Edit tour

Windows Analysis Report
https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450

Overview

General Information

Sample URL:	https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450
Analysis ID:	1417309
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2304,i,8713574515099538720,14730878642164938455,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.207.202.190
Source: unknown	TCP traffic detected without corresponding DNS query: 23.207.202.190
Source: unknown	TCP traffic detected without corresponding DNS query: 23.207.202.190
Source: unknown	TCP traffic detected without corresponding DNS query: 23.207.202.190
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450 HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450 HTTP/1.1Host: reface.com.mxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwEDCQQ%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwEDCQQ%3D
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwEDCQQ%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwEDCAQ%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwEDCAQ%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwEDCAQ%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAQc%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAQc%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAQc%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAAY%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAAY%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAAY%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAwE%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAwE%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAwE%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAgA%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAgA%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECAgA%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBQM%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBQM%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBQM%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBAI%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBAI%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBAI%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBAs%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBAs%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4= HTTP/1.1Host: reface.com.mxConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBAs%3D
Source: global traffic	HTTP traffic detected: GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4=&sec=cWJ2cTYyNDYzMzQ0Mz8= HTTP/1.1Host: reface.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: secures=RVdARQMEAAMFBwECBwo%3D

Source: unknown

DNS traffic detected: queries for: reface.com.mx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@43/0@4/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2304,i,8713574515099538720,14730878642164938455,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2304,i,8713574515099538720,14730878642164938455,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4=	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4=&sec=cWJ2cTYyNDYzMzQ0Mz8=	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=	0%	Avira URL Cloud	safe
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	172.253.63.106	true	false	high
reface.com.mx	160.153.48.195	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
windowsupdatebg.s.llnwi.net	69.164.0.128	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450	false		unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4=&sec=cWJ2cTYyNDYzMzQ0Mz8=	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4=	false	Avira URL Cloud: safe	unknown
https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.63.106	www.google.com	United States	15169	GOOGLEUS	false
160.153.48.195	reface.com.mx	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417309
Start date and time:	2024-03-28 22:57:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@43/0@4/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.253.115.94, 142.250.31.113, 142.250.31.138, 142.250.31.102, 142.250.31.100, 142.250.31.101, 142.250.31.139, 172.253.115.84, 34.104.35.123, 20.12.23.50, 69.164.0.128, 192.229.211.108, 52.165.164.15, 13.95.31.18
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 22:57:58.207653999 CET	49675	443	192.168.2.4	173.222.162.32
Mar 28, 2024 22:57:59.395144939 CET	49678	443	192.168.2.4	104.46.162.224
Mar 28, 2024 22:58:05.614110947 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:05.614141941 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:05.614217043 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:05.614675045 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:05.614694118 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:05.614749908 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:05.615017891 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:05.615030050 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:05.615175962 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:05.615186930 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.080073118 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.080326080 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.080336094 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.081717968 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.081744909 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.081816912 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.081969976 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.081981897 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.082969904 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.083028078 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.083303928 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.083362103 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.084287882 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.084343910 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.084425926 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.084433079 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.130537987 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.130538940 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.130547047 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.177206993 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.236148119 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.236227036 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.236589909 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.236607075 CET	443	49735	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:06.236618996 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.236650944 CET	49735	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.238550901 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:06.284233093 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.419979095 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.420002937 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.420063972 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.420073032 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.420118093 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.421668053 CET	49734	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.421680927 CET	443	49734	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.461745024 CET	49738	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.461796045 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.461867094 CET	49738	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.462146997 CET	49739	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.462196112 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.462248087 CET	49739	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.462814093 CET	49738	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.462830067 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.463435888 CET	49739	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.463458061 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.768980026 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.769503117 CET	49738	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.769524097 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.769640923 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.769870996 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.770133018 CET	49739	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.770149946 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.770486116 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.775187016 CET	49738	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.775262117 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.776338100 CET	49739	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.776405096 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.777005911 CET	49738	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:07.815390110 CET	49675	443	192.168.2.4	173.222.162.32
Mar 28, 2024 22:58:07.824239016 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:07.830774069 CET	49739	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:08.581815958 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:08.581877947 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:08.581975937 CET	49738	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:08.594438076 CET	49738	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:08.594455957 CET	443	49738	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:08.777623892 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:08.777661085 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:08.777713060 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:08.784028053 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:08.784045935 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:08.994345903 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:08.994960070 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:08.994980097 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:08.995841980 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:08.995898962 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:08.998020887 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:08.998084068 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:09.050410986 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:09.050421953 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:09.099030018 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:09.272564888 CET	49741	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:09.272583961 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:09.272721052 CET	49741	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:09.275479078 CET	49741	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:09.275490046 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:09.625565052 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:09.625638008 CET	49741	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:09.630145073 CET	49741	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:09.630155087 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:09.630388021 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:09.673754930 CET	49741	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:09.716237068 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:09.994811058 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:09.994862080 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:09.994913101 CET	49741	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:09.994997978 CET	49741	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:09.995012045 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:09.995028973 CET	49741	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:09.995033979 CET	443	49741	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:10.023610115 CET	49742	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:10.023641109 CET	443	49742	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:10.023780107 CET	49742	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:10.024034977 CET	49742	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:10.024048090 CET	443	49742	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:10.070008993 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:10.070024014 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.070113897 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:10.070487976 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:10.070497990 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.091442108 CET	49739	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:10.136238098 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.388077974 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.388390064 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:10.388400078 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.388669968 CET	443	49742	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:10.388699055 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.388726950 CET	49742	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:10.391932011 CET	49742	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:10.391937971 CET	443	49742	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:10.392138958 CET	443	49742	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:10.392824888 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:10.392879009 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.395798922 CET	49742	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:10.436244011 CET	443	49742	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:10.440464973 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:10.719748020 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.720071077 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.720133066 CET	49739	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:10.729418993 CET	443	49742	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:10.729507923 CET	443	49742	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:10.729558945 CET	49742	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:10.733015060 CET	49739	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:10.733036041 CET	443	49739	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:10.756160975 CET	49742	443	192.168.2.4	23.221.242.90
Mar 28, 2024 22:58:10.756170034 CET	443	49742	23.221.242.90	192.168.2.4
Mar 28, 2024 22:58:16.827893972 CET	49744	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:16.827943087 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:16.828013897 CET	49744	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:16.828368902 CET	49744	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:16.828385115 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:16.876390934 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:16.924242020 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:17.132734060 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:17.133191109 CET	49744	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:17.133208036 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:17.133519888 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:17.134119987 CET	49744	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:17.134186029 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:17.178555965 CET	49744	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.057123899 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.057146072 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.057198048 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.057229996 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.057322025 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.059297085 CET	49743	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.059309959 CET	443	49743	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.085330009 CET	49744	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.093628883 CET	49745	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.093663931 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.093981981 CET	49745	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.094903946 CET	49745	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.094919920 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.128247023 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.398201942 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.398740053 CET	49745	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.398765087 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.399074078 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.399902105 CET	49745	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.399960041 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.440316916 CET	49745	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.710089922 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.710181952 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.710227966 CET	49744	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.710865021 CET	49744	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:18.710881948 CET	443	49744	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:18.996064901 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:18.996109962 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:18.996155024 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:19.113069057 CET	49740	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:58:19.113101006 CET	443	49740	172.253.63.106	192.168.2.4
Mar 28, 2024 22:58:19.811062098 CET	49745	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:19.814086914 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:19.814121008 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:19.814443111 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:19.818080902 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:19.818097115 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:19.852237940 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:20.121841908 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:20.125420094 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:20.125439882 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:20.125787973 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:20.127424002 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:20.127554893 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:20.174933910 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:20.437377930 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:20.437521935 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:20.437747002 CET	49745	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:20.439903975 CET	49745	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:20.439924002 CET	443	49745	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:25.453340054 CET	49753	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:25.453389883 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:25.453557014 CET	49753	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:25.456341028 CET	49753	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:25.456356049 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:25.459284067 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:25.500243902 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:25.760885954 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:25.761162043 CET	49753	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:25.761179924 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:25.761490107 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:25.761893988 CET	49753	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:25.761951923 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:25.802242041 CET	49753	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.642803907 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.642827988 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.642889977 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.642915964 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.645464897 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.645690918 CET	49746	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.645706892 CET	443	49746	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.669353008 CET	49753	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.669380903 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.669406891 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.669800043 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.670172930 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.670178890 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.716229916 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.972372055 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.972670078 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.972687960 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.972999096 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:26.973608017 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:26.973664999 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:27.023003101 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:27.496525049 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:27.496614933 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:27.496666908 CET	49753	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:27.496982098 CET	49753	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:27.497005939 CET	443	49753	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:28.525332928 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:28.525365114 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:28.525888920 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:28.525948048 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:28.526475906 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:28.526498079 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:28.572237968 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:28.830952883 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:28.833951950 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:28.833971977 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:28.834280014 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:28.834721088 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:28.834777117 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:28.878886938 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:29.325242043 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:29.325495958 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:29.325701952 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:29.325766087 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:29.325766087 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:29.325782061 CET	443	49754	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:29.329488039 CET	49754	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:34.348750114 CET	49756	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:34.348779917 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:34.351753950 CET	49756	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:34.352040052 CET	49756	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:34.352051973 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:34.381473064 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:34.424242020 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:34.655504942 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:34.655797005 CET	49756	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:34.655810118 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:34.656111956 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:34.656533003 CET	49756	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:34.656584024 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:34.697449923 CET	49756	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:35.713222980 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:35.713247061 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:35.713310003 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:35.713323116 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:35.713352919 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:35.810522079 CET	49755	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:35.810544014 CET	443	49755	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:35.834616899 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:35.834647894 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:35.834721088 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:35.835088968 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:35.835100889 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:35.837549925 CET	49756	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:35.880239964 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:36.138881922 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:36.139199018 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:36.139209986 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:36.139514923 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:36.139934063 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:36.139997959 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:36.192110062 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:36.613729000 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:36.613797903 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:36.613862038 CET	49756	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:36.614895105 CET	49756	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:36.614909887 CET	443	49756	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:37.653395891 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:37.653430939 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:37.653671980 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:37.656327009 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:37.656339884 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:37.664170980 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:37.708226919 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:37.960283041 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:37.960530996 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:37.960544109 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:37.960851908 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:37.961210012 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:37.961261988 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:38.003603935 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:38.496004105 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:38.496069908 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:38.496175051 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:38.507962942 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:38.507977962 CET	443	49757	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:38.507997990 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:38.508025885 CET	49757	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:43.511298895 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:43.511324883 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:43.511401892 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:43.512881994 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:43.512895107 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:43.558392048 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:43.604238987 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:43.817652941 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:43.818058968 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:43.818072081 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:43.818409920 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:43.819856882 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:43.819916010 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:43.865643024 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:44.890224934 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:44.890249968 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:44.890322924 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:44.890355110 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:44.890552998 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:44.892352104 CET	49758	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:44.892368078 CET	443	49758	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:44.926006079 CET	49760	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:44.926043034 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:44.926106930 CET	49760	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:44.928359032 CET	49760	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:44.928373098 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:44.933921099 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:44.976238966 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:45.232475042 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:45.233179092 CET	49760	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:45.233197927 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:45.233541965 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:45.238538980 CET	49760	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:45.238600969 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:45.283548117 CET	49760	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:45.715925932 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:45.716099024 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:45.716160059 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:45.716413975 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:45.716429949 CET	443	49759	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:45.716439962 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:45.716479063 CET	49759	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:46.772538900 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:46.772584915 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:46.772754908 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:46.775367975 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:46.775387049 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:46.802212954 CET	49760	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:46.848238945 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:47.079118967 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:47.079397917 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:47.079421043 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:47.079730988 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:47.080113888 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:47.080173016 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:47.131280899 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:47.583169937 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:47.583230972 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:47.583276033 CET	49760	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:47.592482090 CET	49760	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:47.592503071 CET	443	49760	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:52.604697943 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:52.604739904 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:52.604813099 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:52.606944084 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:52.606951952 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:52.612936974 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:52.656239986 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:52.911752939 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:52.911974907 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:52.911984921 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:52.912297964 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:52.912658930 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:52.912717104 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:52.957371950 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:53.945338011 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:53.945365906 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:53.945420980 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:53.945422888 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:53.945518017 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:53.971952915 CET	49761	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:53.971986055 CET	443	49761	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:53.987638950 CET	49763	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:53.987669945 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:53.987759113 CET	49763	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:53.988473892 CET	49763	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:53.988490105 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:53.988996983 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:54.032236099 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:54.292490005 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:54.292745113 CET	49763	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:54.292759895 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:54.293072939 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:54.293673038 CET	49763	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:54.293731928 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:54.336705923 CET	49763	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:54.620214939 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:54.620452881 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:54.623581886 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:54.623600960 CET	443	49762	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:54.623629093 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:54.623739958 CET	49762	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:55.668339014 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:55.668370962 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:55.668569088 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:55.668778896 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:55.668790102 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:55.674088955 CET	49763	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:55.720242023 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:55.966864109 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:55.967083931 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:55.967099905 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:55.967428923 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:55.967854977 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:55.967911005 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:56.009182930 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:56.296772957 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:56.296837091 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:58:56.296897888 CET	49763	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:56.297149897 CET	49763	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:58:56.297163963 CET	443	49763	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:01.315985918 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:01.316020012 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:01.317423105 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:01.473366022 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:01.473381996 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:01.507344961 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:01.548238993 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:01.778220892 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:01.784274101 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:01.784285069 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:01.784594059 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:01.787188053 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:01.787240028 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:01.833035946 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:02.686697960 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:02.686722040 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:02.686780930 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:02.686810017 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:02.687886953 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:02.688193083 CET	49765	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:02.688204050 CET	443	49765	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:02.711999893 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:02.713538885 CET	49768	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:02.713582993 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:02.717597008 CET	49768	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:02.717597008 CET	49768	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:02.717632055 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:02.752237082 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:03.015939951 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:03.016244888 CET	49768	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:03.016273022 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:03.016583920 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:03.017018080 CET	49768	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:03.017066956 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:03.069829941 CET	49768	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:03.348365068 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:03.348426104 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:03.348841906 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:03.348858118 CET	443	49767	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:03.348887920 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:03.349241972 CET	49767	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:04.446582079 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:04.446620941 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:04.446834087 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:04.447534084 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:04.447549105 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:04.476259947 CET	49768	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:04.524241924 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:04.751152039 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:04.751521111 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:04.751535892 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:04.751828909 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:04.754606962 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:04.754664898 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:04.809233904 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:05.104908943 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:05.105051041 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:05.107786894 CET	49768	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:05.165986061 CET	49768	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:05.166013002 CET	443	49768	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:08.710717916 CET	49771	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:59:08.710750103 CET	443	49771	172.253.63.106	192.168.2.4
Mar 28, 2024 22:59:08.710966110 CET	49771	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:59:08.711019039 CET	49771	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:59:08.711025953 CET	443	49771	172.253.63.106	192.168.2.4
Mar 28, 2024 22:59:08.926100016 CET	443	49771	172.253.63.106	192.168.2.4
Mar 28, 2024 22:59:08.926362038 CET	49771	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:59:08.926371098 CET	443	49771	172.253.63.106	192.168.2.4
Mar 28, 2024 22:59:08.926654100 CET	443	49771	172.253.63.106	192.168.2.4
Mar 28, 2024 22:59:08.927078009 CET	49771	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:59:08.927128077 CET	443	49771	172.253.63.106	192.168.2.4
Mar 28, 2024 22:59:08.974639893 CET	49771	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:59:10.228430033 CET	49772	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:10.228460073 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:10.228507996 CET	49772	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:10.230339050 CET	49772	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:10.230355024 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:10.263166904 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:10.308238983 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:10.533866882 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:10.534789085 CET	49772	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:10.534804106 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:10.535121918 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:10.536483049 CET	49772	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:10.536540031 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:10.585364103 CET	49772	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.444622040 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.444649935 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.444711924 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.444739103 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.444856882 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.445887089 CET	49770	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.445905924 CET	443	49770	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.556133032 CET	49773	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.556165934 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.556247950 CET	49773	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.557369947 CET	49773	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.557380915 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.560719967 CET	49772	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.604240894 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.860850096 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.861285925 CET	49773	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.861304998 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.861613035 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.862616062 CET	49773	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:11.862668991 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:11.909363031 CET	49773	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:12.192466021 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:12.192553043 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:12.192596912 CET	49772	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:12.193640947 CET	49772	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:12.193651915 CET	443	49772	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.298490047 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:13.298516989 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.298770905 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:13.300358057 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:13.300373077 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.305368900 CET	49773	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:13.352226019 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.598474979 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.599226952 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:13.599251986 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.599596977 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.600174904 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:13.600239992 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.644402027 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:13.936691999 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.936743021 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:13.936788082 CET	49773	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:14.010690928 CET	49773	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:14.010704041 CET	443	49773	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:18.332079887 CET	49723	80	192.168.2.4	23.207.202.190
Mar 28, 2024 22:59:18.332166910 CET	49724	80	192.168.2.4	23.207.202.190
Mar 28, 2024 22:59:18.435261965 CET	80	49723	23.207.202.190	192.168.2.4
Mar 28, 2024 22:59:18.435319901 CET	80	49724	23.207.202.190	192.168.2.4
Mar 28, 2024 22:59:18.435357094 CET	49723	80	192.168.2.4	23.207.202.190
Mar 28, 2024 22:59:18.435540915 CET	49724	80	192.168.2.4	23.207.202.190
Mar 28, 2024 22:59:18.948801041 CET	443	49771	172.253.63.106	192.168.2.4
Mar 28, 2024 22:59:18.948858023 CET	443	49771	172.253.63.106	192.168.2.4
Mar 28, 2024 22:59:18.948966026 CET	49771	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:59:19.025456905 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:19.025456905 CET	49771	443	192.168.2.4	172.253.63.106
Mar 28, 2024 22:59:19.025490046 CET	443	49771	172.253.63.106	192.168.2.4
Mar 28, 2024 22:59:19.052774906 CET	49775	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:19.052802086 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:19.052881002 CET	49775	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:19.053172112 CET	49775	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:19.053177118 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:19.072225094 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:19.358993053 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:19.359297991 CET	49775	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:19.359311104 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:19.359622002 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:19.359973907 CET	49775	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:19.360025883 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:19.414591074 CET	49775	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.205738068 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.205759048 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.205818892 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.205852032 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.205951929 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.207480907 CET	49774	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.207494974 CET	443	49774	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.230426073 CET	49775	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.230428934 CET	49776	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.230472088 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.231468916 CET	49776	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.231915951 CET	49776	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.231928110 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.276237011 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.535172939 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.535432100 CET	49776	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.535448074 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.535753012 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.536178112 CET	49776	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.536245108 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.577570915 CET	49776	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.867300034 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.867400885 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:20.867454052 CET	49775	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.880222082 CET	49775	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:20.880235910 CET	443	49775	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:21.962266922 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:21.962308884 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:21.962373018 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:21.962819099 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:21.962831974 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:21.991364956 CET	49776	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:22.036237001 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:22.266822100 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:22.267272949 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:22.267288923 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:22.267599106 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:22.268635988 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:22.268693924 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:22.316090107 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:22.770952940 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:22.771048069 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:22.771092892 CET	49776	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:22.771301031 CET	49776	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:22.771315098 CET	443	49776	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:28.029380083 CET	49778	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:28.029406071 CET	443	49778	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:28.032483101 CET	49778	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:28.034121037 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:28.034147978 CET	49778	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:28.034162045 CET	443	49778	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:28.076239109 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:28.332572937 CET	443	49778	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:28.333079100 CET	49778	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:28.333090067 CET	443	49778	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:28.333394051 CET	443	49778	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:28.333786011 CET	49778	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:28.333843946 CET	443	49778	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:28.379800081 CET	49778	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.369292974 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.369309902 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.369371891 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.369385958 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.369426966 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.371685982 CET	49777	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.371706963 CET	443	49777	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.394789934 CET	49778	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.394789934 CET	49779	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.394819975 CET	443	49779	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.395855904 CET	49779	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.396197081 CET	49779	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.396223068 CET	443	49779	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.436237097 CET	443	49778	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.701220036 CET	443	49779	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.701509953 CET	49779	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.701519966 CET	443	49779	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.701824903 CET	443	49779	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.702429056 CET	49779	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:29.702485085 CET	443	49779	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:29.752913952 CET	49779	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:30.167864084 CET	443	49778	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:30.167922974 CET	443	49778	160.153.48.195	192.168.2.4
Mar 28, 2024 22:59:30.167989016 CET	49778	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:30.259532928 CET	49778	443	192.168.2.4	160.153.48.195
Mar 28, 2024 22:59:30.259556055 CET	443	49778	160.153.48.195	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 22:58:04.484141111 CET	53	62640	1.1.1.1	192.168.2.4
Mar 28, 2024 22:58:04.539105892 CET	53	57622	1.1.1.1	192.168.2.4
Mar 28, 2024 22:58:05.129421949 CET	53	64145	1.1.1.1	192.168.2.4
Mar 28, 2024 22:58:05.511209011 CET	49993	53	192.168.2.4	1.1.1.1
Mar 28, 2024 22:58:05.511370897 CET	50582	53	192.168.2.4	1.1.1.1
Mar 28, 2024 22:58:05.611171007 CET	53	49993	1.1.1.1	192.168.2.4
Mar 28, 2024 22:58:05.613166094 CET	53	50582	1.1.1.1	192.168.2.4
Mar 28, 2024 22:58:08.656562090 CET	58647	53	192.168.2.4	1.1.1.1
Mar 28, 2024 22:58:08.656879902 CET	58518	53	192.168.2.4	1.1.1.1
Mar 28, 2024 22:58:08.751894951 CET	53	58647	1.1.1.1	192.168.2.4
Mar 28, 2024 22:58:08.752110958 CET	53	58518	1.1.1.1	192.168.2.4
Mar 28, 2024 22:58:22.882534981 CET	53	56601	1.1.1.1	192.168.2.4
Mar 28, 2024 22:58:29.922108889 CET	138	138	192.168.2.4	192.168.2.255
Mar 28, 2024 22:58:41.943312883 CET	53	56374	1.1.1.1	192.168.2.4
Mar 28, 2024 22:59:04.023834944 CET	53	49721	1.1.1.1	192.168.2.4
Mar 28, 2024 22:59:04.619020939 CET	53	50587	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 28, 2024 22:58:05.511209011 CET	192.168.2.4	1.1.1.1	0x514d	Standard query (0)	reface.com.mx	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:05.511370897 CET	192.168.2.4	1.1.1.1	0xa256	Standard query (0)	reface.com.mx	65	IN (0x0001)	false
Mar 28, 2024 22:58:08.656562090 CET	192.168.2.4	1.1.1.1	0x96a3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:08.656879902 CET	192.168.2.4	1.1.1.1	0x3d58	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 28, 2024 22:58:05.611171007 CET	1.1.1.1	192.168.2.4	0x514d	No error (0)	reface.com.mx		160.153.48.195	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:08.751894951 CET	1.1.1.1	192.168.2.4	0x96a3	No error (0)	www.google.com		172.253.63.106	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:08.751894951 CET	1.1.1.1	192.168.2.4	0x96a3	No error (0)	www.google.com		172.253.63.99	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:08.751894951 CET	1.1.1.1	192.168.2.4	0x96a3	No error (0)	www.google.com		172.253.63.104	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:08.751894951 CET	1.1.1.1	192.168.2.4	0x96a3	No error (0)	www.google.com		172.253.63.105	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:08.751894951 CET	1.1.1.1	192.168.2.4	0x96a3	No error (0)	www.google.com		172.253.63.103	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:08.751894951 CET	1.1.1.1	192.168.2.4	0x96a3	No error (0)	www.google.com		172.253.63.147	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:08.752110958 CET	1.1.1.1	192.168.2.4	0x3d58	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 28, 2024 22:58:20.970724106 CET	1.1.1.1	192.168.2.4	0x4246	No error (0)	windowsupdatebg.s.llnwi.net		69.164.0.128	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:21.303764105 CET	1.1.1.1	192.168.2.4	0xb10	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 22:58:21.303764105 CET	1.1.1.1	192.168.2.4	0xb10	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:34.148451090 CET	1.1.1.1	192.168.2.4	0xc287	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 22:58:34.148451090 CET	1.1.1.1	192.168.2.4	0xc287	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:58:57.005002022 CET	1.1.1.1	192.168.2.4	0xc216	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 22:58:57.005002022 CET	1.1.1.1	192.168.2.4	0xc216	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 28, 2024 22:59:16.756580114 CET	1.1.1.1	192.168.2.4	0x1c87	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 22:59:16.756580114 CET	1.1.1.1	192.168.2.4	0x1c87	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reface.com.mx

https:

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:06 UTC	713	OUT	GET /5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450 HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-28 21:58:06 UTC	264	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 28 Mar 2024 21:58:06 GMT Server: Apache Location: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450 Content-Length: 288 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-03-28 21:58:06 UTC	288	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 66 61 63 65 2e 63 6f 6d 2e 6d 78 2f 35 66 65 61 37 66 64 68 66 33 35 2f 3f 77 3d 32 6f 78 77 63 67 6d 31 37 31 2d 38 35 39 32 32 36 34 36 2d 35 37 75 6f 64 33 61 65 35 2d 31 63 78 6b 37 31 31 35 34 37 34 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk7115474

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:06 UTC	714	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450 HTTP/1.1 Host: reface.com.mx Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-28 21:58:07 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:58:06 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:58:06 GMT Set-Cookie: secures=RVdARQMEAAMFBwEDCQQ%3D; expires=Thu, 28-Mar-2024 22:58:06 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:58:07 UTC	3463	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 63 63 34 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>cc4 <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:07 UTC	857	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwEDCQQ%3D
2024-03-28 21:58:08 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:08 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:09 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-28 21:58:09 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=205520 Date: Thu, 28 Mar 2024 21:58:09 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:10 UTC	883	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwEDCQQ%3D
2024-03-28 21:58:10 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:10 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:10 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-28 21:58:10 UTC	774	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z Content-Type: application/octet-stream X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=205499 Date: Thu, 28 Mar 2024 21:58:10 GMT Content-Length: 55 Connection: close X-CID: 2
2024-03-28 21:58:10 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:16 UTC	883	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwEDCQQ%3D
2024-03-28 21:58:18 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:58:16 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:58:16 GMT Set-Cookie: secures=RVdARQMEAAMFBwEDCAQ%3D; expires=Thu, 28-Mar-2024 22:58:16 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:58:18 UTC	3488	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 63 64 64 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>cdd <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:18 UTC	907	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwEDCAQ%3D
2024-03-28 21:58:18 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:18 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:19 UTC	933	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwEDCAQ%3D
2024-03-28 21:58:20 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:19 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:25 UTC	933	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwEDCAQ%3D
2024-03-28 21:58:26 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:58:25 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:58:25 GMT Set-Cookie: secures=RVdARQMEAAMFBwECAQc%3D; expires=Thu, 28-Mar-2024 22:58:25 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:58:26 UTC	3513	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 63 66 36 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>cf6 <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49753	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:26 UTC	957	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAQc%3D
2024-03-28 21:58:27 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:26 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49754	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:28 UTC	983	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAQc%3D
2024-03-28 21:58:29 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:28 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49755	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:34 UTC	983	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAQc%3D
2024-03-28 21:58:35 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:58:34 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:58:34 GMT Set-Cookie: secures=RVdARQMEAAMFBwECAAY%3D; expires=Thu, 28-Mar-2024 22:58:34 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:58:35 UTC	3538	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 64 30 66 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>d0f <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49756	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:35 UTC	1007	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAAY%3D
2024-03-28 21:58:36 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:35 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49757	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:37 UTC	1033	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAAY%3D
2024-03-28 21:58:38 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:37 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49758	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:43 UTC	1033	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAAY%3D
2024-03-28 21:58:44 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:58:43 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:58:43 GMT Set-Cookie: secures=RVdARQMEAAMFBwECAwE%3D; expires=Thu, 28-Mar-2024 22:58:43 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:58:44 UTC	3563	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 64 32 38 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>d28 <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49759	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:44 UTC	1057	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAwE%3D
2024-03-28 21:58:45 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:45 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49760	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:46 UTC	1083	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAwE%3D
2024-03-28 21:58:47 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:46 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49761	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:52 UTC	1083	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAwE%3D
2024-03-28 21:58:53 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:58:52 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:58:52 GMT Set-Cookie: secures=RVdARQMEAAMFBwECAgA%3D; expires=Thu, 28-Mar-2024 22:58:52 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:58:53 UTC	3588	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 64 34 31 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>d41 <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49762	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:53 UTC	1107	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAgA%3D
2024-03-28 21:58:54 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:54 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49763	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:58:55 UTC	1133	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAgA%3D
2024-03-28 21:58:56 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:58:55 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49765	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:01 UTC	1133	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECAgA%3D
2024-03-28 21:59:02 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:59:01 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:59:01 GMT Set-Cookie: secures=RVdARQMEAAMFBwECBQM%3D; expires=Thu, 28-Mar-2024 22:59:01 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:59:02 UTC	3613	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 64 35 61 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>d5a <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49767	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:02 UTC	1157	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBQM%3D
2024-03-28 21:59:03 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:59:02 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49768	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:04 UTC	1183	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBQM%3D
2024-03-28 21:59:05 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:59:04 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49770	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:10 UTC	1183	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBQM%3D
2024-03-28 21:59:11 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:59:10 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:59:10 GMT Set-Cookie: secures=RVdARQMEAAMFBwECBAI%3D; expires=Thu, 28-Mar-2024 22:59:10 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:59:11 UTC	3638	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 64 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>d73 <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49772	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:11 UTC	1207	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBAI%3D
2024-03-28 21:59:12 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:59:11 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49773	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:13 UTC	1233	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBAI%3D
2024-03-28 21:59:13 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:59:13 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49774	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:19 UTC	1233	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBAI%3D
2024-03-28 21:59:20 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:59:19 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:59:19 GMT Set-Cookie: secures=RVdARQMEAAMFBwECBAs%3D; expires=Thu, 28-Mar-2024 22:59:19 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:59:20 UTC	3663	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 64 38 63 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>d8c <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49775	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:20 UTC	1257	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBAs%3D
2024-03-28 21:59:20 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:59:20 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49776	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:21 UTC	1283	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBAs%3D
2024-03-28 21:59:22 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:59:22 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49777	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:28 UTC	1283	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4= HTTP/1.1 Host: reface.com.mx Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBAs%3D
2024-03-28 21:59:29 UTC	377	IN	HTTP/1.1 401 Unauthorized Date: Thu, 28 Mar 2024 21:59:28 GMT Server: Apache X-Powered-By: PHP/5.4.45 Set-Cookie: secures=noka; expires=Thu, 28-Mar-2024 22:59:28 GMT Set-Cookie: secures=RVdARQMEAAMFBwECBwo%3D; expires=Thu, 28-Mar-2024 22:59:28 GMT Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html
2024-03-28 21:59:29 UTC	3688	IN	Data Raw: 32 66 0d 0a 3c 63 65 6e 74 65 72 20 69 64 3d 22 65 6c 22 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 3c 2f 63 65 6e 74 65 72 3e 0d 0a 37 63 0d 0a 3c 73 63 72 69 70 74 3e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6f 6b 27 29 3b 76 61 72 20 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 6c 22 29 3b 20 69 66 28 66 72 61 6d 65 29 20 66 72 61 6d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 72 61 6d 65 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 64 61 35 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 78 68 44 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 2c 20 6b 65 79 29 20 7b 20 20 20 20 20 20 6c 65 74 20 64 65 Data Ascii: 2f<center id="el">Authorization required</center>7c<script>console.log('ok');var frame = document.getElementById("el"); if(frame) frame.parentNode.removeChild(frame);</script>da5 <script> function xhDecode(encoded, key) { let de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49778	160.153.48.195	443	5984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 21:59:29 UTC	1307	OUT	GET /5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4=&sec=cWJ2cTYyNDYzMzQ0Mz8= HTTP/1.1 Host: reface.com.mx Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://reface.com.mx/5fea7fdhf35/?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450&sec=cWJ2cTYyNDYzMzQ1PTE=&sec=cWJ2cTYyNDYzMzQ1PDE=&sec=cWJ2cTYyNDYzMzQ0NTI=&sec=cWJ2cTYyNDYzMzQ0NDM=&sec=cWJ2cTYyNDYzMzQ0NzQ=&sec=cWJ2cTYyNDYzMzQ0NjU=&sec=cWJ2cTYyNDYzMzQ0MTY=&sec=cWJ2cTYyNDYzMzQ0MDc=&sec=cWJ2cTYyNDYzMzQ0MD4= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: secures=RVdARQMEAAMFBwECBwo%3D
2024-03-28 21:59:30 UTC	220	IN	HTTP/1.1 407 Unauthorized Date: Thu, 28 Mar 2024 21:59:29 GMT Server: Apache X-Powered-By: PHP/5.4.45 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 2664, Parent PID: 2836

General

Target ID:	0
Start time:	22:58:00
Start date:	28/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5984, Parent PID: 2664

General

Target ID:	2
Start time:	22:58:02
Start date:	28/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2304,i,8713574515099538720,14730878642164938455,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6500, Parent PID: 2836

General

Target ID:	3
Start time:	22:58:04
Start date:	28/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 2664, Parent PID: 2836

General

Chronological Activities

Analysis Process: chrome.exePID: 5984, Parent PID: 2664

General

Chronological Activities

Analysis Process: chrome.exePID: 6500, Parent PID: 2836

General

Chronological Activities

Disassembly

Windows Analysis Report
https://reface.com.mx/5fea7fdhf35?w=2oxwcgm171-85922646-57uod3ae5-1cxk711547450