Edit tour

Windows Analysis Report
https://ff94c94a.vill.pages.dev/

Overview

General Information

Sample URL:	https://ff94c94a.vill.pages.dev/
Analysis ID:	1634770
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Creates files inside the system directory

Deletes files inside the Windows folder

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2432,i,4406870543599195809,12126500052874229075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2464 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2432,i,4406870543599195809,12126500052874229075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4440 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ff94c94a.vill.pages.dev/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T03:47:29.553187+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49760	44.210.193.205	443	TCP

HTTP traffic detected: POST /bolt-performance?src=72&evid=21&appName=thunderbolt&is_rollout=1&is_company_network=false&is_sav_rollout=0&is_dac_rollout=0&dc=virginia-pub&microPop=virginia-pub_g&is_cached=true&msid=57ff5af1-a60a-483e-8a45-f8f2a231ad6e&session_id=d0f78582-9fab-4605-85ca-61262f3cda54&ish=false&isb=false&vsi=322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7&caching=hit,hit&pv=visible&pn=1&v=1.15353.0&url=https%3A%2F%2Fktolia.wixsite.com%2Fmy-site-1&st=2&ts=205&tsn=4066&platformOnSite=true HTTP/1.1Host: frog.wix.comConnection: keep-aliveContent-Length: 0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://ktolia.wixsite.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://ktolia.wixsite.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_160.4.dr	String found in binary or memory: https://github.com/getsentry/sentry-javascript
Source: chromecache_228.4.dr, chromecache_153.4.dr	String found in binary or memory: https://static.parastorage.com/services/auto-frontend-modules/dist/webworker/auto-frontend-modules.6
Source: chromecache_199.4.dr	String found in binary or memory: https://static.parastorage.com/services/wix-thunderbolt/dist/componentsLoader.8acadaf2.chunk.min.js.
Source: chromecache_197.4.dr	String found in binary or memory: https://static.parastorage.com/services/wix-thunderbolt/dist/cyclicTabbing.29f6a6d7.chunk.min.js.map
Source: chromecache_219.4.dr	String found in binary or memory: https://static.parastorage.com/services/wix-thunderbolt/dist/environmentWixCodeSdk.a8e26091.chunk.mi
Source: chromecache_163.4.dr	String found in binary or memory: https://static.parastorage.com/services/wix-thunderbolt/dist/ooi.f864528d.chunk.min.js.map

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir2872_1720205765

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir2872_1720205765

Jump to behavior

Source: classification engine

Classification label: mal48.phis.win@24/229@32/11

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2432,i,4406870543599195809,12126500052874229075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2464 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2432,i,4406870543599195809,12126500052874229075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4440 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ff94c94a.vill.pages.dev/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2432,i,4406870543599195809,12126500052874229075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2464 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2432,i,4406870543599195809,12126500052874229075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4440 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://ff94c94a.vill.pages.dev/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
browser.sentry-cdn.com	151.101.2.217	true	false	high
glb-editor.wix.com	34.149.206.255	true	false	high
username-ccm-206-118.wix.com	34.144.206.118	true	false	high
td-static-34-49-229-81.parastorage.com	34.49.229.81	true	false	unknown
d1cq301dpr7fww.cloudfront.net	3.167.227.123	true	false	unknown
www.google.com	142.250.186.36	true	false	high
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	false	high
ff94c94a.vill.pages.dev	172.66.44.90	true	false	unknown
bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	44.210.193.205	true	false	high
static.wixstatic.com	unknown	unknown	false	high
siteassets.parastorage.com	unknown	unknown	false	high
frog.wix.com	unknown	unknown	false	high
ktolia.wixsite.com	unknown	unknown	true	unknown
panorama.wixapps.net	unknown	unknown	false	high
static.parastorage.com	unknown	unknown	false	high
www.wix.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://frog.wix.com/bolt-performance?src=72&evid=28&appName=thunderbolt&is_rollout=1&is_company_network=false&is_sav_rollout=0&is_dac_rollout=0&dc=virginia-pub&microPop=virginia-pub_g&is_cached=true&msid=57ff5af1-a60a-483e-8a45-f8f2a231ad6e&session_id=d0f78582-9fab-4605-85ca-61262f3cda54&ish=false&isb=false&vsi=322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7&caching=hit,hit&pv=visible&pn=1&v=1.15353.0&url=https%3A%2F%2Fktolia.wixsite.com%2Fmy-site-1&st=2&ts=205&tsn=4066&name=partially_visible&duration=1741661242520&pageId=vh096&isSuccessfulSSR=true	false	high
https://frog.wix.com/bpm	false	high
https://frog.wix.com/bolt-performance	false	high
https://frog.wix.com/bolt-performance?src=72&evid=21&appName=thunderbolt&is_rollout=1&is_company_network=false&is_sav_rollout=0&is_dac_rollout=0&dc=virginia-pub&microPop=virginia-pub_g&is_cached=true&msid=57ff5af1-a60a-483e-8a45-f8f2a231ad6e&session_id=d0f78582-9fab-4605-85ca-61262f3cda54&ish=false&isb=false&vsi=322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7&caching=hit,hit&pv=visible&pn=1&v=1.15353.0&url=https%3A%2F%2Fktolia.wixsite.com%2Fmy-site-1&st=2&ts=205&tsn=4066&platformOnSite=true	false	high
https://frog.wix.com/site-members?_msid=57ff5af1-a60a-483e-8a45-f8f2a231ad6e&vsi=322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7&_av=thunderbolt-1.15353.0&isb=false&_brandId=wix&_siteBranchId=undefined&_ms=11194&_isHeadless=undefined&_hostingPlatform=VIEWER&_lv=2.0.985%7CC&_visitorId=915d49c4-540c-4073-b26c-24057355d9c2&_siteMemberId=undefined&bsi=d686ec6d-ccee-45db-a022-536151cde387%7C1&src=5&evid=698&biToken=57ff5af1-a60a-483e-8a45-f8f2a231ad6e&context=undefined&ts=7333&viewmode=undefined&visitor_id=915d49c4-540c-4073-b26c-24057355d9c2&site_member_id=undefined&site_settings_lng=en&browser_lng=en&lng_mismatch=false&layout=undefined&_isca=1&_iscf=1&_ispd=0&_ise=0&_=17416612459640	false	high
https://frog.wix.com/	false	high
https://browser.sentry-cdn.com/7.120.3/modulemetadata.es5.min.js	false	high
https://ktolia.wixsite.com/my-site-1	true	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high
https://frog.wix.com/rich-editor	false	high
https://ff94c94a.vill.pages.dev/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://static.parastorage.com/services/wix-thunderbolt/dist/cyclicTabbing.29f6a6d7.chunk.min.js.map	chromecache_197.4.dr	false	high
https://static.parastorage.com/services/wix-thunderbolt/dist/componentsLoader.8acadaf2.chunk.min.js.	chromecache_199.4.dr	false	high
https://static.parastorage.com/services/auto-frontend-modules/dist/webworker/auto-frontend-modules.6	chromecache_228.4.dr, chromecache_153.4.dr	false	high
https://static.parastorage.com/services/wix-thunderbolt/dist/environmentWixCodeSdk.a8e26091.chunk.mi	chromecache_219.4.dr	false	high
https://github.com/getsentry/sentry-javascript	chromecache_160.4.dr	false	high
https://static.parastorage.com/services/wix-thunderbolt/dist/ooi.f864528d.chunk.min.js.map	chromecache_163.4.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
34.49.229.81	td-static-34-49-229-81.parastorage.com	United States	2686	ATGS-MMD-ASUS	false
34.144.206.118	username-ccm-206-118.wix.com	United States	2686	ATGS-MMD-ASUS	false
172.66.44.90	ff94c94a.vill.pages.dev	United States	13335	CLOUDFLARENETUS	false
151.101.2.217	browser.sentry-cdn.com	United States	54113	FASTLYUS	false
34.149.87.45	td-ccm-neg-87-45.wixdns.net	United States	2686	ATGS-MMD-ASUS	false
44.210.193.205	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
34.149.206.255	glb-editor.wix.com	United States	2686	ATGS-MMD-ASUS	false
3.167.227.123	d1cq301dpr7fww.cloudfront.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.8
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1634770
Start date and time:	2025-03-11 03:46:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://ff94c94a.vill.pages.dev/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@24/229@32/11

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.78, 142.250.185.163, 142.250.185.142, 66.102.1.84, 142.250.184.238, 142.250.184.206, 142.250.185.174, 172.217.18.106, 142.250.186.106, 142.250.184.202, 142.250.186.138, 172.217.18.10, 142.250.185.106, 142.250.185.202, 172.217.16.138, 142.250.185.170, 216.58.206.74, 142.250.185.138, 142.250.185.74, 142.250.186.74, 142.250.186.170, 172.217.23.106, 142.250.184.234, 142.250.185.110, 142.250.186.46, 142.250.185.238, 142.250.181.227, 172.217.18.110, 142.250.185.195, 23.199.214.10, 20.12.23.50, 150.171.27.10
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, accounts.google.com, redirector.gvt1.com, content-autofill.googleapis.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, g.bing.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: https://ff94c94a.vill.pages.dev/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.915590256616454
Encrypted:	false
SSDEEP:	48:F5CacOZhkqVbQ/TlyrKhgrWw2Dlee6j5qbbqA+vagT9iYHaLHIat:F51rGqVITYrCwsxkTPHkTt
MD5:	5545A3CCB0221EC82E186F2D723F17CD
SHA1:	CEAEDAFC7C2A17DB751CB39340E015DC1F887264
SHA-256:	8B4162AF470850C974F879D0B2AC21190195C60676131DC9048D64DEC17BD065
SHA-512:	66581D95381B19592014F1038C2D6593E7342928257B78CCB10DEAABA5834DBFB1683061D8A39E38A9289A48543D25E18CB87AA6D55A1F194A4E9B9DC454DCBE
Malicious:	false
Reputation:	low
Preview:	..F..&. ....F....#d.{.j....g.R..... ...~(..ig. ...(g.......?.o.O].\|..d.M. ..2/....).....Y.....\..p....Dz.....g.6....+..%.`ws..tR.F.E....3&J.w0...+.....<^.xjR.....Q..(.$..M.K...l.\|K7.}.V.b[....8H.(.......wv7..C.._...~........4.N.dC..M%L....0.......(a.L..E.u..j;E.588T.(...........}.&.3.....i5r(.b\q....e.]..2G...0.`..$}..]s..G.....n(W8/.tpp2.1.[...b..c....}.....b.....qL..g"m....F..(......7..-.QO.z...Q....#..........-z.9uw.S..$.3..5MI#........f.].7.....~.x.x........7f."3...^.....{.U...-..A.B.Kk4~24ji`....Myn../..3...!....9."..Y.wemJ.mwK_.6../&.}....s.>}...o..T.>..."...<~.d.............$........ 4..#..7..M..n.P...Y4.._....)... .`Ma.9.G.3X &..-..P6.%...8...+...+..=u.......7.A..d....r)z.28p.ZD..."..(/...u.T.....\3m{Zp.(..7."..D]MeXF.....v2...b.p.M..."..."".....5..1a.UReJD5q...c...]....*.{7..#i.HO36.^\>...+y..."2..j.U...1\|..1.>...>r..;.U.r..G....!...Cv.'McH...N.4...V.R....#...d.B.2..m......OZ.........}B....&.9M<....4.Vk:,....X;K....S.

Source: https://ktolia.wixsite.com/my-site-1	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft 365' is well-known and typically associated with the domain 'microsoft.com'., The URL 'ktolia.wixsite.com' does not match the legitimate domain for Microsoft 365., The use of 'wixsite.com' suggests a website hosted on Wix, which is a website builder platform and not typically associated with Microsoft 365., The presence of input fields asking for sensitive information like 'Net ID \| Username' and 'Portal Pass' is suspicious, especially when hosted on a non-Microsoft domain., The URL does not contain any direct reference to Microsoft or its services, which is a common tactic in phishing attempts. DOM: 1.1.pages.csv
Source: https://ktolia.wixsite.com/my-site-1	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft 365' is well-known and typically associated with the domain 'microsoft.com'., The URL 'ktolia.wixsite.com' does not match the legitimate domain for Microsoft 365., The use of 'wixsite.com' suggests a website hosted on Wix, which is a common platform for creating personal or small business websites, not typically used by large corporations like Microsoft., The presence of input fields requesting sensitive information such as 'Net ID \| Username' and 'Portal Pass' is suspicious, especially when hosted on a non-Microsoft domain., The URL does not contain any direct reference to Microsoft or its services, which is unusual for a legitimate Microsoft 365 page. DOM: 1.4.pages.csv

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI9s/OAQiB1s4BCNLgzgEI8ePOAQiv5M4BCOLkzgEIi+XOAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7.120.3/modulemetadata.es5.min.js HTTP/1.1Host: browser.sentry-cdn.comConnection: keep-aliveOrigin: https://ktolia.wixsite.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ktolia.wixsite.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ff94c94a.vill.pages.dev
Source: global traffic	DNS traffic detected: DNS query: ktolia.wixsite.com
Source: global traffic	DNS traffic detected: DNS query: static.parastorage.com
Source: global traffic	DNS traffic detected: DNS query: static.wixstatic.com
Source: global traffic	DNS traffic detected: DNS query: siteassets.parastorage.com
Source: global traffic	DNS traffic detected: DNS query: frog.wix.com
Source: global traffic	DNS traffic detected: DNS query: panorama.wixapps.net
Source: global traffic	DNS traffic detected: DNS query: browser.sentry-cdn.com
Source: global traffic	DNS traffic detected: DNS query: www.wix.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 03:47:06.227963924 CET	53	61930	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:06.326426029 CET	53	52162	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:09.605214119 CET	53	55090	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:09.612704039 CET	53	60028	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:10.410288095 CET	51740	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:10.410450935 CET	50695	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:10.417059898 CET	53	50695	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:10.417206049 CET	53	51740	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:11.772355080 CET	54193	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:11.775913954 CET	62291	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:11.784907103 CET	53	54193	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:11.786967039 CET	53	62291	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:15.960045099 CET	64017	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:15.960236073 CET	61354	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:15.971259117 CET	53	64017	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:15.971273899 CET	53	61354	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:16.469161987 CET	58428	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:16.469379902 CET	61107	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:16.482194901 CET	53	58428	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:16.482373953 CET	53	61107	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:19.804287910 CET	63022	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:19.804497957 CET	59676	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:19.805875063 CET	57019	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:19.806258917 CET	51410	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:19.811837912 CET	53	63022	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:19.811852932 CET	53	59676	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:19.813026905 CET	53	57019	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:19.813083887 CET	53	51410	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:19.816483974 CET	57694	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:19.816836119 CET	63471	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:19.823573112 CET	53	57694	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:19.823971987 CET	53	63471	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:20.023303032 CET	53790	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:20.024342060 CET	55097	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:20.025290012 CET	61411	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:20.025290012 CET	60332	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:20.030592918 CET	53	53790	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:20.031682968 CET	53	55097	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:20.032254934 CET	53	61411	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:20.042932987 CET	53	60332	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:20.072745085 CET	57439	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:20.072745085 CET	54487	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:20.079862118 CET	53	57439	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:20.080156088 CET	53	54487	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:24.025340080 CET	60610	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:24.025398970 CET	60892	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:24.032459021 CET	53	60892	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:24.032812119 CET	53	60610	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:24.219835043 CET	58918	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:24.220005035 CET	61862	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:24.226912975 CET	53	61862	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:24.232192039 CET	53	58918	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:24.967983961 CET	53	64286	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:26.245125055 CET	51884	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:26.245337963 CET	53513	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:26.258917093 CET	53	53513	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:26.259998083 CET	53	51884	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:26.748353958 CET	53	64072	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:27.199023008 CET	52805	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:27.199264050 CET	53284	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:27.209908962 CET	53	52805	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:27.212124109 CET	53	53284	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:31.141613960 CET	58764	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:31.141762018 CET	51637	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:31.148814917 CET	53	51637	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:31.156099081 CET	53	58764	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:31.605986118 CET	53243	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:31.605986118 CET	52422	53	192.168.2.5	1.1.1.1
Mar 11, 2025 03:47:31.613414049 CET	53	52422	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:31.618549109 CET	53	53243	1.1.1.1	192.168.2.5
Mar 11, 2025 03:47:46.011029005 CET	53	65276	1.1.1.1	192.168.2.5
Mar 11, 2025 03:48:03.399658918 CET	138	138	192.168.2.5	192.168.2.255
Mar 11, 2025 03:48:05.955193043 CET	53	49640	1.1.1.1	192.168.2.5
Mar 11, 2025 03:48:08.541949987 CET	53	49714	1.1.1.1	192.168.2.5
Mar 11, 2025 03:48:10.845921993 CET	53	51666	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 11, 2025 03:47:09.605660915 CET	192.168.2.5	1.1.1.1	c223	(Port unreachable)	Destination Unreachable
Mar 11, 2025 03:47:20.043076038 CET	192.168.2.5	1.1.1.1	c276	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:18 UTC	575	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI9s/OAQiB1s4BCNLgzgEI8ePOAQiv5M4BCOLkzgEIi+XOAQ== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:19 UTC	1303	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 02:47:18 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-VFLTGHPqOjZin5pRuSVVaA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-11 02:47:19 UTC	75	IN	Data Raw: 66 35 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 69 72 20 69 6e 64 69 61 20 66 6c 69 67 68 74 20 63 6c 6f 67 67 65 64 20 74 6f 69 6c 65 74 73 22 2c 22 68 75 6d 61 6e 20 72 69 67 68 74 73 22 2c 22 75 6e 77 61 6e 74 65 64 20 Data Ascii: f50)]}'["",["air india flight clogged toilets","human rights","unwanted
2025-03-11 02:47:19 UTC	1378	IN	Data Raw: 74 72 75 65 20 6d 61 74 65 22 2c 22 76 65 72 64 61 6e 73 6b 20 77 61 72 7a 6f 6e 65 20 6d 61 70 22 2c 22 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 73 6e 6f 77 20 66 6f 72 65 63 61 73 74 22 2c 22 74 65 6e 6e 69 73 20 69 6e 64 69 61 6e 20 77 65 6c 6c 73 22 2c 22 65 6c 6f 6e 20 6d 75 73 6b 20 73 70 61 63 65 78 20 72 6f 63 6b 65 74 20 65 78 70 6c 6f 73 69 6f 6e 22 2c 22 64 6f 77 20 6a 6f 6e 65 73 20 73 74 6f 63 6b 20 6d 61 72 6b 65 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 6f 49 6b 6b 34 53 46 51 Data Ascii: true mate","verdansk warzone map","winter storm snow forecast","tennis indian wells","elon musk spacex rocket explosion","dow jones stock markets"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChoIkk4SFQ
2025-03-11 02:47:19 UTC	1378	IN	Data Raw: 68 48 54 44 68 33 61 32 49 31 55 6b 64 71 59 56 68 6e 4d 47 35 76 55 56 4a 6e 5a 58 4e 35 4d 6b 70 4c 56 31 49 78 55 55 46 78 54 47 64 71 52 58 4e 74 57 58 5a 4c 4e 31 4e 54 54 31 64 61 61 6d 4e 72 4e 47 6c 74 63 57 5a 47 61 57 46 50 4c 33 68 5a 52 6e 6c 6f 52 57 70 6f 53 32 46 78 59 6c 4a 56 65 58 49 77 59 32 70 46 59 54 46 55 53 58 64 61 56 30 74 7a 63 48 56 48 51 6e 4e 52 59 30 51 31 61 31 4e 4e 65 48 46 6f 5a 6d 78 4e 4e 43 39 56 4e 45 6f 30 59 6d 64 47 57 6d 35 30 53 45 46 61 52 31 52 59 53 6e 4d 32 62 6d 52 54 51 56 4e 45 4b 31 6c 48 54 32 4d 30 54 6b 4a 6a 5a 47 64 71 54 6d 68 31 4e 45 46 4b 4c 31 5a 61 59 6d 31 31 57 54 56 69 53 6c 56 54 65 55 5a 78 61 55 70 42 65 58 68 4e 54 48 6c 4e 63 45 6c 47 4d 32 4a 74 54 32 56 33 54 6e 6f 34 64 6b 38 31 56 Data Ascii: hHTDh3a2I1UkdqYVhnMG5vUVJnZXN5MkpLV1IxUUFxTGdqRXNtWXZLN1NTT1daamNrNGltcWZGaWFPL3hZRnloRWpoS2FxYlJVeXIwY2pFYTFUSXdaV0tzcHVHQnNRY0Q1a1NNeHFoZmxNNC9VNEo0YmdGWm50SEFaR1RYSnM2bmRTQVNEK1lHT2M0TkJjZGdqTmh1NEFKL1ZaYm11WTViSlVTeUZxaUpBeXhNTHlNcElGM2JtT2V3Tno4dk81V
2025-03-11 02:47:19 UTC	1096	IN	Data Raw: 55 56 56 4e 52 6c 42 47 53 45 38 72 61 33 4e 61 52 32 6f 78 53 47 4a 6c 4d 58 51 76 53 56 67 32 4e 46 70 52 59 31 46 57 63 30 5a 49 62 48 70 30 62 46 56 36 56 55 35 4b 55 31 46 78 61 45 67 77 4e 54 42 52 62 32 70 73 64 44 64 4c 51 31 4e 53 57 55 45 7a 64 47 64 54 61 58 4a 68 5a 57 35 71 63 45 4d 34 59 6e 52 4d 55 6d 78 36 52 6e 42 5a 51 6c 52 78 4e 6a 51 77 62 48 4a 35 59 57 46 48 51 30 6c 4c 5a 31 64 4a 55 6e 6c 4f 63 45 59 79 51 57 45 35 63 6a 67 33 5a 48 4e 4b 5a 47 52 57 4d 54 4a 45 55 6d 45 76 64 47 35 36 4b 33 5a 58 4d 30 4e 7a 51 6c 59 77 4e 47 49 78 52 6a 56 32 59 6a 4e 34 4e 44 63 7a 4f 55 77 34 63 44 4a 31 5a 6c 4e 56 64 46 52 57 52 56 70 4d 56 33 64 55 56 6a 68 6f 63 55 70 6b 51 6b 4a 4e 59 6d 6c 46 62 7a 64 4a 54 31 52 69 63 30 64 7a 64 33 52 Data Ascii: UVVNRlBGSE8ra3NaR2oxSGJlMXQvSVg2NFpRY1FWc0ZIbHp0bFV6VU5KU1FxaEgwNTBRb2psdDdLQ1NSWUEzdGdTaXJhZW5qcEM4YnRMUmx6RnBZQlRxNjQwbHJ5YWFHQ0lLZ1dJUnlOcEYyQWE5cjg3ZHNKZGRWMTJEUmEvdG56K3ZXM0NzQlYwNGIxRjV2YjN4NDczOUw4cDJ1ZlNVdFRWRVpMV3dUVjhocUpkQkJNYmlFbzdJT1Ric0dzd3R
2025-03-11 02:47:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:21 UTC	1073	OUT	POST /bolt-performance?src=72&evid=21&appName=thunderbolt&is_rollout=1&is_company_network=false&is_sav_rollout=0&is_dac_rollout=0&dc=virginia-pub&microPop=virginia-pub_g&is_cached=true&msid=57ff5af1-a60a-483e-8a45-f8f2a231ad6e&session_id=d0f78582-9fab-4605-85ca-61262f3cda54&ish=false&isb=false&vsi=322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7&caching=hit,hit&pv=visible&pn=1&v=1.15353.0&url=https%3A%2F%2Fktolia.wixsite.com%2Fmy-site-1&st=2&ts=205&tsn=4066&platformOnSite=true HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:22 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:22 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:22 UTC	597	OUT	GET /7.120.3/modulemetadata.es5.min.js HTTP/1.1 Host: browser.sentry-cdn.com Connection: keep-alive Origin: https://ktolia.wixsite.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:22 UTC	545	IN	HTTP/1.1 200 OK Connection: close Content-Length: 3323 Cache-Control: public, max-age=31536000 Expires: Tue, 03 Mar 2026 08:06:43 GMT Last-Modified: Fri, 10 Jan 2025 08:47:56 GMT ETag: W/"ccf0e1db3811d44808d97a63c7a72d1f" Content-Type: application/javascript; charset=utf-8 X-GUploader-Response-Body-Transformations: gunzipped Accept-Ranges: bytes Age: 672039 Date: Tue, 11 Mar 2025 02:47:22 GMT Vary: Accept-Encoding Access-Control-Allow-Origin: * Server: Fastly Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-03-11 02:47:22 UTC	1379	IN	Data Raw: 2f 2a 21 20 40 73 65 6e 74 72 79 2f 62 72 6f 77 73 65 72 20 37 2e 31 32 30 2e 33 20 28 35 61 38 33 33 62 34 29 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 67 65 74 73 65 6e 74 72 79 2f 73 65 6e 74 72 79 2d 6a 61 76 61 73 63 72 69 70 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 76 61 72 20 74 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 2c 6e 3d 74 26 26 72 5b 74 5d 2c 6f 3d 30 3b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 63 61 6c 6c 28 72 29 3b 69 66 28 72 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 72 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a Data Ascii: /! @sentry/browser 7.120.3 (5a833b4) \| https://github.com/getsentry/sentry-javascript /!function(r){var t={};function n(r){var t="function"==typeof Symbol&&Symbol.iterator,n=t&&r[t],o=0;if(n)return n.call(r);if(r&&"number"==typeof r.length)return{next:
2025-03-11 02:47:22 UTC	1379	IN	Data Raw: 66 6f 72 28 76 61 72 20 68 3d 28 66 3d 76 6f 69 64 20 30 2c 6e 28 62 2e 72 65 76 65 72 73 65 28 29 29 29 2c 64 3d 68 2e 6e 65 78 74 28 29 3b 21 64 2e 64 6f 6e 65 3b 64 3d 68 2e 6e 65 78 74 28 29 29 7b 76 61 72 20 77 3d 64 2e 76 61 6c 75 65 3b 69 66 28 77 2e 66 69 6c 65 6e 61 6d 65 29 7b 61 2e 73 65 74 28 77 2e 66 69 6c 65 6e 61 6d 65 2c 76 29 3b 62 72 65 61 6b 7d 7d 7d 63 61 74 63 68 28 72 29 7b 66 3d 7b 65 72 72 6f 72 3a 72 7d 7d 66 69 6e 61 6c 6c 79 7b 74 72 79 7b 64 26 26 21 64 2e 64 6f 6e 65 26 26 28 69 3d 68 2e 72 65 74 75 72 6e 29 26 26 69 2e 63 61 6c 6c 28 68 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 66 29 74 68 72 6f 77 20 66 2e 65 72 72 6f 72 7d 7d 7d 7d 7d 63 61 74 63 68 28 72 29 7b 74 3d 7b 65 72 72 6f 72 3a 72 7d 7d 66 69 6e 61 6c 6c 79 7b 74 72 Data Ascii: for(var h=(f=void 0,n(b.reverse())),d=h.next();!d.done;d=h.next()){var w=d.value;if(w.filename){a.set(w.filename,v);break}}}catch(r){f={error:r}}finally{try{d&&!d.done&&(i=h.return)&&i.call(h)}finally{if(f)throw f.error}}}}}catch(r){t={error:r}}finally{tr
2025-03-11 02:47:22 UTC	565	IN	Data Raw: 72 72 6f 72 3a 72 7d 7d 66 69 6e 61 6c 6c 79 7b 74 72 79 7b 65 26 26 21 65 2e 64 6f 6e 65 26 26 28 66 3d 69 2e 72 65 74 75 72 6e 29 26 26 66 2e 63 61 6c 6c 28 69 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 6f 29 74 68 72 6f 77 20 6f 2e 65 72 72 6f 72 7d 7d 7d 29 29 7d 63 61 74 63 68 28 72 29 7b 7d 7d 28 6f 2e 67 65 74 4f 70 74 69 6f 6e 73 28 29 2e 73 74 61 63 6b 50 61 72 73 65 72 2c 72 29 2c 72 7d 7d 7d 2c 68 3d 28 79 3d 76 2c 75 3d 62 2c 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 72 3d 5b 5d 2c 74 3d 30 3b 74 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 72 5b 74 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 72 65 74 75 72 6e 20 75 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 66 28 5b Data Ascii: rror:r}}finally{try{e&&!e.done&&(f=i.return)&&f.call(i)}finally{if(o)throw o.error}}}))}catch(r){}}(o.getOptions().stackParser,r),r}}},h=(y=v,u=b,Object.assign((function(){for(var r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return u.apply(void 0,f([

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:26 UTC	1133	OUT	POST /bolt-performance?src=72&evid=28&appName=thunderbolt&is_rollout=1&is_company_network=false&is_sav_rollout=0&is_dac_rollout=0&dc=virginia-pub&microPop=virginia-pub_g&is_cached=true&msid=57ff5af1-a60a-483e-8a45-f8f2a231ad6e&session_id=d0f78582-9fab-4605-85ca-61262f3cda54&ish=false&isb=false&vsi=322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7&caching=hit,hit&pv=visible&pn=1&v=1.15353.0&url=https%3A%2F%2Fktolia.wixsite.com%2Fmy-site-1&st=2&ts=205&tsn=4066&name=partially_visible&duration=1741661242520&pageId=vh096&isSuccessfulSSR=true HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:27 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:26 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:28 UTC	652	OUT	POST / HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 900 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:28 UTC	900	OUT	Data Raw: 7b 22 64 74 22 3a 33 30 37 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 30 2c 22 66 22 3a 7b 22 5f 62 72 61 6e 64 49 64 22 3a 22 77 69 78 22 2c 22 5f 6d 73 22 3a 38 36 35 31 2c 22 5f 68 6f 73 74 69 6e 67 50 6c 61 74 66 6f 72 6d 22 3a 22 56 49 45 57 45 52 22 2c 22 73 72 63 22 3a 37 32 2c 22 65 76 69 64 22 3a 31 38 31 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 22 76 69 65 77 65 72 22 2c 22 6d 73 69 64 22 3a 22 35 37 66 66 35 61 66 31 2d 61 36 30 61 2d 34 38 33 65 2d 38 61 34 35 2d 66 38 66 32 61 32 33 31 61 64 36 65 22 2c 22 76 73 69 22 3a 22 33 32 32 66 63 39 38 64 2d 32 62 62 65 2d 34 64 35 63 2d 38 61 61 31 2d 61 36 62 39 39 62 61 38 39 38 62 37 22 2c 22 73 65 73 73 69 6f 6e 49 64 22 3a 22 64 30 66 37 38 35 38 32 2d 39 66 61 62 2d 34 36 30 35 2d 38 35 63 61 2d 36 31 32 Data Ascii: {"dt":307,"e":[{"dt":0,"f":{"_brandId":"wix","_ms":8651,"_hostingPlatform":"VIEWER","src":72,"evid":181,"platform":"viewer","msid":"57ff5af1-a60a-483e-8a45-f8f2a231ad6e","vsi":"322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7","sessionId":"d0f78582-9fab-4605-85ca-612
2025-03-11 02:47:28 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:28 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:28 UTC	669	OUT	POST /bolt-performance HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 3566 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:28 UTC	3566	OUT	Data Raw: 7b 22 64 74 22 3a 33 33 30 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 30 2c 22 66 22 3a 7b 22 74 73 22 3a 34 38 34 34 2c 22 74 73 6e 22 3a 38 37 30 35 2c 22 70 76 22 3a 74 72 75 65 2c 22 5f 62 72 61 6e 64 49 64 22 3a 22 77 69 78 22 2c 22 5f 6d 73 22 3a 38 37 30 35 2c 22 5f 68 6f 73 74 69 6e 67 50 6c 61 74 66 6f 72 6d 22 3a 22 56 49 45 57 45 52 22 2c 22 61 70 70 4e 61 6d 65 22 3a 22 74 68 75 6e 64 65 72 62 6f 6c 74 22 2c 22 63 6f 72 72 49 64 22 3a 22 32 31 64 65 37 36 66 61 2d 31 34 64 30 2d 34 65 62 61 2d 38 61 33 65 2d 63 66 61 34 34 38 30 38 63 38 66 32 22 2c 22 69 73 5f 72 6f 6c 6c 6f 75 74 22 3a 31 2c 22 69 73 53 75 63 63 65 73 73 66 75 6c 53 53 52 22 3a 74 72 75 65 2c 22 73 72 63 22 3a 37 32 2c 22 65 76 69 64 22 3a 32 38 2c 22 73 65 73 73 69 6f 6e 5f 69 64 Data Ascii: {"dt":330,"e":[{"dt":0,"f":{"ts":4844,"tsn":8705,"pv":true,"_brandId":"wix","_ms":8705,"_hostingPlatform":"VIEWER","appName":"thunderbolt","corrId":"21de76fa-14d0-4eba-8a3e-cfa44808c8f2","is_rollout":1,"isSuccessfulSSR":true,"src":72,"evid":28,"session_id
2025-03-11 02:47:28 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:28 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:29 UTC	1266	OUT	POST /site-members?_msid=57ff5af1-a60a-483e-8a45-f8f2a231ad6e&vsi=322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7&_av=thunderbolt-1.15353.0&isb=false&_brandId=wix&_siteBranchId=undefined&_ms=11194&_isHeadless=undefined&_hostingPlatform=VIEWER&_lv=2.0.985%7CC&_visitorId=915d49c4-540c-4073-b26c-24057355d9c2&_siteMemberId=undefined&bsi=d686ec6d-ccee-45db-a022-536151cde387%7C1&src=5&evid=698&biToken=57ff5af1-a60a-483e-8a45-f8f2a231ad6e&context=undefined&ts=7333&viewmode=undefined&visitor_id=915d49c4-540c-4073-b26c-24057355d9c2&site_member_id=undefined&site_settings_lng=en&browser_lng=en&lng_mismatch=false&layout=undefined&_isca=1&_iscf=1&_ispd=0&_ise=0&_=17416612459640 HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:29 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:29 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:32 UTC	522	OUT	POST /bpm HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 1276 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:32 UTC	1276	OUT	Data Raw: 7b 22 64 74 22 3a 31 35 37 33 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 31 2c 22 66 22 3a 7b 22 5f 62 72 61 6e 64 49 64 22 3a 22 77 69 78 22 2c 22 5f 6d 73 22 3a 37 35 34 32 2c 22 5f 68 6f 73 74 69 6e 67 50 6c 61 74 66 6f 72 6d 22 3a 22 56 49 45 57 45 52 22 2c 22 5f 76 69 73 69 74 6f 72 49 64 22 3a 22 39 31 35 64 34 39 63 34 2d 35 34 30 63 2d 34 30 37 33 2d 62 32 36 63 2d 32 34 30 35 37 33 35 35 64 39 63 32 22 2c 22 73 72 63 22 3a 37 32 2c 22 65 76 69 64 22 3a 35 32 30 2c 22 61 70 70 73 5f 69 64 73 22 3a 5b 22 32 32 35 64 64 39 31 32 2d 37 64 65 61 2d 34 37 33 38 2d 38 36 38 38 2d 34 62 38 63 36 39 35 35 66 66 63 32 22 5d 2c 22 77 69 64 67 65 74 73 5f 69 64 73 22 3a 5b 22 33 37 31 65 65 31 39 39 2d 33 38 39 63 2d 34 61 39 33 2d 38 34 39 65 2d 65 33 35 62 38 61 Data Ascii: {"dt":1573,"e":[{"dt":1,"f":{"_brandId":"wix","_ms":7542,"_hostingPlatform":"VIEWER","_visitorId":"915d49c4-540c-4073-b26c-24057355d9c2","src":72,"evid":520,"apps_ids":["225dd912-7dea-4738-8688-4b8c6955ffc2"],"widgets_ids":["371ee199-389c-4a93-849e-e35b8a
2025-03-11 02:47:33 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:33 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:33 UTC	530	OUT	POST /rich-editor HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 1889 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:33 UTC	1889	OUT	Data Raw: 7b 22 64 74 22 3a 33 30 34 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 30 2c 22 66 22 3a 7b 22 5f 6d 73 22 3a 39 37 37 39 2c 22 73 72 63 22 3a 31 31 36 2c 22 65 76 69 64 22 3a 31 35 2c 22 63 6f 6e 74 61 69 6e 65 72 22 3a 22 46 6f 72 6d 73 22 2c 22 63 6f 6e 74 61 69 6e 65 72 5f 69 64 22 3a 22 22 2c 22 63 6f 6e 74 61 69 6e 65 72 5f 70 6c 61 74 66 6f 72 6d 22 3a 22 4c 69 76 65 73 69 74 65 22 2c 22 70 6f 73 74 5f 69 64 22 3a 22 22 2c 22 72 63 65 5f 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 62 64 63 32 30 38 64 66 2d 64 66 38 34 2d 34 62 65 33 2d 38 61 39 39 2d 35 63 66 31 65 62 62 38 61 61 38 64 22 2c 22 77 69 78 52 69 63 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 31 32 30 2e 33 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 31 30 2e 31 32 30 2e 33 22 2c 22 70 72 65 76 69 65 Data Ascii: {"dt":304,"e":[{"dt":0,"f":{"_ms":9779,"src":116,"evid":15,"container":"Forms","container_id":"","container_platform":"Livesite","post_id":"","rce_session_id":"bdc208df-df84-4be3-8a99-5cf1ebb8aa8d","wixRicosVersion":"10.120.3","version":"10.120.3","previe
2025-03-11 02:47:34 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:34 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:35 UTC	669	OUT	POST /bolt-performance HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 5178 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:35 UTC	5178	OUT	Data Raw: 7b 22 64 74 22 3a 39 35 32 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 35 37 33 2c 22 66 22 3a 7b 22 74 73 22 3a 37 33 31 32 2c 22 74 73 6e 22 3a 31 31 31 37 33 2c 22 70 76 22 3a 74 72 75 65 2c 22 5f 62 72 61 6e 64 49 64 22 3a 22 77 69 78 22 2c 22 5f 6d 73 22 3a 31 31 31 37 33 2c 22 5f 68 6f 73 74 69 6e 67 50 6c 61 74 66 6f 72 6d 22 3a 22 56 49 45 57 45 52 22 2c 22 61 70 70 4e 61 6d 65 22 3a 22 74 68 75 6e 64 65 72 62 6f 6c 74 22 2c 22 63 6f 72 72 49 64 22 3a 22 32 31 64 65 37 36 66 61 2d 31 34 64 30 2d 34 65 62 61 2d 38 61 33 65 2d 63 66 61 34 34 38 30 38 63 38 66 32 22 2c 22 69 73 5f 72 6f 6c 6c 6f 75 74 22 3a 31 2c 22 69 73 53 75 63 63 65 73 73 66 75 6c 53 53 52 22 3a 74 72 75 65 2c 22 6e 61 6d 65 22 3a 22 6c 6f 61 64 53 69 74 65 46 65 61 74 75 72 65 73 22 2c Data Ascii: {"dt":952,"e":[{"dt":573,"f":{"ts":7312,"tsn":11173,"pv":true,"_brandId":"wix","_ms":11173,"_hostingPlatform":"VIEWER","appName":"thunderbolt","corrId":"21de76fa-14d0-4eba-8a3e-cfa44808c8f2","is_rollout":1,"isSuccessfulSSR":true,"name":"loadSiteFeatures",
2025-03-11 02:47:36 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:35 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:39 UTC	530	OUT	POST /rich-editor HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 3608 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:39 UTC	3608	OUT	Data Raw: 7b 22 64 74 22 3a 35 33 38 31 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 35 30 36 36 2c 22 66 22 3a 7b 22 5f 6d 73 22 3a 31 35 31 34 39 2c 22 65 76 69 64 22 3a 31 30 30 36 2c 22 61 63 74 69 6f 6e 5f 74 79 70 65 22 3a 22 61 70 70 65 61 72 65 64 22 2c 22 65 72 72 6f 72 5f 6e 61 6d 65 22 3a 22 6d 75 73 74 20 68 61 76 65 20 72 65 71 75 69 72 65 64 20 70 72 6f 70 65 72 74 79 20 27 66 69 72 73 74 5f 6e 61 6d 65 5f 31 31 38 64 27 22 2c 22 66 69 65 6c 64 5f 69 64 22 3a 22 36 65 66 63 65 31 30 33 2d 31 32 62 32 2d 34 61 61 33 2d 37 66 30 64 2d 32 35 66 36 62 61 33 63 64 32 30 35 22 2c 22 66 69 65 6c 64 5f 74 61 72 67 65 74 22 3a 22 66 69 72 73 74 5f 6e 61 6d 65 5f 31 31 38 64 22 2c 22 66 69 65 6c 64 5f 6e 61 6d 65 22 3a 22 46 75 6c 6c 20 4e 61 6d 65 22 2c 22 5f 72 70 22 Data Ascii: {"dt":5381,"e":[{"dt":5066,"f":{"_ms":15149,"evid":1006,"action_type":"appeared","error_name":"must have required property 'first_name_118d'","field_id":"6efce103-12b2-4aa3-7f0d-25f6ba3cd205","field_target":"first_name_118d","field_name":"Full Name","_rp"
2025-03-11 02:47:39 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:39 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:40 UTC	652	OUT	POST / HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 381 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:40 UTC	381	OUT	Data Raw: 7b 22 64 74 22 3a 34 35 35 33 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 34 32 34 35 2c 22 66 22 3a 7b 22 5f 62 72 61 6e 64 49 64 22 3a 22 77 69 78 22 2c 22 5f 6d 73 22 3a 32 31 34 32 38 2c 22 5f 68 6f 73 74 69 6e 67 50 6c 61 74 66 6f 72 6d 22 3a 22 56 49 45 57 45 52 22 2c 22 73 72 63 22 3a 37 32 2c 22 65 76 69 64 22 3a 31 38 33 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 22 76 69 65 77 65 72 22 2c 22 73 65 73 73 69 6f 6e 49 64 22 3a 22 64 30 66 37 38 35 38 32 2d 39 66 61 62 2d 34 36 30 35 2d 38 35 63 61 2d 36 31 32 36 32 66 33 63 64 61 35 34 22 2c 22 6d 73 69 64 22 3a 22 35 37 66 66 35 61 66 31 2d 61 36 30 61 2d 34 38 33 65 2d 38 61 34 35 2d 66 38 66 32 61 32 33 31 61 64 36 65 22 2c 22 76 73 69 22 3a 22 33 32 32 66 63 39 38 64 2d 32 62 62 65 2d 34 64 35 63 2d 38 61 61 Data Ascii: {"dt":4553,"e":[{"dt":4245,"f":{"_brandId":"wix","_ms":21428,"_hostingPlatform":"VIEWER","src":72,"evid":183,"platform":"viewer","sessionId":"d0f78582-9fab-4605-85ca-61262f3cda54","msid":"57ff5af1-a60a-483e-8a45-f8f2a231ad6e","vsi":"322fc98d-2bbe-4d5c-8aa
2025-03-11 02:47:40 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:40 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:47:51 UTC	530	OUT	POST /rich-editor HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 1668 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:47:51 UTC	1668	OUT	Data Raw: 7b 22 64 74 22 3a 31 31 31 39 36 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 31 30 38 39 34 2c 22 66 22 3a 7b 22 5f 72 70 22 3a 22 66 6f 72 6d 73 2d 70 6c 61 74 66 6f 72 6d 2d 75 6f 75 22 7d 7d 5d 2c 22 67 22 3a 7b 22 5f 6d 73 69 64 22 3a 22 35 37 66 66 35 61 66 31 2d 61 36 30 61 2d 34 38 33 65 2d 38 61 34 35 2d 66 38 66 32 61 32 33 31 61 64 36 65 22 2c 22 76 73 69 22 3a 22 33 32 32 66 63 39 38 64 2d 32 62 62 65 2d 34 64 35 63 2d 38 61 61 31 2d 61 36 62 39 39 62 61 38 39 38 62 37 22 2c 22 5f 61 76 22 3a 22 74 68 75 6e 64 65 72 62 6f 6c 74 2d 31 2e 31 35 33 35 33 2e 30 22 2c 22 69 73 62 22 3a 66 61 6c 73 65 2c 22 5f 73 69 74 65 4f 77 6e 65 72 49 64 22 3a 22 63 65 66 34 35 30 66 38 2d 30 32 31 61 2d 34 65 64 34 2d 62 62 35 64 2d 63 36 65 30 31 65 31 32 61 34 35 63 Data Ascii: {"dt":11196,"e":[{"dt":10894,"f":{"_rp":"forms-platform-uou"}}],"g":{"_msid":"57ff5af1-a60a-483e-8a45-f8f2a231ad6e","vsi":"322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7","_av":"thunderbolt-1.15353.0","isb":false,"_siteOwnerId":"cef450f8-021a-4ed4-bb5d-c6e01e12a45c
2025-03-11 02:47:51 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:47:51 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:48:09 UTC	530	OUT	POST /rich-editor HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 1747 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:48:09 UTC	1747	OUT	Data Raw: 7b 22 64 74 22 3a 31 38 33 34 34 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 31 38 30 33 34 2c 22 66 22 3a 7b 22 5f 6d 73 22 3a 34 34 36 39 33 2c 22 61 63 74 69 6f 6e 5f 74 79 70 65 22 3a 22 62 6c 75 72 22 2c 22 5f 72 70 22 3a 22 66 6f 72 6d 73 2d 70 6c 61 74 66 6f 72 6d 2d 75 6f 75 22 7d 7d 2c 7b 22 64 74 22 3a 31 38 30 37 39 2c 22 66 22 3a 7b 22 5f 6d 73 22 3a 34 34 37 33 36 2c 22 61 63 74 69 6f 6e 5f 74 79 70 65 22 3a 22 66 6f 63 75 73 22 2c 22 5f 72 70 22 3a 22 66 6f 72 6d 73 2d 70 6c 61 74 66 6f 72 6d 2d 75 6f 75 22 7d 7d 5d 2c 22 67 22 3a 7b 22 5f 6d 73 69 64 22 3a 22 35 37 66 66 35 61 66 31 2d 61 36 30 61 2d 34 38 33 65 2d 38 61 34 35 2d 66 38 66 32 61 32 33 31 61 64 36 65 22 2c 22 76 73 69 22 3a 22 33 32 32 66 63 39 38 64 2d 32 62 62 65 2d 34 64 35 63 2d Data Ascii: {"dt":18344,"e":[{"dt":18034,"f":{"_ms":44693,"action_type":"blur","_rp":"forms-platform-uou"}},{"dt":18079,"f":{"_ms":44736,"action_type":"focus","_rp":"forms-platform-uou"}}],"g":{"_msid":"57ff5af1-a60a-483e-8a45-f8f2a231ad6e","vsi":"322fc98d-2bbe-4d5c-
2025-03-11 02:48:10 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:48:09 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://ff94c94a.vill.pages.dev/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Windows Analysis Report
https://ff94c94a.vill.pages.dev/

Timestamp	Bytes transferred	Direction	Data
2025-03-11 02:48:19 UTC	530	OUT	POST /rich-editor HTTP/1.1 Host: frog.wix.com Connection: keep-alive Content-Length: 1665 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ktolia.wixsite.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://ktolia.wixsite.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 02:48:19 UTC	1665	OUT	Data Raw: 7b 22 64 74 22 3a 39 31 30 39 2c 22 65 22 3a 5b 7b 22 64 74 22 3a 38 37 39 37 2c 22 66 22 3a 7b 22 5f 72 70 22 3a 22 66 6f 72 6d 73 2d 70 6c 61 74 66 6f 72 6d 2d 75 6f 75 22 7d 7d 5d 2c 22 67 22 3a 7b 22 5f 6d 73 69 64 22 3a 22 35 37 66 66 35 61 66 31 2d 61 36 30 61 2d 34 38 33 65 2d 38 61 34 35 2d 66 38 66 32 61 32 33 31 61 64 36 65 22 2c 22 76 73 69 22 3a 22 33 32 32 66 63 39 38 64 2d 32 62 62 65 2d 34 64 35 63 2d 38 61 61 31 2d 61 36 62 39 39 62 61 38 39 38 62 37 22 2c 22 5f 61 76 22 3a 22 74 68 75 6e 64 65 72 62 6f 6c 74 2d 31 2e 31 35 33 35 33 2e 30 22 2c 22 69 73 62 22 3a 66 61 6c 73 65 2c 22 5f 73 69 74 65 4f 77 6e 65 72 49 64 22 3a 22 63 65 66 34 35 30 66 38 2d 30 32 31 61 2d 34 65 64 34 2d 62 62 35 64 2d 63 36 65 30 31 65 31 32 61 34 35 63 22 2c Data Ascii: {"dt":9109,"e":[{"dt":8797,"f":{"_rp":"forms-platform-uou"}}],"g":{"_msid":"57ff5af1-a60a-483e-8a45-f8f2a231ad6e","vsi":"322fc98d-2bbe-4d5c-8aa1-a6b99ba898b7","_av":"thunderbolt-1.15353.0","isb":false,"_siteOwnerId":"cef450f8-021a-4ed4-bb5d-c6e01e12a45c",
2025-03-11 02:48:19 UTC	383	IN	HTTP/1.1 204 No Content Date: Tue, 11 Mar 2025 02:48:19 GMT Connection: close Server: nginx Access-Control-Allow-Origin: https://ktolia.wixsite.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

Target ID:	1
Start time:	22:46:58
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6d8c90000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	22:47:04
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2432,i,4406870543599195809,12126500052874229075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2464 /prefetch:3
Imagebase:	0x7ff6d8c90000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	8
Start time:	22:47:07
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2432,i,4406870543599195809,12126500052874229075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4440 /prefetch:8
Imagebase:	0x7ff6d8c90000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	11
Start time:	22:47:10
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ff94c94a.vill.pages.dev/"
Imagebase:	0x7ff6d8c90000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre