nov 26, 2024 08:20:10.418176889 CET	1236	IN	Data Raw: 26 39 40 d7 51 02 f8 97 00 60 7f 88 b9 29 52 37 48 41 13 10 d2 a5 8c 60 07 c5 4b c7 49 73 d9 c0 b9 1d 8e d1 23 78 28 61 a8 49 d7 f5 3d 75 01 c7 af 01 40 9c ac 13 64 37 95 b6 98 dd 72 a6 96 13 44 82 b2 00 c8 12 ed 3d 45 d7 2b d7 ae 0c 1a 14 a0 4c Data Ascii: &9@Q`)R7HA`KIs#x(aI=u@d7rD=E+Lz]c\|_^jvrBg[b_vAOIohk2x+6/W\W<Ja0akL@9<,=?N@f7{PbQ<~>OckCh>*
Nov 26, 2024 08:20:34.269362926 CET	452	OUT	GET /tile/?qt=vtile&x=49626&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline2.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:34.678087950 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:34 GMT Content-Type: image/png Content-Length: 15730 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:52 GMT ETag: W/"2ebcf45c60995ab343eaa82b7ae1c960" Cache-Control: max-age=2592000 Age: 866706 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0412774534 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:52 GMT Ohc-Cache-HIT: fra01-sys-jomo6.fra01.baidu.com [4], zhuzuncache65 [4], csix100 [2] Ohc-File-Size: 15730 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f9 f7 f4 eb eb eb e5 e6 ea e4 eb f2 cc ce d1 ff ff ff fa f6 fb e3 e3 e4 f3 f1 ee d7 d8 db f5 f3 f1 d6 db e3 99 5e e0 93 55 dd b9 86 de a5 70 e6 9d 64 e2 ba 8d e5 d7 c8 ed c4 99 e4 ec ea f3 d1 af ea b0 76 da e5 d6 f0 f6 f2 fe f3 eb f9 db dd e2 b4 b7 c7 dd e3 e7 f2 ee ea c6 b5 d6 ec f1 ee 91 9b b2 69 95 fc d1 e5 f0 55 87 fb ad d3 dd 91 a6 d6 ab af b6 6c 85 bb 46 7c fa d0 cb b7 e4 2d 47 d2 94 6d 64 61 62 e0 b5 94 ec da cb ed aa 70 ed 96 4a ef 89 31 f6 d3 ad f6 cc 9d f6 e9 d0 cf e7 d7 a5 d9 b8 f1 81 1f 6b c9 90 91 d5 ab 79 91 c6 65 7e b7 ff e3 ac fe e7 b4 e8 e8 ba ff ec ba 1b a7 f3 75 00 00 00 01 62 4b 47 44 05 f8 6f e9 c7 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTE^UpdviUlF\|-GmdabpJ1kye~ubKGDopHYs~<IDATx]cF@lP$[R49v'MwwJd;#"Wx><[MdWM:_E}1_-?bczw(%T7[(^bZJ\|#Yy+OxE4M0?fFx#vNgbEFVb!XO\TXsY\|FsUxj8% lXr@ V?W;fj/W0R`iI89r;4ZG
Nov 26, 2024 08:20:35.371588945 CET	452	OUT	GET /tile/?qt=vtile&x=49623&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline2.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.780052900 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 15307 Connection: keep-alive Expires: Sun, 08 Dec 2024 20:11:57 GMT ETag: W/"58aee004f57cf809d5de17de287ff47e" Cache-Control: max-age=2592000 Age: 459927 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0717171669 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 20:11:57 GMT Ohc-Cache-HIT: fra01-sys-jomo6.fra01.baidu.com [4], vhkg04bgpcache68 [4], zhuzuncache59 [4], bdix77 [2] Ohc-File-Size: 15307 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 bd 50 4c 54 45 e4 eb f2 ff ff ff 4f ab 8c f5 f9 fa a3 d8 bb 8f ca b5 b5 ce cf bf e0 d5 6d b8 9f ed f0 f5 c6 e8 d3 dc e5 e8 ce d1 d7 f5 f3 f1 ec eb ec d7 d7 da e5 e5 eb fb e9 c6 ff ec ba ff e3 ac fd db a5 f4 ec e9 b9 ef d0 31 a9 77 40 bf 7d da dc e3 f4 f1 ee fe e7 b4 f8 eb d4 d1 ea f0 d4 d5 da eb ec f2 fe e0 a7 e3 e3 e4 fa d8 9d f9 f7 f4 c9 cb d2 ee d6 b0 ef d3 cf cf e1 b6 71 85 b6 89 95 b7 cc ce e4 66 7d b4 99 a7 ca af b6 cb bc ed cd ad b0 b5 d3 cf b5 a5 98 77 e3 a8 a2 e6 d8 ed d6 ac de f6 f2 fe a4 8f d8 a3 6a e0 cc 91 6f 79 91 c6 a0 d3 e3 58 b4 d3 e6 7c 86 ef 69 76 f0 57 66 ff 3d 94 9b 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEOm1w@}qf}wjoyX\|ivWf=bKGD-pHYs~:^IDATx}Cl'W-B.?UU/Z!a/:E>>\|p]'O[` N#5.oiy8??9gqN?=9>~'#<gp1N>N'<~r?YYyG_,@O?NN?'''P?'#$]N`pH <O,sMM2@>}:9DN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49844	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:08.997416019 CET	451	OUT	GET /tile/?qt=vtile&x=24811&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline0.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.260781050 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Type: image/png Content-Length: 15840 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"489c4b88720fa87a391b01f16db295a4" Cache-Control: max-age=2592000 Age: 1515656 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154150561 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo7.fra01.baidu.com [2], zhuzuncache51 [1], qdix242 [1] Ohc-File-Size: 15840 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f5 f3 f0 d5 d5 da ff ff ff cb cd d3 f8 f7 f8 e4 eb f2 da e4 ec e8 e8 e8 d7 d8 db d7 d9 e4 da da dd e3 e3 e4 ed ed f2 ca e9 d7 6c c9 93 94 d4 b1 f3 f1 ee d3 d3 d6 ed f2 f2 cf d1 d5 dd dd e2 92 97 a2 2d af 75 b8 e7 d9 68 9e 93 ba c5 d2 ec eb ec 3e a3 81 e5 e5 ea e0 a7 9d ad b0 b6 f0 65 73 f3 ed e9 c6 c7 cc ea d6 d2 e7 7c 86 f1 d5 b6 71 85 b6 b2 b8 ca 6b 7b 9f fd db a5 fe d8 9d ff e3 ab ff ec ba d2 c6 b7 8b 96 b0 60 68 76 fc f5 e9 f8 e8 d0 fe e6 b5 cc 90 6e f2 ee fb ea e6 f4 9e 9f d7 79 91 c6 f1 ea f6 d0 cc e9 8c 76 6d cc a7 e7 a5 6c df e6 d9 ee 61 98 e8 49 78 e7 3e 6f e4 0b c1 48 35 00 00 00 01 62 4b 47 44 02 66 0b 7c 64 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEl-uh>es\|qk{`hvnyvmlaIx>oH5bKGDf\|dpHYs~<pIDATx}c$l,7&+63o$j&<5H!RZcF{mhWWEq:;HL1\|$L}A_q~N\\|!xyy>]R@p$IT+,4w~O^>^hUapQ)??/`\|~@?^O?03B bT3LL2_M<edjg}!>c?Ox17`dx@lIVAdC
Nov 26, 2024 08:20:10.260811090 CET	1236	IN	Data Raw: 30 62 00 84 9f 06 b1 0c 03 58 39 e4 b6 00 a7 9a d1 cf fc 63 95 7e 14 00 a0 fc e3 c5 c5 e7 cf 17 f0 f3 a3 f8 42 e3 6a 51 9f 20 33 72 09 80 0c 88 9a 2c 49 07 91 e8 a4 a7 0a 01 2c bf 1f fb fc bb 1f b7 b9 3f 8b f1 e5 f2 3d 74 d7 44 40 c6 72 34 1c a0 Data Ascii: 0bX9c~BjQ 3r,I,?=tD@r4\a%Dp,AF?3)=yr]9},?J_\j?+@$qieL\C/$O,[9c98Zddn
Nov 26, 2024 08:20:10.260822058 CET	388	IN	Data Raw: 59 60 84 9e a3 5e 1e 4b 2b a7 3f 7e 3c fe 5b 1d e2 be 43 fc ab 6c 55 b3 ea 4b e0 f4 e8 6e ad c1 e4 6b 44 41 4d 21 ea 98 3f b8 b1 44 0e 98 de cd 53 0b c0 9d 5e 01 43 cc 57 75 b5 7f d0 12 82 c2 0b a3 82 78 f8 6f 79 30 74 68 b8 40 86 d3 18 28 cf 65 Data Ascii: Y`^K+?~<[ClUKnkDAM!?DS^CWuxoy0th@(eNN< ZbOQ(;Tji:9p*L"H\|!S.byB:\|\|?ML(eQd0t7;X&K~K^X`{?o
Nov 26, 2024 08:20:10.263171911 CET	1236	IN	Data Raw: 7b 53 d5 98 7d d5 12 82 ad ab a8 7b 01 76 bf 6a e9 ac c5 b0 cf d2 43 2a 22 15 11 97 5e 2e f9 46 69 68 13 71 cc b0 8b c7 6f a0 ed f6 12 ff fd db b7 6f 3f d0 51 f2 35 01 70 a3 69 5c 2d 94 fa fa e5 eb cd 17 98 10 10 0d c4 2b 75 8d 63 51 58 46 6b 05 Data Ascii: {S}{vjC"^.Fihqoo?Q5pi\-+ucQXFkW?`1M U&N34t/&dCEFbt\'L\|\C;YJ\-h\|]Y}EraJJoL)}0GO=x@>ho\|jYB,
Nov 26, 2024 08:20:10.263197899 CET	1236	IN	Data Raw: df 87 e3 d2 5f 45 60 98 97 81 dc 91 85 af 01 a0 59 05 94 0f 82 cb 0a ef fc f9 6f 41 b0 85 a0 70 6c 81 59 2b 22 89 ba 0e 02 ff 1f 3f ae f7 2c 3c b2 04 c8 c9 c2 8f 2b 90 b5 87 db e3 e4 e1 5b f1 ef b5 fc 16 81 98 63 de b6 8d c7 7c 76 f7 c7 98 18 75 Data Ascii: _E`YoAplY+"?,<+[c\|vu \|\uHfUn?K9UXW{j:Dy4RZy1awE9O?'[Fl-uGH,(tqlGJ/zy-\|n=
Nov 26, 2024 08:20:10.263209105 CET	388	IN	Data Raw: 11 01 7d 13 d7 8e c9 00 ed f7 4c 3b f0 4e 9a 90 28 8c 03 b7 32 79 e6 cc 03 6a 7e 45 49 7b f6 68 17 3e 50 51 9c 66 e1 72 37 70 94 8c 22 f1 cf 9b b5 31 6c e6 0d 27 e8 2b 15 4b 98 d9 0f b3 fd c4 1f 50 77 e5 4e 45 06 ba fc 1e 02 f9 bd 2f e6 80 66 8c Data Ascii: }L;N(2yj~EI{h>PQfr7p"1l'+KPwNE/ffb1AJ3Y`h#TMhTmNA!7!cEoum?RC3rMAc$G^3Q4wsQC12[#\|(#+hF!D^wvnRO
Nov 26, 2024 08:20:10.266021013 CET	1236	IN	Data Raw: e7 a0 bd 07 e5 4b ac 99 0f 80 e9 b7 a4 fa 6d c9 aa 29 58 20 26 00 70 6f 88 e3 b9 94 76 db c3 e5 fa 97 05 c0 32 76 8e 6c 00 e2 6f 8e 26 bd df c6 f5 a8 ee b4 c1 75 0f 0e eb 87 c7 1f 7a 71 4f 6c 62 4b db 80 a4 85 e5 f9 eb 38 7c da da 4c 13 9d e5 c9 Data Ascii: Km)X &pov2vlo&uzqOlbK8\|L\|CP&<'Tl2x"51OHfh#HaB_A;UOMn5rTtol<eV0wBcwk)/0#{>oSw){r~H*2
Nov 26, 2024 08:20:10.266096115 CET	1236	IN	Data Raw: 1e 19 02 00 dd 61 af 45 bb 16 7e 8a d9 ba 34 df 3a 4f 80 49 b7 ae a0 b3 02 95 e3 b0 eb 95 e8 02 a0 48 e1 d0 d7 57 aa c3 ef f7 b0 89 33 f2 fe f5 d5 55 37 ed 0d ea 05 f9 3b f5 75 37 2b 9b a3 59 cf e3 58 a6 e5 f0 69 5f 99 23 9c 98 62 a2 4a e2 83 49 Data Ascii: aE~4:OIHW3U7;u7+YXi_#bJIGG@uZ@=vV@@5rMgY}EN$_jbL\PiQ.O ,\A9}4Y5[PSC2L^6UmedL~@A@S\<$`%]n'D
Nov 26, 2024 08:20:10.266107082 CET	388	IN	Data Raw: 67 45 11 f2 6c 52 4e 4b 14 49 ba 5f cb 8e d5 e0 64 ee 01 00 3a 5c 21 de 1c 27 3b c8 95 f3 fc 51 5c 37 a8 51 3a 3b a2 72 ac 22 b7 e1 9b e9 5e 3a 37 1f 12 29 20 3e a8 9c 12 01 f9 4e 3c b7 a5 e9 07 54 4c e5 77 71 97 25 c9 6b 78 25 94 a4 eb dc a6 3a Data Ascii: gElRNKI_d:\!';Q\7Q:;r"^:7) >N<TLwq%kx%:\!51jA+&;B,GF2%qgmTBx(N1ZlAR?]%i38]6Oq@>4aX0p4/@r&\|1A
Nov 26, 2024 08:20:10.268501997 CET	1236	IN	Data Raw: 69 b9 c7 d5 ed da 0d 65 99 9d 97 7a 2b 03 9b 38 0e 64 1a 95 ae 90 f1 e2 46 61 73 5c f1 84 02 a7 0e 68 c7 c9 12 86 ea b8 d2 35 ad f3 84 d4 b8 54 12 59 d0 b1 f2 d5 77 1f 96 01 a5 57 eb c1 6c 3d 52 3a 56 b3 d5 6a 75 8b 0d 52 86 08 80 1a 79 de 6a 3d Data Ascii: iez+8dFas\h5TYwWl=R:VjuRyj=[@by MYrQ`j2 ZsGr})CxF><.5f}y[j[?Wz6Sbv?WX+ir@c/LFtCR1N;])"0!C3p
Nov 26, 2024 08:20:10.380772114 CET	1236	IN	Data Raw: d1 a4 61 98 51 01 00 4f 02 c4 b5 25 94 78 18 0c 3f b6 7d 22 de 0a 25 4c 93 b4 41 f3 39 5f 26 c1 9e 65 6f 8c 91 f5 7a e2 71 25 23 50 d4 0a 22 59 3d 49 3a de 46 a9 3a a4 3b d8 65 13 2e 8d 7c 33 d1 67 a4 8f e6 27 8b bd b8 a9 d3 74 8e 86 60 9c b5 de Data Ascii: aQO%x?}"%LA9_&eozq%#P"Y=I:F:;e.\|3g't`e>21DXcA]X$Sv.f &Y3^n~VG^yg<dM$4o&s%8H}I,mt*7Eu/bq
Nov 26, 2024 08:20:34.269290924 CET	452	OUT	GET /tile/?qt=vtile&x=49624&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline0.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:34.674002886 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:34 GMT Content-Type: image/png Content-Length: 17844 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:52 GMT ETag: W/"875ecc4adb1d15228968a57e14babfee" Cache-Control: max-age=2592000 Age: 866705 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0412798499 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:52 GMT Ohc-Cache-HIT: fra01-sys-jomo1.fra01.baidu.com [2], zhuzuncache56 [4], wzix56 [4] Ohc-File-Size: 17844 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 e4 eb f2 db dc dd fe fe ff f9 f7 f4 d5 d8 dc e3 e6 eb ec eb eb ec 6b 77 ef 53 63 ec 9a a1 eb d6 d8 db de e2 e8 7c 86 e3 bb ca f3 ed ec e3 e3 e3 f5 f3 f0 e6 e8 e9 eb ec f3 97 d2 fc 9b d3 fb ef ef f4 f3 f1 ee f8 f7 fb ad b6 ce a1 a6 b4 ca c8 ce dd e2 e8 ce d1 d7 d3 d4 d6 d4 e8 f1 e3 e1 dd d4 d5 da d6 da e5 af d7 f5 9d cd f1 c6 cc d9 cc ea d9 b7 e4 cf 93 d5 b0 69 c8 8f ba c5 d6 f6 f2 fe ba 8e e5 9a a8 c8 9d 63 e3 a5 6f e6 a3 8e d4 99 5e e0 d0 ae ea e6 d5 f1 c4 98 e4 93 55 dd b1 76 da d2 cc e8 74 8d c2 7b 93 c7 8a 97 b8 6b 84 bc 77 87 af 66 7d b5 5b b0 94 35 9e 7b fe e8 b5 6c 28 f3 b0 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 44 51 49 44 41 [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEkwSc\|ico^Uvt{kwf}[5{l(pHYs~DQIDATx}{F:thU,QKyhR@ ;3{JZ6{33\;Nz3O?pyoy><0{X\|2{?=ky<z`jn$a0~U-n3V)/l%5>wQ1zah_=<z+Xzpg?{b;+?ySd:u_O\^$L~%uF_?=5"Lc'^v0oQ2o=y7I
Nov 26, 2024 08:20:34.888577938 CET	452	OUT	GET /tile/?qt=vtile&x=49625&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline0.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.293283939 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 15150 Connection: keep-alive Expires: Sun, 08 Dec 2024 20:12:00 GMT ETag: W/"c3a4f7150b1b4227e694f56ac5e58886" Cache-Control: max-age=2592000 Age: 1479612 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0720568544 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 20:12:00 GMT Ohc-Cache-HIT: fra01-sys-jomo7.fra01.baidu.com [4], zhuzuncache52 [1], suzix231 [4] Ohc-File-Size: 15150 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 ff ec ba fa e8 c7 e8 dc d0 d2 c9 b6 c8 bb ad ff e3 ac fe e6 b5 dd e2 e8 e6 e6 ea d4 d5 d8 f7 e9 d8 fd db a5 f5 f3 f0 f3 f1 ee f2 ee e9 f8 da b6 dc dc dc df e0 df e3 e3 e3 f6 f2 fe da dd e3 ff ff ff ec eb eb f1 ed f7 ec eb f3 ea ce b1 de b3 92 d1 95 6e d6 c5 9c fa f3 e9 fe d8 9d f9 f7 f4 f9 f6 fb ce d1 d7 ef e8 d6 a6 9a 79 ad af b2 ca ca cd 94 94 93 ef c3 9c bb c2 d1 dc 8e 44 eb aa 6f b2 b7 ca ee 97 4b e4 eb f2 f1 8a 31 f1 81 1f 76 76 76 ab 96 d9 79 91 c6 8e 98 b2 72 85 b5 dd e6 f2 d5 c9 ea 66 7d b4 e4 d8 ee c4 9c e5 b9 86 de 9b 61 e2 a5 6f e6 93 55 dd d1 af ea b1 77 da 4f 07 4d 24 00 00 00 01 62 4b 47 44 15 e5 d8 f9 a3 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEnyDoK1vvvyrf}aoUwOM$bKGDpHYs~9IDATx]c8Nm-lL@;i{u6Mn;Ww&2Hrc4\|O&S~:/gu]/M?o:Y,#B\|,GETo''o\KByR{>7?v\|1"d>.n>1_nO~to^FVH>nynXw ]d`4nf}X>Bd_8?xL;\|IPXh/TP,bj_js+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49852	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:09.017236948 CET	451	OUT	GET /tile/?qt=vtile&x=24812&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline1.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.326855898 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Type: image/png Content-Length: 19511 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"a7104f1a54bfbf734bb911249e2dd77d" Cache-Control: max-age=2592000 Age: 1515656 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154485746 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo5.fra01.baidu.com [2], zhuzuncache53 [1], xiangyix129 [1] Ohc-File-Size: 19511 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 e4 eb f2 ff ff ff 8d ca b4 cb e5 dc db e5 e8 4f ac 8c ee f0 ee ba ea d5 6d b9 9f 32 ae 77 d5 d5 d9 ce d2 d8 d7 d8 da f6 f7 f8 d4 d4 d6 f5 f3 f0 d1 e6 f3 99 d4 ff db db dd f4 f1 ee f5 e8 d2 f7 d8 ac ff e3 ab ff ec ba e5 db d5 c9 c8 c8 c1 bf c0 f2 ee fb da dc e3 e6 e6 ea e8 d0 ac d4 b1 9c cc 90 6e bc 87 68 b2 d5 cc e3 e3 e4 b1 b1 b1 eb eb ec eb ed f2 ab d2 f0 3e a6 81 ba c3 d7 96 96 96 c7 cc d8 9d d1 f6 a8 b2 cb aa b3 cb 96 a9 d1 9e cf f3 75 8d c2 7b 93 c8 83 98 c8 6b 83 bc 88 95 b7 9b a6 c4 78 87 b0 b3 bb d1 8b 97 b9 cb d2 e2 95 a2 b9 66 7d b4 60 c9 91 3f c0 7c 46 c5 7e 79 95 8a 2d 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEOm2wnh>u{kxf}`?\|F~y-bKGD-pHYs~JIDATx}871A2f=9HCo&W*9#nn{'Z/N~;K+V~[>VRJz<>9I1=YO?o^w"wNH)%H;G$cSeP~(W!n3~ ^X/0+qD?+>^FW/2!xVQ
Nov 26, 2024 08:20:10.326872110 CET	1236	IN	Data Raw: 6f a2 fc 63 f9 3c 58 40 dc cb 9f 2f e2 96 01 10 f7 37 02 f6 1c 7f 13 f7 b7 bc 3c 06 40 2a 69 41 20 32 9b 3d 05 00 38 f8 e2 b6 c3 3e 3f a6 c9 0a 56 ae 8f c9 6f 4b 2f fe f8 69 e1 1f e0 5b 52 f8 94 7c b5 d6 c7 0d bf dc cb 35 00 41 18 7c 04 d2 ff 8d Data Ascii: oc<X@/7<@*iA 2=8>?VoK/i[R\|5A\|\|!qx'Jn$l8J-P$A9e-cC}[z9l{5\|L =xUz88.q!c,I\|a'1~M6~#"Iw@
Nov 26, 2024 08:20:10.326884031 CET	388	IN	Data Raw: 2f 50 6e de 11 8f 3e 80 74 3a 12 a4 d4 fc a5 49 21 19 80 89 1a 60 43 40 5e 30 04 9c 8b a4 a7 c9 d3 d3 ea 1a e5 ce 96 60 89 7a d1 00 90 0e 43 71 57 51 ae 97 97 73 6c 77 00 80 08 58 ba 4f 57 92 03 13 e0 ef 86 03 8c 1a f0 85 51 03 e7 0c 01 67 40 bb Data Ascii: /Pn>t:I!`C@^0`zCqWQslwXOWQg@EM}\SqaLyn#*&t5u@wFQvtOdy{'[aO,HX )!XaVEr\|Lwn/_FdL!
Nov 26, 2024 08:20:10.329415083 CET	1236	IN	Data Raw: 1c 0c 5a 7c fc f8 fb e3 e3 a7 73 fb 6e d5 0f 70 28 53 32 64 99 76 5a ef 7d 46 45 8c 9e 7f 69 bd 7d ff f2 0d 9d 91 8c 11 d8 e0 cf e0 9d 0e fd 07 92 bc 73 7c e1 ab c2 3c 04 77 98 3e 94 7f 16 97 92 c9 5d 49 89 fe e0 ea f5 09 ff 29 ee 72 03 ac 0d 2e Data Ascii: Z\|snp(S2dvZ}FEi}s\|<w>]I)r."1$2=J/Ny@7!xc9U)vB(OUl~S"Vtj@h}B<@-.m/{Qlfr@lWx
Nov 26, 2024 08:20:10.329440117 CET	1236	IN	Data Raw: 2c 27 2e 0a 82 a5 12 c9 e2 38 06 20 27 ee 27 b5 73 c6 10 4c 8b 02 98 3d f4 51 1b 4b 17 10 f8 e6 0d c9 96 32 f6 98 81 8b 2e 08 4a ae 9d dd 21 8e f3 44 09 0e 0b 1a 00 b4 15 ac 83 48 67 01 98 c9 aa e9 4e 67 6c d9 66 51 e0 0f f5 81 96 b0 d9 48 04 7c Data Ascii: ,'.8 ''sL=QK2.J!DHgNglfQH\|@./S,O\`wi3Sa"I^?=*Z0I/#yE0egt102ejT1<S%IlsQApa\|SY,R[BES!b 9~6
Nov 26, 2024 08:20:10.329449892 CET	388	IN	Data Raw: 71 23 b6 94 8b 8f 33 58 bb 3d fc a2 d3 9e 07 ca 3a b0 49 d2 6a 00 76 f5 10 00 ee ef 19 9b ac 56 00 90 ff 31 e8 38 93 19 69 41 c1 b3 64 98 23 41 83 35 2a 94 dd cc 48 e3 90 f7 be 0f 0b c6 5a 5c b0 3a b0 98 42 a5 ca c0 53 71 4c 66 5e 96 98 6c db b6 Data Ascii: q#3X=:IjvV18iAd#A5HZ\:BSqLf^lBz#jjv@nk[E{<-!v~,WOly9lgXB!;bE<$}9&1}t<e=NjvFbp:N0z:7+X0s\|)&$
Nov 26, 2024 08:20:10.332067966 CET	1236	IN	Data Raw: 19 ca 51 f2 87 f3 dc 4e b8 88 91 53 57 2b d8 5b 6f 20 d7 33 61 75 88 13 6c 23 c2 3f ac 75 b9 a4 ae 03 01 f1 42 d2 b0 b0 e3 2b 3d 03 c0 56 38 e5 4e ec 8f 3f 76 ed 09 f5 60 0f 80 c4 5d df ee f7 47 31 3c 02 64 61 1e ea 4d 8d 08 48 00 80 64 20 01 c0 Data Ascii: QNSW+[o 3aul#?uB+=V8N?v`]G1<daMHd ^,"[Sn&FX9u{hRGgsI:'Xt!v$=P@$4FX:AbBJ7uZqm5\0Ka4rQtDt&<HtG`AMh%W
Nov 26, 2024 08:20:10.332114935 CET	1236	IN	Data Raw: 4b ee 19 56 2a f7 b9 dc 0b ab 40 c0 f5 c3 82 af 22 3d 57 06 c0 87 10 df 9c 17 e1 34 dc 31 8a 9b a7 09 f3 3e 1f d7 54 85 61 14 ad 6a f0 9e bc 05 27 4b 22 53 ea be f3 0e 00 2d 04 be 0f 01 88 06 0a 98 03 c3 56 00 74 15 5c 41 55 12 f3 a4 88 ed 09 c0 Data Ascii: KV@"=W41>Taj'K"S-Vt\AU)7(@ sgAfRH0)IOL)+]bvsS Anbqd!R_'"n'aRRNKB5z:F#u"c/bcdtd(h
Nov 26, 2024 08:20:10.332124949 CET	388	IN	Data Raw: 76 17 1f 65 73 90 a2 de fd 68 f7 3d 00 71 07 00 3d 44 17 0c 20 e9 37 16 27 05 ba 62 ea ef 31 00 dd f0 a0 71 4c d3 b1 03 20 a5 57 e8 78 00 a9 8e 1c 3b fa 2f 2f af 07 c0 de 67 81 7a 90 ce 86 9c 24 4d b4 14 2c 4f b5 38 d4 ce 5e 50 2d 93 3e 02 e6 d8 Data Ascii: vesh=q=D 7'b1qL Wx;//gz$M,O8^P->}&(0Vwtho\|0-SLU}WA`=uS9y'1=tP+wXQ2j@,k1btiS8On`P=fdJ7TNb:
Nov 26, 2024 08:20:10.334667921 CET	1236	IN	Data Raw: b6 8e 52 d0 69 cb fd 41 aa 46 54 3b 36 5b 9a 23 d8 01 9d 80 1a ea bb d8 96 18 e4 6e 91 00 8d 9e 89 16 44 5c f2 b9 12 a0 24 d3 b2 83 33 3a f3 d6 10 9c 15 80 55 2e 16 6c 61 ac 17 e5 26 ea 89 1e d4 52 f0 b8 a7 fe b0 86 86 b6 14 ea 19 0c 41 61 09 4b Data Ascii: RiAFT;6[#nD\$3:U.la&RAaK kf6al`{x&,5S=rzaCThrK^5@rapG6lhHI,G.-'qD')"\B<yrA"c&%
Nov 26, 2024 08:20:10.447031975 CET	1236	IN	Data Raw: 39 fa 0d 00 f8 26 ca 52 ba 22 13 5b 00 e0 94 88 ec 74 70 0f 0e 03 80 0a e0 d0 e2 af 47 8c 33 ec 1b e0 08 06 e0 b8 2f ab fd 7e 5f 4a a0 9f 0d 81 ee d6 1d bd cc 18 b2 0e 80 88 8b a5 1c 2f 9a 45 ff e9 82 13 0b 00 34 36 21 b1 3a c3 e1 42 43 e7 99 79 Data Ascii: 9&R"[tpG3/~_J/E46!:BCydL@VXbjlD6;[v%P(Wk]!5bt:6Sbu.cW@7t0WEEgWUyH[`PLt@a6ANKr~~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49849	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:09.017908096 CET	451	OUT	GET /tile/?qt=vtile&x=24813&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline3.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.269352913 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Type: image/png Content-Length: 15923 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"dd630153a65d3a884ece79ca3ee193c9" Cache-Control: max-age=2592000 Age: 1515656 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154074976 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo4.fra01.baidu.com [2], zhuzuncache61 [1], qdix61 [1] Ohc-File-Size: 15923 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f5 f3 f0 e3 e3 e4 ff ff ff e6 e6 e9 db da dd f7 f6 fa d3 d3 d6 d5 d5 da dd dd e2 e4 eb f2 c9 cc d6 d7 e5 ed 1e a3 8f cc e8 d6 9a d7 b0 d7 d8 da f0 ef ed eb eb ec 8a 96 b7 98 a7 ca 79 91 c6 44 74 e5 ae b6 cd f2 ee fb f3 f1 ee cc cd d1 68 a0 9d 6a c8 91 ec eb f3 aa d2 e3 6f c5 eb d6 d9 e3 f2 e9 f5 c4 99 e5 ad 8d dc 9b 62 e1 a5 70 e7 d0 cb e8 d0 ae ea e6 d6 f1 93 55 dd b1 77 da 5e b9 e9 c4 b6 d8 a5 a8 ae 71 86 b7 66 7d b4 61 66 71 72 78 85 d6 b3 9c e3 2e 47 be 89 65 e7 da d3 fe db a5 f9 e9 cf fe e6 b6 ff ec ba 4e 95 78 fc f5 e8 fe e3 ac f2 d4 b5 d8 9a 6b dc 8e 44 e3 cc aa 20 87 62 df 00 00 00 01 62 4b 47 44 02 66 0b 7c 64 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEyDthjobpUw^qf}afqrx.GeNxkD bbKGDf\|dpHYs~<IDATx}67t9:lwmz"lsk15y^oA@RsX_eqtM,_>0XGUY2p~O>(nF"C6Wtr3=AxUX\|#%aR'Qo;o?8h<n$}gA1<x9H/&tMU%qAfa~Tea6_(f6" 6}ij'NJ?
Nov 26, 2024 08:20:10.269381046 CET	1236	IN	Data Raw: a7 84 07 8d cf 80 d4 a4 10 1f 7f 11 f2 c3 2f 1f 81 0f 7e f9 2c 92 4a 71 40 23 8f ab ff 69 f1 df f8 11 f0 7f 73 93 bc 68 29 6f 87 d7 e1 8f 06 00 59 0f 02 b0 41 12 3c 2d db 40 b3 d7 50 13 f3 5d 83 28 c3 89 f7 73 87 0a f0 03 21 06 95 86 39 42 cf 7a Data Ascii: /~,Jq@#ish)oYA<-@P](s!9BzP2~U_>Hk@o7-"o@1@X^ @_g^3i&sPaVL(Qh02O2H4@_lW&q.H4M$]ARi4FLmR(`
Nov 26, 2024 08:20:10.269392967 CET	388	IN	Data Raw: e1 cd 1b 62 0b 56 00 62 7f ad 09 ba de 8b 6b 1a f0 82 94 f0 3b d3 2a 0e d7 e2 40 03 fe be dc 89 ab 1d fe 89 c9 98 ea 77 00 e0 20 d7 42 ec c4 1e 11 b0 e8 75 b8 01 71 37 86 ee 58 8a 46 44 36 6d ea 2e 88 c2 51 36 d0 2c c0 08 a0 5b 38 23 b1 47 68 c3 Data Ascii: bVbk;*@w Buq7XFD6m.Q6,[8#GhIxD_D>\+x;y\|xy8\_cF>r}@vM%XK Ta1D)Y8/4hr&}}<lkq/!f;K4#Jf:mj%WD^
Nov 26, 2024 08:20:10.271785975 CET	1236	IN	Data Raw: 0d a8 3d 80 c3 11 14 38 fe 7f 6d 01 20 48 ad ed 19 fa 2b 06 08 84 02 e8 87 1f 47 49 7f 78 28 02 bf ff 7e 65 00 f0 e5 ca 78 40 87 1b 10 f7 a2 d4 a8 e3 b5 3a 57 49 8c 05 1d d0 88 b9 f1 ce 67 af ad 24 50 ca 70 8e 55 37 3c 00 b9 db ed 0e c0 e1 bb 9d Data Ascii: =8m H+GIx(~ex@:WIg$PpU7<8+#ifrxW(Zrd`6ES0=JBgy;hD3*)jF $2&6" 'TH~0I[$(6y lPdY?^K~,
Nov 26, 2024 08:20:10.271827936 CET	1236	IN	Data Raw: b7 60 23 40 a6 97 10 88 29 3f 11 8e 4e aa ed ba ac 4e e7 4b dc 09 51 f3 e5 a5 37 32 32 e7 0a 48 c7 33 da 24 83 5b 07 5c 80 46 b8 85 c4 ae a4 f1 2e 3e c7 20 06 ed 7d 2e 01 80 21 10 b9 70 90 11 00 6d 40 e2 5f 8c 4f aa 6f 66 71 ab d3 e9 7c 25 e4 5a Data Ascii: `#@)?NNKQ722H3$[\F.> }.!pm@_Oofq\|%ZQ<G!jnT":\\|."H&&&t:D*j\wX8-fi?NbKoypSsVWT~nd sA\|0lTHD< GvXeY"m C@N7R0
Nov 26, 2024 08:20:10.271837950 CET	388	IN	Data Raw: 2f 69 21 c1 68 4e e2 1c 5b 3f 71 02 01 76 cc 8c fb 1c b9 1f df 9b a7 02 da 90 c9 a9 fe d4 08 27 37 db 6e 38 00 ec fb 47 a4 18 aa 0d 96 9a b4 8c 8f 5b 15 a8 f9 4a bc 9e 35 98 23 3a 7b e0 8c b8 cf a1 16 46 b7 b1 75 01 c8 c8 fb d9 0e 5f 34 b9 dd 5a Data Ascii: /i!hN[?qv'7n8G[J5#:{Fu_4Z9.Y\Ar;=~>Ghw3 k#6zgg[OWo@U`2o8pE#9-Y1\,[/kicHv+0Ub
Nov 26, 2024 08:20:10.274414062 CET	1236	IN	Data Raw: cc 35 91 f4 f3 c5 04 54 f0 04 b8 db d4 eb 35 51 51 6f c7 ec 00 58 2f 62 20 4f c1 bc c5 01 e0 16 2f cb 5a 96 72 b1 12 ec 80 0c 02 10 f7 4a 46 0a 3f 8d fd 9d 13 81 88 16 22 5a 95 90 87 d5 cc ca 00 f4 fe ce 06 79 85 c2 a8 ee 46 fc 1e fd 99 d3 01 da Data Ascii: 5T5QQoX/b O/ZrJF?"ZyFDD"<iZ)A=dA9RjV6 8hoswD}:kP:/!v=n8@/-F&taqhue(vt^` l131@!o$?
Nov 26, 2024 08:20:10.274442911 CET	1236	IN	Data Raw: ab f2 13 96 6e db d9 b7 c2 b3 48 05 8f db c8 50 01 b2 13 09 32 f5 7a 9e b1 9d 6a d4 bd 0d 95 1e c1 8d e2 f7 b6 17 57 1c a0 da f0 15 dd b6 a4 33 1d ac 70 46 6d c4 3a a0 33 10 f2 ce d3 4b 53 05 98 91 20 6b bd de 1a 3f b1 4f 9f 1b e4 8c de 9b ce 41 Data Ascii: nHP2zjW3pFm:3KS k?OAGUO]77.h"5uk!+{"1:b.~E-=W=J4M$v<`3!(ooEy+4JvgXA`z<Y0$:@v}:
Nov 26, 2024 08:20:10.274458885 CET	388	IN	Data Raw: 37 63 aa 89 ba ac 83 d4 60 b7 f1 dd d5 35 c4 db 3b cc 3c 5d 43 1c 22 e5 18 07 d0 aa f0 50 25 9a d2 36 a3 28 bc a1 cb 92 85 5b 36 01 c0 22 d1 af f5 1b e1 e3 ab fb 4b d5 27 7e 4d 9d e4 a9 a5 b4 e7 1d 8e 1c 6d a1 ef 09 a4 ef af 77 eb a3 18 15 01 b2 Data Ascii: 7c`5;<]C"P%6([6"K'~Mmw%{i=J4xETIDg>py\_%$@jauyyadD K_7N#G,R$CGykbOYvcG=yg,@xpE>
Nov 26, 2024 08:20:10.276835918 CET	1236	IN	Data Raw: f0 b1 37 3a b6 aa 49 8a 48 b1 57 a7 a7 59 be 98 18 7c d9 9b 8f 5e a5 16 ca a2 98 b4 02 45 13 10 97 66 23 fc 3d bc 00 56 9f ba 8f 62 ce 59 5e 81 cc 1f 69 d0 e1 09 38 ae 89 33 f0 b8 25 50 88 87 63 db 6d 5f 4b 12 77 18 08 28 a0 8c 40 25 ab 56 0b b9 Data Ascii: 7:IHWY\|^Ef#=VbY^i83%Pcm_Kw(@%VU@T-T_8mTHHg4ek;Ca1cC7@ilJ6m{c3 VLF7rI{DDr%{r0@9(\|F72q`~kr[
Nov 26, 2024 08:20:10.389575958 CET	1236	IN	Data Raw: 7f 2a 85 a1 63 ad 11 d7 14 2f f5 21 ed 97 07 ae 54 c2 da b6 cb dd 25 a6 19 af 71 15 e6 70 29 d5 10 eb fd 71 8f 75 cf 7a cd 89 8e 0d 8d 47 a6 9f 3a 52 59 2c 90 cb 01 00 c0 12 c4 ac ea 28 e6 f7 89 71 13 33 3b e6 18 5a 19 93 20 44 2a 92 4f 22 04 20 Data Ascii: c/!T%qp)quzG:RY,(q3;Z DO" ]V@\Fp`@VKc}}V4U=C^CCHXN-9*I}_@tiUEW4`gvn+D}Y!r&r(X#)V E#%b
Nov 26, 2024 08:20:34.889224052 CET	452	OUT	GET /tile/?qt=vtile&x=49623&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline3.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.294892073 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 17366 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:53 GMT ETag: W/"9bb51ff67f5b503f20ff20d7a1d80008" Cache-Control: max-age=2592000 Age: 860427 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0413094976 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:53 GMT Ohc-Cache-HIT: fra01-sys-jomo0.fra01.baidu.com [4], zhuzuncache58 [4], wzix76 [2] Ohc-File-Size: 17366 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 e4 eb f2 d3 d5 d8 f6 f7 fa ff ff ff eb ec f2 ec ec eb ce d2 d6 f5 f3 f0 b0 9c d9 ca cc d1 ef ee f4 e3 e3 e3 f9 f7 f4 eb 96 4b f1 81 1f ef 89 31 ec a9 6f f2 d4 a1 f4 ed ea ec a5 9d f9 d8 ac f2 e5 d5 f3 f1 ee da dd e2 dc e4 e8 a0 d0 dc db dc dd e5 e7 ea f0 d7 d1 fe e3 ac ff ec ba fe e7 b5 9e a0 a3 ee 5e 6d e5 17 34 73 73 73 ea f3 f5 e9 f6 fa ca a0 df a6 6b de a5 6f e6 93 55 dd e8 d6 f1 d5 c8 eb d1 b0 eb a8 9b 7a cf e9 f0 31 ad cd 61 b0 d1 af db ea 73 c7 dd 26 a3 c8 e7 7b 85 ca e9 d9 95 d4 b1 65 c9 90 b9 ee cf 65 a3 a4 65 7d b6 37 c9 d5 3f c0 7c 45 c5 7e 3e b3 82 31 b1 77 ff 2e 9e 1a 00 00 00 01 62 4b 47 44 03 11 0c 4c f2 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEK1o^m4ssskoUz1as&{eee}7?\|E~>1w.bKGDLpHYs~BfIDATx}cHFB1Nl7 _A:dL0xHKFP?8_>LkM\dxcjq.#b/-xd^>\\_WH.Ul$/<@URXFi5V$I1/'0X_ha9c)\\,onftd7XJ=Xd<9?.(M;W>'`cpELPpIO15=`9Y7%M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49858	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:09.706321001 CET	979	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:10.963352919 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:13.444801092 CET	979	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:13.845256090 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:13 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:18.753002882 CET	1066	OUT	GET /js/report?b_pi=03675761c4b29133&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=0&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2F&u_ru=&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=1552&pe_tt=121&pe_rt=2350&pe_rpt=3790&pe_dpt=17303&pe_wst=8986&pe_fst=26288&pe_drt=9120&pe_ft=26302&pe_hreqt=2064&pe_hrest=286&pe_fet=22227&pe_jst=6585&pe_csst=4918&pe_imgt=7389&pe_ajaxt=1910&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605606177&pe_css_url=http%3A%2F%2F2.ss.508sys.com%2Fcss%2Fdist%2Fstyles%2FfontsIco.min.css%3Fv%3D202404081140&pe_img_url=http%3A%2F%2F28088389.s21i.faiusr.com%2F4%2FABUIABAEGAAg5I_FjAYolrjWogIwpAI4lwE.png&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fajax%2Flog_h.jsp&b_ct=1732605616480&b_rt=1&b_dl=1.3&b_et=3g&b_dc=1090& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:19.153439999 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:18 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:20.145147085 CET	672	OUT	GET /js/report?b_pi=03675761c4b29133&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=0&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2F&u_ru=&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=03675761c4b29133&b_ct=1732605617389&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1090& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:20.546204090 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:20 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:23.506742001 CET	979	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:23.907187939 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:23 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:36.381580114 CET	981	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRE6YZsKXUOQfX5KBkpg1DRH%2FbaDnpvEYAWQ_yDjRaaEE%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:36.782636881 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:36 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:38.782363892 CET	1341	OUT	GET /js/report?b_pi=036757da3bf4da65&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=0&pe_tt=0&pe_rt=1627&pe_rpt=1049&pe_dpt=5099&pe_wst=5005&pe_fst=10104&pe_drt=5078&pe_ft=10120&pe_hreqt=1032&pe_hrest=596&pe_fet=8476&pe_jst=3390&pe_csst=1047&pe_imgt=2737&pe_ajaxt=1170&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605632363&pe_css_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fjzcusstyle.jsp%3Fid%3D-1%26colId%3D2%26extId%3D0%26_csw%3D0%26clientSupportWebp%3Dtrue&pe_img_url=http%3A%2F%2Fstatic.tieba.baidu.com%2Ftb%2Fpms%2Fimg%2Fst.gif%3Fts%3D4%26t%3Dpageview%26sid%3Dm3y4npye3nz%26ver%3D5%26pid%3D241%26px%3D12801024%26ref%3Dhttp%253A%252F%252Fwww.wheel-done.com%252F%26page%3D18_1%26p%3D18%26dv%3D6%26cmd%3Dopen&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fajax%2Flogin_h.jsp%3Fcmd%3DwafNotCk_checkMemberSameTimeLogin&b_ct=173 [TRUNCATED] Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:39.311150074 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:39 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:48.091448069 CET	981	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRFwSulxsNHzxX%2FM7CSWzpCF1jWmNnk4sxvMmbG7ZmuMw%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:48.492861032 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:48 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:50.575704098 CET	1328	OUT	GET /js/report?b_pi=0367580668186ff6&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=0&pe_tt=0&pe_rt=1134&pe_rpt=921&pe_dpt=4968&pe_wst=2833&pe_fst=7800&pe_drt=2891&pe_ft=7811&pe_hreqt=848&pe_hrest=286&pe_fet=6605&pe_jst=3211&pe_csst=1074&pe_imgt=1157&pe_ajaxt=1837&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605643770&pe_css_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fjzcusstyle.jsp%3Fid%3D-1%26colId%3D2%26extId%3D0%26_csw%3D0%26clientSupportWebp%3Dtrue&pe_img_url=http%3A%2F%2Fapi.map.baidu.com%2Fimages%2Fblank.gif%3Fproduct%3Djsapi%26sub_product%3Djsapi%26v%3D2.0%26sub_product_v%3D2.0%26t%3D31034223%26code%3D5000%26da_src%3D5000%26device_pixel_ratio%3D1%26platform%3DWin32&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fajax%2FmgClue_h.jsp%3Fcmd%3DgetWafNotCk_getClueTicket%26_v%3D1732605642710&b_ct=1732605647424&b_ [TRUNCATED] Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:51.103993893 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:51.125546932 CET	755	OUT	GET /js/report?b_pi=0367580668186ff6&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=0367580668186ff6&b_ct=1732605648771&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1066& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:51.526163101 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:51 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:57.819417000 CET	979	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTR7eSdvEOrzLa_UeZDolLKyig95q67kRmINT6HiImvcvk%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:58.220139027 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:58 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:21:06.994287968 CET	979	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRJYHl4rE_aUUKItLOTOCJ4Y4PYoqWKfrSEw8cRXXsmrk%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:07.563013077 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:21:07 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49860	112.34.113.148	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.276545048 CET	361	OUT	GET /s.gif?l=http://www.wheel-done.com/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:11.974400043 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:11 GMT
Nov 26, 2024 08:20:36.082437038 CET	401	OUT	GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2F&l=http://www.wheel-done.com/en/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:36.677185059 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:36 GMT
Nov 26, 2024 08:20:46.124408007 CET	406	OUT	GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:46.727008104 CET	161	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 23 Content-Type: image/gif Server: bfe Date: Tue, 26 Nov 2024 07:20:46 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:20:56.623513937 CET	406	OUT	GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:57.212627888 CET	161	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 23 Content-Type: image/gif Server: bfe Date: Tue, 26 Nov 2024 07:20:56 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:21:05.442137957 CET	406	OUT	GET /s.gif?r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&l=http://www.wheel-done.com/en/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:06.035240889 CET	161	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 23 Content-Type: image/gif Server: bfe Date: Tue, 26 Nov 2024 07:21:05 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 01 00 00 ff ff 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49816	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.495572090 CET	509	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=95963881&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:11.041405916 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:10 GMT Etag: "6731c1ee-31" Expires: Wed, 27 Nov 2024 07:20:10 GMT Http_x_bd_logid: 1210760708 Http_x_bd_logid64: 1210760260206299402 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:58 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=7C63560D7B2464D6DD6F8EF1CCF42A03:FG=1; expires=Wed, 26-Nov-25 07:20:10 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:11.045145035 CET	393	OUT	GET /images/copyright_logo.png HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:11.594003916 CET	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 2586 Content-Type: image/png Date: Tue, 26 Nov 2024 07:20:11 GMT Etag: "6731c1e4-a1a" Expires: Wed, 27 Nov 2024 07:20:11 GMT Http_x_bd_logid: 1211313049 Http_x_bd_logid64: 1211313220634397706 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:48 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=A6E8552BACE25A4A9EE7C8F3B2E60417:FG=1; expires=Wed, 26-Nov-25 07:20:11 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4d 00 00 00 20 08 06 00 00 00 57 63 f5 34 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 09 bc 49 44 41 54 78 da e4 5a 7b 50 54 d7 19 3f fb 00 b2 12 d8 05 79 58 56 84 99 d0 28 42 29 49 d3 82 fe 81 36 d1 69 9d 04 d2 c1 4e 9d 69 46 a4 74 e2 4c ff 90 51 52 42 c7 f8 24 e4 8f a6 89 8d 8f 4e 6b 3b c6 3c 74 5a 6b 70 3a e8 8c 6d 74 0c e0 48 13 9d a9 c8 00 be a2 bc 41 09 84 85 95 d7 b2 8f 7e bf c3 39 cb dd bb 77 71 31 88 1d fb cd 7c 73 ef 3d f7 9c 73 bf f3 3b df f3 ec ea d8 03 90 c7 e3 61 b3 49 3a 22 79 8b e9 c5 37 66 f7 23 b3 29 ef a3 04 4d 80 65 20 0e 25 0e 23 0e 11 a0 4d 10 8f 11 3b 45 57 bd 90 d5 4d ec 12 98 7a fe ef 40 13 80 01 ac 27 89 a3 89 a3 b6 6e dd 9a d1 d3 d3 63 3f 7c f8 f0 0d 7a 1e 24 1e 15 32 86 0a e0 00 e6 88 60 07 40 fc 5f d6 48 3f d0 be 29 0b ad 8a 25 7e e6 fc f9 f3 c7 3b 3a 3a 6e 7b 04 d1 fd cd 8d 1b 37 16 d3 bb e7 0b 89 8e 1d 3b b6 b7 ba ba fa f8 9e 3d 7b b6 46 47 [TRUNCATED] Data Ascii: PNGIHDRM Wc4tEXtSoftwareAdobe ImageReadyqe<IDATxZ{PT?yXV(B)I6iNiFtLQRB$Nk;<tZkp:mtHA~9wq1\|s=s;aI:"y7f#)Me %#M;EWMz@'nc?\|z$2`@_H?)%~;::n{7;={FGGgS"a6dyAk"jjj%Xc~p8&vutbbQP___-[~IcqZf-*\|mo})q{\|~abYAsgtb&8=[%AY\|38UK9mSs8)vCCnvq}Q7e]~~MLLLKw}\f!N:}#c51~mW5>>nHWJ\|C&@jj2"&
Nov 26, 2024 08:20:11.594286919 CET	827	IN	Data Raw: 26 06 11 90 45 46 06 bf de 85 89 93 22 f7 f7 f7 db 97 2c 59 f2 f4 b5 6b d7 ec 22 9f b3 89 dc ce fd 38 68 1a 9c 7e 04 a5 0b 2f 02 30 98 de af 8a ee b0 94 84 5b 6c 65 56 1b d7 9c 55 3f 0a f7 19 00 10 b3 96 9b 58 44 a4 c1 6f b2 fc 9f 45 f0 eb fc f9 Data Ascii: &EF",Yk"8h~/0[leVU?XDoE#^Zn]0Eu5A/T<B\|<V0'@(}txFBK:}a`}#Kj\|@f>'J\;&2,{"cwzQ=) wu/IzcwBY
Nov 26, 2024 08:20:11.795200109 CET	1138	IN	Data Raw: d9 b1 d6 f0 82 42 a6 37 5b d8 04 f5 09 cb 59 e1 27 db 60 c5 6e 6f 7f 52 88 95 74 69 0e 98 dc 02 b0 b8 33 e7 7c da b0 7b f6 fd ef 79 9f 21 e8 f0 c7 1f f9 8d 35 90 82 99 b7 ed 60 00 8c 07 91 da 1a ef bb 86 86 06 38 54 96 91 91 11 25 9d 7b d9 96 5e Data Ascii: B7[Y'`noRti3\|{y!5`8T%{^x%+VEw<x,e!9\x.)\|}zkEJ?vE=h?\|mm~}8NnOh_!5=OfN&H3dA<@*<-z8\|}d4'j
Nov 26, 2024 08:20:11.866281033 CET	455	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk73838&seckey=-1%2C-1&timeStamp=1732605609720&sign=021634ea5dfa HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.425529957 CET	904	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:12 GMT Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212140612 Http_x_bd_logid64: 1212140180188883978 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=5B61084BF03BAE6C8C95C474F6BB1C5F:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=0F624378EEB2143D6A21F91ECE6DF246:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12121406121187274250112615 Content-Length: 121 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 33 38 33 38 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 33 38 33 38 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk73838 && BMap._rd._cbk73838({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})
Nov 26, 2024 08:20:12.429183960 CET	477	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605610720&callback=BMap.logCbk6219177233&sign=0c25ae630a48 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.985481977 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:12 GMT Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212698993 Http_x_bd_logid64: 1212698070459988234 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=5B61084BF03BAE6CB76B491686ECAE82:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=0F624378EEB2143DE3C76C9AB621B2BC:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12126989933878174986112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 32 31 39 31 37 37 32 33 33 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 32 31 39 31 37 37 32 33 33 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk6219177233 && BMap.logCbk6219177233({"result":{"error":0}})
Nov 26, 2024 08:20:20.553927898 CET	479	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=80032489&code=5054&da_src=5054&pic=6 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:21.094465017 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:20 GMT Etag: "6731c227-31" Expires: Wed, 27 Nov 2024 07:20:20 GMT Http_x_bd_logid: 1220815927 Http_x_bd_logid64: 1220815283779142666 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:55 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=2DBDB216DE197587B31287110E4151E7:FG=1; expires=Wed, 26-Nov-25 07:20:20 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:21.219512939 CET	560	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=89714645&code=5030&da_src=5030&load_script_time=1071&load_tiles_time=3350&map_width=320&map_height=240&map_size=76800 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:21.766387939 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:21 GMT Etag: "6731c202-31" Expires: Wed, 27 Nov 2024 07:20:21 GMT Http_x_bd_logid: 1221486573 Http_x_bd_logid64: 1221486290426433802 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:18 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=636148245A8C921D5E5842B7DC927796:FG=1; expires=Wed, 26-Nov-25 07:20:21 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:34.000711918 CET	682	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk15045&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632356&sign=4ea4a809dda8 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:34.563838959 CET	875	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:34 GMT Expires: Wed, 27 Nov 2024 07:20:34 GMT Http_x_bd_logid: 1234268966 Http_x_bd_logid64: 1234268501262829834 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=E2318EAB9EAB47067E472E17F97FB642:FG=1; expires=Wed, 26-Nov-25 07:20:34 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=5F3AE252FA3D89B4E521E69E2F80F539:FG=1; expires=Wed, 26-Nov-25 07:20:34 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12342689662610116618112615 Content-Length: 93 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 31 35 30 34 35 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 31 35 30 34 35 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk15045 && BMap._rd._cbk15045({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:20:35.493936062 CET	768	OUT	GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk66656&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632887&sign=378b64229bc9 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:36.053980112 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:35 GMT Expires: Wed, 27 Nov 2024 07:20:35 GMT Http_x_bd_logid: 1235755545 Http_x_bd_logid64: 1235755223457733642 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=5E47F7B9BE2CFEAEC9720CD15C89ABCF:FG=1; expires=Wed, 26-Nov-25 07:20:35 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=25D9AC9B2DF758CA82126F6CE33317D4:FG=1; expires=Wed, 26-Nov-25 07:20:35 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12357555450365110282112615 Transfer-Encoding: chunked Data Raw: 35 31 31 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 36 36 36 35 36 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 36 36 36 35 36 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 511/**/BMap._rd._cbk66656 && BMap._rd._cbk66656({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type
Nov 26, 2024 08:20:36.054131985 CET	858	IN	Data Raw: 22 3a 32 2c 22 75 70 5f 70 72 6f 76 69 6e 63 65 5f 6e 61 6d 65 22 3a 22 5c 75 35 65 37 66 5c 75 34 65 31 63 5c 75 37 37 30 31 22 7d 2c 22 65 72 72 5f 6d 73 67 22 3a 22 22 2c 22 68 6f 74 5f 63 69 74 79 22 3a 5b 22 5c 75 35 33 31 37 5c 75 34 65 61 Data Ascii: ":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315"
Nov 26, 2024 08:20:36.255513906 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49863	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.619357109 CET	475	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605607162&callback=BMap.logCbk4206044938&sign=8817e55d060a HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.146692038 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:11 GMT Expires: Wed, 27 Nov 2024 07:20:11 GMT Http_x_bd_logid: 1211873224 Http_x_bd_logid64: 1211873190557917194 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=08740CE4DD62A4D3520B28B50A758488:FG=1; expires=Wed, 26-Nov-25 07:20:11 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=4F4D9313271EFE7F6146DB44AF723BFD:FG=1; expires=Wed, 26-Nov-25 07:20:11 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12118732242732931082112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 32 30 36 30 34 34 39 33 38 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 32 30 36 30 34 34 39 33 38 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk4206044938 && BMap.logCbk4206044938({"result":{"error":0}})
Nov 26, 2024 08:20:12.150212049 CET	416	OUT	GET /getmodules?v=2.0&t=20140707&mod=copyrightctrl_kneba2&seckey=-1%2C-1&timeStamp=1732605609767&sign=0aa625ac9280 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.693654060 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:12 GMT Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212417122 Http_x_bd_logid64: 1212417172361926666 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=5B61084BF03BAE6C85A5A2849D5E5845:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=648B9412B2A66CD3F3FEB06DC570139A:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12124171222676045834112615 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 33 64 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 56 4d 73 db 36 10 bd f7 57 d0 3c 50 44 84 d0 72 67 7a 11 c5 cc d4 8a 35 4d 2a 79 9a 3a 39 39 1e cf e2 43 12 1a 8a 60 49 e8 cb 0a ff 7b 16 22 29 92 b6 92 36 17 8a 5c 2c 76 f7 bd b7 0b e8 f2 d5 ab cb c7 7f f2 58 83 f8 d5 f3 ea 37 bf c7 75 ba cf d4 62 69 b8 c9 e2 1e 75 7a bb 40 ee 8c 4c 84 3f 17 41 9a 69 a3 cd 3e 95 f4 b0 9f 0f e7 eb 84 1b a5 13 9f 1c cc 52 e5 c1 5b cf 3b fe be 93 7e f9 4d 0a aa 12 65 14 c4 ea 49 36 ee 40 0e d0 8a 15 34 3e 01 87 38 3e 6e a6 40 c2 63 90 6b f0 ab b7 f7 ba 7e 13 80 31 c2 4c 9a 75 96 38 47 cb b8 a0 02 3a 19 36 90 39 2c b2 8b 21 04 20 c4 cd 46 26 66 aa 72 84 22 33 df b5 68 5d da 42 c0 8e f1 0b 72 d6 7b a5 37 12 29 f8 ff 1b 9e b4 5e fd d4 86 15 a4 96 0b be 84 64 21 9f 6d 1b 7b 9e 8f cf 20 37 fb 18 29 d2 b1 ce 22 16 bc 0d 34 52 13 fc b5 f2 09 06 2d e8 35 b4 05 e9 10 7c 0d 0d b1 24 dc 05 7f 06 1f a1 94 68 4c dd eb 19 a4 8f 3c dd 8f 51 6f 97 84 96 37 88 2a 56 cb 94 58 30 5f 67 39 66 75 85 9c c3 3a 36 2e 9a b6 4b 65 e4 5d 0a 5c 46 [TRUNCATED] Data Ascii: 3ddVMs6W<PDrgz5My:99C`I{")6\,vX7ubiuz@L?Ai>R[;~MeI6@4>8>n@ck~1Lu8G:69,! F&fr"3h]Br{7)^d!m{ 7)"4R-5\|$hL<Qo7VX0_g9fu:6.Ke]\Fn:OrXrcieeW4ueu"NpU-9n6aX
Nov 26, 2024 08:20:12.693767071 CET	595	IN	Data Raw: bd 6e 93 a0 e6 7e a7 31 91 c8 c1 45 59 05 e7 41 2c 93 85 59 92 b9 ce fc 12 f4 80 b2 67 8b 21 8c 58 08 fd 7e dd e0 c1 c2 76 a3 f5 e6 35 98 bf 99 7f d8 0d 07 74 3f 1c 14 84 8a ae b9 fa d8 2a 61 96 e8 51 7d 2e a5 9d 2f f4 e6 51 22 b7 4e cc 7c 4e 05 Data Ascii: n~1EYA,Yg!X~v5t?aQ}./Q"N\|Nj9YNrN(m D4/U,2@8VCwc2F#WN+WSPPybs4H<P}H4r^V\|S%8\|M/96+N7ABIR_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49864	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.636193037 CET	474	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605608165&callback=BMap.logCbk6093782709&sign=563b1c95e849 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.216063976 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:11 GMT Expires: Wed, 27 Nov 2024 07:20:11 GMT Http_x_bd_logid: 1211931599 Http_x_bd_logid64: 1211931640215492362 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=08740CE4DD62A4D392B3BABA5A531771:FG=1; expires=Wed, 26-Nov-25 07:20:11 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=2E3560B84FF19DCAB0A03C942E269F47:FG=1; expires=Wed, 26-Nov-25 07:20:11 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12119315991355626506112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 30 39 33 37 38 32 37 30 39 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 30 39 33 37 38 32 37 30 39 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk6093782709 && BMap.logCbk6093782709({"result":{"error":0}})
Nov 26, 2024 08:20:12.218319893 CET	491	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53093328&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.770843029 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:12 GMT Etag: "6731c1c5-31" Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212492064 Http_x_bd_logid64: 1212492690217851658 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:17 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=71430D4893A2A9372A964CC45CFDC4E5:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49865	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.665057898 CET	476	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605609176&callback=BMap.logCbk5542380316&sign=498e4551a420 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.276535988 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:11 GMT Expires: Wed, 27 Nov 2024 07:20:11 GMT Http_x_bd_logid: 1211995675 Http_x_bd_logid64: 1211995492567624458 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=08740CE4DD62A4D3F4BDBF7F45074425:FG=1; expires=Wed, 26-Nov-25 07:20:11 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=93850939BBBBB8C1053B5AFCA6A5E121:FG=1; expires=Wed, 26-Nov-25 07:20:11 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12119956750681523210112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 35 35 34 32 33 38 30 33 31 36 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 35 35 34 32 33 38 30 33 31 36 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk5542380316 && BMap.logCbk5542380316({"result":{"error":0}})
Nov 26, 2024 08:20:12.280394077 CET	533	OUT	GET /?qt=cen&b=12703713.02%2C2560839.99%3B12704353.11%2C2561320.07&l=17&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk87276&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=-1%2C-1&timeStamp=1732605610224&sign=6e8c8dfcda44 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.854401112 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:12 GMT Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212557385 Http_x_bd_logid64: 1212557330234628874 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=5B61084BF03BAE6CE0BEA09080E92FE6:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=374AA2E1594C24B7C362AC575ED2D602:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12125573850198846218112615 Transfer-Encoding: chunked Data Raw: 35 32 32 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 37 32 37 36 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 37 32 37 36 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 522/**/BMap._rd._cbk87276 && BMap._rd._cbk87276({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type
Nov 26, 2024 08:20:12.854480982 CET	880	IN	Data Raw: 22 3a 32 2c 22 75 70 5f 70 72 6f 76 69 6e 63 65 5f 6e 61 6d 65 22 3a 22 5c 75 35 65 37 66 5c 75 34 65 31 63 5c 75 37 37 30 31 22 7d 2c 22 65 72 72 5f 6d 73 67 22 3a 22 22 2c 22 68 6f 74 5f 63 69 74 79 22 3a 5b 22 5c 75 35 33 31 37 5c 75 34 65 61 Data Ascii: ":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49866	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.766293049 CET	353	OUT	GET /tile/?qt=vtile&x=24811&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline0.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.123500109 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: image/png Content-Length: 15840 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"489c4b88720fa87a391b01f16db295a4" Cache-Control: max-age=2592000 Age: 1515657 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154150561 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo7.fra01.baidu.com [2], zhuzuncache51 [1], qdix242 [1] Ohc-File-Size: 15840 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f5 f3 f0 d5 d5 da ff ff ff cb cd d3 f8 f7 f8 e4 eb f2 da e4 ec e8 e8 e8 d7 d8 db d7 d9 e4 da da dd e3 e3 e4 ed ed f2 ca e9 d7 6c c9 93 94 d4 b1 f3 f1 ee d3 d3 d6 ed f2 f2 cf d1 d5 dd dd e2 92 97 a2 2d af 75 b8 e7 d9 68 9e 93 ba c5 d2 ec eb ec 3e a3 81 e5 e5 ea e0 a7 9d ad b0 b6 f0 65 73 f3 ed e9 c6 c7 cc ea d6 d2 e7 7c 86 f1 d5 b6 71 85 b6 b2 b8 ca 6b 7b 9f fd db a5 fe d8 9d ff e3 ab ff ec ba d2 c6 b7 8b 96 b0 60 68 76 fc f5 e9 f8 e8 d0 fe e6 b5 cc 90 6e f2 ee fb ea e6 f4 9e 9f d7 79 91 c6 f1 ea f6 d0 cc e9 8c 76 6d cc a7 e7 a5 6c df e6 d9 ee 61 98 e8 49 78 e7 3e 6f e4 0b c1 48 35 00 00 00 01 62 4b 47 44 02 66 0b 7c 64 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEl-uh>es\|qk{`hvnyvmlaIx>oH5bKGDf\|dpHYs~<pIDATx}c$l,7&+63o$j&<5H!RZcF{mhWWEq:;HL1\|$L}A_q~N\\|!xyy>]R@p$IT+,4w~O^>^hUapQ)??/`\|~@?^O?03B bT3LL2_M<edjg}!>c?Ox17`dx@lIVAdC
Nov 26, 2024 08:20:12.123605967 CET	1236	IN	Data Raw: 30 62 00 84 9f 06 b1 0c 03 58 39 e4 b6 00 a7 9a d1 cf fc 63 95 7e 14 00 a0 fc e3 c5 c5 e7 cf 17 f0 f3 a3 f8 42 e3 6a 51 9f 20 33 72 09 80 0c 88 9a 2c 49 07 91 e8 a4 a7 0a 01 2c bf 1f fb fc bb 1f b7 b9 3f 8b f1 e5 f2 3d 74 d7 44 40 c6 72 34 1c a0 Data Ascii: 0bX9c~BjQ 3r,I,?=tD@r4\a%Dp,AF?3)=yr]9},?J_\j?+@$qieL\C/$O,[9c98Zddn
Nov 26, 2024 08:20:12.123615980 CET	388	IN	Data Raw: 59 60 84 9e a3 5e 1e 4b 2b a7 3f 7e 3c fe 5b 1d e2 be 43 fc ab 6c 55 b3 ea 4b e0 f4 e8 6e ad c1 e4 6b 44 41 4d 21 ea 98 3f b8 b1 44 0e 98 de cd 53 0b c0 9d 5e 01 43 cc 57 75 b5 7f d0 12 82 c2 0b a3 82 78 f8 6f 79 30 74 68 b8 40 86 d3 18 28 cf 65 Data Ascii: Y`^K+?~<[ClUKnkDAM!?DS^CWuxoy0th@(eNN< ZbOQ(;Tji:9p*L"H\|!S.byB:\|\|?ML(eQd0t7;X&K~K^X`{?o
Nov 26, 2024 08:20:12.126013994 CET	1236	IN	Data Raw: 7b 53 d5 98 7d d5 12 82 ad ab a8 7b 01 76 bf 6a e9 ac c5 b0 cf d2 43 2a 22 15 11 97 5e 2e f9 46 69 68 13 71 cc b0 8b c7 6f a0 ed f6 12 ff fd db b7 6f 3f d0 51 f2 35 01 70 a3 69 5c 2d 94 fa fa e5 eb cd 17 98 10 10 0d c4 2b 75 8d 63 51 58 46 6b 05 Data Ascii: {S}{vjC"^.Fihqoo?Q5pi\-+ucQXFkW?`1M U&N34t/&dCEFbt\'L\|\C;YJ\-h\|]Y}EraJJoL)}0GO=x@>ho\|jYB,
Nov 26, 2024 08:20:12.126025915 CET	1236	IN	Data Raw: df 87 e3 d2 5f 45 60 98 97 81 dc 91 85 af 01 a0 59 05 94 0f 82 cb 0a ef fc f9 6f 41 b0 85 a0 70 6c 81 59 2b 22 89 ba 0e 02 ff 1f 3f ae f7 2c 3c b2 04 c8 c9 c2 8f 2b 90 b5 87 db e3 e4 e1 5b f1 ef b5 fc 16 81 98 63 de b6 8d c7 7c 76 f7 c7 98 18 75 Data Ascii: _E`YoAplY+"?,<+[c\|vu \|\uHfUn?K9UXW{j:Dy4RZy1awE9O?'[Fl-uGH,(tqlGJ/zy-\|n=
Nov 26, 2024 08:20:12.126035929 CET	388	IN	Data Raw: 11 01 7d 13 d7 8e c9 00 ed f7 4c 3b f0 4e 9a 90 28 8c 03 b7 32 79 e6 cc 03 6a 7e 45 49 7b f6 68 17 3e 50 51 9c 66 e1 72 37 70 94 8c 22 f1 cf 9b b5 31 6c e6 0d 27 e8 2b 15 4b 98 d9 0f b3 fd c4 1f 50 77 e5 4e 45 06 ba fc 1e 02 f9 bd 2f e6 80 66 8c Data Ascii: }L;N(2yj~EI{h>PQfr7p"1l'+KPwNE/ffb1AJ3Y`h#TMhTmNA!7!cEoum?RC3rMAc$G^3Q4wsQC12[#\|(#+hF!D^wvnRO
Nov 26, 2024 08:20:12.128597975 CET	1236	IN	Data Raw: e7 a0 bd 07 e5 4b ac 99 0f 80 e9 b7 a4 fa 6d c9 aa 29 58 20 26 00 70 6f 88 e3 b9 94 76 db c3 e5 fa 97 05 c0 32 76 8e 6c 00 e2 6f 8e 26 bd df c6 f5 a8 ee b4 c1 75 0f 0e eb 87 c7 1f 7a 71 4f 6c 62 4b db 80 a4 85 e5 f9 eb 38 7c da da 4c 13 9d e5 c9 Data Ascii: Km)X &pov2vlo&uzqOlbK8\|L\|CP&<'Tl2x"51OHfh#HaB_A;UOMn5rTtol<eV0wBcwk)/0#{>oSw){r~H*2
Nov 26, 2024 08:20:12.128649950 CET	1236	IN	Data Raw: 1e 19 02 00 dd 61 af 45 bb 16 7e 8a d9 ba 34 df 3a 4f 80 49 b7 ae a0 b3 02 95 e3 b0 eb 95 e8 02 a0 48 e1 d0 d7 57 aa c3 ef f7 b0 89 33 f2 fe f5 d5 55 37 ed 0d ea 05 f9 3b f5 75 37 2b 9b a3 59 cf e3 58 a6 e5 f0 69 5f 99 23 9c 98 62 a2 4a e2 83 49 Data Ascii: aE~4:OIHW3U7;u7+YXi_#bJIGG@uZ@=vV@@5rMgY}EN$_jbL\PiQ.O ,\A9}4Y5[PSC2L^6UmedL~@A@S\<$`%]n'D
Nov 26, 2024 08:20:12.128660917 CET	388	IN	Data Raw: 67 45 11 f2 6c 52 4e 4b 14 49 ba 5f cb 8e d5 e0 64 ee 01 00 3a 5c 21 de 1c 27 3b c8 95 f3 fc 51 5c 37 a8 51 3a 3b a2 72 ac 22 b7 e1 9b e9 5e 3a 37 1f 12 29 20 3e a8 9c 12 01 f9 4e 3c b7 a5 e9 07 54 4c e5 77 71 97 25 c9 6b 78 25 94 a4 eb dc a6 3a Data Ascii: gElRNKI_d:\!';Q\7Q:;r"^:7) >N<TLwq%kx%:\!51jA+&;B,GF2%qgmTBx(N1ZlAR?]%i38]6Oq@>4aX0p4/@r&\|1A
Nov 26, 2024 08:20:12.131217003 CET	1236	IN	Data Raw: 69 b9 c7 d5 ed da 0d 65 99 9d 97 7a 2b 03 9b 38 0e 64 1a 95 ae 90 f1 e2 46 61 73 5c f1 84 02 a7 0e 68 c7 c9 12 86 ea b8 d2 35 ad f3 84 d4 b8 54 12 59 d0 b1 f2 d5 77 1f 96 01 a5 57 eb c1 6c 3d 52 3a 56 b3 d5 6a 75 8b 0d 52 86 08 80 1a 79 de 6a 3d Data Ascii: iez+8dFas\h5TYwWl=R:VjuRyj=[@by MYrQ`j2 ZsGr})CxF><.5f}y[j[?Wz6Sbv?WX+ir@c/LFtCR1N;])"0!C3p
Nov 26, 2024 08:20:12.243732929 CET	1236	IN	Data Raw: d1 a4 61 98 51 01 00 4f 02 c4 b5 25 94 78 18 0c 3f b6 7d 22 de 0a 25 4c 93 b4 41 f3 39 5f 26 c1 9e 65 6f 8c 91 f5 7a e2 71 25 23 50 d4 0a 22 59 3d 49 3a de 46 a9 3a a4 3b d8 65 13 2e 8d 7c 33 d1 67 a4 8f e6 27 8b bd b8 a9 d3 74 8e 86 60 9c b5 de Data Ascii: aQO%x?}"%LA9_&eozq%#P"Y=I:F:;e.\|3g't`e>21DXcA]X$Sv.f &Y3^n~VG^yg<dM$4o&s%8H}I,mt*7Eu/bq
Nov 26, 2024 08:20:34.921916008 CET	354	OUT	GET /tile/?qt=vtile&x=49624&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline0.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.344995022 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 17844 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:52 GMT ETag: W/"875ecc4adb1d15228968a57e14babfee" Cache-Control: max-age=2592000 Age: 866706 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0412798499 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:52 GMT Ohc-Cache-HIT: fra01-sys-jomo1.fra01.baidu.com [2], zhuzuncache56 [4], wzix56 [4] Ohc-File-Size: 17844 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 e4 eb f2 db dc dd fe fe ff f9 f7 f4 d5 d8 dc e3 e6 eb ec eb eb ec 6b 77 ef 53 63 ec 9a a1 eb d6 d8 db de e2 e8 7c 86 e3 bb ca f3 ed ec e3 e3 e3 f5 f3 f0 e6 e8 e9 eb ec f3 97 d2 fc 9b d3 fb ef ef f4 f3 f1 ee f8 f7 fb ad b6 ce a1 a6 b4 ca c8 ce dd e2 e8 ce d1 d7 d3 d4 d6 d4 e8 f1 e3 e1 dd d4 d5 da d6 da e5 af d7 f5 9d cd f1 c6 cc d9 cc ea d9 b7 e4 cf 93 d5 b0 69 c8 8f ba c5 d6 f6 f2 fe ba 8e e5 9a a8 c8 9d 63 e3 a5 6f e6 a3 8e d4 99 5e e0 d0 ae ea e6 d5 f1 c4 98 e4 93 55 dd b1 76 da d2 cc e8 74 8d c2 7b 93 c7 8a 97 b8 6b 84 bc 77 87 af 66 7d b5 5b b0 94 35 9e 7b fe e8 b5 6c 28 f3 b0 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 44 51 49 44 41 [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEkwSc\|ico^Uvt{kwf}[5{l(pHYs~DQIDATx}{F:thU,QKyhR@ ;3{JZ6{33\;Nz3O?pyoy><0{X\|2{?=ky<z`jn$a0~U-n3V)/l%5>wQ1zah_=<z+Xzpg?{b;+?ySd:u_O\^$L~%uF_?=5"Lc'^v0oQ2o=y7I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49868	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.767925024 CET	353	OUT	GET /tile/?qt=vtile&x=24812&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline2.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.030589104 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: image/png Content-Length: 19363 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"5874f74f5ea1446c265929e54d83adb2" Cache-Control: max-age=2592000 Age: 1454506 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154446541 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo4.fra01.baidu.com [2], zhuzuncache52 [4], wzix83 [1] Ohc-File-Size: 19363 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f6 f8 f8 ff ff ff db db dc e4 eb f2 ce d2 d8 f5 f3 f0 d6 db e3 ec eb ec e3 e3 e4 d7 d8 db ec ee f1 dd e3 e8 e8 e8 e8 dc de e2 d3 d3 d6 d4 d5 d9 e4 e6 ea 93 93 94 9b a3 b1 af b0 b2 f3 f1 ee 99 d4 ff 71 73 76 ed f2 f3 f1 ee eb ac d6 ef d0 d1 ce b7 cc d2 ca d2 e3 ad b6 cd 99 a8 c9 c9 cd d5 e3 e6 f2 c7 c8 c9 79 91 c6 84 99 c8 71 85 b6 88 94 b4 d0 e8 f3 66 7d b4 9a d4 f3 71 c4 e8 91 cf ec 5a b8 dd e4 db d8 c2 50 5b d0 b2 af e6 bd c1 f8 ed f3 b3 df db 3a a4 a6 6d 79 94 d1 e6 da a6 da bb 8f d1 ae 69 c8 90 62 a6 94 f6 e9 d0 fb db ab ff ec ba ff e2 ac da cb b1 fd f7 e7 3f 9f 7c f7 22 5b 19 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEqsvyqf}qZP[:myib?\|"[bKGD-pHYs~J3IDATx}z8.@b/dDro]),,q^L@)hRF8R+"\I_Hw?rr29<b,e/)i>$?OYO_Z=+!2\|;Cjb+\|TV/>^"CD{xlV]!%b6z32RyH=.N4%zH\|$,ZfM2zy4Y:x}X-~L
Nov 26, 2024 08:20:12.030606031 CET	1236	IN	Data Raw: 08 00 b9 67 00 64 20 5f ac 4b 7c ec b5 8c 76 bc 2d 15 11 1f 97 55 95 26 6b fe 3a 0a 26 00 80 07 2b 8b 67 03 80 9f 20 02 8b 7c 10 ba b5 61 80 1c 65 d0 7d 03 fa d6 dd e1 08 6b 35 7f 52 06 e6 2d 6e 69 7c af be e4 f7 ed ba 84 f9 18 48 c4 8f 6c b5 0e Data Ascii: gd _K\|v-U&k:&+g \|ae}k5R-ni\|Hlgtu}WU_ &Jn`%W\|)uf@y!XbX.oT(M"k[kr>O0k\iCF% xcW5VF@&G(
Nov 26, 2024 08:20:12.030625105 CET	388	IN	Data Raw: e0 15 9a c1 63 1d 80 ae 21 3f 60 8f 1f b8 39 1d d8 0c 86 80 c0 b9 81 ef 8b bb b9 70 00 28 95 97 18 55 4b f4 7d 4d 2c 84 eb 01 c3 da 6e 25 f1 25 4c 5e d2 6f 48 d6 94 01 7e 1a ed 7c ef 11 58 68 d8 00 50 12 25 9e 3f 05 00 3a 0f 36 e9 65 5a a7 b9 8e Data Ascii: c!?`9p(UK}M,n%%L^oH~\|XhP%?:6eZ\|az;sp$ {/{mD`Toc&M3Q`P) aZY20O?RBvi3Y 5H~rGZ#(A]6Fi;b["@
Nov 26, 2024 08:20:12.033072948 CET	1236	IN	Data Raw: 02 c9 4d 21 c1 3f 0c 22 74 86 1b e3 fa 28 5e 5f 27 69 95 1a 5a ad fc e0 96 82 59 d4 d7 2a 7b 1a d5 01 58 81 87 37 6f 1e ae 03 00 a0 1c 7d 3f 9f 87 e0 8d 8c e3 3a 5a 1d 20 a0 d9 9f 3e bb bd bf f0 fe a0 c3 6b b6 e0 44 7e 41 76 10 19 ff ad 0c 21 18 Data Ascii: M!?"t(^_'iZY*{X7o}?:Z >kD~Av!K =^q/>P!6F1(Tb$(4}4(P"mTmfZgQm DJc88n[b,5D!'RMI?@?AEPsl~UA]!@$mQ4
Nov 26, 2024 08:20:12.033103943 CET	1236	IN	Data Raw: ac 42 59 7c f8 e3 fd fb ed fb f7 e0 08 e0 9e eb 1f c5 f1 68 b3 e3 06 d3 f4 f0 68 c0 53 3d b2 11 77 02 c8 ac 4f 41 91 18 22 26 f5 98 fe 17 6f 57 47 0e 87 c0 25 26 25 40 0f 2e 41 fb 81 1f 70 b3 58 c6 37 05 57 44 ea a7 00 20 39 c3 8f e9 9b 03 c8 36 Data Ascii: BY\|hhS=wOA"&oWG%&%@.ApX7WD 96NwR0#>-Iu@6`N5 U^<.=./noU~NA@$c&B=2!f@kBKjTRUn)XT=vX, v
Nov 26, 2024 08:20:12.033116102 CET	388	IN	Data Raw: ab f6 29 6f a2 45 91 2c 80 e5 21 1c 8e 82 4b 66 70 e2 e8 00 18 02 14 98 e8 3a 47 c8 da 51 99 6c 67 de 94 61 3d ee 36 54 b1 00 6b c0 da 2d 8c 53 4c 92 8e 34 e0 c3 f8 49 03 65 07 57 96 0c c8 9b d5 cd 62 47 d1 50 87 4d 2b ca 11 2a 3c 00 50 e7 c8 b8 Data Ascii: )oE,!Kfp:GQlga=6Tk-SL4IeWbGPM+<PIz+lwop1(13F@vW}'W7+ zR'G1REg'I\M`;%^( +wYO54YN=ArA\|Y~Y4n%!*)xf2C
Nov 26, 2024 08:20:12.035612106 CET	1236	IN	Data Raw: 70 8a f5 61 70 9e 50 32 4a bb 2c 8a 2e ba 50 f9 84 e7 01 50 52 e8 a1 3b a6 f3 f9 e3 bb 5b a7 f0 d7 bb 58 49 1a 12 cd 19 9d aa f5 99 40 ec 08 70 2a c1 c6 05 0c 52 ce d7 ea e7 c5 1a 10 fe 6d 9b 01 06 60 15 13 00 d8 24 1e 60 27 0a 3c 46 d3 c4 6e 85 Data Ascii: papP2J,.PPR;[XI@p*Rm`$`'<Fnd%<ULl'#\|e\"S9U3@Xu\|vhONj7fN#P?bW#\|\|F=lRcPblwPtvJou@c5V
Nov 26, 2024 08:20:12.035689116 CET	1236	IN	Data Raw: dc fc b9 61 00 e0 df b7 6f 60 bd c3 3f de b8 9e 12 a5 44 c6 67 23 e2 04 bb 9e d1 3a 87 10 5e 48 01 be b1 e7 78 18 aa b9 cc 1f 05 22 03 0c 52 97 36 00 ca 0e 76 7d 52 88 9e a1 46 af ca 3a 15 48 c6 be 52 39 e0 82 85 de 02 95 d4 4c 31 b0 13 e2 9d 90 Data Ascii: ao`?Dg#:^Hx"R6v}RF:HR9L1y;Iz-<sCN,UUO=S3j$E!1ICnM9LEqg-=7BUo$g&LTP'[mg\|7.3v$@LQ7
Nov 26, 2024 08:20:12.035700083 CET	388	IN	Data Raw: 9e 09 f4 e0 d0 d8 b7 6b 56 31 8f d7 7b 70 de e8 60 18 44 81 95 96 9c 11 00 b5 9a 95 36 5e 1e 0b b9 a5 c7 aa 04 76 38 96 f7 cf 00 80 cf fd 6a c2 5d ae 15 89 62 01 bb db 09 69 44 5d 4b 1a e0 f1 dd 5b 9b 01 26 da f8 46 df 05 01 20 15 13 77 4a 34 b8 Data Ascii: kV1{p`D6^v8j]biD]K[&F wJ4&4 OQy*N~_Xe$6sbri2;;z:DrA0}x&Num-m@+~\|0@ \|3TEA#PHY:;61{~\{-.!\\
Nov 26, 2024 08:20:12.038113117 CET	1236	IN	Data Raw: 6e 3c 33 1f 30 3c 1e 0d c7 87 78 90 00 88 97 11 a7 b6 a9 99 66 08 c0 f4 c9 c9 21 36 eb 58 99 73 c1 a9 ee 27 67 8a 0e 00 30 9f 9a 1c f4 08 f9 43 82 7e ef e0 c9 a9 14 32 62 00 f5 c3 d9 ed e3 9b 77 6f 6e 87 0d a2 95 2f 3c 86 78 b0 23 27 98 86 0c 83 Data Ascii: n<30<xf!6Xs'g0C~2bwon/<x#'G6lY\Ap GeXy!d$@A 0V-s(pgsc(Ks!`Csw`135"x26*Z/Jih=ClKRVNS
Nov 26, 2024 08:20:12.150758028 CET	1236	IN	Data Raw: 17 4e 86 ed ee eb a4 eb 70 3a ea f4 8d 50 22 00 7f 8f 60 6b da 72 f8 c3 28 6e 72 35 15 74 ce 56 60 49 a6 10 ad c0 09 c0 5a d6 d6 fb d6 3e c2 9d cb 83 9c c5 8f df 9e cc 08 f9 d4 f0 b6 68 c8 1d 40 eb 5a fa 19 20 b6 93 3e c5 4e 77 9b 24 ae 59 88 83 Data Ascii: Np:P"`kr(nr5tV`IZ>h@Z >Nw$Y&qT5d?[3E;pdg`PUw;w.!/k!>vmce[V2*^;?5fgE6bx\|t_<MVq3 tz,3PpJb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49867	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.767978907 CET	353	OUT	GET /tile/?qt=vtile&x=24813&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline2.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.040046930 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: image/png Content-Length: 17410 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"75e5cbff6f624c716c94cb5ebaa19542" Cache-Control: max-age=2592000 Age: 1515657 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154049220 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo2.fra01.baidu.com [2], zhuzuncache62 [1], czix115 [1] Ohc-File-Size: 17410 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 e4 e3 ec f2 ee fb c9 cc d6 67 7d b3 6b 83 bc 7b 93 c8 d4 d4 db e6 e9 ea ff ff ff da da de d3 d3 d8 f6 f6 fa d8 d8 e4 e2 e3 e5 ed ec f4 dd dc e3 f3 f3 f4 6a c8 90 dc e4 e7 ea e5 f3 f2 e8 f7 e8 e7 f2 e1 de e9 eb eb ed b7 ca d1 75 8d c2 eb f1 f4 c4 98 e3 d1 af ea bd 8f e3 b9 86 de e6 d3 f3 b1 76 da 79 8a b6 83 98 c8 b3 bb d1 a8 b1 cb d0 cc e7 9d 64 e2 ca cc d3 cf e2 d9 90 d1 ae a2 d8 b9 ca b9 cb aa b3 cb 99 a7 c9 d0 ab b2 89 96 b7 8d 99 b8 e7 53 3d 99 a3 ae d2 7c 81 77 86 ac e8 1d 1f 72 78 85 62 64 6b ef 04 01 fb 9a 00 66 a9 91 22 9f 50 a6 d6 e2 d4 ea f1 52 b2 d2 44 ab cd 26 8e eb 11 00 00 00 01 62 4b 47 44 08 86 de 95 7a 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEg}k{juvydS=\|wrxbdkf"PRD&bKGDzpHYs~BIDATx]6>vKp96W>fc<#xF#0TH'LJ4Jb.YOokJI9n-5ysm'KGrn!6Bb44$~)5HAatLtZ\|X#z-hFra?l65'_74&)tM>lxY"QZ C:Z~<5'I?\|^+=>=>n_o[f
Nov 26, 2024 08:20:12.040108919 CET	1236	IN	Data Raw: 42 b5 88 ea b1 80 e6 00 82 72 06 84 a4 0d d6 be b4 10 ee 03 80 7f 49 9f 60 a8 01 18 db 1f 82 6f 3e 6c b6 00 c2 1a b0 78 02 7e d0 00 3c 69 be 58 03 37 c8 e9 7a 03 3f 70 d2 47 72 bb a6 81 c4 af 81 13 f0 dd 87 8d 1c f9 c0 71 cb 74 f1 f8 3b 8f ed a3 Data Ascii: BrI`o>lx~<iX7z?pGrqt;yDjc7H^/-kg@^m7rx@n),8`)pv-!w[Mvzn;kD[~~/Xp,HY@aU-,5\;5`
Nov 26, 2024 08:20:12.040118933 CET	388	IN	Data Raw: 50 03 9a 6d 5b 13 83 00 80 7e db 22 ff 1f d6 8f 33 e0 80 47 ed 1a 02 f5 b3 e9 03 72 80 7a 32 00 18 0e 80 a7 5f db f4 6f 6c fe 4e e3 22 9a 8f ae 00 40 f8 60 a5 44 fd 0f 92 9a 43 ba e3 5a e1 2d 7d ed 68 fb d6 ca 68 03 e0 bb 00 f8 60 03 00 eb 1c 38 Data Ascii: Pm[~"3Grz2_olN"@`DCZ-}hh`8V2/@0>mXN$x.Ev)TM~a`R[e\Em#1}k0"r@gfQF?%0$\|p?IO,(3h
Nov 26, 2024 08:20:12.042820930 CET	1236	IN	Data Raw: b1 bd 9a 9e 44 4b 41 c7 87 02 57 50 08 2f 70 01 f0 42 00 2c 62 bd 9c 0e 24 04 41 16 6e 29 e0 c9 71 50 89 6c f0 b4 86 69 46 7b 67 f3 34 c3 80 d9 c3 fa e9 00 bf 1b 35 f8 84 bf 3f f0 ef 6b a9 8d e2 0b 7c ec 00 00 88 f7 c7 da 26 f5 a7 c3 97 b2 14 a4 Data Ascii: DKAWP/pB,b$An)qPliF{g45?k\|&;=KCt}"Rl0N1K$f`<s[`dvGEw[4H1\|LJ<-OZo,X7u"hdBJ5
Nov 26, 2024 08:20:12.042845964 CET	1236	IN	Data Raw: bf c0 22 40 00 fc 82 79 83 4c 64 06 e0 90 37 00 64 12 98 fb 58 11 7b 7b b0 f6 ab 6c ee 01 5b ec 5e e9 ab a2 3b 8f 65 04 00 50 c2 38 02 00 9c 1d 27 00 26 5d 00 1a 7a 83 41 6f 88 7d 9d c1 b9 b7 b8 24 e4 92 44 2a d8 68 98 c6 0f a3 44 c3 1d c5 5d 00 Data Ascii: "@yLd7dX{{l[^;eP8'&]zAo}$D*hD]`_O10P; :D(rpNyW%"eIq$Gs@ 0wQ?^)Dg6(G`Z,\|25E5%ClnFu3?%"i8zz_/C
Nov 26, 2024 08:20:12.042856932 CET	388	IN	Data Raw: fc 91 2c 3b fa ab 3b f3 9a e6 c2 62 72 04 63 a2 43 4e 5a 16 f8 ee 7d 4c 96 25 88 9c 1f b3 24 74 05 e2 18 01 bf 6b 48 0c 00 30 c3 b2 47 21 52 98 3c e6 95 66 14 3c f5 b6 62 7a 79 2f 6f 19 a0 23 d0 54 f1 1a 70 75 78 4c d5 fc e6 73 38 1c 29 61 35 30 Data Ascii: ,;;brcCNZ}L%$tkH0G!R<f<bzy/o#TpuxLs8)a50P%HERSW%KB&x+[_O6R1o4lRDF7j`(C8<?r#c$ty]lBN1Waf1nY~votD8(Ez6Bx;M
Nov 26, 2024 08:20:12.045372009 CET	1236	IN	Data Raw: 6a 46 cf 8a 85 80 b5 9a 74 72 ad 51 8b 1e ad 06 ad a8 f8 e8 7e a2 25 94 b1 82 fc e0 52 a6 be ed 28 87 ef ac 74 1d 31 01 b9 ef c4 6b 0c 00 88 e6 d4 65 ad a2 08 8d 97 6e 86 06 65 33 5e 5e d4 7a f5 a7 c1 3e 88 92 a1 87 b5 2c 42 2b 26 6a e6 f0 7e 7c Data Ascii: jFtrQ~%R(t1kene3^^z>,B+&j~\|1Zj }JX"]b`i$'/rRL0gN[)6%7Eg+%:;W(tUqVMW`qIPsp'=rd9\|?&
Nov 26, 2024 08:20:12.045463085 CET	1236	IN	Data Raw: c3 ef da 4e 56 c2 b2 dd e8 a3 60 57 36 f6 23 af 55 5b 42 b5 6f c2 2a fb dc d7 64 ba 6d 1c 8e 31 e9 25 72 69 f3 d2 1f 1f 19 80 cf 9f 19 80 8f 7f 84 b8 d7 cd 2a 94 ed 01 70 bb 1a 70 f3 4c b7 e3 43 51 d7 cf b7 d7 0d 7d a7 b0 ca 3e cb fa 65 b7 51 c2 Data Ascii: NV`W6#U[Bodm1%rippLCQ}>eQ"(nl"~),`[d=(5Kz3Vv7-a}6)/scT]kpN?e kq4q]Yh\|!/8Vk0u
Nov 26, 2024 08:20:12.045480013 CET	388	IN	Data Raw: 98 f1 4a c1 fc ca 67 f8 f0 1e 28 b9 f3 4e c0 04 ab 3c 3f ed f2 fc 78 cc 79 af 32 01 40 67 2f c0 38 6a d6 38 fa 3a 2f 56 12 c8 7a 27 bc 06 00 de 2f 45 29 08 00 f8 8a 93 3a cd 4f aa 0d 80 68 16 5a d6 58 55 ca 3f 07 40 da 6d bb ef eb e2 28 6d 2b e1 Data Ascii: Jg(N<?xy2@g/8j8:/Vz'/E):OhZXU?@m(m+X4!?\sU'#28c(o_V;?H}5G\resjd5c,0B'*Qy.K<81b{w3O
Nov 26, 2024 08:20:12.048209906 CET	1236	IN	Data Raw: b2 7a be 43 21 08 ee 74 24 23 a4 48 e0 02 00 81 28 77 25 02 20 4f 13 04 20 d7 3b 58 bd b2 f4 68 d9 56 12 0b 01 60 49 28 52 b6 7a 27 bc 50 64 08 e9 90 de 8e 00 80 5b 9f 2a 17 dd 20 cd c3 02 25 60 1a cb cb 83 77 76 b4 cd 00 5d 1c 65 97 09 d6 2d 65 Data Ascii: zC!t$#H(w% O ;XhV`I(Rz'Pd[* %`wv]e-e=#uu]d=Y&QD8WIz'#Ywdlc6nZ cr@Rwpq{?#5XGUH J?R`O$.n86%W
Nov 26, 2024 08:20:12.160104036 CET	1236	IN	Data Raw: 26 39 40 d7 51 02 f8 97 00 60 7f 88 b9 29 52 37 48 41 13 10 d2 a5 8c 60 07 c5 4b c7 49 73 d9 c0 b9 1d 8e d1 23 78 28 61 a8 49 d7 f5 3d 75 01 c7 af 01 40 9c ac 13 64 37 95 b6 98 dd 72 a6 96 13 44 82 b2 00 c8 12 ed 3d 45 d7 2b d7 ae 0c 1a 14 a0 4c Data Ascii: &9@Q`)R7HA`KIs#x(aI=u@d7rD=E+Lz]c\|_^jvrBg[b_vAOIohk2x+6/W\W<Ja0akL@9<,=?N@f7{PbQ<~>OckCh>*
Nov 26, 2024 08:20:34.732609987 CET	354	OUT	GET /tile/?qt=vtile&x=49626&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline2.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.140331030 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:34 GMT Content-Type: image/png Content-Length: 15730 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:52 GMT ETag: W/"2ebcf45c60995ab343eaa82b7ae1c960" Cache-Control: max-age=2592000 Age: 866706 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0412774534 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:52 GMT Ohc-Cache-HIT: fra01-sys-jomo6.fra01.baidu.com [2], zhuzuncache65 [4], csix100 [2] Ohc-File-Size: 15730 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f9 f7 f4 eb eb eb e5 e6 ea e4 eb f2 cc ce d1 ff ff ff fa f6 fb e3 e3 e4 f3 f1 ee d7 d8 db f5 f3 f1 d6 db e3 99 5e e0 93 55 dd b9 86 de a5 70 e6 9d 64 e2 ba 8d e5 d7 c8 ed c4 99 e4 ec ea f3 d1 af ea b0 76 da e5 d6 f0 f6 f2 fe f3 eb f9 db dd e2 b4 b7 c7 dd e3 e7 f2 ee ea c6 b5 d6 ec f1 ee 91 9b b2 69 95 fc d1 e5 f0 55 87 fb ad d3 dd 91 a6 d6 ab af b6 6c 85 bb 46 7c fa d0 cb b7 e4 2d 47 d2 94 6d 64 61 62 e0 b5 94 ec da cb ed aa 70 ed 96 4a ef 89 31 f6 d3 ad f6 cc 9d f6 e9 d0 cf e7 d7 a5 d9 b8 f1 81 1f 6b c9 90 91 d5 ab 79 91 c6 65 7e b7 ff e3 ac fe e7 b4 e8 e8 ba ff ec ba 1b a7 f3 75 00 00 00 01 62 4b 47 44 05 f8 6f e9 c7 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTE^UpdviUlF\|-GmdabpJ1kye~ubKGDopHYs~<IDATx]cF@lP$[R49v'MwwJd;#"Wx><[MdWM:_E}1_-?bczw(%T7[(^bZJ\|#Yy+OxE4M0?fFx#vNgbEFVb!XO\TXsY\|FsUxj8% lXr@ V?W;fj/W0R`iI89r;4ZG
Nov 26, 2024 08:20:35.827069998 CET	354	OUT	GET /tile/?qt=vtile&x=49623&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline2.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:36.234599113 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:36 GMT Content-Type: image/png Content-Length: 15307 Connection: keep-alive Expires: Sun, 08 Dec 2024 20:11:57 GMT ETag: W/"58aee004f57cf809d5de17de287ff47e" Cache-Control: max-age=2592000 Age: 459928 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0717171669 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 20:11:57 GMT Ohc-Cache-HIT: fra01-sys-jomo6.fra01.baidu.com [2], vhkg04bgpcache68 [4], zhuzuncache59 [4], bdix77 [2] Ohc-File-Size: 15307 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 bd 50 4c 54 45 e4 eb f2 ff ff ff 4f ab 8c f5 f9 fa a3 d8 bb 8f ca b5 b5 ce cf bf e0 d5 6d b8 9f ed f0 f5 c6 e8 d3 dc e5 e8 ce d1 d7 f5 f3 f1 ec eb ec d7 d7 da e5 e5 eb fb e9 c6 ff ec ba ff e3 ac fd db a5 f4 ec e9 b9 ef d0 31 a9 77 40 bf 7d da dc e3 f4 f1 ee fe e7 b4 f8 eb d4 d1 ea f0 d4 d5 da eb ec f2 fe e0 a7 e3 e3 e4 fa d8 9d f9 f7 f4 c9 cb d2 ee d6 b0 ef d3 cf cf e1 b6 71 85 b6 89 95 b7 cc ce e4 66 7d b4 99 a7 ca af b6 cb bc ed cd ad b0 b5 d3 cf b5 a5 98 77 e3 a8 a2 e6 d8 ed d6 ac de f6 f2 fe a4 8f d8 a3 6a e0 cc 91 6f 79 91 c6 a0 d3 e3 58 b4 d3 e6 7c 86 ef 69 76 f0 57 66 ff 3d 94 9b 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEOm1w@}qf}wjoyX\|ivWf=bKGD-pHYs~:^IDATx}Cl'W-B.?UU/Z!a/:E>>\|p]'O[` N#5.oiy8??9gqN?=9>~'#<gp1N>N'<~r?YYyG_,@O?NN?'''P?'#$]N`pH <O,sMM2@>}:9DN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49869	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.777586937 CET	353	OUT	GET /tile/?qt=vtile&x=24813&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline3.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.077229023 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: image/png Content-Length: 15923 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"dd630153a65d3a884ece79ca3ee193c9" Cache-Control: max-age=2592000 Age: 1470235 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154074976 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo7.fra01.baidu.com [2], zhuzuncache61 [4], qdix61 [1] Ohc-File-Size: 15923 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f5 f3 f0 e3 e3 e4 ff ff ff e6 e6 e9 db da dd f7 f6 fa d3 d3 d6 d5 d5 da dd dd e2 e4 eb f2 c9 cc d6 d7 e5 ed 1e a3 8f cc e8 d6 9a d7 b0 d7 d8 da f0 ef ed eb eb ec 8a 96 b7 98 a7 ca 79 91 c6 44 74 e5 ae b6 cd f2 ee fb f3 f1 ee cc cd d1 68 a0 9d 6a c8 91 ec eb f3 aa d2 e3 6f c5 eb d6 d9 e3 f2 e9 f5 c4 99 e5 ad 8d dc 9b 62 e1 a5 70 e7 d0 cb e8 d0 ae ea e6 d6 f1 93 55 dd b1 77 da 5e b9 e9 c4 b6 d8 a5 a8 ae 71 86 b7 66 7d b4 61 66 71 72 78 85 d6 b3 9c e3 2e 47 be 89 65 e7 da d3 fe db a5 f9 e9 cf fe e6 b6 ff ec ba 4e 95 78 fc f5 e8 fe e3 ac f2 d4 b5 d8 9a 6b dc 8e 44 e3 cc aa 20 87 62 df 00 00 00 01 62 4b 47 44 02 66 0b 7c 64 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEyDthjobpUw^qf}afqrx.GeNxkD bbKGDf\|dpHYs~<IDATx}67t9:lwmz"lsk15y^oA@RsX_eqtM,_>0XGUY2p~O>(nF"C6Wtr3=AxUX\|#%aR'Qo;o?8h<n$}gA1<x9H/&tMU%qAfa~Tea6_(f6" 6}ij'NJ?
Nov 26, 2024 08:20:12.077267885 CET	1236	IN	Data Raw: a7 84 07 8d cf 80 d4 a4 10 1f 7f 11 f2 c3 2f 1f 81 0f 7e f9 2c 92 4a 71 40 23 8f ab ff 69 f1 df f8 11 f0 7f 73 93 bc 68 29 6f 87 d7 e1 8f 06 00 59 0f 02 b0 41 12 3c 2d db 40 b3 d7 50 13 f3 5d 83 28 c3 89 f7 73 87 0a f0 03 21 06 95 86 39 42 cf 7a Data Ascii: /~,Jq@#ish)oYA<-@P](s!9BzP2~U_>Hk@o7-"o@1@X^ @_g^3i&sPaVL(Qh02O2H4@_lW&q.H4M$]ARi4FLmR(`
Nov 26, 2024 08:20:12.077280998 CET	388	IN	Data Raw: e1 cd 1b 62 0b 56 00 62 7f ad 09 ba de 8b 6b 1a f0 82 94 f0 3b d3 2a 0e d7 e2 40 03 fe be dc 89 ab 1d fe 89 c9 98 ea 77 00 e0 20 d7 42 ec c4 1e 11 b0 e8 75 b8 01 71 37 86 ee 58 8a 46 44 36 6d ea 2e 88 c2 51 36 d0 2c c0 08 a0 5b 38 23 b1 47 68 c3 Data Ascii: bVbk;*@w Buq7XFD6m.Q6,[8#GhIxD_D>\+x;y\|xy8\_cF>r}@vM%XK Ta1D)Y8/4hr&}}<lkq/!f;K4#Jf:mj%WD^
Nov 26, 2024 08:20:12.079608917 CET	1236	IN	Data Raw: 0d a8 3d 80 c3 11 14 38 fe 7f 6d 01 20 48 ad ed 19 fa 2b 06 08 84 02 e8 87 1f 47 49 7f 78 28 02 bf ff 7e 65 00 f0 e5 ca 78 40 87 1b 10 f7 a2 d4 a8 e3 b5 3a 57 49 8c 05 1d d0 88 b9 f1 ce 67 af ad 24 50 ca 70 8e 55 37 3c 00 b9 db ed 0e c0 e1 bb 9d Data Ascii: =8m H+GIx(~ex@:WIg$PpU7<8+#ifrxW(Zrd`6ES0=JBgy;hD3*)jF $2&6" 'TH~0I[$(6y lPdY?^K~,
Nov 26, 2024 08:20:12.079655886 CET	1236	IN	Data Raw: b7 60 23 40 a6 97 10 88 29 3f 11 8e 4e aa ed ba ac 4e e7 4b dc 09 51 f3 e5 a5 37 32 32 e7 0a 48 c7 33 da 24 83 5b 07 5c 80 46 b8 85 c4 ae a4 f1 2e 3e c7 20 06 ed 7d 2e 01 80 21 10 b9 70 90 11 00 6d 40 e2 5f 8c 4f aa 6f 66 71 ab d3 e9 7c 25 e4 5a Data Ascii: `#@)?NNKQ722H3$[\F.> }.!pm@_Oofq\|%ZQ<G!jnT":\\|."H&&&t:D*j\wX8-fi?NbKoypSsVWT~nd sA\|0lTHD< GvXeY"m C@N7R0
Nov 26, 2024 08:20:12.079667091 CET	388	IN	Data Raw: 2f 69 21 c1 68 4e e2 1c 5b 3f 71 02 01 76 cc 8c fb 1c b9 1f df 9b a7 02 da 90 c9 a9 fe d4 08 27 37 db 6e 38 00 ec fb 47 a4 18 aa 0d 96 9a b4 8c 8f 5b 15 a8 f9 4a bc 9e 35 98 23 3a 7b e0 8c b8 cf a1 16 46 b7 b1 75 01 c8 c8 fb d9 0e 5f 34 b9 dd 5a Data Ascii: /i!hN[?qv'7n8G[J5#:{Fu_4Z9.Y\Ar;=~>Ghw3 k#6zgg[OWo@U`2o8pE#9-Y1\,[/kicHv+0Ub
Nov 26, 2024 08:20:12.081907988 CET	1236	IN	Data Raw: cc 35 91 f4 f3 c5 04 54 f0 04 b8 db d4 eb 35 51 51 6f c7 ec 00 58 2f 62 20 4f c1 bc c5 01 e0 16 2f cb 5a 96 72 b1 12 ec 80 0c 02 10 f7 4a 46 0a 3f 8d fd 9d 13 81 88 16 22 5a 95 90 87 d5 cc ca 00 f4 fe ce 06 79 85 c2 a8 ee 46 fc 1e fd 99 d3 01 da Data Ascii: 5T5QQoX/b O/ZrJF?"ZyFDD"<iZ)A=dA9RjV6 8hoswD}:kP:/!v=n8@/-F&taqhue(vt^` l131@!o$?
Nov 26, 2024 08:20:12.081954956 CET	1236	IN	Data Raw: ab f2 13 96 6e db d9 b7 c2 b3 48 05 8f db c8 50 01 b2 13 09 32 f5 7a 9e b1 9d 6a d4 bd 0d 95 1e c1 8d e2 f7 b6 17 57 1c a0 da f0 15 dd b6 a4 33 1d ac 70 46 6d c4 3a a0 33 10 f2 ce d3 4b 53 05 98 91 20 6b bd de 1a 3f b1 4f 9f 1b e4 8c de 9b ce 41 Data Ascii: nHP2zjW3pFm:3KS k?OAGUO]77.h"5uk!+{"1:b.~E-=W=J4M$v<`3!(ooEy+4JvgXA`z<Y0$:@v}:
Nov 26, 2024 08:20:12.081965923 CET	388	IN	Data Raw: 37 63 aa 89 ba ac 83 d4 60 b7 f1 dd d5 35 c4 db 3b cc 3c 5d 43 1c 22 e5 18 07 d0 aa f0 50 25 9a d2 36 a3 28 bc a1 cb 92 85 5b 36 01 c0 22 d1 af f5 1b e1 e3 ab fb 4b d5 27 7e 4d 9d e4 a9 a5 b4 e7 1d 8e 1c 6d a1 ef 09 a4 ef af 77 eb a3 18 15 01 b2 Data Ascii: 7c`5;<]C"P%6([6"K'~Mmw%{i=J4xETIDg>py\_%$@jauyyadD K_7N#G,R$CGykbOYvcG=yg,@xpE>
Nov 26, 2024 08:20:12.084487915 CET	1236	IN	Data Raw: f0 b1 37 3a b6 aa 49 8a 48 b1 57 a7 a7 59 be 98 18 7c d9 9b 8f 5e a5 16 ca a2 98 b4 02 45 13 10 97 66 23 fc 3d bc 00 56 9f ba 8f 62 ce 59 5e 81 cc 1f 69 d0 e1 09 38 ae 89 33 f0 b8 25 50 88 87 63 db 6d 5f 4b 12 77 18 08 28 a0 8c 40 25 ab 56 0b b9 Data Ascii: 7:IHWY\|^Ef#=VbY^i83%Pcm_Kw(@%VU@T-T_8mTHHg4ek;Ca1cC7@ilJ6m{c3 VLF7rI{DDr%{r0@9(\|F72q`~kr[
Nov 26, 2024 08:20:12.197366953 CET	1236	IN	Data Raw: 7f 2a 85 a1 63 ad 11 d7 14 2f f5 21 ed 97 07 ae 54 c2 da b6 cb dd 25 a6 19 af 71 15 e6 70 29 d5 10 eb fd 71 8f 75 cf 7a cd 89 8e 0d 8d 47 a6 9f 3a 52 59 2c 90 cb 01 00 c0 12 c4 ac ea 28 e6 f7 89 71 13 33 3b e6 18 5a 19 93 20 44 2a 92 4f 22 04 20 Data Ascii: c/!T%qp)quzG:RY,(q3;Z DO" ]V@\Fp`@VKc}}V4U=C^CCHXN-9*I}_@tiUEW4`gvn+D}Y!r&r(X#)V E#%b
Nov 26, 2024 08:20:35.495157003 CET	354	OUT	GET /tile/?qt=vtile&x=49623&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline3.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.903304100 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 17366 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:53 GMT ETag: W/"9bb51ff67f5b503f20ff20d7a1d80008" Cache-Control: max-age=2592000 Age: 860427 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0413094976 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:53 GMT Ohc-Cache-HIT: fra01-sys-jomo0.fra01.baidu.com [2], zhuzuncache58 [4], wzix76 [2] Ohc-File-Size: 17366 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 e4 eb f2 d3 d5 d8 f6 f7 fa ff ff ff eb ec f2 ec ec eb ce d2 d6 f5 f3 f0 b0 9c d9 ca cc d1 ef ee f4 e3 e3 e3 f9 f7 f4 eb 96 4b f1 81 1f ef 89 31 ec a9 6f f2 d4 a1 f4 ed ea ec a5 9d f9 d8 ac f2 e5 d5 f3 f1 ee da dd e2 dc e4 e8 a0 d0 dc db dc dd e5 e7 ea f0 d7 d1 fe e3 ac ff ec ba fe e7 b5 9e a0 a3 ee 5e 6d e5 17 34 73 73 73 ea f3 f5 e9 f6 fa ca a0 df a6 6b de a5 6f e6 93 55 dd e8 d6 f1 d5 c8 eb d1 b0 eb a8 9b 7a cf e9 f0 31 ad cd 61 b0 d1 af db ea 73 c7 dd 26 a3 c8 e7 7b 85 ca e9 d9 95 d4 b1 65 c9 90 b9 ee cf 65 a3 a4 65 7d b6 37 c9 d5 3f c0 7c 45 c5 7e 3e b3 82 31 b1 77 ff 2e 9e 1a 00 00 00 01 62 4b 47 44 03 11 0c 4c f2 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEK1o^m4ssskoUz1as&{eee}7?\|E~>1w.bKGDLpHYs~BfIDATx}cHFB1Nl7 _A:dL0xHKFP?8_>LkM\dxcjq.#b/-xd^>\\_WH.Ul$/<@URXFi5V$I1/'0X_ha9c)\\,onftd7XJ=Xd<9?.(M;W>'`cpELPpIO15=`9Y7%M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49872	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.841149092 CET	353	OUT	GET /tile/?qt=vtile&x=24812&y=5001&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline1.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.119359016 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: image/png Content-Length: 19511 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"a7104f1a54bfbf734bb911249e2dd77d" Cache-Control: max-age=2592000 Age: 1515657 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154485746 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo5.fra01.baidu.com [2], zhuzuncache53 [1], xiangyix129 [1] Ohc-File-Size: 19511 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 e4 eb f2 ff ff ff 8d ca b4 cb e5 dc db e5 e8 4f ac 8c ee f0 ee ba ea d5 6d b9 9f 32 ae 77 d5 d5 d9 ce d2 d8 d7 d8 da f6 f7 f8 d4 d4 d6 f5 f3 f0 d1 e6 f3 99 d4 ff db db dd f4 f1 ee f5 e8 d2 f7 d8 ac ff e3 ab ff ec ba e5 db d5 c9 c8 c8 c1 bf c0 f2 ee fb da dc e3 e6 e6 ea e8 d0 ac d4 b1 9c cc 90 6e bc 87 68 b2 d5 cc e3 e3 e4 b1 b1 b1 eb eb ec eb ed f2 ab d2 f0 3e a6 81 ba c3 d7 96 96 96 c7 cc d8 9d d1 f6 a8 b2 cb aa b3 cb 96 a9 d1 9e cf f3 75 8d c2 7b 93 c8 83 98 c8 6b 83 bc 88 95 b7 9b a6 c4 78 87 b0 b3 bb d1 8b 97 b9 cb d2 e2 95 a2 b9 66 7d b4 60 c9 91 3f c0 7c 46 c5 7e 79 95 8a 2d 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEOm2wnh>u{kxf}`?\|F~y-bKGD-pHYs~JIDATx}871A2f=9HCo&W*9#nn{'Z/N~;K+V~[>VRJz<>9I1=YO?o^w"wNH)%H;G$cSeP~(W!n3~ ^X/0+qD?+>^FW/2!xVQ
Nov 26, 2024 08:20:12.119395018 CET	1236	IN	Data Raw: 6f a2 fc 63 f9 3c 58 40 dc cb 9f 2f e2 96 01 10 f7 37 02 f6 1c 7f 13 f7 b7 bc 3c 06 40 2a 69 41 20 32 9b 3d 05 00 38 f8 e2 b6 c3 3e 3f a6 c9 0a 56 ae 8f c9 6f 4b 2f fe f8 69 e1 1f e0 5b 52 f8 94 7c b5 d6 c7 0d bf dc cb 35 00 41 18 7c 04 d2 ff 8d Data Ascii: oc<X@/7<@*iA 2=8>?VoK/i[R\|5A\|\|!qx'Jn$l8J-P$A9e-cC}[z9l{5\|L =xUz88.q!c,I\|a'1~M6~#"Iw@
Nov 26, 2024 08:20:12.119398117 CET	388	IN	Data Raw: 2f 50 6e de 11 8f 3e 80 74 3a 12 a4 d4 fc a5 49 21 19 80 89 1a 60 43 40 5e 30 04 9c 8b a4 a7 c9 d3 d3 ea 1a e5 ce 96 60 89 7a d1 00 90 0e 43 71 57 51 ae 97 97 73 6c 77 00 80 08 58 ba 4f 57 92 03 13 e0 ef 86 03 8c 1a f0 85 51 03 e7 0c 01 67 40 bb Data Ascii: /Pn>t:I!`C@^0`zCqWQslwXOWQg@EM}\SqaLyn#*&t5u@wFQvtOdy{'[aO,HX )!XaVEr\|Lwn/_FdL!
Nov 26, 2024 08:20:12.121540070 CET	1236	IN	Data Raw: 1c 0c 5a 7c fc f8 fb e3 e3 a7 73 fb 6e d5 0f 70 28 53 32 64 99 76 5a ef 7d 46 45 8c 9e 7f 69 bd 7d ff f2 0d 9d 91 8c 11 d8 e0 cf e0 9d 0e fd 07 92 bc 73 7c e1 ab c2 3c 04 77 98 3e 94 7f 16 97 92 c9 5d 49 89 fe e0 ea f5 09 ff 29 ee 72 03 ac 0d 2e Data Ascii: Z\|snp(S2dvZ}FEi}s\|<w>]I)r."1$2=J/Ny@7!xc9U)vB(OUl~S"Vtj@h}B<@-.m/{Qlfr@lWx
Nov 26, 2024 08:20:12.121557951 CET	1236	IN	Data Raw: 2c 27 2e 0a 82 a5 12 c9 e2 38 06 20 27 ee 27 b5 73 c6 10 4c 8b 02 98 3d f4 51 1b 4b 17 10 f8 e6 0d c9 96 32 f6 98 81 8b 2e 08 4a ae 9d dd 21 8e f3 44 09 0e 0b 1a 00 b4 15 ac 83 48 67 01 98 c9 aa e9 4e 67 6c d9 66 51 e0 0f f5 81 96 b0 d9 48 04 7c Data Ascii: ,'.8 ''sL=QK2.J!DHgNglfQH\|@./S,O\`wi3Sa"I^?=*Z0I/#yE0egt102ejT1<S%IlsQApa\|SY,R[BES!b 9~6
Nov 26, 2024 08:20:12.121570110 CET	388	IN	Data Raw: 71 23 b6 94 8b 8f 33 58 bb 3d fc a2 d3 9e 07 ca 3a b0 49 d2 6a 00 76 f5 10 00 ee ef 19 9b ac 56 00 90 ff 31 e8 38 93 19 69 41 c1 b3 64 98 23 41 83 35 2a 94 dd cc 48 e3 90 f7 be 0f 0b c6 5a 5c b0 3a b0 98 42 a5 ca c0 53 71 4c 66 5e 96 98 6c db b6 Data Ascii: q#3X=:IjvV18iAd#A5HZ\:BSqLf^lBz#jjv@nk[E{<-!v~,WOly9lgXB!;bE<$}9&1}t<e=NjvFbp:N0z:7+X0s\|)&$
Nov 26, 2024 08:20:12.123326063 CET	1236	IN	Data Raw: 19 ca 51 f2 87 f3 dc 4e b8 88 91 53 57 2b d8 5b 6f 20 d7 33 61 75 88 13 6c 23 c2 3f ac 75 b9 a4 ae 03 01 f1 42 d2 b0 b0 e3 2b 3d 03 c0 56 38 e5 4e ec 8f 3f 76 ed 09 f5 60 0f 80 c4 5d df ee f7 47 31 3c 02 64 61 1e ea 4d 8d 08 48 00 80 64 20 01 c0 Data Ascii: QNSW+[o 3aul#?uB+=V8N?v`]G1<daMHd ^,"[Sn&FX9u{hRGgsI:'Xt!v$=P@$4FX:AbBJ7uZqm5\0Ka4rQtDt&<HtG`AMh%W
Nov 26, 2024 08:20:12.123379946 CET	1236	IN	Data Raw: 4b ee 19 56 2a f7 b9 dc 0b ab 40 c0 f5 c3 82 af 22 3d 57 06 c0 87 10 df 9c 17 e1 34 dc 31 8a 9b a7 09 f3 3e 1f d7 54 85 61 14 ad 6a f0 9e bc 05 27 4b 22 53 ea be f3 0e 00 2d 04 be 0f 01 88 06 0a 98 03 c3 56 00 74 15 5c 41 55 12 f3 a4 88 ed 09 c0 Data Ascii: KV@"=W41>Taj'K"S-Vt\AU)7(@ sgAfRH0)IOL)+]bvsS Anbqd!R_'"n'aRRNKB5z:F#u"c/bcdtd(h
Nov 26, 2024 08:20:12.123394966 CET	388	IN	Data Raw: 76 17 1f 65 73 90 a2 de fd 68 f7 3d 00 71 07 00 3d 44 17 0c 20 e9 37 16 27 05 ba 62 ea ef 31 00 dd f0 a0 71 4c d3 b1 03 20 a5 57 e8 78 00 a9 8e 1c 3b fa 2f 2f af 07 c0 de 67 81 7a 90 ce 86 9c 24 4d b4 14 2c 4f b5 38 d4 ce 5e 50 2d 93 3e 02 e6 d8 Data Ascii: vesh=q=D 7'b1qL Wx;//gz$M,O8^P->}&(0Vwtho\|0-SLU}WA`=uS9y'1=tP+wXQ2j@,k1btiS8On`P=fdJ7TNb:
Nov 26, 2024 08:20:12.125929117 CET	1236	IN	Data Raw: b6 8e 52 d0 69 cb fd 41 aa 46 54 3b 36 5b 9a 23 d8 01 9d 80 1a ea bb d8 96 18 e4 6e 91 00 8d 9e 89 16 44 5c f2 b9 12 a0 24 d3 b2 83 33 3a f3 d6 10 9c 15 80 55 2e 16 6c 61 ac 17 e5 26 ea 89 1e d4 52 f0 b8 a7 fe b0 86 86 b6 14 ea 19 0c 41 61 09 4b Data Ascii: RiAFT;6[#nD\$3:U.la&RAaK kf6al`{x&,5S=rzaCThrK^5@rapG6lhHI,G.-'qD')"\B<yrA"c&%
Nov 26, 2024 08:20:12.239619970 CET	1236	IN	Data Raw: 39 fa 0d 00 f8 26 ca 52 ba 22 13 5b 00 e0 94 88 ec 74 70 0f 0e 03 80 0a e0 d0 e2 af 47 8c 33 ec 1b e0 08 06 e0 b8 2f ab fd 7e 5f 4a a0 9f 0d 81 ee d6 1d bd cc 18 b2 0e 80 88 8b a5 1c 2f 9a 45 ff e9 82 13 0b 00 34 36 21 b1 3a c3 e1 42 43 e7 99 79 Data Ascii: 9&R"[tpG3/~_J/E46!:BCydL@VXbjlD6;[v%P(Wk]!5bt:6Sbu.cW@7t0WEEgWUyH[`PLt@a6ANKr~~
Nov 26, 2024 08:20:34.746068954 CET	354	OUT	GET /tile/?qt=vtile&x=49625&y=10004&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline1.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.158418894 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:34 GMT Content-Type: image/png Content-Length: 16612 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:53 GMT ETag: W/"567c169cce069f41679d8b5305867936" Cache-Control: max-age=2592000 Age: 866705 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0413146743 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:53 GMT Ohc-Cache-HIT: fra01-sys-jomo4.fra01.baidu.com [2], zhuzuncache61 [4], bdix61 [2] Ohc-File-Size: 16612 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 fe fe ff f5 f3 f0 e3 e3 e3 ec eb eb f4 e9 d6 ff e3 ad ff ec ba fb e9 c7 d7 d8 da fd da a5 fe e7 b5 e6 e7 e9 f6 f2 fe e4 eb f2 a7 d6 f3 ec eb f4 cc cf d4 db e3 e9 f4 f1 ed f9 f6 f4 db dd e2 f5 d9 b5 d1 ca b7 fc d7 9d ae b0 b4 f3 ee ea c6 c7 c9 92 93 94 92 9c ad f9 f6 fb f1 ee f6 b0 91 da c4 98 e5 9b 62 e2 a6 70 e7 cf e7 d8 b2 df ca a4 d9 bc 93 d5 af 8a d2 9f 69 c8 8f 53 c0 7f ec e5 b9 af d6 af d5 d5 a6 93 55 dd e5 d6 f0 d1 b0 ea d7 c8 eb b3 b8 c7 b8 cb cc a8 99 77 ce bb a5 74 86 ae e5 dd d2 6b 7b 9f 65 67 6c c6 b6 da b1 76 da ec 9c 56 f0 8a 32 78 90 c5 3d 40 43 24 27 2a 50 98 5e bc 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 3f 81 49 44 41 [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEbpiSUwtk{eglvV2x=@C$'P^pHYs~?IDATx}c8ls^ccC_6Ls!m7-q]MhE#B,v>c0Uc8-?R=oS1Dyt81?6'/0$A/-k~p\j7C\(26c%#}a&l~1IJ??NG!4 ,_[@MMK,?shg:AuIk22*mO@:udkNcU6%K5`,8hZ@qip`3Uue&t8n~hA
Nov 26, 2024 08:20:35.371767044 CET	354	OUT	GET /tile/?qt=vtile&x=49626&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline1.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.784240961 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 16186 Connection: keep-alive Expires: Sun, 08 Dec 2024 20:12:00 GMT ETag: W/"2136763c7036f6653fa4fd2567763d97" Cache-Control: max-age=2592000 Age: 1479611 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0720227432 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 20:12:00 GMT Ohc-Cache-HIT: fra01-sys-jomo2.fra01.baidu.com [2], zhuzuncache62 [1], csix70 [2] Ohc-File-Size: 16186 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f6 f2 fe e1 df e5 f9 f7 f4 c7 cb d8 66 7d b5 6b 83 bb 75 8d c2 dc dc e3 e4 e4 eb f4 f3 f4 ff ff ff f9 f6 fb d5 d4 db ed eb f3 e3 e2 e4 d9 d8 dc f3 f1 ee f3 ed eb ff e3 ac ff ec ba fa d8 ac 78 88 b0 9a a7 c9 f2 ed f9 e8 e7 ea e7 e9 f3 ec ec ec ff e7 b4 ad b5 cd f4 e4 d4 82 98 c8 7b 93 c8 f0 d9 d0 fc d5 9d ba c6 e1 d6 da e6 ef f1 f5 8a 96 b8 de e1 ea bb c3 d6 d1 cb e8 cb cb d3 a8 ae b7 e7 9f 5f df a8 a3 f2 94 16 ba 8c e5 c3 98 e5 9d 64 e3 a5 6f e7 e6 d4 f3 d0 ae ea b1 76 da 99 5e e0 c6 b5 d2 b9 86 dd 95 9b b0 93 55 dd e6 60 6d e8 1d 1f 64 61 62 ef 04 01 ef 51 18 e5 7c 86 f4 ae 78 d7 00 00 00 01 62 4b 47 44 0a 68 d0 f4 56 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEf}kux{_dov^U`mdabQ\|xbKGDhVpHYs~=IDATx]c6nHv7HfWo>$%JdI\|Ix Zi3O0~gga6\Tv~ZA/FZzmyn}';{;W8z?,z5IY.il!<i-\;$[X;(~B~\|qhWyhltS_]X"@s:'kZpFq=5i36770FGv9D Tr(28oSq\S)Avpa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49871	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:10.841217041 CET	353	OUT	GET /tile/?qt=vtile&x=24811&y=5002&z=17&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline1.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.080672026 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: image/png Content-Length: 17665 Connection: keep-alive Expires: Sun, 08 Dec 2024 18:19:14 GMT ETag: W/"f89481432950126aa3a91bdb90a68cc8" Cache-Control: max-age=2592000 Age: 1470234 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 1154328643 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 18:19:14 GMT Ohc-Cache-HIT: fra01-sys-jomo4.fra01.baidu.com [2], zhuzuncache55 [4], xaix210 [1] Ohc-File-Size: 17665 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 d3 d3 d6 ff ff ff f3 f1 ee f5 f3 f0 d8 d7 d8 db de e2 f7 f7 f8 d5 d8 dd da db dd e3 e3 e4 cc ce d3 c6 ca d3 e4 eb f2 8e 97 b1 99 a7 c4 dd e3 ea ec ee f1 e6 e8 ea d4 d5 da 91 d0 e5 68 cb df ca da e1 eb eb ec ce d1 d6 d9 e3 e7 d5 ec f3 e4 e6 eb ae db ea d5 db e2 f4 ec ea ce d3 d9 c8 c9 cd e1 f4 f9 cb d9 db e0 a2 9e cd 89 77 b3 ba c8 c8 5b 39 de 60 5a ee d3 d3 a7 ad b6 f8 f1 ef ea c0 c0 e1 e4 dc ea f2 f4 36 c9 d5 b2 de d6 2d b3 ce 4e b0 d1 6a bd d9 25 a5 c9 e1 22 3a ec 6a 77 65 64 69 e8 7a 85 f1 ef f8 93 d5 af 63 c8 8d 5b a1 95 e7 e4 f0 34 b5 78 3e bc 82 3f c0 7c 45 c5 7e 4e 0c f8 d5 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEhw[9`Z6-Nj%":jwedizc[4x>?\|E~NbKGD-pHYs~CIDATx}cYlH6IO;{Hdt-I43!88,gQw_7Qp6oZJ5/?\|euA"O<9$PmMA_NA\|#7.QTE@_5C21o1<JGh#Y}(p20\|IkDX>.\| * 2f0e2z,@JOP8jHY(D(<+'h&
Nov 26, 2024 08:20:12.080682993 CET	1236	IN	Data Raw: d9 fc 44 06 98 6f e1 13 b6 ce df 96 09 46 1c b0 03 44 27 39 60 96 8b 86 ac 62 73 f9 6b 00 28 94 3a c6 6e 64 83 04 ff d8 06 09 53 a7 31 00 69 8a 6d d7 2d 16 ab d5 2a 49 36 9b ec e3 87 0f 1f b7 db ad 80 e9 84 9b 50 2a cb b2 3c 17 51 5d e2 77 25 13 Data Ascii: DoFD'9`bsk(:ndS1im-I6P<Q]w%)(a5(KBzEQuTQ&!bQg'_~o`Gpbr<>\|@[\|#H{APuEEYT# 5TMSI_T+PR$HFAuUy
Nov 26, 2024 08:20:12.080693960 CET	388	IN	Data Raw: de ee 1f 6f f6 37 0c 40 9d f6 22 f0 20 0b 20 ed 0e 69 7d 00 66 b8 79 bc b9 83 3f 1e f7 84 d1 23 30 04 90 7e f9 70 73 79 93 e2 13 c0 14 06 00 05 a4 17 8d cf 8f 69 55 64 63 e7 90 a8 6b 8e 88 c0 4c d3 2f 77 ef 4f 0c a0 5f 57 a0 0b 3d ed 3f 11 00 12 Data Ascii: o7@" i}fy?#0~psyiUdckL/wO_W=?9}B@rK7nX@5 ) w7:LP37@V%eHX^&=ct1j@nLO#Ew4.QG79`:5w2/O>\|
Nov 26, 2024 08:20:12.083309889 CET	1236	IN	Data Raw: f0 84 7e 7f c4 f9 ff 7d 8f 7c 71 c3 00 00 18 73 89 e6 ee 31 bd 95 77 28 02 e0 30 00 67 dc de a1 52 78 94 0f a0 20 1e 6e 10 80 07 b0 10 69 0a fe 00 6a c0 22 94 57 ef 69 2e ea a4 c0 10 8c e6 94 a3 00 c4 64 3c 8b 82 f3 c3 6f 45 04 c7 00 54 6c 01 9a Data Ascii: ~}\|qs1w(0gRx nij"Wi.d<oETlM$X,oqsm0KPw `x$Jy4{sWVv4JfQ85*\nA\{.I`A`wd$#^!t6Q!%.M\|
Nov 26, 2024 08:20:12.083352089 CET	1236	IN	Data Raw: 2e 39 02 96 06 5c a3 cc a3 1a d7 44 71 5e 1c 09 93 86 be 98 d6 57 a5 d1 fa 29 68 c0 f0 9c cc 83 32 70 f5 c6 18 4d f2 f4 a2 d9 fb 3a 62 76 41 6a 80 1d 96 b0 e3 8e 21 31 41 2c 5e bf 1d 1d 9e 42 20 ef 95 5e 95 09 c7 7a 61 dd 86 e7 e1 57 be 0c bc 45 Data Ascii: .9\Dq^W)h2pM:bvAj!1A,^B ^zaWE+1URu\V#_T;HZfkQ;s(\|xz/'Ev6Ie>Q^U<QdE2n$Z"y/QoiHwgfb>dfFMo)
Nov 26, 2024 08:20:12.083363056 CET	388	IN	Data Raw: f2 b7 d4 8e 95 de a0 f3 04 4a 6a 74 d2 a6 46 ed 0d b2 b0 a7 85 4d 24 b9 0b 18 e6 92 a3 6a f0 f9 19 11 58 ca 0f 7f 00 18 7f 30 00 4f 80 c7 eb f2 ea 65 b9 96 17 af 9f 5f 2e 34 00 3c f1 2c 1f f0 fc eb 95 e1 80 d7 77 ec 04 1c 2b 3d ff 19 25 47 e5 1c Data Ascii: JjtFM$jX0Oe_.4<,w+=%GX$j`$btKZ^]\\<2C=p3N`:!zzkwbh.,@%PCp%?k^]9" 2r{AJY<zr3^(Y
Nov 26, 2024 08:20:12.086307049 CET	1236	IN	Data Raw: 03 22 2f 5e 5f 81 5e d0 f4 cb a7 8f 01 00 52 17 80 e5 7b b6 43 8f d5 60 df 0e a3 f2 6e fe ad b1 08 c6 ed bb b3 d4 d1 a3 2c 03 b4 10 a8 6b d2 37 60 85 06 9e 10 0f ed 07 11 03 ac 41 0f ae 5f 9f 40 04 d6 c0 e7 72 79 e1 02 f0 f2 bc b4 7e 80 16 81 8f Data Ascii: "/^_^R{C`n,k7`A_@ry~`SlV=T^`U/mq{<v)$\|fQ>i9\|Z j0K+Waq$Gh!?%]?kC<*yH1p(@nf` WAx~dEstt-).#
Nov 26, 2024 08:20:12.086318970 CET	1236	IN	Data Raw: 7b 98 6a 9d 81 e1 92 81 72 a8 75 96 8c 59 a0 7d 1f 0b 50 a7 b8 36 9c b1 16 6f 6a 00 de 7a 3d 22 db a1 b6 e6 1a ba 81 04 30 9f 6b 53 3f 6c 6e 54 50 71 02 35 bc 51 56 3a fb 3b 0c 58 42 a3 06 79 6d b8 60 ce 16 eb 93 00 58 29 75 3d 95 b3 11 6f 6a c0 Data Ascii: {jruY}P6ojz="0kS?lnTPq5QV:;XBym`X)u=ojG5kRn7,{!o;~A}eN8g#'\'IT82Ql=73#S5?.C97I@:j00A:}LcVTmdA&],
Nov 26, 2024 08:20:12.086330891 CET	388	IN	Data Raw: cd 7d 44 00 90 4e 39 48 5d e0 c1 92 21 d8 1d 36 78 14 19 d5 5e 6c ba f0 76 d1 c4 54 0b 19 2d 40 49 34 f6 39 28 22 f4 2b 00 70 77 02 c9 dd 96 45 40 1f e3 c0 0c 7e 5f 14 f7 86 d5 19 00 7a ef e1 7e 87 c4 52 c7 54 64 00 94 00 56 82 f7 5b 02 00 4c 22 Data Ascii: }DN9H]!6x^lvT-@I49("+pwE@~_z~RTdV[L"Kh<>6Hp[+pD6;;<4,@z@]U5"#p8@Tu_ofIl'D`q8gB^np:D
Nov 26, 2024 08:20:12.088713884 CET	1236	IN	Data Raw: 60 09 96 f4 fd 44 4d 21 4d 9a e8 9c cb 38 36 bf 50 a5 12 e8 57 12 00 e1 fe d3 ef 1c 0d 4b c0 99 0b 80 3e 29 e6 ec be ae 56 87 1d f7 8f 04 00 ea fb c3 e1 80 d3 9a ed 92 fb fb dd b6 90 05 f0 03 2d 8d b3 0e 39 83 52 b9 11 be cb 0c cd 03 5c 34 5b 30 Data Ascii: `DM!M86PWK>)V-9R\4[0'E^V;:qgm2"6NaiOwmE_v"zHvv({bOBG Q`4z5uhwr=)P_*;F"//c-x1Ki-
Nov 26, 2024 08:20:12.200620890 CET	1236	IN	Data Raw: 9e bd 37 a6 7e 53 92 a3 da 7c 44 00 a8 65 e1 60 c5 b8 b1 29 3c a3 ce 3d 6f b0 a6 c9 ab 6b 19 b7 dc a0 b5 2a b7 67 f6 e2 72 52 0b 2c 4c 2b e3 ae cc 44 cc 30 fe 1c 00 ee 6e 87 bc ed f7 e4 8d 58 c0 1e b5 d1 93 bf da da c4 5e b1 22 19 08 c4 0c 68 b5 Data Ascii: 7~S\|De`)<=ok*grR,L+D0nX^"hz2+y.Z.,wdf_9q12Ov;PK}OC=wV\|dwSYU5X]g0F#zz@oZkn+BI6jIvgkg9\d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49878	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:11.305862904 CET	390	OUT	GET /images/mapctrls1d3.gif HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:12.871253014 CET	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 899 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:12 GMT Etag: "6731c1ec-383" Expires: Wed, 27 Nov 2024 07:20:12 GMT Http_x_bd_logid: 1212591350 Http_x_bd_logid64: 1212591942374229258 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:56 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=71430D4893A2A937360B4A2EC0E11013:FG=1; expires=Wed, 26-Nov-25 07:20:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 35 00 4a 00 d5 1d 00 ce ce ce 7e 7e 7e 5c 8a e5 f5 f6 fa 88 a9 eb f4 f4 f4 be cf f2 cb cb cb c5 d4 f3 c6 c6 c6 f1 f1 f1 f8 f9 fa fe fe fe fe fd fd 9e 9e a0 9a 9a 9a 9d 9d 9d c2 c2 c2 90 90 90 a0 a0 a0 76 9c e8 f6 f6 f6 ca ca ca fd fd fd d8 0b 0b f7 f7 f7 b3 b3 b3 fa fa fa ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 1d 00 2c 00 00 00 00 35 00 4a 00 00 06 ff 40 8c 70 48 24 76 8e c8 a4 72 c9 6c 22 8b d0 a1 73 4a 75 4a 99 d7 aa b6 2a ec 60 96 df ee 76 6c fd 7a 93 66 31 79 8d 36 9f df 5e 37 9b ad c6 ca e7 e4 3a f8 8e df aa d3 4f 7c 7d 5c 80 4f 47 7a 83 84 70 86 88 89 53 59 4a 90 8e 54 51 51 93 7e 95 45 97 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad 6c 1a b0 b1 b2 b3 b4 b5 b6 b7 b7 [TRUNCATED] Data Ascii: GIF89a5J~~~\v!,5J@pH$vrl"sJuJ`vlzf1y6^7:O\|}\OGzpSYJTQQ~Eltpnu+-CLD@@j(:!Z]}t@Hu"S`5o&Fx$<j{H7.`[7FrY)X0m0?*N+FWaRkLJ`Y",(4B
Nov 26, 2024 08:20:12.872030020 CET	277	IN	Data Raw: 59 1e ca 7d b0 41 12 a0 2d b9 6b d6 7c 01 20 e8 ac c7 7b d8 b3 9f c0 f1 ae 63 77 ee b1 ae a4 1d 6f f3 63 de 5c 57 da 00 11 9c 06 57 c8 f5 ad 71 91 06 49 57 dc e7 00 ad 65 aa 4c 1f 8c 27 8f 70 01 05 a5 9a d7 ef 93 da 7d 43 05 09 55 31 15 dc 64 5b Data Ascii: Y}A-k\| {cwoc\WWqIWeL'p}CU1d[asgh36Q&Nosa6f8bfh+j (#^B(h"#^7#9#+(b,yAOBX$H0"(%0`O:%dMa&2&Ui2&^i$@NrN6)"b8c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49883	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:12.341100931 CET	492	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605608165&callback=BMap.logCbk6093782709&sign=563b1c95e849 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:13.874746084 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:13 GMT Expires: Wed, 27 Nov 2024 07:20:13 GMT Http_x_bd_logid: 1213602037 Http_x_bd_logid64: 1213602100206299402 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12136020370198846218112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 30 39 33 37 38 32 37 30 39 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 30 39 33 37 38 32 37 30 39 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk6093782709 && BMap.logCbk6093782709({"result":{"error":0}})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49884	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:12.403045893 CET	494	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605609176&callback=BMap.logCbk5542380316&sign=498e4551a420 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:13.981132984 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:13 GMT Expires: Wed, 27 Nov 2024 07:20:13 GMT Http_x_bd_logid: 1213708600 Http_x_bd_logid64: 1213708611262829834 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12137086003504027658112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 35 35 34 32 33 38 30 33 31 36 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 35 35 34 32 33 38 30 33 31 36 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk5542380316 && BMap.logCbk5542380316({"result":{"error":0}})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49885	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:12.554470062 CET	347	OUT	GET /images/mapctrls2d0.png HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:14.085458040 CET	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 11596 Content-Type: image/png Date: Tue, 26 Nov 2024 07:20:13 GMT Etag: "67403b95-2d4c" Expires: Wed, 27 Nov 2024 07:20:13 GMT Http_x_bd_logid: 1213816520 Http_x_bd_logid64: 1213816951262560266 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Fri, 22 Nov 2024 08:06:45 GMT Server: apache Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2c 00 00 01 d0 08 06 00 00 00 da a3 88 d7 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 66 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDR,tEXtSoftwareAdobe ImageReadyqe<fiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0180117407206811B71BEFA893479FCC" xmpMM:DocumentID="xmp.did:5F55D253175711E1AE49E7AD72699815" xmpMM:InstanceID="xmp.iid:5F55D252175711E1AE49E7AD72699815" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0780117407206811B71BEF
Nov 26, 2024 08:20:14.085495949 CET	1236	IN	Data Raw: 41 38 39 33 34 37 39 46 43 43 22 20 73 74 52 65 66 3a 64 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 37 31 42 45 46 41 38 39 33 34 37 39 46 43 43 22 2f 3e 20 3c 2f 72 64 66 3a 44 65 Data Ascii: A893479FCC" stRef:documentID="xmp.did:0180117407206811B71BEFA893479FCC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>WG)\|IDATx]\|TUf&eH/^B"Hqu\|km]q(@CO!i;{WgoM
Nov 26, 2024 08:20:14.085510015 CET	1236	IN	Data Raw: 08 e6 01 8b ed 91 e9 3d 48 9f 6e e1 ba 77 ac 1e 89 56 32 7f 66 2a f3 19 5e d0 0d 0e ef e3 98 c6 02 b6 ee 62 80 a3 31 94 70 2e b1 f4 1f c5 24 af d8 03 76 e2 b0 18 72 6d 76 bc 26 eb 51 6a 87 36 c1 fb 23 e8 3f ad 3c 0d fd c8 83 03 53 59 c0 d6 45 08 Data Ascii: =HnwV2f*^b1p.$vrmv&Qj6#?<SYE9+/'6M\s+jd+$C=y446[f%;zKFc&I"MMM~6Z+;3v E{l!0Z
Nov 26, 2024 08:20:14.085551023 CET	1236	IN	Data Raw: f7 10 1e b2 11 27 d0 0f 93 6d 93 fe b0 57 f6 f5 d9 d1 ff 19 68 a1 e8 eb e0 8d 32 01 49 2c 65 22 38 8e c7 b0 56 af a1 89 a9 18 b2 71 46 6b 76 ba 21 d3 6c b8 fa 98 1c e8 6d 6f 65 e9 af 35 8f 8e 58 9f 18 11 66 9a 63 a6 a8 59 b1 71 b1 83 d2 7a a7 91 Data Ascii: 'mWh2I,e"8VqFkv!lmoe5XfcYqzn)G#~Dk[+#>}ON{+7EE')C$4swMo1=s~mZ+fic71*m-mVv;y(l&D@3fLDs
Nov 26, 2024 08:20:14.085563898 CET	1236	IN	Data Raw: bb 8e 36 32 cb 0e 30 ac 62 d6 e6 01 1b ae 0a ec c6 8d 1b 03 d3 9a 73 73 73 77 00 a7 52 ad 35 f7 43 4b c7 7b 40 6b 01 ab 9b d6 0c 40 19 ad 19 27 36 d4 6a cd 08 ba 7b 42 18 99 3e 31 9e f4 eb 11 a1 aa 83 81 55 31 2a ac 7a ed b5 d7 f4 d1 9a 21 36 b7 Data Ascii: 620bssswR5CK{@k@'6j{B>1U1*z!6rZs:X5!hU(ZJlRP@r$G-r?pUWW3v!kSRRRm6Tk^~5Z3h:^k`f1!=dfh;s_5O?7;"
Nov 26, 2024 08:20:14.085583925 CET	1236	IN	Data Raw: d3 41 d1 9a 11 88 67 71 92 ef 63 87 4e 35 91 75 bb 6a bc 60 c7 0c 8c 12 11 17 ab d1 ca 85 e0 23 c1 d3 9a a5 40 67 a4 46 32 7a b3 14 58 6c 38 03 da d6 86 5a b3 29 b8 5a 33 ba 07 ae 59 c3 98 ec 64 13 79 4c 39 17 dd 9e 2a fb 9e 67 cf 9c 21 e5 65 e7 Data Ascii: AgqcN5uj`#@gF2zXl8Z)Z3YdyL9g!e8A=T/%gb=Z3Z,a'9{ShJ=?o9if\|E..."[lWWtq0Kyl>NknZ3
Nov 26, 2024 08:20:14.085596085 CET	1236	IN	Data Raw: 6a e6 87 7d 94 9f 63 47 0e 14 15 9e 2a 5a 1b 11 11 61 c9 cf cb 1f c8 ec a1 6d b3 31 53 a5 5a 5a 4d 6d 2d 39 78 f0 00 f9 fe bb 75 2d f9 f9 c7 3e fd f2 f3 d5 8f ee dc b6 31 57 a8 35 0b c1 72 80 fd aa 6b ee 37 70 68 d2 15 bf be 66 66 5c 7c fc 14 88 Data Ascii: j}cG*Zam1SZZMm-9xu->1W5rk7phff\\|9IrR2ILJSC&EdD3g}%55mIebZXNEdZ'^ve~^dqhxx81Y}8W8'oKiR`U^\|e[Y4Ot0mucngv3Y2
Nov 26, 2024 08:20:14.085691929 CET	1236	IN	Data Raw: 9b 36 6d 8a 82 70 b3 be a4 a4 64 1c e4 a0 9a 0a 35 20 16 bb 7a f5 ea b5 bb b6 b6 76 f2 03 0f 3c 50 cf 59 d0 f3 f3 6f 26 eb 8b 2f be d8 36 67 ce 1c 13 44 11 e6 3e 0c 6f 9f 7c f2 89 6b de bc 79 18 49 30 75 6c c2 e7 a4 4e 58 68 6a 66 a7 45 6c 10 83 Data Ascii: 6mpd5 zv<PYo&/6gD>o\|kyI0ulNXhjfEls^u;g,]O7}tF`3C!x8h%(Ok{^SIr# ESvx-2nauFkC-BFg?Y08`b]$c
Nov 26, 2024 08:20:14.085704088 CET	1236	IN	Data Raw: 5a a1 4d 42 2b b4 43 2b b4 2f 00 5e ba 74 29 e6 f7 4f c1 71 17 1c 3d 35 be fe 2c 1c ff a8 ae ae 7e ee 8d 37 de 10 f5 40 23 ea 38 9e 99 35 6b d6 42 dc 6d d9 24 b3 b3 1b 97 2f f0 9f 03 f7 f5 2c 2c 2c 5c f4 ce 3b ef d8 e0 fe 79 62 73 12 7a d7 71 e0 Data Ascii: ZMB+C+/^t)Oq=5,~7@#85kBm$/,,,\;ybszq}/Nqn*VxZ:rn+2h5gqx=fh,?ff5&R$/P\|Sqhp!]%kW`;S]C\| 4]nO:=pk.g=ccc[_?
Nov 26, 2024 08:20:14.085716009 CET	896	IN	Data Raw: f0 47 4f 74 f5 79 e0 e3 05 84 ba 63 59 b9 73 ca 84 64 43 49 a8 6e 3e fc bb 97 cb 9d 93 c7 27 07 8d 84 06 34 91 72 f7 2b 95 f4 f5 97 26 8b 92 50 29 42 1a 28 09 f5 db c2 77 bf 5a 49 5f 3d 36 c9 87 84 f2 49 26 bf 3d 76 83 ef 7d 7e 90 50 93 48 94 50 Data Ascii: GOtycYsdCIn>'4r+&P)B(wZI_=6I&=v}~PHPn^$JBH&t$TWWd%IPjQM_RF&(PN>3iCNg%Iqq\|8?t%q>s(QR\|Dzi$`AOk#r$Th
Nov 26, 2024 08:20:21.222409964 CET	436	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=80032489&code=5054&da_src=5054&pic=6 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:21.766169071 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:21 GMT Etag: "6731c229-31" Expires: Wed, 27 Nov 2024 07:20:21 GMT Http_x_bd_logid: 1221496224 Http_x_bd_logid64: 1221496851464025354 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:57 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:21.780281067 CET	517	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=89714645&code=5030&da_src=5030&load_script_time=1071&load_tiles_time=3350&map_width=320&map_height=240&map_size=76800 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:22.328325987 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:22 GMT Etag: "6731c1ec-31" Expires: Wed, 27 Nov 2024 07:20:22 GMT Http_x_bd_logid: 1222055229 Http_x_bd_logid64: 1222055070373367818 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:56 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:34.568954945 CET	700	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk15045&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632356&sign=4ea4a809dda8 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:35.127747059 CET	489	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:34 GMT Expires: Wed, 27 Nov 2024 07:20:34 GMT Http_x_bd_logid: 1234844302 Http_x_bd_logid64: 1234844222400625674 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12348443020198846218112615 Content-Length: 93 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 31 35 30 34 35 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 31 35 30 34 35 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk15045 && BMap._rd._cbk15045({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:20:35.773324013 CET	466	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=50602536&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:36.318173885 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:36 GMT Etag: "6731c1a0-31" Expires: Wed, 27 Nov 2024 07:20:36 GMT Http_x_bd_logid: 1236047131 Http_x_bd_logid64: 1236047132567624458 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:34:40 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:36.319406033 CET	786	OUT	GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk66656&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632887&sign=378b64229bc9 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:36.884181023 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:36 GMT Expires: Wed, 27 Nov 2024 07:20:36 GMT Http_x_bd_logid: 1236592925 Http_x_bd_logid64: 1236592122961431818 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12365929252739232266112615 Transfer-Encoding: chunked Data Raw: 35 31 30 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 36 36 36 35 36 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 36 36 36 35 36 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 510/**/BMap._rd._cbk66656 && BMap._rd._cbk66656({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"
Nov 26, 2024 08:20:36.884205103 CET	471	IN	Data Raw: 22 2c 22 74 69 6d 65 22 3a 30 2c 22 74 79 70 65 22 3a 34 2c 22 71 74 22 3a 22 63 65 6e 22 2c 22 62 22 3a 22 31 32 37 30 33 38 37 33 2e 31 2c 32 35 36 30 39 36 30 2e 30 37 3b 31 32 37 30 34 31 39 33 2e 30 34 2c 32 35 36 31 31 39 39 2e 39 39 22 2c Data Ascii: ","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk66656","timeStamp":"1732605632887","sign":"378b64229bc9"},"uii_err":0,"a
Nov 26, 2024 08:20:37.078551054 CET	495	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605635316&callback=BMap.logCbk7744760272&sign=e17821be048f HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:37.652010918 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:37 GMT Expires: Wed, 27 Nov 2024 07:20:37 GMT Http_x_bd_logid: 1237355626 Http_x_bd_logid64: 1237355152412717066 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12373556262745120778112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 37 34 34 37 36 30 32 37 32 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 37 34 34 37 36 30 32 37 32 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7744760272 && BMap.logCbk7744760272({"result":{"error":0}})
Nov 26, 2024 08:20:46.664977074 CET	711	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk27910&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605644934&sign=97db8b984019 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:47.217317104 CET	518	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:46 GMT Expires: Wed, 27 Nov 2024 07:20:46 GMT Http_x_bd_logid: 1246941268 Http_x_bd_logid64: 1246941962621653258 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12469412682543624970112615 Content-Length: 121 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 32 37 39 31 30 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 32 37 39 31 30 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk27910 && BMap._rd._cbk27910({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})
Nov 26, 2024 08:20:47.406774998 CET	788	OUT	GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk94280&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605645452&sign=b5626638a8cf HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:47.976035118 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:47 GMT Expires: Wed, 27 Nov 2024 07:20:47 GMT Http_x_bd_logid: 1247681565 Http_x_bd_logid64: 1247681023416209418 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12476815652978101258112615 Transfer-Encoding: chunked Data Raw: 35 31 31 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 39 34 32 38 30 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 39 34 32 38 30 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 511/**/BMap._rd._cbk94280 && BMap._rd._cbk94280({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"
Nov 26, 2024 08:20:56.310863972 CET	711	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk82991&seckey=QjkmsigYB6FtJVS1%2B1zLo5Cn9S0I2rb%2FJ1brfUmjqgY%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605654036&sign=c74c2ea44a50 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:56.858958006 CET	518	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:56 GMT Expires: Wed, 27 Nov 2024 07:20:56 GMT Http_x_bd_logid: 1256586375 Http_x_bd_logid64: 1256586162940420362 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12565863750198846218112615 Content-Length: 121 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 32 39 39 31 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 32 39 39 31 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk82991 && BMap._rd._cbk82991({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49905	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:18.657080889 CET	770	OUT	GET /js/report?b_pi=03675761c4b29133&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=0&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2F&u_ru=&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=03675761c4b29133&b_ct=1732605617389&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1090& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:20.139746904 CET	512	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:19 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Set-Cookie: _faiHeDistictId=64d9d5eba4cbe61c; HttpOnly; Max-Age=31536000 Set-Cookie: _faiHeSessionId=64d9d5eba4cbcf97; HttpOnly; Max-Age=3600 Set-Cookie: _faiHeSesPvStep=1; HttpOnly; Max-Age=3600 Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:22.874977112 CET	1077	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRjGJVq3f6rMMpTWX315VlopR3vtD464rn7TLBYe9_6F0%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:23.501223087 CET	313	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:23 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:35.766767025 CET	1079	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRE6YZsKXUOQfX5KBkpg1DRH%2FbaDnpvEYAWQ_yDjRaaEE%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:36.363656998 CET	313	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:36 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:38.172557116 CET	1439	OUT	GET /js/report?b_pi=036757da3bf4da65&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=0&pe_tt=0&pe_rt=1627&pe_rpt=1049&pe_dpt=5099&pe_wst=5005&pe_fst=10104&pe_drt=5078&pe_ft=10120&pe_hreqt=1032&pe_hrest=596&pe_fet=8476&pe_jst=3390&pe_csst=1047&pe_imgt=2737&pe_ajaxt=1170&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605632363&pe_css_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fjzcusstyle.jsp%3Fid%3D-1%26colId%3D2%26extId%3D0%26_csw%3D0%26clientSupportWebp%3Dtrue&pe_img_url=http%3A%2F%2Fstatic.tieba.baidu.com%2Ftb%2Fpms%2Fimg%2Fst.gif%3Fts%3D4%26t%3Dpageview%26sid%3Dm3y4npye3nz%26ver%3D5%26pid%3D241%26px%3D12801024%26ref%3Dhttp%253A%252F%252Fwww.wheel-done.com%252F%26page%3D18_1%26p%3D18%26dv%3D6%26cmd%3Dopen&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fajax%2Flogin_h.jsp%3Fcmd%3DwafNotCk_checkMemberSameTimeLogin&b_ct=173 [TRUNCATED] Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:38.778104067 CET	457	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:38 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Set-Cookie: _faiHeDistictId=64d9d5fdd28b516f; HttpOnly; Max-Age=31536000 Set-Cookie: _faiHeSessionId=64d9d5fdd28b5aaa; HttpOnly; Max-Age=3600 Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:50.508507013 CET	853	OUT	GET /js/report?b_pi=0367580668186ff6&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=0367580668186ff6&b_ct=1732605648771&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1066& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:51.122045040 CET	512	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Set-Cookie: _faiHeDistictId=64d9d609e18b7879; HttpOnly; Max-Age=31536000 Set-Cookie: _faiHeSessionId=64d9d609e18b516b; HttpOnly; Max-Age=3600 Set-Cookie: _faiHeSesPvStep=1; HttpOnly; Max-Age=3600 Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:56.989011049 CET	1077	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTR7eSdvEOrzLa_UeZDolLKyig95q67kRmINT6HiImvcvk%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:57.591181993 CET	313	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:57 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)
Nov 26, 2024 08:20:59.935812950 CET	1414	OUT	GET /js/report?b_pi=0367582d98b4c0db&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&pe_dt=0&pe_tt=0&pe_rt=1400&pe_rpt=1147&pe_dpt=5599&pe_wst=2936&pe_fst=8534&pe_drt=3006&pe_ft=8545&pe_hreqt=1132&pe_hrest=269&pe_fet=7130&pe_jst=2730&pe_csst=1146&pe_imgt=1388&pe_ajaxt=1621&pe_js_url=https%3A%2F%2Fdlswbr.baidu.com%2Fheicha%2Fmw%2Fabclite-2063-s.js%3F_t%3D1732605654028&pe_css_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fjzcusstyle.jsp%3Fid%3D-1%26colId%3D2%26extId%3D0%26_csw%3D0%26clientSupportWebp%3Dtrue&pe_img_url=http%3A%2F%2Fapi.map.baidu.com%2Fimages%2Fblank.gif%3Fproduct%3Djsapi%26sub_product%3Djsapi%26v%3D2.0%26sub_product_v%3D2.0%26t%3D36261355%26code%3D5000%26da_src%3D5000%26device_pixel_ratio%3D1%26platform%3DWin32&pe_ajax_url=http%3A%2F%2Fwww.wheel-done.com%2Fen%2Fajax%2Flogin_h.jsp%3Fcmd%3DwafNotCk_checkMemberSameTimeLogin&b_ct=1732605658016&b_rt=1&b_dl=1. [TRUNCATED] Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49946	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:34.261218071 CET	509	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=50602536&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.760519028 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:35 GMT Etag: "6731c1ec-31" Expires: Wed, 27 Nov 2024 07:20:35 GMT Http_x_bd_logid: 1235491030 Http_x_bd_logid64: 1235491163410043914 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:56 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=1492F3A3D552A63F763A4ADF75EB8476:FG=1; expires=Wed, 26-Nov-25 07:20:35 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:35.823520899 CET	491	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=16384724&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:36.362127066 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:36 GMT Etag: "6731c1e3-31" Expires: Wed, 27 Nov 2024 07:20:36 GMT Http_x_bd_logid: 1236092407 Http_x_bd_logid64: 1236092103924375562 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:47 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=36A471277943D2613E16231216D0877A:FG=1; expires=Wed, 26-Nov-25 07:20:36 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:36.483889103 CET	477	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605635316&callback=BMap.logCbk7744760272&sign=e17821be048f HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:37.030244112 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:36 GMT Expires: Wed, 27 Nov 2024 07:20:36 GMT Http_x_bd_logid: 1236758529 Http_x_bd_logid64: 1236758992789659658 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=8B5E483D9B79A7D5E445704F72B7D941:FG=1; expires=Wed, 26-Nov-25 07:20:36 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=36A471277943D2611BA76B219AA569C6:FG=1; expires=Wed, 26-Nov-25 07:20:36 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12367585290395393034112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 37 34 34 37 36 30 32 37 32 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 37 34 34 37 36 30 32 37 32 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7744760272 && BMap.logCbk7744760272({"result":{"error":0}})
Nov 26, 2024 08:20:45.520688057 CET	657	OUT	GET /getmodules?v=2.0&t=20140707&mod=newvectordrawlib_phku2t&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643775&sign=1aae87229181 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:46.066220045 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:45 GMT Expires: Wed, 27 Nov 2024 07:20:45 GMT Http_x_bd_logid: 1245790510 Http_x_bd_logid64: 1245790123771476234 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=A639095EF452FA374C082BD7B68A3A03:FG=1; expires=Wed, 26-Nov-25 07:20:45 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=B18E30E7B2EA24E84E8EB69BE6FA1392:FG=1; expires=Wed, 26-Nov-25 07:20:45 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12457905104036966410112615 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 38 30 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 3b 6b 77 9b b8 b6 df ef af 70 99 39 1e a8 15 0c ce a3 1d 13 d5 2b cf be db b4 49 3b d3 eb f8 66 09 10 04 07 83 03 38 b1 13 fb bf df bd 25 81 b1 93 74 66 ce 3d eb 9e 39 0d 7a 6e 6d 6d ed b7 e4 f6 f3 e7 ed 8b 61 1e a7 cc ef 34 9b 65 49 ff 2d e1 b7 37 dc 2b d2 cc cf d8 6d 1c b9 bf 91 c6 6f c1 24 f1 8a 28 4d 1a a7 a1 ce 8c fb e2 32 ca cd 0f 6f 69 ea 88 d2 15 9d 9a a9 3b 84 49 26 9f 16 3c f1 75 36 9f df 2f c8 fd 9b cb 6e ba 30 9c 2f be e9 b1 38 d6 71 30 91 33 0c 39 f3 28 a4 f7 0b 59 c4 d5 b9 4f af 65 ed 72 42 c7 b2 74 78 40 af 17 a7 a1 39 ce d2 22 2d 66 63 4e 01 c1 c6 17 df 69 d4 1b cd 8c d1 12 49 c4 30 0a f4 67 35 b0 0a 65 b5 46 ea dc b0 ac e1 52 6c 73 5c 73 c4 c6 94 c1 37 70 a9 a8 40 a1 6a 15 d3 a6 72 a8 e8 4b 99 ae 70 ff ac 5a a7 ae 79 05 15 d9 b8 e7 2d 87 ee 9b 3e bf 89 3c 7e 12 4d 79 fc 95 01 6a 00 f6 60 0a 5b 74 cd cb 0f b0 3f d7 3c e5 14 67 e7 c5 2c e6 f3 b9 96 a4 d9 88 c5 1a 0e 4b 96 1d a7 45 36 9f e3 e8 d7 d7 b4 63 59 50 38 e4 62 b6 cf 29 d6 ee 14 [TRUNCATED] Data Ascii: 80c;kwp9+I;f8%tf=9znmma4eI-7+mo$(M2oi;I&<u6/n0/8q039(YOerBtx@9"-fcNiI0g5eFRls\s7p@jrKpZy-><~Myj`[t?<g,KE6cYP8b)"kznb+fl<8b_F;n+o~\~OSMw
Nov 26, 2024 08:20:46.066236973 CET	1236	IN	Data Raw: 64 a4 1b 62 47 cd 66 b9 8f 67 54 74 ce e7 b8 9f 66 d3 da c5 af 19 f3 24 2c 2e 7b ae 79 3d d1 b1 9b 60 2b a9 0e cf b8 97 87 c0 7c ff e8 86 27 c5 87 28 07 96 e2 99 ae 79 71 e4 5d 69 a4 51 3f 67 24 42 ab e5 c0 71 db 14 57 f3 b9 21 c8 93 f3 e2 2c 1a Data Ascii: dbGfgTtf$,.{y=`+\|'(yq]iQ?g$BqW!,tR+Mt$5b%/,+g"$zaZQ9As=5FWESyfz\|=M;af5^AIE.{zDa,NcZz]}2pE1cR{X\^`t
Nov 26, 2024 08:20:46.066250086 CET	1236	IN	Data Raw: a4 11 b4 69 fc 94 38 6b b4 21 6b b4 01 35 91 3f 8f 5a 3e 76 8d a8 be 61 6f 0c 0d 51 87 ae e4 31 0a 10 ef 26 2f 4f ba 9f 0c b0 2a 6c 38 6c 00 8a 3d bd aa 43 41 59 9e b2 49 f2 72 2c 98 74 d9 88 9c 3b aa da 4c 37 00 8a 88 42 8d 26 b2 4e 14 11 94 86 Data Ascii: i8k!k5?Z>vaoQ1&/Ol8l=CAYIr,t;L7B&NgvWYH B2P\|ik_3LKEB&`\~sAk\t+>^~9><jBiF:6hCNf8XiY!6AE
Nov 26, 2024 08:20:46.066340923 CET	1236	IN	Data Raw: 97 c5 28 6e e6 e9 24 f3 38 1d e6 30 bb a9 cc 0c 2d ad 4c b3 32 32 54 d9 18 08 91 a4 f4 08 62 00 e3 aa 5d 77 76 60 9b 28 17 95 44 28 b9 6b c8 8c 22 34 5c b8 31 4b ae 50 1d a8 a9 35 22 6d 3d 20 92 e8 bc 95 c0 dd 34 f6 1d 74 bc 37 7c ee a5 19 de bb Data Ascii: (n$80-L22Tb]wv`(D(k"4\1KP5"m= 4t7\|$]LLNr*`"[pX<S)Vl;AxR40$L!UMK$^fCxBx~VwS"TwH\CKiOS"!H&JJ(t <I.^}
Nov 26, 2024 08:20:46.066353083 CET	1236	IN	Data Raw: 93 11 bd 47 a6 ec de e3 a9 8b fb f1 ae f6 4b e7 10 ff d3 08 3a 8d 65 9b 1b e0 7f 9a d0 b7 df b2 b8 cc 81 81 77 08 0d b9 b6 20 f2 c1 d2 2a a0 e3 cd 63 fb e8 00 4c 78 1d 92 b7 63 bb b6 fb 10 52 22 20 5d 5c fa 00 4c b0 e3 2a ac a3 fd e3 97 c7 07 ab Data Ascii: GK:ew cLxcR" ]\LHYzVH)%EEJhvUR-7-\|g9yoOYHUM\|1N!zHa_<eXx/owg8XI\|xIJ\=x<C
Nov 26, 2024 08:20:46.066365004 CET	1236	IN	Data Raw: 4d 24 48 9b 18 48 c2 46 8d bc a8 49 d6 c8 77 4b 63 d0 0d c1 16 a5 34 ed e9 01 a6 08 75 7c 22 a3 96 ac bf f7 26 b6 41 1e 36 73 68 c6 a4 db f1 53 51 3f aa 40 99 76 03 89 46 4e 5b 26 aa f8 2e 30 46 8b 76 0c 88 e4 dd 3e 1f b4 6d 18 26 8a 2d 5b 54 b0 Data Ascii: M$HHFIwKc4u\|"&A6shSQ?@vFN[&.0Fv>m&-[TzD6P9>qm`9p w[xL!'7?K3@F\|0kY9>[9PvkOD:DC\~]6("L?bA17WcCmP).mBP}r
Nov 26, 2024 08:20:46.066378117 CET	504	IN	Data Raw: 32 f9 90 c1 5d e9 70 85 47 43 a5 15 2f 7f 10 0a 6b bc 7e c4 e9 03 fb d4 b6 5f 5a cf 1b 22 23 77 f2 d6 f1 6e d4 2f 89 d2 5c 87 73 cb 55 35 8f f0 d1 a9 33 9b d1 e9 94 7a 37 ce 74 46 f3 1b 67 36 a5 1b f0 99 5a d4 dd 70 9f 7b 37 1b de 73 6c b5 a8 d7 Data Ascii: 2]pGC/k~_Z"#wn/\sU53z7tFg6Zp{7slrU\|Od6%"3/Q;w^Qn,ys]YFOBKz'V2)C"/sBzX\edabc1>_Ta`hhaM@Ot^,`CP22hk
Nov 26, 2024 08:20:46.189929008 CET	491	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53200280&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:46.741377115 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:46 GMT Etag: "6731c1c4-31" Expires: Wed, 27 Nov 2024 07:20:46 GMT Http_x_bd_logid: 1246464829 Http_x_bd_logid64: 1246464730210477834 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:16 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=FFF20EAEE8D526AD89178F077C8BA458:FG=1; expires=Wed, 26-Nov-25 07:20:46 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:46.929655075 CET	474	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605645776&callback=BMap.logCbk6226715041&sign=2072cc6b2c46 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:47.467928886 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:47 GMT Expires: Wed, 27 Nov 2024 07:20:47 GMT Http_x_bd_logid: 1247198821 Http_x_bd_logid64: 1247198263416209418 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=1C23D51EA8D4D5E8A911F2A9DF279FA4:FG=1; expires=Wed, 26-Nov-25 07:20:47 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=F6D1C20FA458E2FB2CB7C45CAE5128C5:FG=1; expires=Wed, 26-Nov-25 07:20:47 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12471988211994864650112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 32 32 36 37 31 35 30 34 31 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 32 32 36 37 31 35 30 34 31 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk6226715041 && BMap.logCbk6226715041({"result":{"error":0}})
Nov 26, 2024 08:20:47.912950993 CET	477	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605646761&callback=BMap.logCbk8973956757&sign=57d54babd95e HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:48.455291986 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:48 GMT Expires: Wed, 27 Nov 2024 07:20:48 GMT Http_x_bd_logid: 1248180786 Http_x_bd_logid64: 1248180401978284042 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=8A10648EE3D655900BA905FF212B6027:FG=1; expires=Wed, 26-Nov-25 07:20:48 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=2E982457A12F40E540FAF1CCC63C3767:FG=1; expires=Wed, 26-Nov-25 07:20:48 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12481807862656740106112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 39 37 33 39 35 36 37 35 37 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 39 37 33 39 35 36 37 35 37 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk8973956757 && BMap.logCbk8973956757({"result":{"error":0}})
Nov 26, 2024 08:20:50.765964031 CET	476	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605648766&callback=BMap.logCbk9348424000&sign=6391d8f0bbc3 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:51.314235926 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:51 GMT Expires: Wed, 27 Nov 2024 07:20:51 GMT Http_x_bd_logid: 1251037019 Http_x_bd_logid64: 1251037690550478602 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=8A2768B71F433FA5BE5E815ED9B2605C:FG=1; expires=Wed, 26-Nov-25 07:20:51 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=AF17FC9DCF45442A10D8320669D0552A:FG=1; expires=Wed, 26-Nov-25 07:20:51 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12510370191435514890112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 39 33 34 38 34 32 34 30 30 30 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 39 33 34 38 34 32 34 30 30 30 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk9348424000 && BMap.logCbk9348424000({"result":{"error":0}})
Nov 26, 2024 08:20:55.194838047 CET	683	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk5925&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo5Cn9S0I2rb%2FJ1brfUmjqgY%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605654023&sign=6d791134464b HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:55.752079964 CET	873	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:55 GMT Expires: Wed, 27 Nov 2024 07:20:55 GMT Http_x_bd_logid: 1255463521 Http_x_bd_logid64: 1255463952349520650 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=5E9895B64395456FF25A84EDD4358179:FG=1; expires=Wed, 26-Nov-25 07:20:55 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=09EAE61F6A0AE232DD512184FAC7BFB1:FG=1; expires=Wed, 26-Nov-25 07:20:55 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12554635212663654410112615 Content-Length: 91 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 35 39 32 35 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 35 39 32 35 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk5925 && BMap._rd._cbk5925({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:20:55.756475925 CET	693	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk82991&seckey=QjkmsigYB6FtJVS1%2B1zLo5Cn9S0I2rb%2FJ1brfUmjqgY%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605654036&sign=c74c2ea44a50 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:56.303062916 CET	904	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:56 GMT Expires: Wed, 27 Nov 2024 07:20:56 GMT Http_x_bd_logid: 1256027216 Http_x_bd_logid64: 1256027790927219978 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=B43EA8AE0BC4E31B86688C15D2C86C9B:FG=1; expires=Wed, 26-Nov-25 07:20:56 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=92A3BF592B5BF5640C40C50528123EA2:FG=1; expires=Wed, 26-Nov-25 07:20:56 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12560272162739232266112615 Content-Length: 121 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 32 39 39 31 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 38 32 39 39 31 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk82991 && BMap._rd._cbk82991({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})
Nov 26, 2024 08:20:56.306699038 CET	475	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605655021&callback=BMap.logCbk4406923950&sign=3878eae1f10c HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:56.852401972 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:56 GMT Expires: Wed, 27 Nov 2024 07:20:56 GMT Http_x_bd_logid: 1256575708 Http_x_bd_logid64: 1256575741592342538 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=B43EA8AE0BC4E31BB93BC0EA4E9A7ED7:FG=1; expires=Wed, 26-Nov-25 07:20:56 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=92A3BF592B5BF5649AB9EA49545B076C:FG=1; expires=Wed, 26-Nov-25 07:20:56 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12565757082543624970112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 34 30 36 39 32 33 39 35 30 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 34 30 36 39 32 33 39 35 30 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk4406923950 && BMap.logCbk4406923950({"result":{"error":0}})
Nov 26, 2024 08:20:57.163800001 CET	474	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605656020&callback=BMap.logCbk8136133267&sign=a194ed09867f HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:57.708715916 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:57 GMT Expires: Wed, 27 Nov 2024 07:20:57 GMT Http_x_bd_logid: 1257432232 Http_x_bd_logid64: 1257432691594414858 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=0D60F253D501EAC8E45C6C99EDDA4299:FG=1; expires=Wed, 26-Nov-25 07:20:57 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=4E89BA83C278B88F015A0845BF9ED1DE:FG=1; expires=Wed, 26-Nov-25 07:20:57 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12574322320190176522112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 31 33 36 31 33 33 32 36 37 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 31 33 36 31 33 33 32 36 37 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk8136133267 && BMap.logCbk8136133267({"result":{"error":0}})
Nov 26, 2024 08:20:58.498249054 CET	477	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605657349&callback=BMap.logCbk1914489283&sign=d18613173a5c HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:59.041764021 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:58 GMT Expires: Wed, 27 Nov 2024 07:20:58 GMT Http_x_bd_logid: 1258767686 Http_x_bd_logid64: 1258767443771476234 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=6BDA6DEAD146E0756D20614DED04A409:FG=1; expires=Wed, 26-Nov-25 07:20:58 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=6C0FB91520740601B460C77D51E10381:FG=1; expires=Wed, 26-Nov-25 07:20:58 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12587676860365110282112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 31 39 31 34 34 38 39 32 38 33 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 31 39 31 34 34 38 39 32 38 33 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk1914489283 && BMap.logCbk1914489283({"result":{"error":0}})
Nov 26, 2024 08:20:59.943387032 CET	476	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605658020&callback=BMap.logCbk2627632843&sign=50babe7b3c77 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49948	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:34.261288881 CET	691	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk71768&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632385&sign=ca9adc6fe98e HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.805114985 CET	904	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:35 GMT Expires: Wed, 27 Nov 2024 07:20:35 GMT Http_x_bd_logid: 1235526881 Http_x_bd_logid64: 1235526603924375562 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=5E47F7B9BE2CFEAE9FBB6BEC33066890:FG=1; expires=Wed, 26-Nov-25 07:20:35 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=CD029FB9DEB73612A6B7B7D168D8E0A1:FG=1; expires=Wed, 26-Nov-25 07:20:35 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12355268811994864650112615 Content-Length: 121 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 31 37 36 38 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 31 37 36 38 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk71768 && BMap._rd._cbk71768({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})
Nov 26, 2024 08:20:35.807890892 CET	474	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605634322&callback=BMap.logCbk1399821954&sign=d2ba6044c010 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:36.356493950 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:36 GMT Expires: Wed, 27 Nov 2024 07:20:36 GMT Http_x_bd_logid: 1236075092 Http_x_bd_logid64: 1236075873410182410 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=8B5E483D9B79A7D5F2BEC89BD113E1AE:FG=1; expires=Wed, 26-Nov-25 07:20:36 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=04C4071F5EBAB4FB93FAC456E450A382:FG=1; expires=Wed, 26-Nov-25 07:20:36 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12360750921546338570112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 31 33 39 39 38 32 31 39 35 34 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 31 33 39 39 38 32 31 39 35 34 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk1399821954 && BMap.logCbk1399821954({"result":{"error":0}})
Nov 26, 2024 08:20:45.520816088 CET	509	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=31034223&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:46.079407930 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:45 GMT Etag: "6731c238-31" Expires: Wed, 27 Nov 2024 07:20:45 GMT Http_x_bd_logid: 1245797694 Http_x_bd_logid64: 1245797092368553226 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:37:12 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=883316E8C1475EEE47860D5F5AFD9EAF:FG=1; expires=Wed, 26-Nov-25 07:20:45 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:46.108417034 CET	693	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk27910&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605644934&sign=97db8b984019 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:46.658463001 CET	904	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:46 GMT Expires: Wed, 27 Nov 2024 07:20:46 GMT Http_x_bd_logid: 1246377164 Http_x_bd_logid64: 1246377720646176010 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=6DD96441683CB79BAB1D4138BD0F4F95:FG=1; expires=Wed, 26-Nov-25 07:20:46 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=292F551B2708B7FE85DB83B5971D4E71:FG=1; expires=Wed, 26-Nov-25 07:20:46 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12463771642663654410112615 Content-Length: 121 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 32 37 39 31 30 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 32 37 39 31 30 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk27910 && BMap._rd._cbk27910({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})
Nov 26, 2024 08:20:56.032382011 CET	770	OUT	GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk39410&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo5Cn9S0I2rb%2FJ1brfUmjqgY%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605654538&sign=c2a16d70705c HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:56.598273993 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:56 GMT Expires: Wed, 27 Nov 2024 07:20:56 GMT Http_x_bd_logid: 1256301203 Http_x_bd_logid64: 1256301681275450378 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=B43EA8AE0BC4E31B888E17D1783CBEEC:FG=1; expires=Wed, 26-Nov-25 07:20:56 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=BF1D447FE1A24A0F4DEBDEE3BDBE20BC:FG=1; expires=Wed, 26-Nov-25 07:20:56 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12563012033504027658112615 Transfer-Encoding: chunked Data Raw: 35 31 30 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 33 39 34 31 30 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 33 39 34 31 30 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 510/**/BMap._rd._cbk39410 && BMap._rd._cbk39410({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type
Nov 26, 2024 08:20:56.598295927 CET	857	IN	Data Raw: 22 3a 32 2c 22 75 70 5f 70 72 6f 76 69 6e 63 65 5f 6e 61 6d 65 22 3a 22 5c 75 35 65 37 66 5c 75 34 65 31 63 5c 75 37 37 30 31 22 7d 2c 22 65 72 72 5f 6d 73 67 22 3a 22 22 2c 22 68 6f 74 5f 63 69 74 79 22 3a 5b 22 5c 75 35 33 31 37 5c 75 34 65 61 Data Ascii: ":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315"
Nov 26, 2024 08:20:56.800980091 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Nov 26, 2024 08:21:04.497853994 CET	695	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk394&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605662833&sign=f2ae8e43acc7 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:05.048578978 CET	900	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:04 GMT Expires: Wed, 27 Nov 2024 07:21:04 GMT Http_x_bd_logid: 1264766157 Http_x_bd_logid64: 1264766813407401994 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=E70A184D23123A95D2D8048D2A7482F1:FG=1; expires=Wed, 26-Nov-25 07:21:04 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=94A7A16964001456A341013FC4729F44:FG=1; expires=Wed, 26-Nov-25 07:21:04 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12647661572656740106112615 Content-Length: 117 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 33 39 34 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 33 39 34 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk394 && BMap._rd._cbk394({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})
Nov 26, 2024 08:21:05.053594112 CET	774	OUT	GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk76389&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605663341&sign=b91f519b6f46 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:05.624667883 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:05 GMT Expires: Wed, 27 Nov 2024 07:21:05 GMT Http_x_bd_logid: 1265323895 Http_x_bd_logid64: 1265323160282076170 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=2D5F5F4E6045B5F317F2C6CF95176F2F:FG=1; expires=Wed, 26-Nov-25 07:21:05 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=041F6EB20611EE4241890B1A901A7FE4:FG=1; expires=Wed, 26-Nov-25 07:21:05 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12653238952739232266112615 Transfer-Encoding: chunked Data Raw: 35 31 31 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 36 33 38 39 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 36 33 38 39 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 511/**/BMap._rd._cbk76389 && BMap._rd._cbk76389({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type
Nov 26, 2024 08:21:05.624758005 CET	858	IN	Data Raw: 22 3a 32 2c 22 75 70 5f 70 72 6f 76 69 6e 63 65 5f 6e 61 6d 65 22 3a 22 5c 75 35 65 37 66 5c 75 34 65 31 63 5c 75 37 37 30 31 22 7d 2c 22 65 72 72 5f 6d 73 67 22 3a 22 22 2c 22 68 6f 74 5f 63 69 74 79 22 3a 5b 22 5c 75 35 33 31 37 5c 75 34 65 61 Data Ascii: ":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315"
Nov 26, 2024 08:21:05.829468966 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Nov 26, 2024 08:21:05.975260019 CET	474	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605664831&callback=BMap.logCbk7081181651&sign=69830daf9dbb HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:06.523729086 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:06 GMT Expires: Wed, 27 Nov 2024 07:21:06 GMT Http_x_bd_logid: 1266240083 Http_x_bd_logid64: 1266240941898201354 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=0C79C82BF1FAA619574E399CBBFCE873:FG=1; expires=Wed, 26-Nov-25 07:21:06 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=3301BDECEBA13685416DC3664D109830:FG=1; expires=Wed, 26-Nov-25 07:21:06 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12662400832529240074112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 30 38 31 31 38 31 36 35 31 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 30 38 31 31 38 31 36 35 31 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7081181651 && BMap.logCbk7081181651({"result":{"error":0}})
Nov 26, 2024 08:21:07.973134041 CET	476	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605666827&callback=BMap.logCbk8321850506&sign=0f11f3707dae HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:08.527009964 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:08 GMT Expires: Wed, 27 Nov 2024 07:21:08 GMT Http_x_bd_logid: 1268242111 Http_x_bd_logid64: 1268242370693820682 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=F1A55F12B5EADC29387990F20EB504B9:FG=1; expires=Wed, 26-Nov-25 07:21:08 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=9C37280E4424461A439FEA75E185E380:FG=1; expires=Wed, 26-Nov-25 07:21:08 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12682421111285634058112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 33 32 31 38 35 30 35 30 36 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 33 32 31 38 35 30 35 30 36 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk8321850506 && BMap.logCbk8321850506({"result":{"error":0}})
Nov 26, 2024 08:21:12.660098076 CET	681	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk2541&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo9pV82ijWeQ1eQUvJVIpGCI%3D%2CmT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc&timeStamp=1732605671413&sign=4f7b9a22d5cc HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:13.232820988 CET	873	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:12 GMT Expires: Wed, 27 Nov 2024 07:21:12 GMT Http_x_bd_logid: 1272935639 Http_x_bd_logid64: 1272935502829006858 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=52E3D6F775D9A70056C1AB8A70632C43:FG=1; expires=Wed, 26-Nov-25 07:21:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=4F589DFE9D2A05E588E9852CFD21DD31:FG=1; expires=Wed, 26-Nov-25 07:21:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12729356393029481482112615 Content-Length: 91 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 32 35 34 31 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 32 35 34 31 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk2541 && BMap._rd._cbk2541({"error":0,"content":{"business":1,"unauth":0}})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49952	45.113.194.211	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:34.647644997 CET	517	OUT	GET /tb/pms/img/st.gif?ts=4&t=pageview&sid=m3y4npye3nz&ver=5&pid=241&px=12801024&ref=http%3A%2F%2Fwww.wheel-done.com%2F&page=18_1&p=18&dv=6&cmd=open HTTP/1.1 Host: static.tieba.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:36.244752884 CET	273	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Connection: keep-alive Content-Length: 43 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:35 GMT Etag: "51e62f22-2b" Last-Modified: Wed, 17 Jul 2013 05:44:02 GMT Server: Apache Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:21:04.078318119 CET	522	OUT	GET /tb/pms/img/st.gif?ts=1&t=pageview&sid=m3y4odhwass&ver=5&pid=241&px=12801024&ref=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&page=18_1&p=18&dv=6&cmd=open HTTP/1.1 Host: static.tieba.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:04.664177895 CET	273	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Connection: keep-alive Content-Length: 43 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:21:04 GMT Etag: "51e62f22-2b" Last-Modified: Wed, 17 Jul 2013 05:44:02 GMT Server: Apache Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49853	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:34.889488935 CET	452	OUT	GET /tile/?qt=vtile&x=49624&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline3.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.307297945 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 16729 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:52 GMT ETag: W/"12535db4f58aaf621f8a460bcc6c1f1" Cache-Control: max-age=2592000 Age: 970889 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0412778471 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:52 GMT Ohc-Cache-HIT: fra01-sys-jomo2.fra01.baidu.com [2], zhuzuncache52 [4], qdix242 [2] Ohc-File-Size: 16729 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f9 f7 f4 ff ff ff 39 a0 7d 91 ca b7 f5 f3 f0 f2 ee ea d4 d4 d6 73 86 b4 5c 7a af 89 95 b7 db dc dd ec ec eb e5 e7 ea e4 eb f2 e3 e3 e3 da dd e3 f7 f6 fa 97 d2 fc 9b d3 fb d5 d6 da f5 d6 ad ff ec ba ff e3 ad f5 e9 d0 fe e7 b4 b3 d0 da ce e6 dc af b6 cc c8 cb d2 dd e2 e8 ec ec f2 f3 f1 ee ae d7 ef ec f2 f4 ce d2 d7 d0 e8 f3 5d 95 a1 6b bb c7 5e a8 d4 97 d0 e5 33 9a dc e7 db d0 e6 ce aa ad b0 b5 d8 b3 99 91 94 9b a6 9a 79 e2 99 5f 25 28 2c 5d 5f 61 3d 40 43 3b 69 ab d5 ca eb aa 96 d8 c4 99 e4 9b 61 e1 a5 6f e7 93 55 dd e6 d4 f3 f2 eb f9 d2 b1 eb b0 75 da c6 b5 d8 ef 8a 31 7a c5 4e b4 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTE9}s\z]k^3y_%(,]_a=@C;iaoUu1zNbKGD-pHYs~?IDATx}CviS8@6W\$Y%6[%G3fFd2'&i\|=ug'''3s01WQ?b!Dshv/#?W1]\|?;M=As?&Y?.S/RD#Dplgn_/)a? 07<q_@>=yK%5i?&:_@"?9Q,zWUVA1KryThSFL{:18~
Nov 26, 2024 08:20:35.307322979 CET	1236	IN	Data Raw: d9 3c b3 8d 3c 40 d9 83 44 e0 88 94 ec 71 7c 64 f6 11 30 07 5e 1d 6b eb 3e 06 80 2b 84 67 7a 00 a9 ca 8b 72 fc b4 77 a8 c0 24 44 13 10 7f 87 7f 9d 8b 21 13 00 d9 0b 9a e7 a2 61 12 93 a0 48 2b 37 76 48 76 91 38 8e 88 e0 b5 9e 57 04 e1 d0 28 10 30 Data Ascii: <<@Dq\|d0^k>+gzrw$D!aH+7vHv8W(0o9()o>&!~;X@<`%Gq)%$z;T&X\|$75+xHWW5~~)nErWA</~z#@Jxu
Nov 26, 2024 08:20:35.307332993 CET	388	IN	Data Raw: 6c 84 61 88 0e d3 6e 57 93 10 80 11 2a 00 4b 7b 4f 6b fc e7 b4 79 3c 0d 90 e8 df 90 df f2 35 49 7e 94 e4 46 3d cd 77 16 bd 55 47 1a 07 00 19 bb 91 46 f8 1c 00 c3 34 f0 4d cb 0e c2 bb 75 50 db af 6f df bf 0e fa 00 9a f6 c5 a2 a7 88 e8 0c f8 00 23 Data Ascii: lanW*K{Oky<5I~F=wUGF4MuPo#XT7@=TO;&V%Gxoc>86Rp5:"nzEj)[UCrEyc\YL?({yeQt\fStL\|)N{[NMi
Nov 26, 2024 08:20:35.309945107 CET	1236	IN	Data Raw: ae c2 d1 b2 5b 92 37 7b fe 3e f5 40 c7 00 30 64 ff fa d5 5f 3f be fc f0 a3 67 18 2f e2 93 d2 53 f2 ab b4 53 3f 67 d3 21 d9 bd a0 1c 90 fc c3 00 7c ef fc b4 4b 74 b1 c4 2f b1 12 9b 3d 3f ae 7f e4 8f 3f 22 f1 f2 f8 19 00 d4 ba 3d 12 9e d9 18 f3 6d Data Ascii: [7{>@0d_?g/SS?g!\|Kt/=??"=m+<8((M0Gtt0?>{y\|?>?)t+{4^Q"yRN^_b_1nog]TG/kOXQ,
Nov 26, 2024 08:20:35.309998035 CET	1236	IN	Data Raw: ed 0c 83 1c fd 61 32 9d da c6 7f 04 00 39 ef 1f cb d4 7a 18 f4 83 ec 62 8c b5 b7 64 e7 79 47 7e d7 43 47 01 42 b4 02 41 0e 03 14 0b c2 9f 28 e8 76 01 e5 10 19 74 0d 70 f5 63 5a 6a ed f1 fd 9b 38 3b bb 53 bb b8 3e 23 fb 14 f7 40 19 6a 73 c9 c2 0b Data Ascii: a29zbdyG~CGBA(vtpcZj8;S>#@jsq&v,,@: G"?*7]he/#akt"KM8($_1Xg)b=%?'N_RX5:N{C< =_ aPulD^$elMAT#e
Nov 26, 2024 08:20:35.310008049 CET	388	IN	Data Raw: fd cf f3 78 55 db 40 28 9d 45 e9 2b 16 f4 ec e5 70 f4 3f 00 a0 d1 67 a9 7d 9d 41 f0 bd b2 00 99 8c 3a 2e a8 01 80 ef 9b b5 61 95 10 5e c5 15 5a c1 ec e7 cf 73 05 c0 4a 9e 9f e4 6b 16 4c ad 84 48 f0 01 95 ef 19 e6 93 69 d9 83 d0 32 8a fe 76 4c 8c Data Ascii: xU@(E+p?g}A:.a^ZsJkLHi2vL9ipn,dcIsyS{#@0t~RY:N`k!.!JL".$e4ISF)AVTu:IAg5uNBo@8
Nov 26, 2024 08:20:35.312639952 CET	1236	IN	Data Raw: c3 f8 bc 4e 88 11 00 49 a4 0b a3 d1 14 91 a8 c3 ef b6 0b f0 6b 0d f0 e9 74 53 af 31 e7 45 5a c1 48 e3 58 7e 35 e9 09 e5 c6 6a 00 30 61 7d e4 60 e2 c7 a9 5b 0d 9c 21 49 00 94 ae 9b 46 0d 17 a0 81 88 35 09 5c f2 62 d8 f1 97 46 3e ec 68 14 20 0b a4 Data Ascii: NIktS1EZHX~5j0a}`[!IF5\bF>h 9kDtxJ%V0$92]HP%U\|P5e7DW<s@XT2d'BeX]G8-NU`~O}La>:7?;TAu[
Nov 26, 2024 08:20:35.312705994 CET	1236	IN	Data Raw: 1f f6 62 fb f6 f6 7a d8 ef f7 e2 4d 2c d5 d4 97 b2 2c f0 65 08 00 27 6a b1 a0 1f 4d 3f 5f 11 2c 0b 9a 77 27 46 d7 16 44 06 00 31 a7 77 eb c5 c6 18 00 90 f4 7f 21 00 49 f2 7b b7 d9 8a 3d 79 01 00 e0 0d 04 de c1 9f fd 76 27 f6 c9 01 d0 39 6c 18 00 Data Ascii: bzM,,e'jM?_,w'FD1w!I{=yv'9l*E%P-Lbt`)U`%K!4@QBo~v#Q8]X,P.3v?n]r4r-g245[k=~u{Hn)
Nov 26, 2024 08:20:35.312715054 CET	388	IN	Data Raw: d3 94 37 c4 94 f5 7a 58 e8 7b 52 5f 7f bd ee 36 35 02 af c6 53 99 65 9a 54 03 40 7d d7 93 d9 cc 72 19 7e dd 81 21 01 08 7a 79 90 01 b5 fb 51 63 5e 28 3a 04 7a 91 1a 2b ec da 07 8e 21 01 fc 77 3b b9 ca de 6f d5 80 07 de ef f7 87 2d 67 5a 30 ed b2 Data Ascii: 7zX{R_65SeT@}r~!zyQc^(:z+!w;o-gZ0[BQ;@=:PMf@OeAuVUVu+oAuU%60KY"z1HP]Bo%j3~u[hql7{)&T7!;>
Nov 26, 2024 08:20:35.315644026 CET	1236	IN	Data Raw: 60 47 d5 7c 0d 1f 58 9d c5 9a fe 66 c1 e7 b1 fc 3b 6f 00 10 d6 fd b3 95 91 66 97 11 b0 4a 07 1d 25 01 d4 fb c3 2b 69 3d 90 c0 eb 0e 00 00 99 01 80 b7 fd 66 b7 07 a1 b7 0a 80 2d a2 04 6f 47 0b f2 9d 04 80 bc 60 dd 4b dc d2 00 f2 cb d4 77 3a 39 67 Data Ascii: `G\|Xf;ofJ%+i=f-oG`Kw:9gHl;x\3%.9</I[auQH.NIO\mblH ,-M`=ZfJ@H(9XrBN\|d3P.K
Nov 26, 2024 08:20:35.427743912 CET	1236	IN	Data Raw: 47 5e 54 ee 1a af d2 0e 1b 92 25 06 4a ae c9 6e 04 bd 06 54 cd e2 03 2c 58 58 24 60 b0 20 2f e1 1c 9f 25 87 df 52 1e bf 62 8e 2a 1e ca 3b 99 ee 69 e9 44 ef ef dd 00 44 2d 00 68 1f a0 95 17 ad c8 f4 bd aa b7 18 4d ba e4 71 bd d5 93 09 51 cf 60 c1 Data Ascii: G^T%JnT,XX$` /%Rb;iDD-hMqQ`>JXIK-wcnBw)'&~t\\BzdT 0z7+([0OU(<N7Ky"&OVTNfu-oY;E9D!jJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49873	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:35.493329048 CET	354	OUT	GET /tile/?qt=vtile&x=49625&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline0.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.916770935 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 15150 Connection: keep-alive Expires: Sun, 08 Dec 2024 20:12:00 GMT ETag: W/"c3a4f7150b1b4227e694f56ac5e58886" Cache-Control: max-age=2592000 Age: 1479612 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0720568544 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 20:12:00 GMT Ohc-Cache-HIT: fra01-sys-jomo7.fra01.baidu.com [2], zhuzuncache52 [1], suzix231 [4] Ohc-File-Size: 15150 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 ff ec ba fa e8 c7 e8 dc d0 d2 c9 b6 c8 bb ad ff e3 ac fe e6 b5 dd e2 e8 e6 e6 ea d4 d5 d8 f7 e9 d8 fd db a5 f5 f3 f0 f3 f1 ee f2 ee e9 f8 da b6 dc dc dc df e0 df e3 e3 e3 f6 f2 fe da dd e3 ff ff ff ec eb eb f1 ed f7 ec eb f3 ea ce b1 de b3 92 d1 95 6e d6 c5 9c fa f3 e9 fe d8 9d f9 f7 f4 f9 f6 fb ce d1 d7 ef e8 d6 a6 9a 79 ad af b2 ca ca cd 94 94 93 ef c3 9c bb c2 d1 dc 8e 44 eb aa 6f b2 b7 ca ee 97 4b e4 eb f2 f1 8a 31 f1 81 1f 76 76 76 ab 96 d9 79 91 c6 8e 98 b2 72 85 b5 dd e6 f2 d5 c9 ea 66 7d b4 e4 d8 ee c4 9c e5 b9 86 de 9b 61 e2 a5 6f e6 93 55 dd d1 af ea b1 77 da 4f 07 4d 24 00 00 00 01 62 4b 47 44 15 e5 d8 f9 a3 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTEnyDoK1vvvyrf}aoUwOM$bKGDpHYs~9IDATx]c8Nm-lL@;i{u6Mn;Ww&2Hrc4\|O&S~:/gu]/M?o:Y,#B\|,GETo''o\KByR{>7?v\|1"d>.n>1_nO~to^FVH>nynXw ]d`4nf}X>Bd_8?xL;\|IPXh/TP,bj_js+
Nov 26, 2024 08:20:35.916826010 CET	1236	IN	Data Raw: 00 ae d4 d7 e5 ac d7 a2 13 7f 3e 5d 2c f0 67 db 9b 3f 70 7c 85 af e8 aa 7a 27 7c 5d 09 2e 87 0a c0 0e 5f d8 c9 4f 9e d7 00 cc 50 fc d4 8b 0c c9 63 a9 ed 20 fa 92 a4 e6 b0 01 80 f3 5e 14 23 d4 7d 4d e5 bb 00 c8 11 80 3d be 7f f4 45 d1 0c 6d d6 51 Data Ascii: >],g?p\|z'\|]._OPc ^#}M=EmQ<+~Ek&Xp#eK<WW%\|\|^Exno`x$'=A0T. &Hv,]a'6&.e o+FC
Nov 26, 2024 08:20:35.916836977 CET	388	IN	Data Raw: 08 47 98 ab 0b 43 70 75 20 3b fa 92 a0 99 0c e8 65 c1 b5 02 00 0f 03 f1 99 5c 20 04 03 83 54 40 e4 02 59 50 14 e5 1e 4d 00 21 90 a6 2e 4a b5 d6 01 d3 13 ca 69 fe fe b8 fa be da 6e b7 ab bb ef 0f c0 cf e7 a3 2d fc 7d 73 f3 7d d4 78 75 25 7e c5 1a Data Ascii: GCpu ;e\ T@YPM!.Jin-}s}xu%~rVuuqX4DuUXWTYz_x>G"sPt=+_{ca.W.bsTP_8Ir<]oa\|Fw+}U\|c+7+zV
Nov 26, 2024 08:20:35.919188023 CET	1236	IN	Data Raw: 0c 80 08 e6 1f fe 4a 0b 1c 89 04 20 91 82 f3 59 0f 5c dd 6f 87 5b 2d ba 3f 62 30 40 e9 1e be c3 ec af 6c af 3e 08 e2 30 ae 65 cf bd 30 26 f6 e1 76 d7 45 f5 38 68 84 81 1e 4c 48 37 80 98 32 45 a0 f0 db c0 04 15 c9 2b 85 6f da 6c ec de 74 f0 bd 8e Data Ascii: J Y\o[-?b0@l>0e0&vE8hLH72E+oltEG.@&1.R4qu\!_7B7}fiNn!cHSo-$3`YUeg\|T-gBo\|QxfiJN;O(9cS}"V
Nov 26, 2024 08:20:35.919208050 CET	1236	IN	Data Raw: e5 05 b5 c2 b0 2d 0e ea 61 c0 8c 83 82 09 6d dc 33 02 04 80 c0 a3 ea 29 9c fe 11 00 87 2b aa 42 4d 1b b0 6a 80 88 83 fe 1a 5b d3 14 98 d7 95 0f e8 1f 07 ed 8b 23 3e 31 98 d0 39 09 c0 11 8c 85 3a f8 18 f9 9d fe 11 00 07 64 04 dc 0b 36 54 c0 55 e2 Data Ascii: -am3)+BMj[#>19:d6TU% 3"Wja@*l<>p+(:10K"o09P\|PnD?@6 4W/@5JBl;k&tJcSIdeN$[uk
Nov 26, 2024 08:20:35.919218063 CET	388	IN	Data Raw: a4 42 9a 13 50 eb 74 c6 51 1a 8d c2 f8 59 00 ac f9 20 fb 50 d6 7b ae 66 03 5e 4c b5 71 d6 04 20 3d 5c 4a 47 e1 d0 24 4f c8 0c 3e d3 15 c0 d1 48 a5 be 34 4b 12 60 83 1a 6e 4b 12 48 2a a4 01 60 ad 08 4c f9 8f da 9e 45 07 40 29 83 58 f2 41 e4 7d 19 Data Ascii: BPtQY P{f^Lq =\JG$O>H4K`nKH*`LE@)XA}Fk.~{ki+7?I4P@9jheK>EZ%.:qOtN@%j5=Y)TEi(<u}N3(~f:'u`5hZ;VEiQ
Nov 26, 2024 08:20:35.921725035 CET	1236	IN	Data Raw: 35 00 ce c4 41 48 d2 0e fb 27 d0 80 7d 80 5b 3e eb 8d 13 f0 1c 5a 77 ec 00 b5 16 5b 66 8e 3d c8 83 da 40 17 63 f5 ac 51 1c b7 2d 0d 4c bb 01 d0 b7 51 ab 00 58 e2 a0 7b 08 0f a9 9b 63 1c 7c ca ea 4e 21 d7 4f 74 00 ce 76 09 58 00 08 58 7c b7 a9 0e Data Ascii: 5AH'}[>Zw[f=@cQ-LQX{c\|N!OtvXX\|StfH[ML;!amEoP!HZTJZOPp@.DyyBcXkf1K6HW/8 3`
Nov 26, 2024 08:20:35.921775103 CET	1236	IN	Data Raw: 60 65 fc 40 94 30 70 3c bb 38 a2 69 40 b5 cf de 11 ab bc c7 c0 02 40 7e ff 22 01 38 a5 99 7b ca dd 67 d7 3d 45 6e 96 95 64 cf a0 c8 f2 2c 3b 81 e4 e5 1e d0 02 bb 07 18 d8 fc 47 f4 c2 a3 34 f4 7d c3 b6 3e 99 0c f2 a1 00 92 61 ec 5c ab b9 20 cb e9 Data Ascii: `e@0p<8i@@~"8{g=End,;G4}>a\ U0P8R*~"QIJ0g%hGg$v>z@Xy<i;>ldF8DN'sm]C(-B3gPi#cLSaA\
Nov 26, 2024 08:20:35.921785116 CET	388	IN	Data Raw: 31 43 bf 17 d3 ce a1 02 30 c8 09 ea 85 b0 b0 07 00 71 1d 06 ae f5 b1 16 09 ce 32 10 de e1 1d 54 a0 02 e0 f3 f7 ef 5f 0c 80 a8 a2 c3 e7 05 c7 50 17 c6 19 3d 3b d8 a1 62 e3 8b 00 50 0b c3 d6 fd 83 ba 09 48 32 dc 88 83 48 07 f9 c5 2e 95 73 2c 01 00 Data Ascii: 1C0q2T_P=;bPH2H.s,ip"@0'"7!8UNU_]a>zyH#/T6>Aw7J8scF0m?a^a_J8[K9XxHEza~5!_/Xs=A#opzzF
Nov 26, 2024 08:20:35.924509048 CET	1236	IN	Data Raw: 50 0b c3 96 38 38 9a 4e f4 6b c0 85 13 c0 4a ec 59 e9 37 10 18 f6 18 0b 78 f0 74 ce 08 ce c4 d3 04 d7 9f 25 c6 bb 4a 74 0b 56 4f 56 ac 98 d0 a0 30 e0 79 0a 02 79 b3 24 82 16 20 21 60 58 2c c4 d3 ba 71 17 02 78 ef b6 88 64 e0 0a 45 25 ad 0d 00 12 Data Ascii: P88NkJY7xt%JtVOV0yy$ !`X,qxdE%`^\;ru(J\|PC&BztIKFyz{1C6`GK^51p3MWN]rl>lh/{#p?{[6Hp#/2*rgk2,V-/
Nov 26, 2024 08:20:36.036828041 CET	1236	IN	Data Raw: 1f de 71 26 c4 49 b0 ca e5 cf 00 70 f5 05 25 df 2d 56 a3 f9 d2 df 17 6d ff bc 6f f3 82 7a 6d dc 8d 25 00 30 e7 6b 3c cc 57 6b 89 75 b4 fb f7 d4 c2 08 ce eb 79 26 60 09 95 f2 30 1d 91 0f 7f a9 01 90 7c 96 3f 70 ab f0 a0 ed bb af 07 65 ce 45 3e 08 Data Ascii: q&Ip%-Vmozm%0k<Wkuy&`0\|?peE>r4])QDA@(WmQK=5>s@+U .&]+^@Lv.a\@W+k~.`P\|0B\G5ph=G/]pP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49875	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:35.516544104 CET	354	OUT	GET /tile/?qt=vtile&x=49624&y=10003&z=18&styles=pl&scaler=1&udt=20241109&from=jsapi2_0 HTTP/1.1 Host: maponline3.bdimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:35.921224117 CET	1236	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: image/png Content-Length: 16729 Connection: keep-alive Expires: Sun, 08 Dec 2024 22:06:52 GMT ETag: W/"12535db4f58aaf621f8a460bcc6c1f1" Cache-Control: max-age=2592000 Age: 970889 Accept-Ranges: bytes Access-Control-Allow-Origin: * Http_x_bd_logid: 0412778471 Ohc-Global-Saved-Time: Fri, 08 Nov 2024 22:06:52 GMT Ohc-Cache-HIT: fra01-sys-jomo2.fra01.baidu.com [2], zhuzuncache52 [4], qdix242 [2] Ohc-File-Size: 16729 X-Cache-Status: HIT Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 03 00 00 00 6b ac 58 54 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 c0 50 4c 54 45 f9 f7 f4 ff ff ff 39 a0 7d 91 ca b7 f5 f3 f0 f2 ee ea d4 d4 d6 73 86 b4 5c 7a af 89 95 b7 db dc dd ec ec eb e5 e7 ea e4 eb f2 e3 e3 e3 da dd e3 f7 f6 fa 97 d2 fc 9b d3 fb d5 d6 da f5 d6 ad ff ec ba ff e3 ad f5 e9 d0 fe e7 b4 b3 d0 da ce e6 dc af b6 cc c8 cb d2 dd e2 e8 ec ec f2 f3 f1 ee ae d7 ef ec f2 f4 ce d2 d7 d0 e8 f3 5d 95 a1 6b bb c7 5e a8 d4 97 d0 e5 33 9a dc e7 db d0 e6 ce aa ad b0 b5 d8 b3 99 91 94 9b a6 9a 79 e2 99 5f 25 28 2c 5d 5f 61 3d 40 43 3b 69 ab d5 ca eb aa 96 d8 c4 99 e4 9b 61 e1 a5 6f e7 93 55 dd e6 d4 f3 f2 eb f9 d2 b1 eb b0 75 da c6 b5 d8 ef 8a 31 7a c5 4e b4 00 00 00 01 62 4b 47 44 01 ff 02 2d de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b [TRUNCATED] Data Ascii: PNGIHDRkXTgAMAasRGB cHRMz&u0`:pQ<PLTE9}s\z]k^3y_%(,]_a=@C;iaoUu1zNbKGD-pHYs~?IDATx}CviS8@6W\$Y%6[%G3fFd2'&i\|=ug'''3s01WQ?b!Dshv/#?W1]\|?;M=As?&Y?.S/RD#Dplgn_/)a? 07<q_@>=yK%5i?&:_@"?9Q,zWUVA1KryThSFL{:18~
Nov 26, 2024 08:20:35.921267033 CET	1236	IN	Data Raw: d9 3c b3 8d 3c 40 d9 83 44 e0 88 94 ec 71 7c 64 f6 11 30 07 5e 1d 6b eb 3e 06 80 2b 84 67 7a 00 a9 ca 8b 72 fc b4 77 a8 c0 24 44 13 10 7f 87 7f 9d 8b 21 13 00 d9 0b 9a e7 a2 61 12 93 a0 48 2b 37 76 48 76 91 38 8e 88 e0 b5 9e 57 04 e1 d0 28 10 30 Data Ascii: <<@Dq\|d0^k>+gzrw$D!aH+7vHv8W(0o9()o>&!~;X@<`%Gq)%$z;T&X\|$75+xHWW5~~)nErWA</~z#@Jxu
Nov 26, 2024 08:20:35.921268940 CET	388	IN	Data Raw: 6c 84 61 88 0e d3 6e 57 93 10 80 11 2a 00 4b 7b 4f 6b fc e7 b4 79 3c 0d 90 e8 df 90 df f2 35 49 7e 94 e4 46 3d cd 77 16 bd 55 47 1a 07 00 19 bb 91 46 f8 1c 00 c3 34 f0 4d cb 0e c2 bb 75 50 db af 6f df bf 0e fa 00 9a f6 c5 a2 a7 88 e8 0c f8 00 23 Data Ascii: lanW*K{Oky<5I~F=wUGF4MuPo#XT7@=TO;&V%Gxoc>86Rp5:"nzEj)[UCrEyc\YL?({yeQt\fStL\|)N{[NMi
Nov 26, 2024 08:20:35.924037933 CET	1236	IN	Data Raw: ae c2 d1 b2 5b 92 37 7b fe 3e f5 40 c7 00 30 64 ff fa d5 5f 3f be fc f0 a3 67 18 2f e2 93 d2 53 f2 ab b4 53 3f 67 d3 21 d9 bd a0 1c 90 fc c3 00 7c ef fc b4 4b 74 b1 c4 2f b1 12 9b 3d 3f ae 7f e4 8f 3f 22 f1 f2 f8 19 00 d4 ba 3d 12 9e d9 18 f3 6d Data Ascii: [7{>@0d_?g/SS?g!\|Kt/=??"=m+<8((M0Gtt0?>{y\|?>?)t+{4^Q"yRN^_b_1nog]TG/kOXQ,
Nov 26, 2024 08:20:35.924117088 CET	1236	IN	Data Raw: ed 0c 83 1c fd 61 32 9d da c6 7f 04 00 39 ef 1f cb d4 7a 18 f4 83 ec 62 8c b5 b7 64 e7 79 47 7e d7 43 47 01 42 b4 02 41 0e 03 14 0b c2 9f 28 e8 76 01 e5 10 19 74 0d 70 f5 63 5a 6a ed f1 fd 9b 38 3b bb 53 bb b8 3e 23 fb 14 f7 40 19 6a 73 c9 c2 0b Data Ascii: a29zbdyG~CGBA(vtpcZj8;S>#@jsq&v,,@: G"?*7]he/#akt"KM8($_1Xg)b=%?'N_RX5:N{C< =_ aPulD^$elMAT#e
Nov 26, 2024 08:20:35.924135923 CET	388	IN	Data Raw: fd cf f3 78 55 db 40 28 9d 45 e9 2b 16 f4 ec e5 70 f4 3f 00 a0 d1 67 a9 7d 9d 41 f0 bd b2 00 99 8c 3a 2e a8 01 80 ef 9b b5 61 95 10 5e c5 15 5a c1 ec e7 cf 73 05 c0 4a 9e 9f e4 6b 16 4c ad 84 48 f0 01 95 ef 19 e6 93 69 d9 83 d0 32 8a fe 76 4c 8c Data Ascii: xU@(E+p?g}A:.a^ZsJkLHi2vL9ipn,dcIsyS{#@0t~RY:N`k!.!JL".$e4ISF)AVTu:IAg5uNBo@8
Nov 26, 2024 08:20:35.926220894 CET	1236	IN	Data Raw: c3 f8 bc 4e 88 11 00 49 a4 0b a3 d1 14 91 a8 c3 ef b6 0b f0 6b 0d f0 e9 74 53 af 31 e7 45 5a c1 48 e3 58 7e 35 e9 09 e5 c6 6a 00 30 61 7d e4 60 e2 c7 a9 5b 0d 9c 21 49 00 94 ae 9b 46 0d 17 a0 81 88 35 09 5c f2 62 d8 f1 97 46 3e ec 68 14 20 0b a4 Data Ascii: NIktS1EZHX~5j0a}`[!IF5\bF>h 9kDtxJ%V0$92]HP%U\|P5e7DW<s@XT2d'BeX]G8-NU`~O}La>:7?;TAu[
Nov 26, 2024 08:20:35.926260948 CET	1236	IN	Data Raw: 1f f6 62 fb f6 f6 7a d8 ef f7 e2 4d 2c d5 d4 97 b2 2c f0 65 08 00 27 6a b1 a0 1f 4d 3f 5f 11 2c 0b 9a 77 27 46 d7 16 44 06 00 31 a7 77 eb c5 c6 18 00 90 f4 7f 21 00 49 f2 7b b7 d9 8a 3d 79 01 00 e0 0d 04 de c1 9f fd 76 27 f6 c9 01 d0 39 6c 18 00 Data Ascii: bzM,,e'jM?_,w'FD1w!I{=yv'9l*E%P-Lbt`)U`%K!4@QBo~v#Q8]X,P.3v?n]r4r-g245[k=~u{Hn)
Nov 26, 2024 08:20:35.926270962 CET	388	IN	Data Raw: d3 94 37 c4 94 f5 7a 58 e8 7b 52 5f 7f bd ee 36 35 02 af c6 53 99 65 9a 54 03 40 7d d7 93 d9 cc 72 19 7e dd 81 21 01 08 7a 79 90 01 b5 fb 51 63 5e 28 3a 04 7a 91 1a 2b ec da 07 8e 21 01 fc 77 3b b9 ca de 6f d5 80 07 de ef f7 87 2d 67 5a 30 ed b2 Data Ascii: 7zX{R_65SeT@}r~!zyQc^(:z+!w;o-gZ0[BQ;@=:PMf@OeAuVUVu+oAuU%60KY"z1HP]Bo%j3~u[hql7{)&T7!;>
Nov 26, 2024 08:20:35.928896904 CET	1236	IN	Data Raw: 60 47 d5 7c 0d 1f 58 9d c5 9a fe 66 c1 e7 b1 fc 3b 6f 00 10 d6 fd b3 95 91 66 97 11 b0 4a 07 1d 25 01 d4 fb c3 2b 69 3d 90 c0 eb 0e 00 00 99 01 80 b7 fd 66 b7 07 a1 b7 0a 80 2d a2 04 6f 47 0b f2 9d 04 80 bc 60 dd 4b dc d2 00 f2 cb d4 77 3a 39 67 Data Ascii: `G\|Xf;ofJ%+i=f-oG`Kw:9gHl;x\3%.9</I[auQH.NIO\mblH ,-M`=ZfJ@H(9XrBN\|d3P.K
Nov 26, 2024 08:20:36.041493893 CET	1236	IN	Data Raw: 47 5e 54 ee 1a af d2 0e 1b 92 25 06 4a ae c9 6e 04 bd 06 54 cd e2 03 2c 58 58 24 60 b0 20 2f e1 1c 9f 25 87 df 52 1e bf 62 8e 2a 1e ca 3b 99 ee 69 e9 44 ef ef dd 00 44 2d 00 68 1f a0 95 17 ad c8 f4 bd aa b7 18 4d ba e4 71 bd d5 93 09 51 cf 60 c1 Data Ascii: G^T%JnT,XX$` /%Rb;iDD-hMqQ`>JXIK-wcnBw)'&~t\\BzdT 0z7+([0OU(<N7Ky"&OVTNfu-oY;E9D!jJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49954	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:35.635894060 CET	475	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605633310&callback=BMap.logCbk7886880435&sign=3e06f861dce5 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:37.259377003 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:36 GMT Expires: Wed, 27 Nov 2024 07:20:36 GMT Http_x_bd_logid: 1236976543 Http_x_bd_logid64: 1236976380373367818 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=8B5E483D9B79A7D5117B8555875D66D1:FG=1; expires=Wed, 26-Nov-25 07:20:36 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=CAE72DEB0B838A6C361094F3FFE21204:FG=1; expires=Wed, 26-Nov-25 07:20:36 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12369765432732931082112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 38 38 36 38 38 30 34 33 35 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 38 38 36 38 38 30 34 33 35 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7886880435 && BMap.logCbk7886880435({"result":{"error":0}})
Nov 26, 2024 08:20:38.175692081 CET	476	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605636310&callback=BMap.logCbk7658843111&sign=c2c7c7c838f9 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:38.739294052 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:38 GMT Expires: Wed, 27 Nov 2024 07:20:38 GMT Http_x_bd_logid: 1238456962 Http_x_bd_logid64: 1238456730303685898 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=4006FBC32D340DB91033295F635429EE:FG=1; expires=Wed, 26-Nov-25 07:20:38 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=7BACC120A76C3CD3BFB7096937707F3E:FG=1; expires=Wed, 26-Nov-25 07:20:38 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12384569620681523210112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 36 35 38 38 34 33 31 31 31 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 36 35 38 38 34 33 31 31 31 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7658843111 && BMap.logCbk7658843111({"result":{"error":0}})
Nov 26, 2024 08:20:45.041651011 CET	683	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk9486&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643765&sign=c3a2f6498151 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:45.629959106 CET	873	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:45 GMT Expires: Wed, 27 Nov 2024 07:20:45 GMT Http_x_bd_logid: 1245332063 Http_x_bd_logid64: 1245332410591741194 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=A639095EF452FA372690AD6B51E93462:FG=1; expires=Wed, 26-Nov-25 07:20:45 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=C4FE9F36F10D760E273E243203BF6186:FG=1; expires=Wed, 26-Nov-25 07:20:45 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12453320632745120778112615 Content-Length: 91 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 39 34 38 36 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 39 34 38 36 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk9486 && BMap._rd._cbk9486({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:20:45.911714077 CET	475	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605644762&callback=BMap.logCbk4966028254&sign=dc2c45f39f3d HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:46.477880955 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:46 GMT Expires: Wed, 27 Nov 2024 07:20:46 GMT Http_x_bd_logid: 1246193112 Http_x_bd_logid64: 1246193702374229258 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=6DD96441683CB79B580DE3A1A531E549:FG=1; expires=Wed, 26-Nov-25 07:20:46 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=A0254F14600978278D831F853AA5F0D9:FG=1; expires=Wed, 26-Nov-25 07:20:46 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12461931121285634058112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 39 36 36 30 32 38 32 35 34 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 39 36 36 30 32 38 32 35 34 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk4966028254 && BMap.logCbk4966028254({"result":{"error":0}})
Nov 26, 2024 08:20:46.602194071 CET	770	OUT	GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk94280&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605645452&sign=b5626638a8cf HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:47.186405897 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:46 GMT Expires: Wed, 27 Nov 2024 07:20:46 GMT Http_x_bd_logid: 1246886452 Http_x_bd_logid64: 1246886480646176010 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=6DD96441683CB79BCA615544300E2190:FG=1; expires=Wed, 26-Nov-25 07:20:46 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=A0254F146009782746820B1F0EE668D0:FG=1; expires=Wed, 26-Nov-25 07:20:46 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12468864520365110282112615 Transfer-Encoding: chunked Data Raw: 35 31 30 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 39 34 32 38 30 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 39 34 32 38 30 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 510/**/BMap._rd._cbk94280 && BMap._rd._cbk94280({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type
Nov 26, 2024 08:20:47.186559916 CET	862	IN	Data Raw: 22 3a 32 2c 22 75 70 5f 70 72 6f 76 69 6e 63 65 5f 6e 61 6d 65 22 3a 22 5c 75 35 65 37 66 5c 75 34 65 31 63 5c 75 37 37 30 31 22 7d 2c 22 65 72 72 5f 6d 73 67 22 3a 22 22 2c 22 68 6f 74 5f 63 69 74 79 22 3a 5b 22 5c 75 35 33 31 37 5c 75 34 65 61 Data Ascii: ":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315"
Nov 26, 2024 08:20:56.032382965 CET	509	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=36261355&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:56.587937117 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:56 GMT Etag: "6731c1a3-31" Expires: Wed, 27 Nov 2024 07:20:56 GMT Http_x_bd_logid: 1256309130 Http_x_bd_logid64: 1256309622835731466 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:34:43 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=F0F3CC050F74144863C162C34169D276:FG=1; expires=Wed, 26-Nov-25 07:20:56 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:56.658068895 CET	491	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=88431406&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:57.220202923 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:56 GMT Etag: "6731c1c5-31" Expires: Wed, 27 Nov 2024 07:20:56 GMT Http_x_bd_logid: 1256940170 Http_x_bd_logid64: 1256940750693820682 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:17 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=F0F3CC050F7414486CEBF90A8473FA3C:FG=1; expires=Wed, 26-Nov-25 07:20:56 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:21:04.468347073 CET	688	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk13991&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605662820&sign=9c0b3cebc48d HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:05.049750090 CET	875	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:04 GMT Expires: Wed, 27 Nov 2024 07:21:04 GMT Http_x_bd_logid: 1264756961 Http_x_bd_logid64: 1264756411772173322 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=E70A184D23123A9518E8F8F52F3B2130:FG=1; expires=Wed, 26-Nov-25 07:21:04 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=19884791F1DD79554173B20515FA4151:FG=1; expires=Wed, 26-Nov-25 07:21:04 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12647569612610116618112615 Content-Length: 93 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 31 33 39 39 31 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 31 33 39 39 31 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk13991 && BMap._rd._cbk13991({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:21:05.056642056 CET	475	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605663832&callback=BMap.logCbk6527070280&sign=052f50e74c7f HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:05.620331049 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:05 GMT Expires: Wed, 27 Nov 2024 07:21:05 GMT Http_x_bd_logid: 1265338189 Http_x_bd_logid64: 1265338760381232906 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=2D5F5F4E6045B5F3D9A9C24332B90015:FG=1; expires=Wed, 26-Nov-25 07:21:05 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=93A9A70719CAB6FC5E6C59F8E71DA102:FG=1; expires=Wed, 26-Nov-25 07:21:05 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12653381890365110282112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 35 32 37 30 37 30 32 38 30 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 35 32 37 30 37 30 32 38 30 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk6527070280 && BMap.logCbk6527070280({"result":{"error":0}})
Nov 26, 2024 08:21:12.660648108 CET	509	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=61124107&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:13.223781109 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:21:12 GMT Etag: "6731c1c7-31" Expires: Wed, 27 Nov 2024 07:21:12 GMT Http_x_bd_logid: 1272944490 Http_x_bd_logid64: 1272944252714248202 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:19 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=64EDAA3875D32F353A2BBA6AD844CE0C:FG=1; expires=Wed, 26-Nov-25 07:21:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49956	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:35.933228970 CET	709	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk71768&seckey=QjkmsigYB6FtJVS1%2B1zLo3HgtAKKBPGXjdHORl8hRVE%3D%2CmT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7&timeStamp=1732605632385&sign=ca9adc6fe98e HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:37.510145903 CET	518	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:37 GMT Expires: Wed, 27 Nov 2024 07:20:37 GMT Http_x_bd_logid: 1237226630 Http_x_bd_logid64: 1237226650648558602 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12372266302978101258112615 Content-Length: 121 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 31 37 36 38 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 31 37 36 38 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk71768 && BMap._rd._cbk71768({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49957	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:36.381658077 CET	492	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605634322&callback=BMap.logCbk1399821954&sign=d2ba6044c010 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:37.964751959 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:37 GMT Expires: Wed, 27 Nov 2024 07:20:37 GMT Http_x_bd_logid: 1237682058 Http_x_bd_logid64: 1237682842902841098 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12376820582739232266112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 31 33 39 39 38 32 31 39 35 34 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 31 33 39 39 38 32 31 39 35 34 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk1399821954 && BMap.logCbk1399821954({"result":{"error":0}})
Nov 26, 2024 08:20:46.121797085 CET	466	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=31034223&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:46.674304962 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:46 GMT Etag: "6731c229-31" Expires: Wed, 27 Nov 2024 07:20:46 GMT Http_x_bd_logid: 1246395307 Http_x_bd_logid64: 1246395750793067786 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:57 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:56.856901884 CET	493	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605655021&callback=BMap.logCbk4406923950&sign=3878eae1f10c HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:57.422368050 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:57 GMT Expires: Wed, 27 Nov 2024 07:20:57 GMT Http_x_bd_logid: 1257138042 Http_x_bd_logid64: 1257138690303685898 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12571380420792543498112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 34 30 36 39 32 33 39 35 30 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 34 30 36 39 32 33 39 35 30 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk4406923950 && BMap.logCbk4406923950({"result":{"error":0}})
Nov 26, 2024 08:21:05.058376074 CET	706	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk13991&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605662820&sign=9c0b3cebc48d HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:05.623552084 CET	489	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:05 GMT Expires: Wed, 27 Nov 2024 07:21:05 GMT Http_x_bd_logid: 1265332671 Http_x_bd_logid64: 1265332513709391882 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12653326712745120778112615 Content-Length: 93 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 31 33 39 39 31 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 31 33 39 39 31 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk13991 && BMap._rd._cbk13991({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:21:05.837199926 CET	792	OUT	GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk76389&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605663341&sign=b91f519b6f46 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:06.419558048 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:06 GMT Expires: Wed, 27 Nov 2024 07:21:06 GMT Http_x_bd_logid: 1266116385 Http_x_bd_logid64: 1266116750634397706 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12661163852978101258112615 Transfer-Encoding: chunked Data Raw: 35 31 30 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 36 33 38 39 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 36 33 38 39 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 510/**/BMap._rd._cbk76389 && BMap._rd._cbk76389({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"
Nov 26, 2024 08:21:06.419879913 CET	471	IN	Data Raw: 22 2c 22 74 69 6d 65 22 3a 30 2c 22 74 79 70 65 22 3a 34 2c 22 71 74 22 3a 22 63 65 6e 22 2c 22 62 22 3a 22 31 32 37 30 33 38 37 33 2e 31 2c 32 35 36 30 39 36 30 2e 30 37 3b 31 32 37 30 34 31 39 33 2e 30 34 2c 32 35 36 31 31 39 39 2e 39 39 22 2c Data Ascii: ","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk76389","timeStamp":"1732605663341","sign":"b91f519b6f46"},"uii_err":0,"a
Nov 26, 2024 08:21:06.620639086 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49959	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:36.499984026 CET	448	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=16384724&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:38.056653976 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:37 GMT Etag: "6731c1c4-31" Expires: Wed, 27 Nov 2024 07:20:37 GMT Http_x_bd_logid: 1237786521 Http_x_bd_logid64: 1237786100533210122 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:16 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:46.121670961 CET	675	OUT	GET /getmodules?v=2.0&t=20140707&mod=newvectordrawlib_phku2t&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643775&sign=1aae87229181 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:46.676496029 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:46 GMT Expires: Wed, 27 Nov 2024 07:20:46 GMT Http_x_bd_logid: 1246399753 Http_x_bd_logid64: 1246399763045252362 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12463997531288513802112615 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 33 65 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 3b 6b 77 9b b8 b6 df ef af 70 99 39 1e a8 15 0c ce a3 1d 13 d5 2b cf be db b4 49 3b d3 eb f8 66 09 10 04 07 83 03 38 b1 13 fb bf df bd 25 81 b1 93 74 66 ce 3d eb 9e 39 0d 7a 6e 6d 6d ed b7 e4 f6 f3 e7 ed 8b 61 1e a7 cc ef 34 9b 65 49 ff 2d e1 b7 37 dc 2b d2 cc cf d8 6d 1c b9 bf 91 c6 6f c1 24 f1 8a 28 4d 1a a7 a1 ce 8c fb e2 32 ca cd 0f 6f 69 ea 88 d2 15 9d 9a a9 3b 84 49 26 9f 16 3c f1 75 36 9f df 2f c8 fd 9b cb 6e ba 30 9c 2f be e9 b1 38 d6 71 30 91 33 0c 39 f3 28 a4 f7 0b 59 c4 d5 b9 4f af 65 ed 72 42 c7 b2 74 78 40 af 17 a7 a1 39 ce d2 22 2d 66 63 4e 01 c1 c6 17 df 69 d4 1b cd 8c d1 12 49 c4 30 0a f4 67 35 b0 0a 65 b5 46 ea dc b0 ac e1 52 6c 73 5c 73 c4 c6 94 c1 37 70 a9 a8 40 a1 6a 15 d3 a6 72 a8 e8 4b 99 ae 70 ff ac 5a a7 ae 79 05 15 d9 b8 e7 2d 87 ee 9b 3e bf 89 3c 7e 12 4d 79 fc 95 01 6a 00 f6 60 0a 5b 74 cd cb 0f b0 3f d7 3c e5 14 67 e7 c5 2c e6 f3 b9 96 a4 d9 88 c5 1a 0e 4b 96 1d a7 45 36 9f e3 e8 d7 d7 b4 63 59 50 38 e4 62 b6 cf 29 d6 ee 14 [TRUNCATED] Data Ascii: 3e6;kwp9+I;f8%tf=9znmma4eI-7+mo$(M2oi;I&<u6/n0/8q039(YOerBtx@9"-fcNiI0g5eFRls\s7p@jrKpZy-><~Myj`[t?<g,KE6cYP8b)"kznb+fl<8b_F;n+o~\~OSMwdbGfgTtf$,.{y=`+\|'(yq]iQ?g$BqW!,tR+Mt$5b%/,+g"$zaZQ9As=5FWESyfz\|=M;af5^AIE.{zDa,NcZz]}2pE1cR{X\^`t4LN)`w0z.,/IMV~eH=(L~2%KW~Q:9ovr.Ch[b?E::(_wvP,,OxBW nK
Nov 26, 2024 08:20:46.676521063 CET	1236	IN	Data Raw: 4a 1d a1 14 84 1e 50 44 e2 14 97 bf d0 5a 65 3b e1 2d aa 01 44 81 56 4f 22 47 b5 16 4f bc d4 e7 df be be 3d 48 47 e3 34 81 ad 00 9e 20 95 ab 40 98 98 0d 38 cb d9 72 ed c8 87 f9 20 51 41 6b a9 bb 5d e6 dc 46 89 9f de f6 83 c1 d2 b0 b8 84 cb 3d 0c Data Ascii: JPDZe;-DVO"GO=HG4 @8r QAk]F=i`\|?GeN\m/mm8GJU5TwfxP8?.(}`%}<oTZ8yKhq%CCco[17b8 dxmM$U
Nov 26, 2024 08:20:46.676537037 CET	1236	IN	Data Raw: ae 00 66 3d 5d 06 3f d2 bf d9 43 78 ef aa fa 9b a0 2a 98 f9 6d 04 2e ea 59 8a 70 ba 8f 0f f9 86 98 5f 1d fe 14 f3 25 de bd 65 50 01 7e 52 81 ec a6 8e c0 9b 64 60 c1 a9 36 4e 23 0c 14 b5 e5 0e bf 9a 37 33 9a 96 1e 5e d5 72 4d 7e 0e ea 59 3d 99 f3 Data Ascii: f=]?Cxm.Yp_%eP~Rd`6N#73^rM~Y=Jk\Q4N+ptG3MrnrwgEIuI:.I >Tv5~ h[hfi%gRN\UoX2*],4pHfgJEb
Nov 26, 2024 08:20:46.676635027 CET	1236	IN	Data Raw: 60 a5 c1 49 4d cd 93 b7 87 78 09 95 5f a6 b7 e2 ca f0 93 a7 df 5f 72 26 d4 e4 72 d4 61 94 91 31 86 0e b5 b6 13 ac 83 e3 ea 3c 8e 24 e6 b3 5d e0 79 e5 12 94 79 ec 4d db ea d8 cd a5 42 2b e0 eb c3 37 48 e8 fe 47 40 19 b4 a5 48 72 93 d9 2a bd ca f8 Data Ascii: `IMx__r&ra1<$]yyMB+7HG@HrE/SvA3C<JhBMV/(,\|c"\|vO?tWpDW_-S7.?Xwu[$2QDq$^ElzT[6J0+)9f
Nov 26, 2024 08:20:46.676656008 CET	1236	IN	Data Raw: 4a 05 b2 5a 93 41 50 a6 b5 96 b7 e3 a2 ea e1 82 e0 fe 80 61 83 10 40 df dc c1 a7 0e 61 3f 02 ed 02 8e 7c 0c 0a a6 19 a3 e6 ce a9 1b 12 3f 68 8a 4b c2 a6 7a f9 33 8e 9b 81 ca 47 c0 c9 5b 9d d5 c7 2b 08 08 1f b8 2c 5d fd 18 1f 5c 04 82 3b c0 35 94 Data Ascii: JZAPa@a?\|?hKz3G[+,]\;5Jq-UB7\?$~DC"#cb<#M<\\R9 nn8@4@tfGbX'#Ow2\| ^Y>R?9FDv
Nov 26, 2024 08:20:46.676672935 CET	1236	IN	Data Raw: a5 da cf e4 83 d8 4f 0d 82 44 e7 fe 67 dc db 58 65 df 08 d8 77 b8 64 df 08 54 51 b4 c6 be 11 b2 6f a4 d8 f7 91 cd 39 0f 30 76 1e 62 ec ac ef d3 59 f2 ac e3 3f e0 7a 25 87 2b d4 f1 d7 a9 e3 3f a4 8e 2f a8 53 17 07 88 bc ee 56 7d d2 32 e1 8c 84 20 Data Ascii: ODgXewdTQo90vbY?z%+?/SV}2 ^XDv(JpFO1e}D kE)-PsA#2hUaaK\`> :OF?1\2wC4~tX:fj"-#DJgz<xoX]
Nov 26, 2024 08:20:46.676690102 CET	118	IN	Data Raw: 06 ea 45 32 84 49 36 26 5b d4 40 db 51 77 b8 9e ba c3 ed 74 55 4f 07 46 f5 ec ae 25 af 5d b7 ba e2 b3 23 3f 2f e5 c7 b6 ca c1 5b 22 6f 62 5b af d4 1c f0 a4 d8 24 2e ca 6e 0b 10 3e 5d 47 b8 0c 6a d1 08 b3 ca 6d 81 f2 32 d8 9a cf 57 7e 54 2b ca b5 Data Ascii: E2I6&[@QwtUOF%]#?/["ob[$.n>]Gjm2W~T+P_,?Bqc&B0
Nov 26, 2024 08:20:46.745676994 CET	448	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=53200280&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:47.290728092 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:47 GMT Etag: "6731c227-31" Expires: Wed, 27 Nov 2024 07:20:47 GMT Http_x_bd_logid: 1247020230 Http_x_bd_logid64: 1247020113779142666 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:55 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:47.478554964 CET	492	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605645776&callback=BMap.logCbk6226715041&sign=2072cc6b2c46 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:48.039172888 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:47 GMT Expires: Wed, 27 Nov 2024 07:20:47 GMT Http_x_bd_logid: 1247759809 Http_x_bd_logid64: 1247759382430608394 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12477598091820473354112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 32 32 36 37 31 35 30 34 31 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 32 32 36 37 31 35 30 34 31 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk6226715041 && BMap.logCbk6226715041({"result":{"error":0}})
Nov 26, 2024 08:20:48.461669922 CET	495	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605646761&callback=BMap.logCbk8973956757&sign=57d54babd95e HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:49.010288954 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:48 GMT Expires: Wed, 27 Nov 2024 07:20:48 GMT Http_x_bd_logid: 1248737921 Http_x_bd_logid64: 1248737292902841098 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12487379211187274250112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 39 37 33 39 35 36 37 35 37 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 39 37 33 39 35 36 37 35 37 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk8973956757 && BMap.logCbk8973956757({"result":{"error":0}})
Nov 26, 2024 08:20:51.319958925 CET	494	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605648766&callback=BMap.logCbk9348424000&sign=6391d8f0bbc3 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:51.871335030 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:51 GMT Expires: Wed, 27 Nov 2024 07:20:51 GMT Http_x_bd_logid: 1251599858 Http_x_bd_logid64: 1251599970656986634 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12515998582529240074112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 39 33 34 38 34 32 34 30 30 30 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 39 33 34 38 34 32 34 30 30 30 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk9348424000 && BMap.logCbk9348424000({"result":{"error":0}})
Nov 26, 2024 08:20:55.774171114 CET	701	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk5925&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLo5Cn9S0I2rb%2FJ1brfUmjqgY%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605654023&sign=6d791134464b HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:56.329585075 CET	487	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:56 GMT Expires: Wed, 27 Nov 2024 07:20:56 GMT Http_x_bd_logid: 1256049298 Http_x_bd_logid64: 1256049300188883978 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12560492982745120778112615 Content-Length: 91 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 35 39 32 35 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 35 39 32 35 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk5925 && BMap._rd._cbk5925({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:20:56.594856977 CET	466	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=36261355&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:57.144293070 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:56 GMT Etag: "6731c204-31" Expires: Wed, 27 Nov 2024 07:20:56 GMT Http_x_bd_logid: 1256873679 Http_x_bd_logid64: 1256873452438651146 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:20 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:57.228522062 CET	448	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=88431406&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:57.780499935 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:57 GMT Etag: "6731c1e3-31" Expires: Wed, 27 Nov 2024 07:20:57 GMT Http_x_bd_logid: 1257507179 Http_x_bd_logid64: 1257507552901227530 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:47 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:20:57.822706938 CET	492	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605656020&callback=BMap.logCbk8136133267&sign=a194ed09867f HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:58.368743896 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:58 GMT Expires: Wed, 27 Nov 2024 07:20:58 GMT Http_x_bd_logid: 1258096654 Http_x_bd_logid64: 1258096672600982282 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12580966541435514890112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 31 33 36 31 33 33 32 36 37 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 31 33 36 31 33 33 32 36 37 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk8136133267 && BMap.logCbk8136133267({"result":{"error":0}})
Nov 26, 2024 08:20:59.046977043 CET	495	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605657349&callback=BMap.logCbk1914489283&sign=d18613173a5c HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:59.595877886 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:59 GMT Expires: Wed, 27 Nov 2024 07:20:59 GMT Http_x_bd_logid: 1259323876 Http_x_bd_logid64: 1259323202957263114 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12593238760798898186112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 31 39 31 34 34 38 39 32 38 33 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 31 39 31 34 34 38 39 32 38 33 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk1914489283 && BMap.logCbk1914489283({"result":{"error":0}})
Nov 26, 2024 08:21:05.057210922 CET	713	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk394&seckey=QjkmsigYB6FtJVS1%2B1zLo%2BhcfjF4ryq%2BiggJNs%2BpaFs%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605662833&sign=f2ae8e43acc7 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:05.605143070 CET	514	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:05 GMT Expires: Wed, 27 Nov 2024 07:21:05 GMT Http_x_bd_logid: 1265332120 Http_x_bd_logid64: 1265332091978284042 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12653321200312904970112615 Content-Length: 117 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 33 39 34 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 33 39 34 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk394 && BMap._rd._cbk394({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})
Nov 26, 2024 08:21:05.624228001 CET	493	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605663832&callback=BMap.logCbk6527070280&sign=052f50e74c7f HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:06.175004005 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:05 GMT Expires: Wed, 27 Nov 2024 07:21:05 GMT Http_x_bd_logid: 1265899880 Http_x_bd_logid64: 1265899390348333066 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12658998802732931082112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 35 32 37 30 37 30 32 38 30 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 36 35 32 37 30 37 30 32 38 30 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk6527070280 && BMap.logCbk6527070280({"result":{"error":0}})
Nov 26, 2024 08:21:06.188363075 CET	466	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=83407359&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:06.738096952 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:21:06 GMT Etag: "6731c1ee-31" Expires: Wed, 27 Nov 2024 07:21:06 GMT Http_x_bd_logid: 1266467750 Http_x_bd_logid64: 1266467950206299402 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:58 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:21:06.790052891 CET	448	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=65184113&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:07.562913895 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:21:07 GMT Etag: "6731c1e4-31" Expires: Wed, 27 Nov 2024 07:21:07 GMT Http_x_bd_logid: 1267067954 Http_x_bd_logid64: 1267067950634397706 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:48 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:21:07.711029053 CET	468	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:21:07 GMT Etag: "6731c1e4-31" Expires: Wed, 27 Nov 2024 07:21:07 GMT Http_x_bd_logid: 1267067954 Http_x_bd_logid64: 1267067950634397706 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:35:48 GMT Server: apache Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:21:08.232968092 CET	495	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605666438&callback=BMap.logCbk7242563566&sign=08745cff6d53 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:08.781646967 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:08 GMT Expires: Wed, 27 Nov 2024 07:21:08 GMT Http_x_bd_logid: 1268508185 Http_x_bd_logid64: 1268508772368553226 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12685081850395393034112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 32 34 32 35 36 33 35 36 36 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 32 34 32 35 36 33 35 36 36 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7242563566 && BMap.logCbk7242563566({"result":{"error":0}})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49960	45.113.194.211	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:36.529666901 CET	474	OUT	GET /tb/pms/img/st.gif?ts=4&t=pageview&sid=m3y4npye3nz&ver=5&pid=241&px=12801024&ref=http%3A%2F%2Fwww.wheel-done.com%2F&page=18_1&p=18&dv=6&cmd=open HTTP/1.1 Host: static.tieba.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:38.130460978 CET	273	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Connection: keep-alive Content-Length: 43 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:20:37 GMT Etag: "51e62f22-2b" Last-Modified: Wed, 17 Jul 2013 05:44:02 GMT Server: Apache Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:21:04.672804117 CET	479	OUT	GET /tb/pms/img/st.gif?ts=1&t=pageview&sid=m3y4odhwass&ver=5&pid=241&px=12801024&ref=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&page=18_1&p=18&dv=6&cmd=open HTTP/1.1 Host: static.tieba.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:05.260683060 CET	273	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Connection: keep-alive Content-Length: 43 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:21:04 GMT Etag: "51e62f22-2b" Last-Modified: Wed, 17 Jul 2013 05:44:02 GMT Server: Apache Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49961	180.76.11.230	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:37.293114901 CET	493	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605633310&callback=BMap.logCbk7886880435&sign=3e06f861dce5 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:38.059668064 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:37 GMT Expires: Wed, 27 Nov 2024 07:20:37 GMT Http_x_bd_logid: 1237784392 Http_x_bd_logid64: 1237784490550478602 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12377843922610116618112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 38 38 36 38 38 30 34 33 35 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 38 38 36 38 38 30 34 33 35 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7886880435 && BMap.logCbk7886880435({"result":{"error":0}})
Nov 26, 2024 08:20:38.743915081 CET	494	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605636310&callback=BMap.logCbk7658843111&sign=c2c7c7c838f9 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:39.287448883 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:39 GMT Expires: Wed, 27 Nov 2024 07:20:39 GMT Http_x_bd_logid: 1239015563 Http_x_bd_logid64: 1239015571994864650 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12390155631296253194112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 36 35 38 38 34 33 31 31 31 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 36 35 38 38 34 33 31 31 31 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7658843111 && BMap.logCbk7658843111({"result":{"error":0}})
Nov 26, 2024 08:20:45.634049892 CET	701	OUT	GET /?qt=business&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk9486&v=2.1&seckey=QjkmsigYB6FtJVS1%2B1zLoxMip0%2FpLUudvIIFW8KvRUQ%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605643765&sign=c3a2f6498151 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:46.193459034 CET	487	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:45 GMT Expires: Wed, 27 Nov 2024 07:20:45 GMT Http_x_bd_logid: 1245908411 Http_x_bd_logid64: 1245908043440956426 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12459084112829006858112615 Content-Length: 91 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 39 34 38 36 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 39 34 38 36 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 31 2c 22 75 6e 61 75 74 68 22 3a 30 7d 7d 29 Data Ascii: /**/BMap._rd._cbk9486 && BMap._rd._cbk9486({"error":0,"content":{"business":1,"unauth":0}})
Nov 26, 2024 08:20:46.482542038 CET	493	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=instance&func=user&subfunc=&t=1732605644762&callback=BMap.logCbk4966028254&sign=dc2c45f39f3d HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:47.051851988 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:46 GMT Expires: Wed, 27 Nov 2024 07:20:46 GMT Http_x_bd_logid: 1246758001 Http_x_bd_logid64: 1246758302564433674 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12467580010395393034112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 39 36 36 30 32 38 32 35 34 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 34 39 36 36 30 32 38 32 35 34 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk4966028254 && BMap.logCbk4966028254({"result":{"error":0}})
Nov 26, 2024 08:20:56.819262981 CET	788	OUT	GET /?qt=cen&b=12703873.1%2C2560960.07%3B12704193.04%2C2561199.99&l=18&ie=utf-8&oue=1&fromproduct=jsapi&v=2.1&callback=BMap._rd._cbk39410&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&seckey=QjkmsigYB6FtJVS1%2B1zLo5Cn9S0I2rb%2FJ1brfUmjqgY%3D%2CmT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC&timeStamp=1732605654538&sign=c2a16d70705c HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:20:57.395380020 CET	1236	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:20:57 GMT Expires: Wed, 27 Nov 2024 07:20:57 GMT Http_x_bd_logid: 1257098377 Http_x_bd_logid64: 1257098482961431818 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12570983772656740106112615 Transfer-Encoding: chunked Data Raw: 35 31 31 0d 0a 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 33 39 34 31 30 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 33 39 34 31 30 28 7b 22 62 6f 75 6e 64 5f 72 61 6e 6b 5f 70 61 72 61 6d 73 22 3a 7b 22 6e 63 22 3a 31 7d 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 62 75 73 69 6e 65 73 73 22 3a 22 5c 75 34 65 31 63 5c 75 39 35 65 38 2c 5c 75 34 65 30 37 5c 75 38 63 36 31 5c 75 35 37 63 65 2c 5c 75 35 36 66 64 5c 75 38 64 33 38 22 2c 22 64 69 73 74 72 69 63 74 22 3a 22 5c 75 37 66 30 33 5c 75 36 39 34 31 5c 75 37 62 62 39 5c 75 39 33 35 36 22 2c 22 6e 61 6d 65 22 3a 22 5c 75 36 64 66 31 5c 75 35 37 33 33 5c 75 35 65 30 32 22 2c 22 73 75 70 5f 62 75 73 22 3a 31 2c 22 73 75 70 5f 6c 75 6b 75 61 6e 67 22 3a 31 2c 22 73 75 70 5f 73 75 62 77 61 79 22 3a 31 2c 22 74 79 70 65 22 3a 33 2c 22 75 69 64 22 3a 33 34 30 7d 2c 22 63 75 72 72 65 6e 74 5f 63 69 74 79 22 3a 7b 22 63 6f 64 65 22 3a 33 34 30 2c 22 67 65 6f 22 3a 22 2e 3d 68 7a 33 72 4c 42 44 33 37 51 50 41 3b 22 2c 22 6c 65 76 65 6c 22 3a 31 [TRUNCATED] Data Ascii: 511/**/BMap._rd._cbk39410 && BMap._rd._cbk39410({"bound_rank_params":{"nc":1},"content":{"business":"\u4e1c\u95e8,\u4e07\u8c61\u57ce,\u56fd\u8d38","district":"\u7f03\u6941\u7bb9\u9356","name":"\u6df1\u5733\u5e02","sup_bus":1,"sup_lukuang":1,"sup_subway":1,"type":3,"uid":340},"current_city":{"code":340,"geo":".=hz3rLBD37QPA;","level":12,"name":"\u6df1\u5733\u5e02","sup":1,"sup_bus":1,"sup_business_area":1,"sup_lukuang":1,"sup_subway":1,"type":2,"up_province_name":"\u5e7f\u4e1c\u7701"},"err_msg":"","hot_city":["\u5317\u4eac\u5e02\|131","\u4e0a\u6d77\u5e02\|289","\u5e7f\u5dde\u5e02\|257","\u6df1\u5733\u5e02\|340","\u6210\u90fd\u5e02\|75","\u5929\u6d25\u5e02\|332","\u5357\u4eac\u5e02\|315","\u676d\u5dde\u5e02\|179","\u6b66\u6c49\u5e02\|218","\u91cd\u5e86\u5e02\|132"],"result":{"data_security_filt_res":0,"error":0,"illegal":0,"qid":"
Nov 26, 2024 08:20:57.395395041 CET	477	IN	Data Raw: 22 2c 22 74 69 6d 65 22 3a 30 2c 22 74 79 70 65 22 3a 34 2c 22 71 74 22 3a 22 63 65 6e 22 2c 22 62 22 3a 22 31 32 37 30 33 38 37 33 2e 31 2c 32 35 36 30 39 36 30 2e 30 37 3b 31 32 37 30 34 31 39 33 2e 30 34 2c 32 35 36 31 31 39 39 2e 39 39 22 2c Data Ascii: ","time":0,"type":4,"qt":"cen","b":"12703873.1,2560960.07;12704193.04,2561199.99","l":"18","ie":"utf-8","oue":"1","fromproduct":"jsapi","v":"2.1","callback":"BMap._rd._cbk39410","timeStamp":"1732605654538","sign":"c2a16d70705c"},"uii_err":0,"a
Nov 26, 2024 08:21:06.529532909 CET	492	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=marker&subfunc=&t=1732605664831&callback=BMap.logCbk7081181651&sign=69830daf9dbb HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:07.082798004 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:06 GMT Expires: Wed, 27 Nov 2024 07:21:06 GMT Http_x_bd_logid: 1266809827 Http_x_bd_logid64: 1266809480188883978 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12668098270798898186112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 30 38 31 31 38 31 36 35 31 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 30 38 31 31 38 31 36 35 31 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7081181651 && BMap.logCbk7081181651({"result":{"error":0}})
Nov 26, 2024 08:21:08.532444954 CET	494	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=layer&func=normal_map&subfunc=&t=1732605666827&callback=BMap.logCbk8321850506&sign=0f11f3707dae HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
Nov 26, 2024 08:21:09.082361937 CET	470	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:08 GMT Expires: Wed, 27 Nov 2024 07:21:08 GMT Http_x_bd_logid: 1268805206 Http_x_bd_logid64: 1268805250550478602 Http_x_bd_product: map Http_x_bd_subsys: apimap Server: apache Tracecode: 12688052060227424266112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 33 32 31 38 35 30 35 30 36 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 38 33 32 31 38 35 30 35 30 36 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk8321850506 && BMap.logCbk8321850506({"result":{"error":0}})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49859	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:38.916343927 CET	745	OUT	GET /js/report?b_pi=036757da3bf4da65&b_a_i=3008&b_sv=1.1&b_cdci=null&b_ai=28088389&b_ba=28088389&b_bw=1&b_bi=0&u_u=http%3A%2F%2Fwww.wheel-done.com%2Fen%2F&u_ru=http%3A%2F%2Fwww.wheel-done.com%2F&c_l=en-US&c_st=1280x1024&c_dpr=1&p_r=http%3A%2F%2Fwww.wheel-done.com%2F&p_t=%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&p_pi=036757da3bf4da65&b_ct=1732605637152&b_rt=0&b_dl=1.3&b_et=3g&b_dc=1191& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:20:39.316973925 CET	312	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:39 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: HIT from i1872260_c17483(cloudsvr)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49750	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:41.970089912 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49756	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:42.851407051 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49791	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:46.428131104 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49807	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:48.553818941 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49811	154.85.69.10	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:48.754254103 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49821	111.180.138.108	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:49.787309885 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49823	14.215.182.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:50.239412069 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49836	111.180.138.108	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:51.676196098 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49839	182.61.244.229	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:52.258882999 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49848	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:54.006604910 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49851	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:54.006619930 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49850	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:54.006628990 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49861	112.34.113.148	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:55.395004034 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49874	185.10.104.124	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:55.880790949 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49877	185.10.104.124	80

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:20:55.924704075 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	50039	107.150.119.147	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:21:02.338992119 CET	1172	OUT	POST /ajax/log_h.jsp HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Content-Length: 38 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://www.wheel-done.com Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605654897 Data Raw: 63 6d 64 3d 77 61 66 4e 6f 74 43 6b 5f 64 6f 67 26 64 6f 67 49 64 3d 32 30 30 31 30 35 26 64 6f 67 53 72 63 3d 31 Data Ascii: cmd=wafNotCk_dog&dogId=200105&dogSrc=1
Nov 26, 2024 08:21:04.074949026 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 55 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1021978014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:04.074968100 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:21:04.074980021 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:21:04.075268030 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:21:04.075278997 CET	291	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding
Nov 26, 2024 08:21:11.047662973 CET	1360	OUT	GET /en/ajax/site_h.jsp?cmd=getWafNotCk_getReqArgsCookie HTTP/1.1 Host: www.wheel-done.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: http://www.wheel-done.com/en/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo9pV82ijWeQ1eQUvJVIpGCI%3D; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc; _nocache=true; _cliid=C0DaAtB2gDRdoE2X; _lastEnterDay=2024-11-26; _siteStatId=326d4cef-0a77-4bb4-b7e1-29b50aa6ea51; _siteStatDay=20241126; _siteStatRedirectUv=redirectUv_28088389; _siteStatVisitorType=visitorType_28088389; _siteStatVisit=visit_28088389; _siteStatReVisit=reVisit_28088389; SECKEY_ABVK=QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE%3D; _checkSiteLvBrowser=true; BMAP_SECKEY=mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7; _choseLanguage=true; _reqArgs=; _siteStatVisitTime=1732605663626
Nov 26, 2024 08:21:11.891745090 CET	1236	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:21:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 63 Connection: keep-alive Content-Encoding: gzip FAI-W-FLOW: 1022723014 Service-Lane: 560dac0265d6c63cd3bf00ff7039f350 FAI-W-AGENT_AID: 28088389 Origin-Agent-Cluster: ?0 Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' .wheel-done.com baidu.com .baidu.com bdstatic.com .bdstatic.com qq.com .qq.com gtimg.com .gtimg.com bdimg.com .bdimg.com faidev.cc .faidev.cc hugedomains.com .hugedomains.com googletagmanager.com .googletagmanager.com google-analytics.com .google-analytics.com fkw.com .fkw.com forweb.cc .forweb.cc webportal.top .webportal.top aaadns.com .aaadns.com yswebportal.cc .yswebportal.cc faiusrd.com .faiusrd.com sgh7ey78.com .sgh7ey78.com alipayobjects.com .alipayobjects.com .alipay.com .hrtechdlg.com .google.com 508sys.com .508sys.com .vip.webportal.top .mall.vip.webportal.top .webportal.cc .webportal.top .fkgameweb.com icoc.ws .icoc.ws faidns.com .faidns.com faisys.com .faisys.com http://faisys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz *.icoc.bz j Data Raw: Data Ascii:
Nov 26, 2024 08:21:11.891772032 CET	1236	IN	Data Raw: 66 6b 77 2e 6e 65 74 20 2a 2e 6a 7a 66 6b 77 2e 6e 65 74 20 6a 7a 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6a 7a 66 6b 77 2e 69 6e 66 6f 20 66 6b 67 75 65 73 74 2e 63 6f 6d 20 2a 2e 66 6b 67 75 65 73 74 2e 63 6f 6d 20 6d 61 6c 6c 66 6b 77 2e 6e 65 74 20 Data Ascii: fkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net .mallfkw.net mallfkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;style-src 'self' 'unsafe-inline' .wheel-done.com bdimg.com .bdimg.com gtimg.com *.gtimg.com f
Nov 26, 2024 08:21:11.891783953 CET	1236	IN	Data Raw: 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 71 6c 6f 67 6f 2e 63 6e 20 68 74 74 70 3a 2f 2f 2a 2e 71 6c 6f 67 6f 2e 63 6e 20 66 61 69 75 73 72 2e 63 6f 6d 20 2a 2e 66 61 69 75 73 72 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 66 61 69 75 73 72 2e 63 6f 6d 20 Data Ascii: go.cn http://qlogo.cn http://.qlogo.cn faiusr.com .faiusr.com http://faiusr.com http://.faiusr.com faimallusr.com .faimallusr.com http://faimallusr.com http://.faimallusr.com 508mallusr.com .508mallusr.com http://508mallusr.com http://*.
Nov 26, 2024 08:21:11.891849041 CET	1236	IN	Data Raw: 73 79 73 2e 63 6f 6d 20 68 74 74 70 3a 2f 2f 2a 2e 66 61 69 73 79 73 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6f 2e 63 6e 20 66 61 69 73 63 6d 2e 63 6f 6d 20 2a 2e 66 61 69 73 63 6d 2e 63 6f 6d 20 69 63 6f 63 2e 76 63 20 2a 2e 69 63 6f 63 2e 76 63 20 Data Ascii: sys.com http://.faisys.com .faisco.cn faiscm.com .faiscm.com icoc.vc .icoc.vc icoc.in .icoc.in icoc.me .icoc.me icoc.bz .icoc.bz jzfkw.net .jzfkw.net jzfkw.info .jzfkw.info fkguest.com .fkguest.com mallfkw.net *.mallfkw.net mallfkw.i
Nov 26, 2024 08:21:11.891866922 CET	299	IN	Data Raw: 66 6b 77 2e 69 6e 66 6f 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 69 6e 66 6f 20 6d 61 6c 6c 66 6b 77 2e 63 6e 20 2a 2e 6d 61 6c 6c 66 6b 77 2e 63 6e 3b 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 52 65 70 6f 72 74 2e 6a 73 70 3b 0d 0a 58 2d 43 6f 6e 74 Data Ascii: fkw.info .mallfkw.info mallfkw.cn .mallfkw.cn;report-uri /cspReport.jsp;X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenVary: Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	50046	180.76.11.161	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:21:04.618614912 CET	509	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=83407359&code=5000&da_src=5000&device_pixel_ratio=1&platform=Win32 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:06.182990074 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:21:05 GMT Etag: "6731c204-31" Expires: Wed, 27 Nov 2024 07:21:05 GMT Http_x_bd_logid: 1265912310 Http_x_bd_logid64: 1265912322438651146 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:36:20 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=328F14A8621DAA058B1119C0E281CDC5:FG=1; expires=Wed, 26-Nov-25 07:21:05 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:21:06.239069939 CET	491	OUT	GET /images/blank.gif?product=jsapi&sub_product=jsapi&v=2.0&sub_product_v=2.0&t=65184113&code=load_mapclick&da_src=load_mapclick HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:06.785151958 CET	661	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 49 Content-Type: image/gif Date: Tue, 26 Nov 2024 07:21:06 GMT Etag: "6731c1a1-31" Expires: Wed, 27 Nov 2024 07:21:06 GMT Http_x_bd_logid: 1266514490 Http_x_bd_logid64: 1266514103957929994 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Mon, 11 Nov 2024 08:34:41 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=F69E62375A9CA95C24468FE441F336A1:FG=1; expires=Wed, 26-Nov-25 07:21:06 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Data Raw: 47 49 46 38 39 61 01 00 01 00 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 09 19 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Nov 26, 2024 08:21:07.669764996 CET	477	OUT	GET /?qt=jsapi_log&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&bmap2=1&device=0&module=overlay&func=dom_lable&subfunc=&t=1732605666438&callback=BMap.logCbk7242563566&sign=08745cff6d53 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:08.228467941 CET	856	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:07 GMT Expires: Wed, 27 Nov 2024 07:21:07 GMT Http_x_bd_logid: 1267945728 Http_x_bd_logid64: 1267945580194159370 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=454903E856BD62D46EA00FABA7D95E30:FG=1; expires=Wed, 26-Nov-25 07:21:07 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=D28D4A8967E1B603B951C92B2A47818B:FG=1; expires=Wed, 26-Nov-25 07:21:07 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12679457280808141066112615 Content-Length: 74 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 32 34 32 35 36 33 35 36 36 20 26 26 20 42 4d 61 70 2e 6c 6f 67 43 62 6b 37 32 34 32 35 36 33 35 36 36 28 7b 22 72 65 73 75 6c 74 22 3a 7b 22 65 72 72 6f 72 22 3a 30 7d 7d 29 Data Ascii: /**/BMap.logCbk7242563566 && BMap.logCbk7242563566({"result":{"error":0}})
Nov 26, 2024 08:21:12.660547972 CET	691	OUT	GET /?qt=business_accredit&v=2.1&ak=KfNSLxuGpyk9BBYHnSqZsYoKxn7MUGxX&callback=BMap._rd._cbk73493&seckey=QjkmsigYB6FtJVS1%2B1zLo9pV82ijWeQ1eQUvJVIpGCI%3D%2CmT6SDgRwIEGgko2nVglBqPbktv_GdgSczqhlajXi4ruTrtjfKIsRMXyDLMumiTS9U5SPZABzM_Lt6rB9Z_DRmtuo2cC3QbxaryEueh7NkVGocKi1RMToC94MBlnfTJ6AP_Pnc5_wrs-9lnCAB8AGDgHZdVdl_t31J5fxcF2MTH6dzThq0KLkqv47M4CcZ1dc&timeStamp=1732605671426&sign=a42e1535599b HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:13.210057020 CET	904	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 26 Nov 2024 07:21:12 GMT Expires: Wed, 27 Nov 2024 07:21:12 GMT Http_x_bd_logid: 1272935655 Http_x_bd_logid64: 1272935321464156426 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=52E3D6F775D9A7003F15ECAF7E9FBE37:FG=1; expires=Wed, 26-Nov-25 07:21:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=BB8AB6104EAAB234E4510FCC67B4784C:FG=1; expires=Wed, 26-Nov-25 07:21:12 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 12729356552656740106112615 Content-Length: 121 Data Raw: 2f 2a 2a 2f 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 33 34 39 33 20 26 26 20 42 4d 61 70 2e 5f 72 64 2e 5f 63 62 6b 37 33 34 39 33 28 7b 22 65 72 72 6f 72 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 2e 22 2c 22 64 61 74 61 22 3a 7b 22 69 73 5f 61 75 74 68 22 3a 66 61 6c 73 65 7d 7d 7d 29 Data Ascii: /**/BMap._rd._cbk73493 && BMap._rd._cbk73493({"error":0,"content":{"status":0,"message":"ok.","data":{"is_auth":false}}})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	50049	154.85.69.9	80	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:21:05.498953104 CET	1077	OUT	GET /js/report?source_type=1&source_opt_type=40004&source_content=%7B%22title%22%3A%22%E8%87%B3%E8%BE%BE%EF%BC%88%E6%B7%B1%E5%9C%B3%EF%BC%89%E5%9B%BD%E9%99%85%E7%89%A9%E6%B5%81%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%22%2C%22opt_content%22%3A%22%E8%AE%BF%E9%97%AE%E7%BD%91%E7%AB%99%E9%A6%96%E9%A1%B5%22%7D&viewer_cliid=C0DaAtB2gDRdoE2X&clue_type=1&client_net=3g&app_type=5&client_device=windows&source_biz=0&recordTicket=hcKbME8whdhO3R3CjAx4XE3EQFXc%2FcK7rocP5s1X2JUVSm9fRhU%2FYzbdiiVxdJ_G1G3neY6Mjuyh2TuEfBWXxdP2Ldq7vjFhWZOIusqZR5aQVAGYpDvq0cuEO7vX3X_rOuG17LUpG8EIpE%2F2j2CtVSQ8xi027NB_8sS2n_Q8QGyfdWj7Cr_dGzac_2nV3QTRJYHl4rE_aUUKItLOTOCJ4Y4PYoqWKfrSEw8cRXXsmrk%3D&is_outside_visit=false&report_type=2&b_rt=10& HTTP/1.1 Host: datareport.webportal.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 26, 2024 08:21:06.989579916 CET	313	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:21:06 GMT Content-Length: 0 Connection: keep-alive Server: F-WEB Origin-Agent-Cluster: ?0 Access-Control-Allow-Methods: * Access-Control-Max-Age: 3600 Access-Control-Allow-Credentials: true X-Ser: i1872260_c17483 X-Cache: MISS from i1872260_c17483(cloudsvr)

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49705	20.190.147.5	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-26 07:19:41 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 07:19:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 07:18:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 692e0004-324a-4c09-9860-f9fe2ed3b1c2 PPServer: PPV: 30 H: PH1PEPF00011E47 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 07:19:41 GMT Connection: close Content-Length: 11409
2024-11-26 07:19:41 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49706	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:42 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 78 43 53 64 54 50 77 43 58 45 79 66 6b 4b 4d 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 33 36 66 64 35 36 66 32 61 39 32 64 64 38 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: xCSdTPwCXEyfkKMk.1Context: b36fd56f2a92dd87
2024-11-26 07:19:42 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 07:19:42 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 78 43 53 64 54 50 77 43 58 45 79 66 6b 4b 4d 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 33 36 66 64 35 36 66 32 61 39 32 64 64 38 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: xCSdTPwCXEyfkKMk.2Context: b36fd56f2a92dd87<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-26 07:19:42 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 78 43 53 64 54 50 77 43 58 45 79 66 6b 4b 4d 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 33 36 66 64 35 36 66 32 61 39 32 64 64 38 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: xCSdTPwCXEyfkKMk.3Context: b36fd56f2a92dd87
2024-11-26 07:19:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 07:19:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6e 78 2f 6e 4b 52 34 37 30 30 43 4b 76 46 64 33 53 51 32 51 6e 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: nx/nKR4700CKvFd3SQ2QnQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49714	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:52 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 79 77 75 42 77 30 76 5a 55 45 47 50 36 54 4a 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 64 35 31 37 61 66 66 38 38 32 31 31 61 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ywuBw0vZUEGP6TJw.1Context: 69d517aff88211ac
2024-11-26 07:19:52 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 07:19:52 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 79 77 75 42 77 30 76 5a 55 45 47 50 36 54 4a 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 64 35 31 37 61 66 66 38 38 32 31 31 61 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ywuBw0vZUEGP6TJw.2Context: 69d517aff88211ac<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-26 07:19:52 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 79 77 75 42 77 30 76 5a 55 45 47 50 36 54 4a 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 64 35 31 37 61 66 66 38 38 32 31 31 61 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ywuBw0vZUEGP6TJw.3Context: 69d517aff88211ac<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-26 07:19:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 07:19:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 7a 76 72 4e 58 57 4d 2f 45 71 59 52 4f 34 68 7a 6c 56 64 35 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qzvrNXWM/EqYRO4hzlVd5Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49715	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 78 6b 6b 4c 41 75 6e 62 30 53 48 74 58 6e 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 36 64 64 65 30 36 61 30 32 38 65 32 34 65 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: PxkkLAunb0SHtXnS.1Context: c6dde06a028e24e2
2024-11-26 07:19:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 07:19:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 78 6b 6b 4c 41 75 6e 62 30 53 48 74 58 6e 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 36 64 64 65 30 36 61 30 32 38 65 32 34 65 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: PxkkLAunb0SHtXnS.2Context: c6dde06a028e24e2<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-26 07:19:53 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 50 78 6b 6b 4c 41 75 6e 62 30 53 48 74 58 6e 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 36 64 64 65 30 36 61 30 32 38 65 32 34 65 32 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: PxkkLAunb0SHtXnS.3Context: c6dde06a028e24e2
2024-11-26 07:19:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 07:19:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 66 4c 71 58 68 77 6f 56 30 4f 33 57 35 56 50 51 2b 7a 68 30 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: KfLqXhwoV0O3W5VPQ+zh0Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:55 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:19:56 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:55 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071955Z-174f78459685m244hC1EWRgp2c0000000v0000000000393r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:19:56 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-26 07:19:56 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-26 07:19:56 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-26 07:19:56 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-26 07:19:56 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-26 07:19:56 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-26 07:19:56 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-26 07:19:56 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-26 07:19:56 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-26 07:19:56 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49722	69.192.160.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:56 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 07:19:56 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=241239 Date: Tue, 26 Nov 2024 07:19:56 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49723	107.150.104.134	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:57 UTC	613	OUT	GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=0&isOem=true&webName=site HTTP/1.1 Host: fe.faisco.cn Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:19:58 UTC	265	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:19:57 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 689 Connection: close FAI-W-FLOW: 205417040 FAI-W-AGENT_AID: 0 Origin-Agent-Cluster: ?0 Access-Control-Allow-Origin: *
2024-11-26 07:19:58 UTC	689	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 0a 76 61 72 20 66 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 0a 66 73 2e 73 72 63 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 2f 6a 73 73 64 6b 5f 31 5f 31 2f 6a 73 2f 68 61 77 6b 45 79 65 2e 6d 69 6e 2e 6a 73 3f 76 3d 32 30 32 34 30 33 31 35 31 37 30 30 22 3b 20 0a 66 73 2e 69 64 20 3d 20 22 66 61 69 48 61 77 6b 45 79 65 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 20 3d 20 7b 7d 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 2e 6a 73 73 64 6b 5f 72 65 73 5f 72 6f 6f 74 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 Data Ascii: (function() { var fs = document.createElement("script"); fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; fs.id = "faiHawkEye"; window.FAI_HAWK_EYE = {}; window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; window.FAI_HAWK_E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49751	69.192.160.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:58 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 07:19:58 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=241256 Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-26 07:19:58 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:58 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:19:58 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071958Z-174f7845968psccphC1EWRuz9s0000000vcg0000000043cr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:19:58 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:58 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:19:58 UTC	492	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: 6584919e-f01e-0003-06a3-3f4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071958Z-174f784596886s2bhC1EWR743w0000000v2g000000009kbv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:19:58 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:58 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:19:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071958Z-174f7845968frfdmhC1EWRxxbw0000000v8g000000000bde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:19:58 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:19:58 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:19:59 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:19:58 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071958Z-174f78459685m244hC1EWRgp2c0000000uzg000000003ang x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:19:59 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49761	107.150.104.134	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:00 UTC	436	OUT	GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=0&isOem=true&webName=site HTTP/1.1 Host: fe.faisco.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:20:01 UTC	265	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 689 Connection: close FAI-W-FLOW: 206081040 FAI-W-AGENT_AID: 0 Origin-Agent-Cluster: ?0 Access-Control-Allow-Origin: *
2024-11-26 07:20:01 UTC	689	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 0a 76 61 72 20 66 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 0a 66 73 2e 73 72 63 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 2f 6a 73 73 64 6b 5f 31 5f 31 2f 6a 73 2f 68 61 77 6b 45 79 65 2e 6d 69 6e 2e 6a 73 3f 76 3d 32 30 32 34 30 33 31 35 31 37 30 30 22 3b 20 0a 66 73 2e 69 64 20 3d 20 22 66 61 69 48 61 77 6b 45 79 65 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 20 3d 20 7b 7d 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 2e 6a 73 73 64 6b 5f 72 65 73 5f 72 6f 6f 74 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 Data Ascii: (function() { var fs = document.createElement("script"); fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; fs.id = "faiHawkEye"; window.FAI_HAWK_EYE = {}; window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; window.FAI_HAWK_E

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:00 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072000Z-174f7845968vqt9xhC1EWRgten0000000v4g000000006e7y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:00 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072001Z-174f7845968nxc96hC1EWRspw80000000us000000000c24z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:01 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:00 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072001Z-174f7845968v75bwhC1EWRuqen0000000g1g000000005tra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:01 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:01 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:01 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072001Z-174f78459688l8rvhC1EWRtzr000000007sg000000002m25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:02 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072003Z-174f7845968glpgnhC1EWR7uec0000000v90000000004wk7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:03 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:03 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072003Z-174f7845968kvnqxhC1EWRmf3g0000000dug00000000ap99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:03 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072003Z-174f7845968xr5c2hC1EWRd0hn0000000c00000000003w96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:03 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:03 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:03 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072003Z-174f78459684bddphC1EWRbht40000000ux000000000278t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:04 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49795	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:03 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=sGCWyK4YEzKrS2O&MD=xlvBVOTx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 07:20:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0df4e3c4-3ceb-43c3-8d45-6344f5118378 MS-RequestId: d2964ee4-55a6-4073-b2cb-2d12c936ed56 MS-CV: UsXzNz/trkuPfzO8.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 07:20:03 GMT Connection: close Content-Length: 24490
2024-11-26 07:20:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-26 07:20:04 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:03 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072004Z-174f7845968v75bwhC1EWRuqen0000000g20000000004xd2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:05 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072005Z-174f7845968cdxdrhC1EWRg0en0000000v1g000000007x0m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49802	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:05 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 68 2b 2b 4c 56 4c 68 6c 45 6d 7a 51 6f 6c 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 34 65 30 63 61 32 61 35 31 32 39 66 62 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ph++LVLhlEmzQolw.1Context: fc4e0ca2a5129fb1
2024-11-26 07:20:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 07:20:05 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 70 68 2b 2b 4c 56 4c 68 6c 45 6d 7a 51 6f 6c 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 34 65 30 63 61 32 61 35 31 32 39 66 62 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ph++LVLhlEmzQolw.2Context: fc4e0ca2a5129fb1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-26 07:20:05 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 68 2b 2b 4c 56 4c 68 6c 45 6d 7a 51 6f 6c 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 34 65 30 63 61 32 61 35 31 32 39 66 62 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ph++LVLhlEmzQolw.3Context: fc4e0ca2a5129fb1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-26 07:20:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 07:20:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 57 4a 35 79 52 72 55 35 6b 36 32 75 66 6b 53 61 50 4b 37 62 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2WJ5yRrU5k62ufkSaPK7bQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:06 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072006Z-174f7845968swgbqhC1EWRmnb40000000v5000000000bg5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:06 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:06 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072006Z-174f7845968px8v7hC1EWR08ng0000000vd0000000003a3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:06 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:06 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072006Z-174f7845968kvnqxhC1EWRmf3g0000000dt000000000e4b8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:06 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:06 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072006Z-174f7845968jrjrxhC1EWRmmrs0000000v70000000006xnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:07 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072008Z-174f784596886s2bhC1EWR743w0000000v3g0000000075rf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:08 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:08 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:08 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072008Z-174f7845968j6t2phC1EWRcfe80000000v5g00000000b62k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:08 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:08 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:08 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072008Z-174f78459685m244hC1EWRgp2c0000000uxg0000000074sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:08 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:08 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072008Z-174f7845968g6hv8hC1EWR1v2n00000002x000000000ds67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:08 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072008Z-174f7845968g6hv8hC1EWR1v2n00000002x000000000ds6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:10 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:10 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072010Z-174f78459684bddphC1EWRbht40000000urg00000000c58a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:10 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:10 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072011Z-174f7845968xlwnmhC1EWR0sv80000000uz0000000003xtk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:10 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072011Z-174f7845968qj8jrhC1EWRh41s0000000v00000000008994 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:10 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072011Z-174f7845968xr5c2hC1EWRd0hn0000000c1g0000000017e4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:11 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:10 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:11 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072011Z-174f784596886s2bhC1EWR743w0000000v3g0000000075tz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:11 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:12 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072012Z-174f7845968kdththC1EWRzvxn00000007k0000000000hum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49862	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 49 32 49 77 6f 53 4b 4f 55 45 4f 75 59 68 50 70 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 61 63 31 65 63 64 61 30 38 39 65 32 30 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: I2IwoSKOUEOuYhPp.1Context: 4fac1ecda089e20d
2024-11-26 07:20:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 07:20:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 49 32 49 77 6f 53 4b 4f 55 45 4f 75 59 68 50 70 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 61 63 31 65 63 64 61 30 38 39 65 32 30 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: I2IwoSKOUEOuYhPp.2Context: 4fac1ecda089e20d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-26 07:20:12 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 49 32 49 77 6f 53 4b 4f 55 45 4f 75 59 68 50 70 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 61 63 31 65 63 64 61 30 38 39 65 32 30 64 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: I2IwoSKOUEOuYhPp.3Context: 4fac1ecda089e20d
2024-11-26 07:20:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 07:20:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 6c 52 4f 4a 41 44 61 65 45 43 6c 30 44 4b 2b 38 2f 57 38 7a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tlROJADaeECl0DK+8/W8zw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:13 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072013Z-174f78459684bddphC1EWRbht40000000ut0000000009gh6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:13 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072013Z-174f7845968swgbqhC1EWRmnb40000000v60000000009scv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:13 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:13 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072013Z-174f78459684bddphC1EWRbht40000000utg000000007s3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49876	182.61.128.141	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:13 UTC	561	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1732605606177 HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:20:13 UTC	460	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:13 GMT Content-Type: application/javascript Content-Length: 1371 Connection: close Last-Modified: Thu, 12 Oct 2023 07:45:54 GMT ETag: "6527a432-505" Age: 81822 Accept-Ranges: bytes Ohc-Cache-HIT: jn2ctcache57 [2], wzix57 [2] Ohc-File-Size: 1285 Ohc-Global-Saved-Time: Mon, 25 Nov 2024 08:36:31 GMT X-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: max-age=7200
2024-11-26 07:20:13 UTC	1371	IN	Data Raw: 77 69 6e 64 6f 77 5b 27 5c 78 35 66 5c 78 35 66 5c 78 35 66 5c 78 36 31 5c 78 36 32 5c 78 37 36 5c 78 36 62 27 5d 3d 27 51 6a 6b 6d 73 69 67 59 42 36 46 74 4a 56 53 31 2b 31 7a 4c 6f 33 48 67 74 41 4b 4b 42 50 47 58 6a 64 48 4f 52 6c 38 68 52 56 45 3d 27 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 2c 6f 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 7c 7c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 2c 65 3d 22 6f 6e 6c 6f 61 64 22 69 6e 20 61 3f 74 3a 69 3b 61 2e 63 68 61 72 73 65 74 3d 22 75 74 66 38 22 2c 61 2e 73 72 63 3d 6e 2c Data Ascii: window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo3HgtAKKBPGXjdHORl8hRVE=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:13 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:13 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072013Z-174f7845968j6t2phC1EWRcfe80000000v80000000006uab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:13 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:14 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072014Z-174f7845968swgbqhC1EWRmnb40000000v4g00000000d4x6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:15 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:15 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:15 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072015Z-174f78459688l8rvhC1EWRtzr000000007u00000000007u0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:15 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:15 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072015Z-174f78459684bddphC1EWRbht40000000uu00000000073mh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:15 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:15 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072015Z-174f7845968frfdmhC1EWRxxbw0000000v5g000000004ppd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:15 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:15 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:15 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072015Z-174f7845968ljs8phC1EWRe6en0000000ux000000000892q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:15 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49891	182.61.128.141	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:15 UTC	561	OUT	GET /heicha/mw/abclite-2063-s.original.js?_=10026 HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:20:16 UTC	466	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:16 GMT Content-Type: application/javascript Content-Length: 113008 Connection: close Last-Modified: Tue, 26 Nov 2024 06:08:54 GMT ETag: "674565f6-1b970" Age: 4273 Accept-Ranges: bytes Ohc-Global-Saved-Time: Tue, 26 Nov 2024 06:09:03 GMT Ohc-Cache-HIT: jn2ctcache58 [2], bdix100 [1] Ohc-File-Size: 113008 X-Cache-Status: HIT Cache-Control: max-age=7200 Access-Control-Allow-Origin: *
2024-11-26 07:20:16 UTC	15918	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 5f 45 6f 34 47 28 29 7b 76 61 72 20 61 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 76 61 72 20 65 3d 27 5c 78 33 31 5c 78 32 65 5c 78 33 31 5c 78 32 65 5c 78 33 32 27 3b 66 75 6e 63 74 69 6f 6e 20 66 28 67 2c 68 29 7b 76 61 72 20 6a 3d 67 5b 27 5c 78 36 63 5c 78 36 35 5c 78 36 65 5c 78 36 37 5c 78 37 34 5c 78 36 38 27 5d 3b 76 61 72 20 6c 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6d 3d 30 78 30 3b 6d 3c 6a 3b 6d 2b 2b 29 7b 76 61 72 20 6e 3d 68 28 67 5b 6d 5d 29 3b 6c 5b 27 5c 78 37 30 5c 78 37 35 5c 78 37 33 5c 78 36 38 27 5d 28 6e 29 3b 7d 72 65 74 75 72 6e 20 6c 3b 7d 76 61 72 20 70 2c 71 2c 72 2c 73 2c 74 2c 75 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 76 3d 27 5c 78 34 33 5c 78 36 38 5c 78 36 31 5c 78 37 32 Data Ascii: (function _Eo4G(){var a=function(c,d){var e='\x31\x2e\x31\x2e\x32';function f(g,h){var j=g['\x6c\x65\x6e\x67\x74\x68'];var l=[];for(var m=0x0;m<j;m++){var n=h(g[m]);l['\x70\x75\x73\x68'](n);}return l;}var p,q,r,s,t,u=decodeURIComponent,v='\x43\x68\x61\x72
2024-11-26 07:20:16 UTC	16384	IN	Data Raw: 63 33 36 5c 75 35 34 35 61 5c 78 37 36 5c 75 35 65 66 32 5c 78 36 63 5c 78 37 35 5c 75 35 65 66 32 5c 78 37 34 5c 75 35 34 35 61 5c 75 35 66 35 66 5c 75 37 30 37 34 5c 75 35 65 35 32 5c 75 36 32 34 66 5c 75 35 34 35 61 5c 78 37 36 5c 75 35 65 66 32 5c 78 36 63 5c 78 37 35 5c 75 35 65 66 32 5c 78 37 34 5c 75 35 34 35 61 5c 75 35 66 35 66 5c 75 37 30 37 34 5c 75 35 65 35 32 5c 75 35 36 63 34 5c 75 35 34 35 61 5c 75 35 63 32 62 5c 78 37 35 5c 75 35 37 37 61 5c 75 35 37 37 61 5c 75 35 34 35 61 5c 78 37 32 5c 75 37 30 36 65 5c 75 37 33 31 33 5c 78 37 35 5c 78 37 34 5c 75 35 34 35 61 5c 78 37 32 5c 78 35 37 5c 78 36 39 5c 75 35 36 63 34 5c 78 37 34 5c 78 36 38 5c 75 35 65 37 37 5c 75 35 61 33 32 5c 75 35 63 32 62 5c 78 37 32 5c 75 37 33 31 33 5c 78 37 37 5c 78 Data Ascii: c36\u545a\x76\u5ef2\x6c\x75\u5ef2\x74\u545a\u5f5f\u7074\u5e52\u624f\u545a\x76\u5ef2\x6c\x75\u5ef2\x74\u545a\u5f5f\u7074\u5e52\u56c4\u545a\u5c2b\x75\u577a\u577a\u545a\x72\u706e\u7313\x75\x74\u545a\x72\x57\x69\u56c4\x74\x68\u5e77\u5a32\u5c2b\x72\u7313\x77\x
2024-11-26 07:20:16 UTC	16384	IN	Data Raw: 61 57 5b 62 30 5d 5d 29 3b 61 6d 2b 3d 30 78 33 2a 62 61 3b 66 6f 72 28 76 61 72 20 62 4f 3d 5b 61 50 2c 61 58 5d 2c 62 50 3d 30 78 30 3b 62 50 3c 30 78 32 3b 2b 2b 62 50 29 7b 76 61 72 20 62 51 3d 62 4f 5b 62 50 5d 3b 66 6f 72 28 62 30 3d 30 78 30 3b 62 30 3c 62 51 5b 27 5c 78 36 63 5c 78 36 35 5c 78 36 65 5c 78 36 37 5c 78 37 34 5c 78 36 38 27 5d 3b 2b 2b 62 30 29 7b 76 61 72 20 62 52 3d 30 78 31 66 26 62 51 5b 62 30 5d 3b 62 42 28 61 62 2c 61 6d 2c 62 4e 5b 62 52 5d 29 2c 61 6d 2b 3d 62 38 5b 62 52 5d 2c 62 52 3e 30 78 66 26 26 28 62 42 28 61 62 2c 61 6d 2c 62 51 5b 62 30 5d 3e 3e 3e 30 78 35 26 30 78 37 66 29 2c 61 6d 2b 3d 62 51 5b 62 30 5d 3e 3e 3e 30 78 63 29 3b 7d 7d 7d 65 6c 73 65 20 62 41 3d 62 79 2c 62 45 3d 62 63 2c 62 49 3d 62 7a 2c 62 4a 3d Data Ascii: aW[b0]]);am+=0x3*ba;for(var bO=[aP,aX],bP=0x0;bP<0x2;++bP){var bQ=bO[bP];for(b0=0x0;b0<bQ['\x6c\x65\x6e\x67\x74\x68'];++b0){var bR=0x1f&bQ[b0];bB(ab,am,bN[bR]),am+=b8[bR],bR>0xf&&(bB(ab,am,bQ[b0]>>>0x5&0x7f),am+=bQ[b0]>>>0xc);}}}else bA=by,bE=bc,bI=bz,bJ=
2024-11-26 07:20:17 UTC	16384	IN	Data Raw: 27 29 5d 21 3d 3d 67 32 5b 62 28 27 30 78 37 62 27 29 5d 3b 7d 5d 5d 2c 61 6a 3d 30 78 30 2c 61 6b 3d 61 68 5b 27 5c 78 36 63 5c 78 36 35 5c 78 36 65 5c 78 36 37 5c 78 37 34 5c 78 36 38 27 5d 3b 61 6a 3c 61 6b 3b 61 6a 2b 2b 29 7b 76 61 72 20 61 6c 3d 61 68 5b 61 6a 5d 2c 61 6d 3d 61 6c 5b 30 78 30 5d 3b 28 30 78 30 2c 61 6c 5b 30 78 31 5d 29 28 29 26 26 61 63 5b 62 28 27 30 78 36 27 29 5d 28 61 6d 29 3b 7d 61 64 5b 27 5c 78 37 32 5c 78 36 35 5c 78 36 64 5c 78 36 66 5c 78 37 36 5c 78 36 35 5c 78 34 33 5c 78 36 38 5c 78 36 39 5c 78 36 63 5c 78 36 34 27 5d 28 61 66 29 2c 61 61 28 61 63 5b 62 28 27 30 78 34 30 27 29 5d 28 27 5c 78 35 66 27 29 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 61 62 29 7b 61 61 28 61 62 29 3b 7d 29 3b 7d 63 61 74 63 68 28 6a 55 29 7b 61 Data Ascii: ')]!==g2[b('0x7b')];}]],aj=0x0,ak=ah['\x6c\x65\x6e\x67\x74\x68'];aj<ak;aj++){var al=ah[aj],am=al[0x0];(0x0,al[0x1])()&&ac[b('0x6')](am);}ad['\x72\x65\x6d\x6f\x76\x65\x43\x68\x69\x6c\x64'](af),aa(ac[b('0x40')]('\x5f'));}(function(ab){aa(ab);});}catch(jU){a
2024-11-26 07:20:17 UTC	16384	IN	Data Raw: 33 5c 78 36 66 5c 78 36 34 5c 78 36 35 5c 78 34 31 5c 78 37 34 27 5d 28 61 66 29 5d 3d 61 66 3b 7d 76 61 72 20 61 67 3d 61 63 5b 27 5c 78 36 33 5c 78 36 38 5c 78 36 31 5c 78 37 32 5c 78 34 31 5c 78 37 34 27 5d 28 30 78 34 30 29 3b 69 66 28 61 67 29 7b 76 61 72 20 61 68 3d 61 61 5b 27 5c 78 36 39 5c 78 36 65 5c 78 36 34 5c 78 36 35 5c 78 37 38 5c 78 34 66 5c 78 36 36 27 5d 28 61 67 29 3b 2d 30 78 31 21 3d 3d 61 68 26 26 28 61 62 3d 61 68 29 3b 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 61 2c 61 62 2c 61 63 29 7b 66 6f 72 28 76 61 72 20 61 64 3d 5b 5d 2c 61 66 3d 30 78 30 2c 61 67 3d 30 78 30 3b 61 67 3c 61 62 3b 61 67 2b 2b 29 69 66 28 61 67 25 30 78 34 29 7b 76 61 72 20 61 68 3d 61 63 5b 61 61 5b 62 28 27 30 78 32 32 27 29 5d 28 61 67 2d 30 78 Data Ascii: 3\x6f\x64\x65\x41\x74'](af)]=af;}var ag=ac['\x63\x68\x61\x72\x41\x74'](0x40);if(ag){var ah=aa['\x69\x6e\x64\x65\x78\x4f\x66'](ag);-0x1!==ah&&(ab=ah);}return function(aa,ab,ac){for(var ad=[],af=0x0,ag=0x0;ag<ab;ag++)if(ag%0x4){var ah=ac[aa[b('0x22')](ag-0x
2024-11-26 07:20:17 UTC	16384	IN	Data Raw: 32 5c 78 36 31 5c 78 36 37 5c 78 36 35 27 5d 2b 30 78 30 3b 7d 63 61 74 63 68 28 75 49 29 7b 61 62 3d 30 78 31 3b 7d 61 61 28 61 62 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 75 4a 28 61 61 29 7b 76 61 72 20 61 62 3b 74 72 79 7b 61 62 3d 21 21 61 6c 5b 62 28 27 30 78 65 32 27 29 5d 2b 30 78 30 3b 7d 63 61 74 63 68 28 75 4d 29 7b 61 62 3d 30 78 31 3b 7d 61 61 28 61 62 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 75 4e 28 61 61 29 7b 76 61 72 20 61 62 3b 74 72 79 7b 61 62 3d 21 21 61 6c 5b 62 28 27 30 78 37 66 27 29 5d 2b 30 78 30 3b 7d 63 61 74 63 68 28 75 51 29 7b 61 62 3d 30 78 31 3b 7d 61 61 28 61 62 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 75 52 28 61 61 29 7b 61 61 28 61 71 5b 27 5c 78 36 33 5c 78 36 66 5c 78 36 66 5c 78 36 62 5c 78 36 39 5c 78 36 35 5c 78 34 35 5c 78 36 Data Ascii: 2\x61\x67\x65']+0x0;}catch(uI){ab=0x1;}aa(ab);}function uJ(aa){var ab;try{ab=!!al[b('0xe2')]+0x0;}catch(uM){ab=0x1;}aa(ab);}function uN(aa){var ab;try{ab=!!al[b('0x7f')]+0x0;}catch(uQ){ab=0x1;}aa(ab);}function uR(aa){aa(aq['\x63\x6f\x6f\x6b\x69\x65\x45\x6
2024-11-26 07:20:17 UTC	15170	IN	Data Raw: 74 69 6f 6e 28 61 61 29 7b 74 72 79 7b 76 61 72 20 61 64 3d 5b 5d 2c 61 66 3d 7b 7d 2c 61 67 3d 6e 65 77 20 61 62 28 7b 27 5c 78 36 39 5c 78 36 33 5c 78 36 35 5c 78 35 33 5c 78 36 35 5c 78 37 32 5c 78 37 36 5c 78 36 35 5c 78 37 32 5c 78 37 33 27 3a 5b 7b 27 5c 78 37 35 5c 78 37 32 5c 78 36 63 5c 78 37 33 27 3a 5b 62 28 27 30 78 31 32 30 27 29 5d 7d 5d 7d 2c 7b 27 5c 78 36 33 5c 78 37 34 27 3a 5b 7b 27 5c 78 37 36 5c 78 37 34 27 3a 21 30 78 30 7d 5d 7d 29 2c 61 68 3d 2f 28 5b 30 2d 39 5d 7b 31 2c 33 7d 28 5c 2e 5b 30 2d 39 5d 7b 31 2c 33 7d 29 7b 33 7d 7c 5b 61 2d 66 30 2d 39 5d 7b 31 2c 34 7d 28 3a 5b 61 2d 66 30 2d 39 5d 7b 31 2c 34 7d 29 7b 37 7d 29 2f 2c 61 6a 3d 66 75 6e 63 74 69 6f 6e 28 61 61 29 7b 76 61 72 20 61 62 3d 61 68 5b 62 28 27 30 78 31 32 Data Ascii: tion(aa){try{var ad=[],af={},ag=new ab({'\x69\x63\x65\x53\x65\x72\x76\x65\x72\x73':[{'\x75\x72\x6c\x73':[b('0x120')]}]},{'\x63\x74':[{'\x76\x74':!0x0}]}),ah=/([0-9]{1,3}(\.[0-9]{1,3}){3}\|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){7})/,aj=function(aa){var ab=ah[b('0x12

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49892	182.61.128.141	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:16 UTC	439	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1732605606177 HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
2024-11-26 07:20:16 UTC	460	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:16 GMT Content-Type: application/javascript Content-Length: 1371 Connection: close Last-Modified: Thu, 12 Oct 2023 07:45:54 GMT ETag: "6527a432-505" Age: 81825 Accept-Ranges: bytes Ohc-Cache-HIT: jn2ctcache57 [2], wzix57 [2] Ohc-File-Size: 1285 Ohc-Global-Saved-Time: Mon, 25 Nov 2024 08:36:31 GMT X-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: max-age=7200
2024-11-26 07:20:16 UTC	1371	IN	Data Raw: 77 69 6e 64 6f 77 5b 27 5c 78 35 66 5c 78 35 66 5c 78 35 66 5c 78 36 31 5c 78 36 32 5c 78 37 36 5c 78 36 62 27 5d 3d 27 51 6a 6b 6d 73 69 67 59 42 36 46 74 4a 56 53 31 2b 31 7a 4c 6f 38 48 42 62 6e 57 72 4e 31 69 57 43 45 76 36 62 43 42 35 4c 67 77 3d 27 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 2c 6f 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 7c 7c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 2c 65 3d 22 6f 6e 6c 6f 61 64 22 69 6e 20 61 3f 74 3a 69 3b 61 2e 63 68 61 72 73 65 74 3d 22 75 74 66 38 22 2c 61 2e 73 72 63 3d 6e 2c Data Ascii: window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo8HBbnWrN1iWCEv6bCB5Lgw=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:16 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:17 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072017Z-174f78459688l8rvhC1EWRtzr000000007pg0000000075rr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:17 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:17 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072017Z-174f7845968pf68xhC1EWRr4h80000000v9g000000008gqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:18 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:17 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:17 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072017Z-174f7845968cpnpfhC1EWR3afc0000000ung00000000b5g2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:18 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:17 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:17 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072017Z-174f7845968nxc96hC1EWRspw80000000urg00000000cv6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49898	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:18 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 46 6b 61 2b 64 6b 6e 74 39 55 32 6d 6e 4c 43 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 33 33 38 66 37 38 36 66 35 33 31 33 34 62 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Fka+dknt9U2mnLCT.1Context: 9338f786f53134bb
2024-11-26 07:20:18 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 07:20:18 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 46 6b 61 2b 64 6b 6e 74 39 55 32 6d 6e 4c 43 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 33 33 38 66 37 38 36 66 35 33 31 33 34 62 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Fka+dknt9U2mnLCT.2Context: 9338f786f53134bb<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-26 07:20:18 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 46 6b 61 2b 64 6b 6e 74 39 55 32 6d 6e 4c 43 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 33 33 38 66 37 38 36 66 35 33 31 33 34 62 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Fka+dknt9U2mnLCT.3Context: 9338f786f53134bb<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-26 07:20:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 07:20:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 6b 6d 4d 42 7a 6a 50 70 30 53 4b 41 44 5a 66 51 42 77 7a 37 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tkmMBzjPp0SKADZfQBwz7A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:19 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:19 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072019Z-174f7845968px8v7hC1EWR08ng0000000vc0000000004vpv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:19 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49900	182.61.128.141	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:19 UTC	439	OUT	GET /heicha/mw/abclite-2063-s.original.js?_=10026 HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
2024-11-26 07:20:20 UTC	466	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:19 GMT Content-Type: application/javascript Content-Length: 113008 Connection: close Last-Modified: Tue, 26 Nov 2024 06:08:54 GMT ETag: "674565f6-1b970" Age: 4276 Accept-Ranges: bytes Ohc-Global-Saved-Time: Tue, 26 Nov 2024 06:09:03 GMT Ohc-Cache-HIT: jn2ctcache58 [2], bdix100 [1] Ohc-File-Size: 113008 X-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: max-age=7200
2024-11-26 07:20:20 UTC	15918	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 5f 45 6f 34 47 28 29 7b 76 61 72 20 61 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 76 61 72 20 65 3d 27 5c 78 33 31 5c 78 32 65 5c 78 33 31 5c 78 32 65 5c 78 33 32 27 3b 66 75 6e 63 74 69 6f 6e 20 66 28 67 2c 68 29 7b 76 61 72 20 6a 3d 67 5b 27 5c 78 36 63 5c 78 36 35 5c 78 36 65 5c 78 36 37 5c 78 37 34 5c 78 36 38 27 5d 3b 76 61 72 20 6c 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6d 3d 30 78 30 3b 6d 3c 6a 3b 6d 2b 2b 29 7b 76 61 72 20 6e 3d 68 28 67 5b 6d 5d 29 3b 6c 5b 27 5c 78 37 30 5c 78 37 35 5c 78 37 33 5c 78 36 38 27 5d 28 6e 29 3b 7d 72 65 74 75 72 6e 20 6c 3b 7d 76 61 72 20 70 2c 71 2c 72 2c 73 2c 74 2c 75 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 76 3d 27 5c 78 34 33 5c 78 36 38 5c 78 36 31 5c 78 37 32 Data Ascii: (function _Eo4G(){var a=function(c,d){var e='\x31\x2e\x31\x2e\x32';function f(g,h){var j=g['\x6c\x65\x6e\x67\x74\x68'];var l=[];for(var m=0x0;m<j;m++){var n=h(g[m]);l['\x70\x75\x73\x68'](n);}return l;}var p,q,r,s,t,u=decodeURIComponent,v='\x43\x68\x61\x72
2024-11-26 07:20:20 UTC	16384	IN	Data Raw: 63 33 36 5c 75 35 34 35 61 5c 78 37 36 5c 75 35 65 66 32 5c 78 36 63 5c 78 37 35 5c 75 35 65 66 32 5c 78 37 34 5c 75 35 34 35 61 5c 75 35 66 35 66 5c 75 37 30 37 34 5c 75 35 65 35 32 5c 75 36 32 34 66 5c 75 35 34 35 61 5c 78 37 36 5c 75 35 65 66 32 5c 78 36 63 5c 78 37 35 5c 75 35 65 66 32 5c 78 37 34 5c 75 35 34 35 61 5c 75 35 66 35 66 5c 75 37 30 37 34 5c 75 35 65 35 32 5c 75 35 36 63 34 5c 75 35 34 35 61 5c 75 35 63 32 62 5c 78 37 35 5c 75 35 37 37 61 5c 75 35 37 37 61 5c 75 35 34 35 61 5c 78 37 32 5c 75 37 30 36 65 5c 75 37 33 31 33 5c 78 37 35 5c 78 37 34 5c 75 35 34 35 61 5c 78 37 32 5c 78 35 37 5c 78 36 39 5c 75 35 36 63 34 5c 78 37 34 5c 78 36 38 5c 75 35 65 37 37 5c 75 35 61 33 32 5c 75 35 63 32 62 5c 78 37 32 5c 75 37 33 31 33 5c 78 37 37 5c 78 Data Ascii: c36\u545a\x76\u5ef2\x6c\x75\u5ef2\x74\u545a\u5f5f\u7074\u5e52\u624f\u545a\x76\u5ef2\x6c\x75\u5ef2\x74\u545a\u5f5f\u7074\u5e52\u56c4\u545a\u5c2b\x75\u577a\u577a\u545a\x72\u706e\u7313\x75\x74\u545a\x72\x57\x69\u56c4\x74\x68\u5e77\u5a32\u5c2b\x72\u7313\x77\x
2024-11-26 07:20:20 UTC	16384	IN	Data Raw: 61 57 5b 62 30 5d 5d 29 3b 61 6d 2b 3d 30 78 33 2a 62 61 3b 66 6f 72 28 76 61 72 20 62 4f 3d 5b 61 50 2c 61 58 5d 2c 62 50 3d 30 78 30 3b 62 50 3c 30 78 32 3b 2b 2b 62 50 29 7b 76 61 72 20 62 51 3d 62 4f 5b 62 50 5d 3b 66 6f 72 28 62 30 3d 30 78 30 3b 62 30 3c 62 51 5b 27 5c 78 36 63 5c 78 36 35 5c 78 36 65 5c 78 36 37 5c 78 37 34 5c 78 36 38 27 5d 3b 2b 2b 62 30 29 7b 76 61 72 20 62 52 3d 30 78 31 66 26 62 51 5b 62 30 5d 3b 62 42 28 61 62 2c 61 6d 2c 62 4e 5b 62 52 5d 29 2c 61 6d 2b 3d 62 38 5b 62 52 5d 2c 62 52 3e 30 78 66 26 26 28 62 42 28 61 62 2c 61 6d 2c 62 51 5b 62 30 5d 3e 3e 3e 30 78 35 26 30 78 37 66 29 2c 61 6d 2b 3d 62 51 5b 62 30 5d 3e 3e 3e 30 78 63 29 3b 7d 7d 7d 65 6c 73 65 20 62 41 3d 62 79 2c 62 45 3d 62 63 2c 62 49 3d 62 7a 2c 62 4a 3d Data Ascii: aW[b0]]);am+=0x3*ba;for(var bO=[aP,aX],bP=0x0;bP<0x2;++bP){var bQ=bO[bP];for(b0=0x0;b0<bQ['\x6c\x65\x6e\x67\x74\x68'];++b0){var bR=0x1f&bQ[b0];bB(ab,am,bN[bR]),am+=b8[bR],bR>0xf&&(bB(ab,am,bQ[b0]>>>0x5&0x7f),am+=bQ[b0]>>>0xc);}}}else bA=by,bE=bc,bI=bz,bJ=
2024-11-26 07:20:20 UTC	16384	IN	Data Raw: 27 29 5d 21 3d 3d 67 32 5b 62 28 27 30 78 37 62 27 29 5d 3b 7d 5d 5d 2c 61 6a 3d 30 78 30 2c 61 6b 3d 61 68 5b 27 5c 78 36 63 5c 78 36 35 5c 78 36 65 5c 78 36 37 5c 78 37 34 5c 78 36 38 27 5d 3b 61 6a 3c 61 6b 3b 61 6a 2b 2b 29 7b 76 61 72 20 61 6c 3d 61 68 5b 61 6a 5d 2c 61 6d 3d 61 6c 5b 30 78 30 5d 3b 28 30 78 30 2c 61 6c 5b 30 78 31 5d 29 28 29 26 26 61 63 5b 62 28 27 30 78 36 27 29 5d 28 61 6d 29 3b 7d 61 64 5b 27 5c 78 37 32 5c 78 36 35 5c 78 36 64 5c 78 36 66 5c 78 37 36 5c 78 36 35 5c 78 34 33 5c 78 36 38 5c 78 36 39 5c 78 36 63 5c 78 36 34 27 5d 28 61 66 29 2c 61 61 28 61 63 5b 62 28 27 30 78 34 30 27 29 5d 28 27 5c 78 35 66 27 29 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 61 62 29 7b 61 61 28 61 62 29 3b 7d 29 3b 7d 63 61 74 63 68 28 6a 55 29 7b 61 Data Ascii: ')]!==g2[b('0x7b')];}]],aj=0x0,ak=ah['\x6c\x65\x6e\x67\x74\x68'];aj<ak;aj++){var al=ah[aj],am=al[0x0];(0x0,al[0x1])()&&ac[b('0x6')](am);}ad['\x72\x65\x6d\x6f\x76\x65\x43\x68\x69\x6c\x64'](af),aa(ac[b('0x40')]('\x5f'));}(function(ab){aa(ab);});}catch(jU){a
2024-11-26 07:20:20 UTC	16384	IN	Data Raw: 33 5c 78 36 66 5c 78 36 34 5c 78 36 35 5c 78 34 31 5c 78 37 34 27 5d 28 61 66 29 5d 3d 61 66 3b 7d 76 61 72 20 61 67 3d 61 63 5b 27 5c 78 36 33 5c 78 36 38 5c 78 36 31 5c 78 37 32 5c 78 34 31 5c 78 37 34 27 5d 28 30 78 34 30 29 3b 69 66 28 61 67 29 7b 76 61 72 20 61 68 3d 61 61 5b 27 5c 78 36 39 5c 78 36 65 5c 78 36 34 5c 78 36 35 5c 78 37 38 5c 78 34 66 5c 78 36 36 27 5d 28 61 67 29 3b 2d 30 78 31 21 3d 3d 61 68 26 26 28 61 62 3d 61 68 29 3b 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 61 2c 61 62 2c 61 63 29 7b 66 6f 72 28 76 61 72 20 61 64 3d 5b 5d 2c 61 66 3d 30 78 30 2c 61 67 3d 30 78 30 3b 61 67 3c 61 62 3b 61 67 2b 2b 29 69 66 28 61 67 25 30 78 34 29 7b 76 61 72 20 61 68 3d 61 63 5b 61 61 5b 62 28 27 30 78 32 32 27 29 5d 28 61 67 2d 30 78 Data Ascii: 3\x6f\x64\x65\x41\x74'](af)]=af;}var ag=ac['\x63\x68\x61\x72\x41\x74'](0x40);if(ag){var ah=aa['\x69\x6e\x64\x65\x78\x4f\x66'](ag);-0x1!==ah&&(ab=ah);}return function(aa,ab,ac){for(var ad=[],af=0x0,ag=0x0;ag<ab;ag++)if(ag%0x4){var ah=ac[aa[b('0x22')](ag-0x
2024-11-26 07:20:20 UTC	16384	IN	Data Raw: 32 5c 78 36 31 5c 78 36 37 5c 78 36 35 27 5d 2b 30 78 30 3b 7d 63 61 74 63 68 28 75 49 29 7b 61 62 3d 30 78 31 3b 7d 61 61 28 61 62 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 75 4a 28 61 61 29 7b 76 61 72 20 61 62 3b 74 72 79 7b 61 62 3d 21 21 61 6c 5b 62 28 27 30 78 65 32 27 29 5d 2b 30 78 30 3b 7d 63 61 74 63 68 28 75 4d 29 7b 61 62 3d 30 78 31 3b 7d 61 61 28 61 62 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 75 4e 28 61 61 29 7b 76 61 72 20 61 62 3b 74 72 79 7b 61 62 3d 21 21 61 6c 5b 62 28 27 30 78 37 66 27 29 5d 2b 30 78 30 3b 7d 63 61 74 63 68 28 75 51 29 7b 61 62 3d 30 78 31 3b 7d 61 61 28 61 62 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 75 52 28 61 61 29 7b 61 61 28 61 71 5b 27 5c 78 36 33 5c 78 36 66 5c 78 36 66 5c 78 36 62 5c 78 36 39 5c 78 36 35 5c 78 34 35 5c 78 36 Data Ascii: 2\x61\x67\x65']+0x0;}catch(uI){ab=0x1;}aa(ab);}function uJ(aa){var ab;try{ab=!!al[b('0xe2')]+0x0;}catch(uM){ab=0x1;}aa(ab);}function uN(aa){var ab;try{ab=!!al[b('0x7f')]+0x0;}catch(uQ){ab=0x1;}aa(ab);}function uR(aa){aa(aq['\x63\x6f\x6f\x6b\x69\x65\x45\x6
2024-11-26 07:20:20 UTC	15170	IN	Data Raw: 74 69 6f 6e 28 61 61 29 7b 74 72 79 7b 76 61 72 20 61 64 3d 5b 5d 2c 61 66 3d 7b 7d 2c 61 67 3d 6e 65 77 20 61 62 28 7b 27 5c 78 36 39 5c 78 36 33 5c 78 36 35 5c 78 35 33 5c 78 36 35 5c 78 37 32 5c 78 37 36 5c 78 36 35 5c 78 37 32 5c 78 37 33 27 3a 5b 7b 27 5c 78 37 35 5c 78 37 32 5c 78 36 63 5c 78 37 33 27 3a 5b 62 28 27 30 78 31 32 30 27 29 5d 7d 5d 7d 2c 7b 27 5c 78 36 33 5c 78 37 34 27 3a 5b 7b 27 5c 78 37 36 5c 78 37 34 27 3a 21 30 78 30 7d 5d 7d 29 2c 61 68 3d 2f 28 5b 30 2d 39 5d 7b 31 2c 33 7d 28 5c 2e 5b 30 2d 39 5d 7b 31 2c 33 7d 29 7b 33 7d 7c 5b 61 2d 66 30 2d 39 5d 7b 31 2c 34 7d 28 3a 5b 61 2d 66 30 2d 39 5d 7b 31 2c 34 7d 29 7b 37 7d 29 2f 2c 61 6a 3d 66 75 6e 63 74 69 6f 6e 28 61 61 29 7b 76 61 72 20 61 62 3d 61 68 5b 62 28 27 30 78 31 32 Data Ascii: tion(aa){try{var ad=[],af={},ag=new ab({'\x69\x63\x65\x53\x65\x72\x76\x65\x72\x73':[{'\x75\x72\x6c\x73':[b('0x120')]}]},{'\x63\x74':[{'\x76\x74':!0x0}]}),ah=/([0-9]{1,3}(\.[0-9]{1,3}){3}\|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){7})/,aj=function(aa){var ab=ah[b('0x12

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:19 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:19 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072019Z-174f7845968v75bwhC1EWRuqen0000000g10000000006xvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:19 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:19 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:20 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072020Z-174f7845968psccphC1EWRuz9s0000000vf00000000006uz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:20 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:19 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072020Z-174f78459688l8rvhC1EWRtzr000000007pg0000000075ug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:20 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:19 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:20 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072020Z-174f784596886s2bhC1EWR743w0000000v3g00000000762c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:20 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49901	163.177.18.92	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:20 UTC	648	OUT	POST /abdr?_o=http%3A%2F%2Fwww.wheel-done.com HTTP/1.1 Host: miao.baidu.com Connection: keep-alive Content-Length: 2011 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: http://www.wheel-done.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:20:20 UTC	2011	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 22 4c 53 75 76 71 7a 63 63 7a 5a 2b 66 4b 6f 2f 74 55 75 50 32 7a 62 2f 78 58 59 76 58 4e 57 45 4a 6c 4c 61 74 46 2b 57 49 4c 6d 62 45 61 64 48 6d 4b 38 75 4a 56 46 5a 63 64 66 4f 64 45 37 68 69 54 4f 59 4a 77 2f 51 72 73 6f 58 70 39 50 44 32 61 4b 6c 55 43 61 57 4c 76 4c 72 77 74 59 4d 34 6a 6a 4b 30 37 37 74 39 2b 48 56 33 36 6d 4d 2f 6c 48 37 36 50 35 2f 4d 45 78 4f 4f 47 43 36 63 39 30 64 33 6e 4d 54 49 53 6a 6f 69 64 61 61 32 64 2b 75 52 61 32 65 37 79 5a 55 61 76 67 6d 4f 56 44 71 32 51 42 6b 30 73 68 75 67 65 69 64 41 47 6e 74 48 61 43 79 4a 7a 37 74 71 5a 6f 57 52 44 77 76 79 52 52 66 35 74 52 70 4d 67 46 4c 76 48 6c 43 6f 57 43 2b 32 35 33 49 73 4d 48 42 6c 6f 77 42 4d 78 71 6d 4c 73 76 35 6b 42 42 6a 47 42 6b 4f 33 68 54 Data Ascii: {"data":"LSuvqzcczZ+fKo/tUuP2zb/xXYvXNWEJlLatF+WILmbEadHmK8uJVFZcdfOdE7hiTOYJw/QrsoXp9PD2aKlUCaWLvLrwtYM4jjK077t9+HV36mM/lH76P5/MExOOGC6c90d3nMTISjoidaa2d+uRa2e7yZUavgmOVDq2QBk0shugeidAGntHaCyJz7tqZoWRDwvyRRf5tRpMgFLvHlCoWC+253IsMHBlowBMxqmLsv5kBBjGBkO3hT
2024-11-26 07:20:21 UTC	1063	IN	HTTP/1.1 200 OK Ab-Sr: 1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ== Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, Host, Content-Type, x-requested-with, X-Custom-Header Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Access-Control-Allow-Origin: http://www.wheel-done.com Access-Control-Expose-Headers: Ab-sr Access-Control-Expose-Headers: Authentication Access-Control-Max-Age: 3600 Authentication: 2a4568ce052b3093608db7c6b95e02baeadbb8cc404be5e6 Content-Length: 235 Content-Type: application/json; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:21 GMT Set-Cookie: ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; Path=/; Domain=miao.baidu.com; Max-Age=2147483647; HttpOnly; Secure; SameSite=None Set-Cookie: ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; Path=/; Domain=miao.baidu.com; Max-Age=2147483647; HttpOnly; Secure; SameSite=None
2024-11-26 07:20:21 UTC	483	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 61 62 5f 73 72 3d 31 2e 30 2e 31 5f 4e 57 5a 68 5a 44 59 32 59 57 45 33 4e 32 49 32 4d 54 64 6b 4d 44 4d 33 4d 57 45 79 5a 54 63 34 4d 6d 55 78 4d 47 49 77 4d 47 4a 6a 4e 54 6c 6c 4e 6d 5a 6b 59 7a 41 33 59 6d 51 31 5a 44 49 79 4d 7a 59 35 4d 54 4d 32 4f 54 6b 35 4d 54 5a 69 4f 54 55 7a 4f 54 55 77 59 6d 45 32 4e 6d 5a 6d 4d 7a 5a 6d 59 57 49 77 4e 47 45 79 5a 44 4a 6a 5a 54 4d 32 4d 54 64 6d 4d 32 59 78 4d 7a 45 30 4d 6d 56 6b 4d 7a 4d 79 4e 7a 4d 34 4d 57 49 7a 4d 44 49 79 5a 6a 68 69 4f 44 6c 68 4d 47 49 31 5a 6a 4d 79 59 6d 52 6d 4f 47 4d 79 4e 54 59 30 4f 54 63 78 4f 57 51 35 4d 6d 4a 6c 4e 6a 51 78 4d 32 4a 6c 4e 44 59 34 4d 54 42 68 4e 32 59 78 4d 54 51 77 5a 51 3d 3d 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 Data Ascii: Set-Cookie: ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; Path=/; Domai
2024-11-26 07:20:21 UTC	235	IN	Data Raw: 7b 22 64 61 74 61 22 3a 22 6d 54 36 53 44 67 52 77 49 45 47 67 6b 6f 32 6e 56 67 6c 42 71 44 70 56 34 54 78 34 68 64 6a 6d 31 53 31 77 33 57 6a 61 74 4f 65 53 6c 4b 45 59 35 64 73 51 44 74 78 43 39 30 44 6c 47 37 41 76 5f 61 45 55 61 66 4c 6b 58 43 4e 4d 43 49 33 6c 53 64 4f 39 54 70 74 68 6f 6e 64 4e 36 71 6f 77 50 6b 5a 70 32 67 57 76 30 39 30 61 42 4b 5a 53 46 4f 46 6e 6a 79 4a 77 6c 6d 6d 47 45 78 58 66 34 5f 32 38 41 78 34 45 75 4b 31 62 6e 79 6f 6b 6b 7a 6f 54 57 4d 37 4c 42 6c 76 30 35 4a 33 35 68 62 58 4c 30 75 44 35 65 6f 7a 58 71 55 4d 53 36 73 5a 34 44 33 55 74 56 52 4f 57 6e 32 74 37 22 2c 22 6b 65 79 5f 69 64 22 3a 22 35 39 22 2c 22 73 69 67 6e 22 3a 22 33 65 63 62 38 38 66 63 22 7d Data Ascii: {"data":"mT6SDgRwIEGgko2nVglBqDpV4Tx4hdjm1S1w3WjatOeSlKEY5dsQDtxC90DlG7Av_aEUafLkXCNMCI3lSdO9TpthondN6qowPkZp2gWv090aBKZSFOFnjyJwlmmGExXf4_28Ax4EuK1bnyokkzoTWM7LBlv05J35hbXL0uD5eozXqUMS6sZ4D3UtVROWn2t7","key_id":"59","sign":"3ecb88fc"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:21 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072021Z-174f7845968kdththC1EWRzvxn00000007h0000000001rax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:21 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072022Z-174f7845968px8v7hC1EWR08ng0000000v8000000000cpvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:21 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072022Z-174f7845968glpgnhC1EWR7uec0000000v8g000000005n7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:22 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072022Z-174f7845968qj8jrhC1EWRh41s0000000uxg00000000dgm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:22 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072022Z-174f78459685726chC1EWRsnbg0000000v70000000002mbu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:23 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072023Z-174f7845968zgtf6hC1EWRqd8s0000000my000000000dw1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:24 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072024Z-174f7845968frfdmhC1EWRxxbw0000000v1g00000000c5na x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:24 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072024Z-174f7845968swgbqhC1EWRmnb40000000v4g00000000d530 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49911	153.3.237.19	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:24 UTC	803	OUT	GET /abdr?_o=http%3A%2F%2Fwww.wheel-done.com HTTP/1.1 Host: miao.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5
2024-11-26 07:20:24 UTC	598	IN	HTTP/1.1 400 Bad Request Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, Host, Content-Type, x-requested-with, X-Custom-Header Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Access-Control-Allow-Origin: http://www.wheel-done.com Access-Control-Max-Age: 3600 Content-Length: 2 Content-Type: application/json; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:24 GMT Set-Cookie: BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; Path=/; Domain=baidu.com; Expires=Wed, 26 Nov 2025 07:20:24 GMT; Max-Age=31536000; Secure; SameSite=None Connection: close
2024-11-26 07:20:24 UTC	2	IN	Data Raw: 22 22 Data Ascii: ""

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:24 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:24 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072024Z-174f784596886s2bhC1EWR743w0000000v500000000052g2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:24 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:24 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072024Z-174f7845968ljs8phC1EWRe6en0000000uwg000000009nk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:25 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:26 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072026Z-174f7845968xlwnmhC1EWR0sv80000000uug00000000c0yk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:26 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:26 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:26 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072026Z-174f7845968xr5c2hC1EWRd0hn0000000c00000000003wtt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:20:26 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49919	163.177.18.92	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:26 UTC	1636	OUT	GET /abdr?data=%7B%22data%22%3A%22M%2FcaOoj0hIWoHDH7%2FLYL79gpE%2FwL0GcCwFB1bEgZcCVLOOOXx8p3JOBATa9bh7kvp0aaMMfkyqpL96Pg03HgBX7g2B3X%2FjGr%2FkhRv5qJoEBU34Cu9w1dKZo41z8bALfm1pkoICCh0J6DdKEItcykD%2Fcn4nTQ5DYh8XHxuNtYNqmodHScw95quJybJjXI3l8SG%2F1JMYFkPms1GJMk2M3L5QbB1E2d5zxwCL%2Fm0NgnnmX2aVaL%2BKFYYIrS7F7gumy4yX70A47a55%2FhYupVDVcosvlZ3USaYsH6%2Bfq4y0MU61hG7%2B2Gqa9x15pi5al7hh2ku9hMPSVSlkQPvN1Pjp3UvkutWes%2BAW6%2BE4SbFs1GJ1FkLHxsOLTmIcpqw9WINv5lOXqpdcODk6Qk0JUKrYCC31%2BIyZIrpiNeqpVkWhmsr9VhLPMedYaXi2fneI5OkbPTkYXkMH6Gw8ABiNUFEXL5ObdS6wTCKessx4YNMnC42EQNZAkvtajtWuGYWSsvWCbHoJMvBBAkuIBGbxYtLk1xoA%3D%3D%22%2C%22key_id%22%3A%22e27381f9d0d847ab%22%2C%22enc%22%3A2%7D&_=0.6455062262011355 HTTP/1.1 Host: miao.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5
2024-11-26 07:20:28 UTC	418	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, Host, Content-Type, x-requested-with, X-Custom-Header Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Access-Control-Allow-Origin: http://www.wheel-done.com Access-Control-Max-Age: 3600 Content-Length: 2 Content-Type: application/json; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:28 GMT Connection: close
2024-11-26 07:20:28 UTC	2	IN	Data Raw: 22 22 Data Ascii: ""

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:26 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072026Z-174f7845968xlwnmhC1EWR0sv80000000uwg000000008na9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:26 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:26 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072026Z-174f7845968kvnqxhC1EWRmf3g0000000dvg000000008pwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:27 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:26 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072026Z-174f7845968cdxdrhC1EWRg0en0000000v10000000007p8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:28 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072028Z-174f7845968swgbqhC1EWRmnb40000000vb0000000001fh9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:28 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:28 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072028Z-174f7845968l4kp6hC1EWRe8840000000vbg0000000065qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:29 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:28 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072029Z-174f7845968vqt9xhC1EWRgten0000000v700000000027ak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:29 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:28 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072029Z-174f7845968v75bwhC1EWRuqen0000000g0g0000000089e5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:28 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:29 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072029Z-174f7845968v75bwhC1EWRuqen0000000g50000000000u8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:20:29 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49928	163.177.18.92	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:29 UTC	2473	OUT	GET /abdr?data=%7B%22data%22%3A%22QKsUApL0F%2BYJYOjcQylm4S6nR%2Fbscxvf1sAw%2F1X5keb5y1hnaB7lw408Bqzh%2FnpLIVZGCYk%2BWkPUGJefJIWJsRQ5pKthIAgZh0jHeb56R%2FN6Zm%2B0tkKCNnUA7fRXWmr8%2FapnmqwJG3yq7qczcvdyTFFM5knqTlMXolRPy0AorUCXm8biQsa9ioF2nchjq%2BoQz50%2FhYqyhjUDBtaWa0%2FITmrjO5l0famguo%2BaysqMDw1kn4%2BirlIJDvS0Y03E7lCB72T6hDt51yqTsiSGx%2Fo15pPWJW43F6UrcU0Tq7Kfkqu8YYXakWZzSS0Ai3fRNDah3%2FTNxB%2BYWFXXvL8TlGN59%2BOANg8HEdC2tIOxV0npymHQWm1idHL9a3TvleziNRRe1%2BhJyls8JZZfumizA84jp6ksAke8cYNjQ9a6wrEW%2BFWiNVIPHOrHj1Eq6pQpZpE22it7RhkUnLDg4rGsuKnmKxkF3sc%2FzqkMfCzYPFvh%2B1OilXCKb26ZB6GVqlAR7wSI0OhqKUFz80FLyDO0tujACFlTZDxMclNSV2YfAORumFEcz1bjPEjRxor2lb2JEhGsrMd8n2iEY%2BlPIldGbL3HtvIHt23oh3uU%2FTe4rkthB1JwlXXS2gioeRLzGYPFDIvCLwp2CZ91DSswl%2FXfpUnZpmWaBH2fSzQZnxEfESmJSTkEP4zrqmGpyoOJds1eZgm3aPXnd11vHTZuDJHpeGtjIYGfM61PKVyJduQigMCQKibZGb%2FolBi0BTLbPZRD%2Bc2AHNDxNsrZwcDRl3uFM%2BGotGKaV0kPlNvMRa%2BKJP4ma7CMLGI2T7KyPMVkRrRyv%2Fb%2FxA0UVl3vk1FoLgxpt9fBH1a%2B3%2Fs5wBmM1ZqJAo7lRkYRV3gGHBAUe1FPGpK63NdbiPXlFKKnhJj9qXQJ5bpSpTCvuntkga [TRUNCATED] Host: miao.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
2024-11-26 07:20:31 UTC	418	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, Host, Content-Type, x-requested-with, X-Custom-Header Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Access-Control-Allow-Origin: http://www.wheel-done.com Access-Control-Max-Age: 3600 Content-Length: 2 Content-Type: application/json; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:31 GMT Connection: close
2024-11-26 07:20:31 UTC	2	IN	Data Raw: 22 22 Data Ascii: ""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49929	107.150.104.134	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:30 UTC	613	OUT	GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1 Host: fe.faisco.cn Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:20:31 UTC	265	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:30 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 689 Connection: close FAI-W-FLOW: 122749049 FAI-W-AGENT_AID: 0 Origin-Agent-Cluster: ?0 Access-Control-Allow-Origin: *
2024-11-26 07:20:31 UTC	689	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 0a 76 61 72 20 66 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 0a 66 73 2e 73 72 63 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 2f 6a 73 73 64 6b 5f 31 5f 31 2f 6a 73 2f 68 61 77 6b 45 79 65 2e 6d 69 6e 2e 6a 73 3f 76 3d 32 30 32 34 30 33 31 35 31 37 30 30 22 3b 20 0a 66 73 2e 69 64 20 3d 20 22 66 61 69 48 61 77 6b 45 79 65 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 20 3d 20 7b 7d 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 2e 6a 73 73 64 6b 5f 72 65 73 5f 72 6f 6f 74 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 Data Ascii: (function() { var fs = document.createElement("script"); fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; fs.id = "faiHawkEye"; window.FAI_HAWK_EYE = {}; window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; window.FAI_HAWK_E

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:30 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:30 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072030Z-174f7845968swgbqhC1EWRmnb40000000vb0000000001fk1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:31 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49930	153.3.237.19	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:30 UTC	1499	OUT	GET /abdr?data=%7B%22data%22%3A%22M%2FcaOoj0hIWoHDH7%2FLYL79gpE%2FwL0GcCwFB1bEgZcCVLOOOXx8p3JOBATa9bh7kvp0aaMMfkyqpL96Pg03HgBX7g2B3X%2FjGr%2FkhRv5qJoEBU34Cu9w1dKZo41z8bALfm1pkoICCh0J6DdKEItcykD%2Fcn4nTQ5DYh8XHxuNtYNqmodHScw95quJybJjXI3l8SG%2F1JMYFkPms1GJMk2M3L5QbB1E2d5zxwCL%2Fm0NgnnmX2aVaL%2BKFYYIrS7F7gumy4yX70A47a55%2FhYupVDVcosvlZ3USaYsH6%2Bfq4y0MU61hG7%2B2Gqa9x15pi5al7hh2ku9hMPSVSlkQPvN1Pjp3UvkutWes%2BAW6%2BE4SbFs1GJ1FkLHxsOLTmIcpqw9WINv5lOXqpdcODk6Qk0JUKrYCC31%2BIyZIrpiNeqpVkWhmsr9VhLPMedYaXi2fneI5OkbPTkYXkMH6Gw8ABiNUFEXL5ObdS6wTCKessx4YNMnC42EQNZAkvtajtWuGYWSsvWCbHoJMvBBAkuIBGbxYtLk1xoA%3D%3D%22%2C%22key_id%22%3A%22e27381f9d0d847ab%22%2C%22enc%22%3A2%7D&_=0.6455062262011355 HTTP/1.1 Host: miao.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
2024-11-26 07:20:32 UTC	394	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, Host, Content-Type, x-requested-with, X-Custom-Header Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Access-Control-Allow-Origin: * Access-Control-Max-Age: 3600 Content-Length: 2 Content-Type: application/json; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:32 GMT Connection: close
2024-11-26 07:20:32 UTC	2	IN	Data Raw: 22 22 Data Ascii: ""

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:30 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:31 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072031Z-174f7845968frfdmhC1EWRxxbw0000000v1g00000000c5ta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:31 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:31 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072031Z-174f7845968n2hr8hC1EWR9cag0000000up000000000bp1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:31 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072031Z-174f7845968nxc96hC1EWRspw80000000uu0000000007asn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:31 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072031Z-174f7845968qj8jrhC1EWRh41s0000000v2g000000003vqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:20:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:33 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072033Z-174f7845968glpgnhC1EWR7uec0000000v7g0000000076fs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:33 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072033Z-174f7845968qj8jrhC1EWRh41s0000000uy000000000cnze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:33 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072033Z-174f7845968jrjrxhC1EWRmmrs0000000va00000000025p6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49941	107.150.104.134	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:33 UTC	436	OUT	GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1 Host: fe.faisco.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:20:34 UTC	265	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 689 Connection: close FAI-W-FLOW: 210490040 FAI-W-AGENT_AID: 0 Origin-Agent-Cluster: ?0 Access-Control-Allow-Origin: *
2024-11-26 07:20:34 UTC	689	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 0a 76 61 72 20 66 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 0a 66 73 2e 73 72 63 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 2f 6a 73 73 64 6b 5f 31 5f 31 2f 6a 73 2f 68 61 77 6b 45 79 65 2e 6d 69 6e 2e 6a 73 3f 76 3d 32 30 32 34 30 33 31 35 31 37 30 30 22 3b 20 0a 66 73 2e 69 64 20 3d 20 22 66 61 69 48 61 77 6b 45 79 65 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 20 3d 20 7b 7d 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 2e 6a 73 73 64 6b 5f 72 65 73 5f 72 6f 6f 74 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 Data Ascii: (function() { var fs = document.createElement("script"); fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; fs.id = "faiHawkEye"; window.FAI_HAWK_EYE = {}; window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; window.FAI_HAWK_E

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:33 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072033Z-174f78459685726chC1EWRsnbg0000000v40000000007fne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:34 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:33 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:33 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072033Z-174f7845968xr5c2hC1EWRd0hn0000000c100000000029se x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:34 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49942	153.3.237.19	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:33 UTC	2283	OUT	GET /abdr?data=%7B%22data%22%3A%22QKsUApL0F%2BYJYOjcQylm4S6nR%2Fbscxvf1sAw%2F1X5keb5y1hnaB7lw408Bqzh%2FnpLIVZGCYk%2BWkPUGJefJIWJsRQ5pKthIAgZh0jHeb56R%2FN6Zm%2B0tkKCNnUA7fRXWmr8%2FapnmqwJG3yq7qczcvdyTFFM5knqTlMXolRPy0AorUCXm8biQsa9ioF2nchjq%2BoQz50%2FhYqyhjUDBtaWa0%2FITmrjO5l0famguo%2BaysqMDw1kn4%2BirlIJDvS0Y03E7lCB72T6hDt51yqTsiSGx%2Fo15pPWJW43F6UrcU0Tq7Kfkqu8YYXakWZzSS0Ai3fRNDah3%2FTNxB%2BYWFXXvL8TlGN59%2BOANg8HEdC2tIOxV0npymHQWm1idHL9a3TvleziNRRe1%2BhJyls8JZZfumizA84jp6ksAke8cYNjQ9a6wrEW%2BFWiNVIPHOrHj1Eq6pQpZpE22it7RhkUnLDg4rGsuKnmKxkF3sc%2FzqkMfCzYPFvh%2B1OilXCKb26ZB6GVqlAR7wSI0OhqKUFz80FLyDO0tujACFlTZDxMclNSV2YfAORumFEcz1bjPEjRxor2lb2JEhGsrMd8n2iEY%2BlPIldGbL3HtvIHt23oh3uU%2FTe4rkthB1JwlXXS2gioeRLzGYPFDIvCLwp2CZ91DSswl%2FXfpUnZpmWaBH2fSzQZnxEfESmJSTkEP4zrqmGpyoOJds1eZgm3aPXnd11vHTZuDJHpeGtjIYGfM61PKVyJduQigMCQKibZGb%2FolBi0BTLbPZRD%2Bc2AHNDxNsrZwcDRl3uFM%2BGotGKaV0kPlNvMRa%2BKJP4ma7CMLGI2T7KyPMVkRrRyv%2Fb%2FxA0UVl3vk1FoLgxpt9fBH1a%2B3%2Fs5wBmM1ZqJAo7lRkYRV3gGHBAUe1FPGpK63NdbiPXlFKKnhJj9qXQJ5bpSpTCvuntkga [TRUNCATED] Host: miao.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
2024-11-26 07:20:35 UTC	394	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, Host, Content-Type, x-requested-with, X-Custom-Header Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Access-Control-Allow-Origin: * Access-Control-Max-Age: 3600 Content-Length: 2 Content-Type: application/json; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:35 GMT Connection: close
2024-11-26 07:20:35 UTC	2	IN	Data Raw: 22 22 Data Ascii: ""

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:35 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:35 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072035Z-174f7845968cpnpfhC1EWR3afc0000000upg000000008yu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:35 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49943	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:35 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 66 44 69 36 73 71 50 36 56 45 47 63 45 54 64 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 37 37 33 66 30 66 37 34 63 66 64 65 38 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: fDi6sqP6VEGcETdc.1Context: 67773f0f74cfde81
2024-11-26 07:20:35 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 07:20:35 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 66 44 69 36 73 71 50 36 56 45 47 63 45 54 64 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 37 37 33 66 30 66 37 34 63 66 64 65 38 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: fDi6sqP6VEGcETdc.2Context: 67773f0f74cfde81<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-26 07:20:35 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 66 44 69 36 73 71 50 36 56 45 47 63 45 54 64 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 37 37 33 66 30 66 37 34 63 66 64 65 38 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: fDi6sqP6VEGcETdc.3Context: 67773f0f74cfde81<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-26 07:20:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 07:20:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 38 6f 44 33 67 79 69 73 55 71 76 65 45 56 4c 69 4c 6a 36 2b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: L8oD3gyisUqveEVLiLj6+w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:35 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:36 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072036Z-174f7845968xr5c2hC1EWRd0hn0000000bz0000000005560 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:36 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49951	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:36 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:36 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072036Z-174f7845968kdththC1EWRzvxn00000007d0000000007tyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:36 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49950	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:36 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:36 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072036Z-174f7845968n2hr8hC1EWR9cag0000000un000000000dvks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:36 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49947	182.61.128.141	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:36 UTC	852	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1732605632363 HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
2024-11-26 07:20:36 UTC	460	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:36 GMT Content-Type: application/javascript Content-Length: 1371 Connection: close Last-Modified: Thu, 12 Oct 2023 07:45:54 GMT ETag: "6527a432-505" Age: 81845 Accept-Ranges: bytes Ohc-Cache-HIT: jn2ctcache57 [2], wzix57 [2] Ohc-File-Size: 1285 Ohc-Global-Saved-Time: Mon, 25 Nov 2024 08:36:31 GMT X-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: max-age=7200
2024-11-26 07:20:36 UTC	1371	IN	Data Raw: 77 69 6e 64 6f 77 5b 27 5c 78 35 66 5c 78 35 66 5c 78 35 66 5c 78 36 31 5c 78 36 32 5c 78 37 36 5c 78 36 62 27 5d 3d 27 51 6a 6b 6d 73 69 67 59 42 36 46 74 4a 56 53 31 2b 31 7a 4c 6f 78 4d 69 70 30 2f 70 4c 55 75 64 76 49 49 46 57 38 4b 76 52 55 51 3d 27 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 2c 6f 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 7c 7c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 2c 65 3d 22 6f 6e 6c 6f 61 64 22 69 6e 20 61 3f 74 3a 69 3b 61 2e 63 68 61 72 73 65 74 3d 22 75 74 66 38 22 2c 61 2e 73 72 63 3d 6e 2c Data Ascii: window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLoxMip0/pLUudvIIFW8KvRUQ=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49949	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:36 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:36 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072036Z-174f7845968v75bwhC1EWRuqen0000000g00000000008h3y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:36 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49955	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:37 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:37 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072037Z-174f7845968qj8jrhC1EWRh41s0000000v40000000001pr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:37 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49958	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:38 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072038Z-174f7845968kdththC1EWRzvxn00000007g0000000003hsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49962	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:38 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 003cf3b7-b01e-0053-2e8c-3fcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072038Z-174f7845968ljs8phC1EWRe6en0000000uv000000000cd9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49964	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:38 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072038Z-174f784596886s2bhC1EWR743w0000000v7000000000288c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49965	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:38 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072039Z-174f7845968kvnqxhC1EWRmf3g0000000dzg000000001yvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49966	163.177.18.92	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:38 UTC	1080	OUT	POST /abdr?_o=http%3A%2F%2Fwww.wheel-done.com HTTP/1.1 Host: miao.baidu.com Connection: keep-alive Content-Length: 2055 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: http://www.wheel-done.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_bid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
2024-11-26 07:20:38 UTC	2055	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 22 4c 53 75 76 71 7a 63 63 7a 5a 2b 66 4b 6f 2f 74 55 75 50 32 7a 62 2f 78 58 59 76 58 4e 57 45 4a 6c 4c 61 74 46 2b 57 49 4c 6d 62 45 61 64 48 6d 4b 38 75 4a 56 46 5a 63 64 66 4f 64 45 37 68 69 54 4f 59 4a 77 2f 51 72 73 6f 58 70 39 50 44 32 61 4b 6c 55 43 61 57 4c 76 4c 72 77 74 59 4d 34 6a 6a 4b 30 37 37 74 39 2b 48 56 33 36 6d 4d 2f 6c 48 37 36 50 35 2f 4d 45 78 4f 4f 47 43 36 63 39 30 64 33 6e 4d 54 49 53 6a 6f 69 64 61 61 32 64 2b 75 52 61 32 65 37 79 5a 55 61 76 67 6d 4f 56 44 71 32 51 42 6b 30 73 68 75 67 65 69 64 41 47 6e 74 48 61 43 79 4a 7a 37 74 71 5a 6f 57 52 44 77 76 79 52 52 66 35 74 52 70 4d 67 46 4c 76 48 6c 43 6f 57 43 2b 32 35 33 49 73 4d 48 42 6c 6f 77 42 4d 78 71 6d 4c 73 76 35 6b 42 42 6a 47 42 6b 4f 33 68 54 Data Ascii: {"data":"LSuvqzcczZ+fKo/tUuP2zb/xXYvXNWEJlLatF+WILmbEadHmK8uJVFZcdfOdE7hiTOYJw/QrsoXp9PD2aKlUCaWLvLrwtYM4jjK077t9+HV36mM/lH76P5/MExOOGC6c90d3nMTISjoidaa2d+uRa2e7yZUavgmOVDq2QBk0shugeidAGntHaCyJz7tqZoWRDwvyRRf5tRpMgFLvHlCoWC+253IsMHBlowBMxqmLsv5kBBjGBkO3hT
2024-11-26 07:20:41 UTC	1063	IN	HTTP/1.1 200 OK Ab-Sr: 1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw== Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, Host, Content-Type, x-requested-with, X-Custom-Header Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Access-Control-Allow-Origin: http://www.wheel-done.com Access-Control-Expose-Headers: Ab-sr Access-Control-Expose-Headers: Authentication Access-Control-Max-Age: 3600 Authentication: ccfca6fa8d08b27f472f6bc0e90f4781384cc080b248fd33 Content-Length: 235 Content-Type: application/json; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:40 GMT Set-Cookie: ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; Path=/; Domain=miao.baidu.com; Max-Age=2147483647; HttpOnly; Secure; SameSite=None Set-Cookie: ab_bid=f6231e06bbdccab42ea5585e9afacbc4b64c; Path=/; Domain=miao.baidu.com; Max-Age=2147483647; HttpOnly; Secure; SameSite=None
2024-11-26 07:20:41 UTC	483	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 61 62 5f 73 72 3d 31 2e 30 2e 31 5f 4f 44 49 7a 5a 54 45 31 5a 44 4a 6d 5a 6d 49 7a 5a 47 55 77 59 6a 6c 68 4d 47 45 32 59 54 49 35 59 6a 63 7a 4e 32 4d 32 4e 44 46 6d 5a 44 68 6d 5a 57 4e 68 4d 6d 4a 6b 4e 44 51 31 5a 6a 52 6a 59 54 41 35 4d 54 42 69 59 6a 55 34 4e 44 6c 6a 5a 44 4e 6a 4e 6d 4e 6b 4d 6d 4d 79 4d 44 4a 6d 4e 44 4d 78 4e 7a 51 78 4d 47 4e 6c 59 54 41 32 5a 54 64 69 59 6a 51 32 59 32 55 31 4d 7a 5a 68 4e 7a 67 35 4e 32 59 34 59 6d 51 32 4d 44 4e 69 59 6a 6b 33 4e 47 55 78 5a 6a 63 30 4e 6a 4a 6d 5a 54 46 68 59 6d 4d 33 59 54 4e 69 59 6a 67 78 59 7a 42 6d 5a 44 45 78 4e 57 4e 68 4d 47 45 35 59 7a 45 77 4d 6a 56 6c 4e 44 67 32 4f 47 51 34 4f 44 4d 30 4e 77 3d 3d 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 Data Ascii: Set-Cookie: ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==; Path=/; Domai
2024-11-26 07:20:41 UTC	235	IN	Data Raw: 7b 22 64 61 74 61 22 3a 22 6d 54 36 53 44 67 52 77 49 45 47 67 6b 6f 32 6e 56 67 6c 42 71 4c 4f 58 6f 36 49 30 55 64 63 41 44 63 4b 4d 57 5f 39 57 41 32 38 39 59 4a 58 6f 56 2d 43 6c 56 68 42 54 6d 51 63 4b 2d 75 66 49 52 42 64 58 66 76 52 47 31 50 38 58 6b 5a 58 7a 38 4e 4a 53 44 46 56 77 7a 69 31 59 63 34 64 49 6a 45 50 69 56 6d 50 35 57 65 53 33 58 7a 45 4d 4d 73 63 50 6a 4e 45 53 2d 36 78 4b 38 4e 42 55 56 36 78 46 70 73 47 61 6f 37 70 41 72 70 73 70 30 4f 67 61 38 49 72 32 55 71 76 55 71 57 58 62 47 77 46 6e 76 75 62 77 52 6f 72 53 6b 7a 68 36 34 35 6b 2d 79 63 44 53 57 58 71 4b 34 72 6a 43 22 2c 22 6b 65 79 5f 69 64 22 3a 22 35 39 22 2c 22 73 69 67 6e 22 3a 22 32 33 34 38 33 34 32 62 22 7d Data Ascii: {"data":"mT6SDgRwIEGgko2nVglBqLOXo6I0UdcADcKMW_9WA289YJXoV-ClVhBTmQcK-ufIRBdXfvRG1P8XkZXz8NJSDFVwzi1Yc4dIjEPiVmP5WeS3XzEMMscPjNES-6xK8NBUV6xFpsGao7pArpsp0Oga8Ir2UqvUqWXbGwFnvubwRorSkzh645k-ycDSWXqK4rjC","key_id":"59","sign":"2348342b"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49967	182.61.128.141	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:38 UTC	722	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1732605632363 HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_NWZhZDY2YWE3N2I2MTdkMDM3MWEyZTc4MmUxMGIwMGJjNTllNmZkYzA3YmQ1ZDIyMzY5MTM2OTk5MTZiOTUzOTUwYmE2NmZmMzZmYWIwNGEyZDJjZTM2MTdmM2YxMzE0MmVkMzMyNzM4MWIzMDIyZjhiODlhMGI1ZjMyYmRmOGMyNTY0OTcxOWQ5MmJlNjQxM2JlNDY4MTBhN2YxMTQwZQ==; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1
2024-11-26 07:20:39 UTC	459	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:39 GMT Content-Type: application/javascript Content-Length: 1371 Connection: close Last-Modified: Thu, 12 Oct 2023 07:45:54 GMT ETag: "6527a432-505" Age: 81848 Accept-Ranges: bytes Ohc-Cache-HIT: jnctcache57 [2], wzix57 [2] Ohc-File-Size: 1285 Ohc-Global-Saved-Time: Mon, 25 Nov 2024 08:36:31 GMT X-Cache-Status: HIT Cache-Control: max-age=7200 Access-Control-Allow-Origin: *
2024-11-26 07:20:39 UTC	1371	IN	Data Raw: 77 69 6e 64 6f 77 5b 27 5c 78 35 66 5c 78 35 66 5c 78 35 66 5c 78 36 31 5c 78 36 32 5c 78 37 36 5c 78 36 62 27 5d 3d 27 51 6a 6b 6d 73 69 67 59 42 36 46 74 4a 56 53 31 2b 31 7a 4c 6f 30 39 4b 74 59 50 79 66 43 47 65 4d 44 57 38 4b 58 63 53 36 74 55 3d 27 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 2c 6f 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 7c 7c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 2c 65 3d 22 6f 6e 6c 6f 61 64 22 69 6e 20 61 3f 74 3a 69 3b 61 2e 63 68 61 72 73 65 74 3d 22 75 74 66 38 22 2c 61 2e 73 72 63 3d 6e 2c Data Ascii: window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo09KtYPyfCGeMDW8KXcS6tU=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49968	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:40 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:45 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072045Z-174f7845968frfdmhC1EWRxxbw0000000v5g000000004q6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:45 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49972	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:40 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:40 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2a3cc61f-301e-001f-7491-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072040Z-174f7845968xr5c2hC1EWRd0hn0000000bwg000000009w1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:40 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49971	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:40 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 4f 6a 77 73 38 52 38 68 6b 4f 45 52 61 51 5a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 34 66 34 64 66 65 36 66 31 36 37 35 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6Ojws8R8hkOERaQZ.1Context: 7a14f4dfe6f16756
2024-11-26 07:20:40 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 07:20:40 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 36 4f 6a 77 73 38 52 38 68 6b 4f 45 52 61 51 5a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 34 66 34 64 66 65 36 66 31 36 37 35 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 6Ojws8R8hkOERaQZ.2Context: 7a14f4dfe6f16756<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-26 07:20:40 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 36 4f 6a 77 73 38 52 38 68 6b 4f 45 52 61 51 5a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 34 66 34 64 66 65 36 66 31 36 37 35 36 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 6Ojws8R8hkOERaQZ.3Context: 7a14f4dfe6f16756
2024-11-26 07:20:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 07:20:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 34 67 6e 73 30 6c 50 79 45 6d 41 6c 6e 76 67 48 42 64 36 2f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: t4gns0lPyEmAlnvgHBd6/A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49973	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:40 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:40 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072040Z-174f7845968ljs8phC1EWRe6en0000000uv000000000cdbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49974	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:41 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072041Z-174f7845968zgtf6hC1EWRqd8s0000000n50000000000zdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49975	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:42 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:42 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072042Z-174f7845968l4kp6hC1EWRe8840000000vdg000000002dpb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49976	107.150.104.134	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:42 UTC	613	OUT	GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1 Host: fe.faisco.cn Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:20:43 UTC	265	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:42 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 689 Connection: close FAI-W-FLOW: 124148049 FAI-W-AGENT_AID: 0 Origin-Agent-Cluster: ?0 Access-Control-Allow-Origin: *
2024-11-26 07:20:43 UTC	689	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 0a 76 61 72 20 66 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 0a 66 73 2e 73 72 63 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 2f 6a 73 73 64 6b 5f 31 5f 31 2f 6a 73 2f 68 61 77 6b 45 79 65 2e 6d 69 6e 2e 6a 73 3f 76 3d 32 30 32 34 30 33 31 35 31 37 30 30 22 3b 20 0a 66 73 2e 69 64 20 3d 20 22 66 61 69 48 61 77 6b 45 79 65 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 20 3d 20 7b 7d 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 2e 6a 73 73 64 6b 5f 72 65 73 5f 72 6f 6f 74 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 Data Ascii: (function() { var fs = document.createElement("script"); fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; fs.id = "faiHawkEye"; window.FAI_HAWK_EYE = {}; window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; window.FAI_HAWK_E

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49977	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:42 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:42 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072042Z-174f7845968glpgnhC1EWR7uec0000000v9g00000000481r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:43 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49978	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:42 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:42 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fdde8523-d01e-0028-578c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072042Z-174f7845968px8v7hC1EWR08ng0000000vf00000000009g4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:43 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49979	153.3.237.19	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:43 UTC	856	OUT	GET /abdr?_o=http%3A%2F%2Fwww.wheel-done.com HTTP/1.1 Host: miao.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_bid=f6231e06bbdccab42ea5585e9afacbc4b64c; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
2024-11-26 07:20:44 UTC	427	IN	HTTP/1.1 400 Bad Request Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, Host, Content-Type, x-requested-with, X-Custom-Header Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Access-Control-Allow-Origin: http://www.wheel-done.com Access-Control-Max-Age: 3600 Content-Length: 2 Content-Type: application/json; charset=utf-8 Date: Tue, 26 Nov 2024 07:20:44 GMT Connection: close
2024-11-26 07:20:44 UTC	2	IN	Data Raw: 22 22 Data Ascii: ""

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49980	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:43 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e544c55f-801e-0083-3181-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072043Z-174f7845968xr5c2hC1EWRd0hn0000000bvg00000000c0xh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49981	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:43 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=sGCWyK4YEzKrS2O&MD=xlvBVOTx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 07:20:44 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 5f5f63f2-e2d7-4607-bb24-b835809e97f2 MS-RequestId: 09c4d4ca-51fb-4ede-9576-4ce351f6e5b1 MS-CV: wYnI51kVDka3WBcQ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 07:20:43 GMT Connection: close Content-Length: 30005
2024-11-26 07:20:44 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-26 07:20:44 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49982	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:44 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:45 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:44 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: f1905457-c01e-0066-4580-3fa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072044Z-174f7845968frfdmhC1EWRxxbw0000000v40000000007d9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:45 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49983	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:44 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:45 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 2ff5ce10-101e-0017-5791-3f47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072045Z-174f7845968qj8jrhC1EWRh41s0000000uz0000000009pvp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:45 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49984	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:44 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:45 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: dc0e935b-901e-005b-3791-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072045Z-174f7845968glpgnhC1EWR7uec0000000v8g000000005ns9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:45 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49985	107.150.104.134	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:45 UTC	436	OUT	GET /hawkEye/outerChain.jsp?appid=3008&aid=28088389&bsAid=28088389&bsId=0&bsWid=1&isOem=true&webName=site HTTP/1.1 Host: fe.faisco.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:20:45 UTC	265	IN	HTTP/1.1 200 OK Server: F-WEB Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 689 Connection: close FAI-W-FLOW: 124654049 FAI-W-AGENT_AID: 0 Origin-Agent-Cluster: ?0 Access-Control-Allow-Origin: *
2024-11-26 07:20:45 UTC	689	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 0a 76 61 72 20 66 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 0a 66 73 2e 73 72 63 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 2f 6a 73 73 64 6b 5f 31 5f 31 2f 6a 73 2f 68 61 77 6b 45 79 65 2e 6d 69 6e 2e 6a 73 3f 76 3d 32 30 32 34 30 33 31 35 31 37 30 30 22 3b 20 0a 66 73 2e 69 64 20 3d 20 22 66 61 69 48 61 77 6b 45 79 65 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 20 3d 20 7b 7d 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 59 45 2e 6a 73 73 64 6b 5f 72 65 73 5f 72 6f 6f 74 20 3d 20 22 2f 2f 66 65 2e 35 30 38 73 79 73 2e 63 6f 6d 22 3b 20 0a 77 69 6e 64 6f 77 2e 46 41 49 5f 48 41 57 4b 5f 45 Data Ascii: (function() { var fs = document.createElement("script"); fs.src = "//fe.508sys.com/jssdk_1_1/js/hawkEye.min.js?v=202403151700"; fs.id = "faiHawkEye"; window.FAI_HAWK_EYE = {}; window.FAI_HAWK_EYE.jssdk_res_root = "//fe.508sys.com"; window.FAI_HAWK_E

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49986	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:45 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:46 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:45 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b189b901-c01e-0079-3391-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072045Z-174f78459688l8rvhC1EWRtzr000000007kg00000000d63m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:46 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49987	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:46 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:47 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 580008bf-301e-0000-1d8a-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072047Z-174f7845968xr5c2hC1EWRd0hn0000000bzg00000000472e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:47 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49988	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:47 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:47 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fde36bdf-c01e-000b-1591-3fe255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072047Z-174f7845968xlwnmhC1EWR0sv80000000uvg00000000a2zq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:47 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49990	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:47 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:47 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 9b9719a8-201e-0033-3491-3fb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072047Z-174f7845968jrjrxhC1EWRmmrs0000000v9g00000000348t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:47 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49989	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:47 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:47 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 6e1934d2-a01e-006f-595c-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072047Z-174f7845968px8v7hC1EWR08ng0000000vcg000000004c6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:47 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49991	182.61.128.141	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:47 UTC	852	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1732605643770 HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
2024-11-26 07:20:48 UTC	459	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:47 GMT Content-Type: application/javascript Content-Length: 1371 Connection: close Last-Modified: Thu, 12 Oct 2023 07:45:54 GMT ETag: "6527a432-505" Age: 81856 Accept-Ranges: bytes Ohc-Cache-HIT: jnctcache57 [2], wzix57 [2] Ohc-File-Size: 1285 Ohc-Global-Saved-Time: Mon, 25 Nov 2024 08:36:31 GMT X-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: max-age=7200
2024-11-26 07:20:48 UTC	1371	IN	Data Raw: 77 69 6e 64 6f 77 5b 27 5c 78 35 66 5c 78 35 66 5c 78 35 66 5c 78 36 31 5c 78 36 32 5c 78 37 36 5c 78 36 62 27 5d 3d 27 51 6a 6b 6d 73 69 67 59 42 36 46 74 4a 56 53 31 2b 31 7a 4c 6f 35 43 6e 39 53 30 49 32 72 62 2f 4a 31 62 72 66 55 6d 6a 71 67 59 3d 27 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 2c 6f 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 7c 7c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 2c 65 3d 22 6f 6e 6c 6f 61 64 22 69 6e 20 61 3f 74 3a 69 3b 61 2e 63 68 61 72 73 65 74 3d 22 75 74 66 38 22 2c 61 2e 73 72 63 3d 6e 2c Data Ascii: window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLo5Cn9S0I2rb/J1brfUmjqgY=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49992	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:47 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:48 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:48 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ab6eb442-501e-0035-0e91-3fc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072048Z-174f7845968swgbqhC1EWRmnb40000000vc0000000000898 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:48 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49993	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:49 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:49 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 951aba40-201e-0085-5291-3f34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072049Z-174f7845968cpnpfhC1EWR3afc0000000usg000000004g79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:49 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49994	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:49 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:49 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2150929f-401e-0064-4382-3f54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072049Z-174f7845968vqt9xhC1EWRgten0000000v60000000004b62 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49996	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:49 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:49 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 32ac4486-a01e-0050-5791-3fdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072049Z-174f7845968nxc96hC1EWRspw80000000uvg000000004zu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:49 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49995	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:49 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:50 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:49 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 97972df5-901e-008f-1591-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072049Z-174f78459688l8rvhC1EWRtzr000000007mg00000000axqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:50 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49997	182.61.128.141	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:50 UTC	722	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1732605643770 HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: BAIDUID=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
2024-11-26 07:20:50 UTC	459	IN	HTTP/1.1 200 OK Server: JSP3/2.0.14 Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Type: application/javascript Content-Length: 1371 Connection: close Last-Modified: Thu, 12 Oct 2023 07:45:54 GMT ETag: "6527a432-505" Age: 81859 Accept-Ranges: bytes Ohc-Cache-HIT: jnctcache57 [2], wzix57 [2] Ohc-File-Size: 1285 Ohc-Global-Saved-Time: Mon, 25 Nov 2024 08:36:31 GMT X-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: max-age=7200
2024-11-26 07:20:50 UTC	1371	IN	Data Raw: 77 69 6e 64 6f 77 5b 27 5c 78 35 66 5c 78 35 66 5c 78 35 66 5c 78 36 31 5c 78 36 32 5c 78 37 36 5c 78 36 62 27 5d 3d 27 51 6a 6b 6d 73 69 67 59 42 36 46 74 4a 56 53 31 2b 31 7a 4c 6f 78 47 47 44 74 2f 72 73 47 6a 57 72 4d 47 45 42 6f 4d 7a 6b 4e 55 3d 27 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 2c 6f 29 7b 76 61 72 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 7c 7c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 2c 65 3d 22 6f 6e 6c 6f 61 64 22 69 6e 20 61 3f 74 3a 69 3b 61 2e 63 68 61 72 73 65 74 3d 22 75 74 66 38 22 2c 61 2e 73 72 63 3d 6e 2c Data Ascii: window['\x5f\x5f\x5f\x61\x62\x76\x6b']='QjkmsigYB6FtJVS1+1zLoxGGDt/rsGjWrMGEBoMzkNU=';!function(){function n(n,o){var r=document.head\|\|document.getElementsByTagName("head")[0],a=document.createElement("script"),e="onload"in a?t:i;a.charset="utf8",a.src=n,

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49999	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:50 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:50 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:50 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 32ac451f-a01e-0050-6491-3fdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072050Z-174f7845968zgtf6hC1EWRqd8s0000000n1g000000006700 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:20:50 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49998	163.177.18.92	443	3508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:50 UTC	1080	OUT	POST /abdr?_o=http%3A%2F%2Fwww.wheel-done.com HTTP/1.1 Host: miao.baidu.com Connection: keep-alive Content-Length: 2055 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: http://www.wheel-done.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://www.wheel-done.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ab_jid=97f6231e06bbdccab42ea5585e9afacbc4b5; ab_jid_BFESS=97f6231e06bbdccab42ea5585e9afacbc4b5; BAIDUID_BFESS=19687D7C8A8A0D2FDE202989E0F6956C:FG=1; ab_bid=f6231e06bbdccab42ea5585e9afacbc4b64c; ab_sr=1.0.1_ODIzZTE1ZDJmZmIzZGUwYjlhMGE2YTI5YjczN2M2NDFmZDhmZWNhMmJkNDQ1ZjRjYTA5MTBiYjU4NDljZDNjNmNkMmMyMDJmNDMxNzQxMGNlYTA2ZTdiYjQ2Y2U1MzZhNzg5N2Y4YmQ2MDNiYjk3NGUxZjc0NjJmZTFhYmM3YTNiYjgxYzBmZDExNWNhMGE5YzEwMjVlNDg2OGQ4ODM0Nw==
2024-11-26 07:20:50 UTC	2055	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 22 4c 53 75 76 71 7a 63 63 7a 5a 2b 66 4b 6f 2f 74 55 75 50 32 7a 62 2f 78 58 59 76 58 4e 57 45 4a 6c 4c 61 74 46 2b 57 49 4c 6d 62 45 61 64 48 6d 4b 38 75 4a 56 46 5a 63 64 66 4f 64 45 37 68 69 54 4f 59 4a 77 2f 51 72 73 6f 58 70 39 50 44 32 61 4b 6c 55 43 61 57 4c 76 4c 72 77 74 59 4d 34 6a 6a 4b 30 37 37 74 39 2b 48 56 33 36 6d 4d 2f 6c 48 37 36 50 35 2f 4d 45 78 4f 4f 47 43 36 63 39 30 64 33 6e 4d 54 49 53 6a 6f 69 64 61 61 32 64 2b 75 52 61 32 65 37 79 5a 55 61 76 67 6d 4f 56 44 71 32 51 42 6b 30 73 68 75 67 65 69 64 41 47 6e 74 48 61 43 79 4a 7a 37 74 71 5a 6f 57 52 44 77 76 79 52 52 66 35 74 52 70 4d 67 46 4c 76 48 6c 43 6f 57 43 2b 32 35 33 49 73 4d 48 42 6c 6f 77 42 4d 78 71 6d 4c 73 76 35 6b 42 42 6a 47 42 6b 4f 33 68 54 Data Ascii: {"data":"LSuvqzcczZ+fKo/tUuP2zb/xXYvXNWEJlLatF+WILmbEadHmK8uJVFZcdfOdE7hiTOYJw/QrsoXp9PD2aKlUCaWLvLrwtYM4jjK077t9+HV36mM/lH76P5/MExOOGC6c90d3nMTISjoidaa2d+uRa2e7yZUavgmOVDq2QBk0shugeidAGntHaCyJz7tqZoWRDwvyRRf5tRpMgFLvHlCoWC+253IsMHBlowBMxqmLsv5kBBjGBkO3hT

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	50000	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:51 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:51 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:51 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: ee9d2ac9-001e-00a2-1991-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072051Z-174f7845968qj8jrhC1EWRh41s0000000uyg00000000b5rg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:51 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	50002	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:51 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:51 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 8a8d0990-701e-0021-2191-3f3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072051Z-174f7845968nxc96hC1EWRspw80000000uyg000000000r3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:52 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	50003	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:51 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 581105fc-301e-0000-6a91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072051Z-174f7845968swgbqhC1EWRmnb40000000v800000000068rb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:52 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	50001	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:20:51 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:20:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:20:52 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 106d4033-401e-008c-3691-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T072052Z-174f7845968zgtf6hC1EWRqd8s0000000n4g000000001tzr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:20:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Target ID:	1
Start time:	02:19:43
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:19:48
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1936,i,7320407238425932596,807607496568096639,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:19:50
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.wheel-done.com/"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.wheel-done.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Windows Analysis Report
http://www.wheel-done.com/