Create Interactive Tour

macOS Analysis Report
https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb

Overview

General Information

Sample URL:	https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb
Analysis ID:	1394800
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false

Signatures

No high impact signatures.

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1394800
Start date and time:	2024-02-19 21:47:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb
Analysis system description:	Virtual Machine, Mojave (Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Detection:	CLEAN
Classification:	clean0.mac@0/19@6/0

Warnings

Excluded IPs from analysis (whitelisted): 23.63.209.230, 23.35.28.27, 44.235.85.225, 44.230.79.122, 17.253.83.197, 17.253.83.203, 142.251.40.42
Excluded domains from analysis (whitelisted): e11408.d.akamaiedge.net, mesu-cdn.apple.com.akadns.net, e673.dsce9.akamaiedge.net, api-glb-ausw2b.smoot.apple.com, help-ar.apple.com.edgekey.net, api.smoot.apple.com, bag-smoot.v.aaplimg.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, configuration.apple.com, mesu-cdn.origin-apple.com.akadns.net, help.origin-apple.com.akadns.net, mesu.g.aaplimg.com, configuration.apple.com.akadns.net, itunes.apple.com.edgekey.net, configuration.apple.com.edgekey.net, safebrowsing.googleapis.com, help.apple.com, smoot-searchv2-ausw2b.v.aaplimg.com, mesu.apple.com, init.itunes.apple.com, init-cdn.itunes-apple.com.akadns.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb

Process Tree

System is macvm-mojave

mono-sgen32 New Fork (PID: 602, Parent: 531)

open (MD5: 34bd93241fa5d2aee225941b1ca14fa4) Arguments:

xpcproxy New Fork (PID: 603, Parent: 1)

Safari (MD5: 2dde28c2f8a38ed2701ba17a0893cbc1) Arguments: /Applications/Safari.app/Contents/MacOS/Safari

xpcproxy New Fork (PID: 612, Parent: 1)

com.apple.Safari.SandboxBroker (MD5: dbc4069451b58fff752f6b018b3f2c4e) Arguments: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker

xpcproxy New Fork (PID: 614, Parent: 1)

nsurlstoraged (MD5: 321b0a40e24b45f0af49ba42742b3f64) Arguments: /usr/libexec/nsurlstoraged --privileged

xpcproxy New Fork (PID: 625, Parent: 1)

silhouette (MD5: 485ec1bd3cd09293e26d05f6fe464bfd) Arguments: /usr/libexec/silhouette

cleanup

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Persistence and Installation Behavior
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 17.248.193.18:443 -> 192.168.11.12:49212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.180.204.73:443 -> 192.168.11.12:49234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.154.131.215:443 -> 192.168.11.12:49235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.154.131.215:443 -> 192.168.11.12:49236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.88.21.119:443 -> 192.168.11.12:49241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.88.55.88:443 -> 192.168.11.12:49242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.88.21.119:443 -> 192.168.11.12:49243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.154.131.215:443 -> 192.168.11.12:49249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.154.131.215:443 -> 192.168.11.12:49250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49254 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49255 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49258 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49264 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49266 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49267 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /cloud/65c3b4dd90fa7b15775a8c25/?5bbb HTTP/1.1Host: forms.yandex.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /s3/cloud/forms/static/freeze/i18n/en.92fb2885.js HTTP/1.1Host: yastatic.netConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /s3/cloud/forms/static/freeze/js/runtime.ca06ac31.js HTTP/1.1Host: yastatic.netOrigin: https://forms.yandex.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /s3/cloud/forms/static/freeze/js/index.a79d0d51.js HTTP/1.1Host: yastatic.netOrigin: https://forms.yandex.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /s3/cloud/forms/static/freeze/js/vendors.13027535.js HTTP/1.1Host: yastatic.netOrigin: https://forms.yandex.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /s3/cloud/forms/static/freeze/css/index.047651d7.css HTTP/1.1Host: yastatic.netConnection: keep-aliveAccept: text/css,/;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /s3/home/fonts/ys/3/text-regular.woff2 HTTP/1.1Host: yastatic.netConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /metrika/tag.js HTTP/1.1Host: mc.yandex.ruConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /watch/3?wmode=7&page-url=https%3A%2F%2Fforms.yandex.com%2Fcloud%2F65c3b4dd90fa7b15775a8c25%2F%3F5bbb&page-ref=&charset=utf-8&ut=noindex&browser-info=pv%3A1%3Avf%3Aqfujqr3nyxpmy96xs6n0cesb%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-GB%3Av%3A1251%3Acn%3A1%3Adp%3A0%3Als%3A196552167312%3Ahid%3A638196510%3Az%3A60%3Ai%3A20240219214855%3Aet%3A1708375735%3Ac%3A1%3Arn%3A1031222969%3Arqn%3A1%3Au%3A1708375735407725049%3Aw%3A1024x647%3As%3A1024x768x24%3Ask%3A1%3Aj%3A1%3Awv%3A2%3Ads%3A674%2C1114%2C443%2C924%2C0%2C0%2C%2C3833%2C0%2C%2C%2C%2C6638%3Aco%3A0%3Ans%3A1708375725986%3Ast%3A1708375736&t=clc(0-0-0)rqnt(1)aw(1)rcm(0)yu(5073307901708375729)cdl(na)ti(1) HTTP/1.1Host: mc.yandex.comOrigin: https://forms.yandex.comCookie: _yasc=TzePaB/Sttzo9E0OEXdvjql0FT4hGrewKJDoGOfNfpjNfoUvVUnVALasatpa8oa7; i=Po1loEkEoi3UIaHZZ3HuDx7TuUPZoC2jcAno9IiFQ+PwfMbrDF/2DtivBOaPYe4M5PGuJK3E9qUobNCRfT5bbeZM6dg=; yandexuid=5073307901708375729Connection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /metrika/advert.gif HTTP/1.1Host: mc.yandex.comAccept: image/png,image/svg+xml,image/;q=0.8,video/;q=0.8,/;q=0.5Connection: keep-aliveCookie: _yasc=TzePaB/Sttzo9E0OEXdvjql0FT4hGrewKJDoGOfNfpjNfoUvVUnVALasatpa8oa7; i=Po1loEkEoi3UIaHZZ3HuDx7TuUPZoC2jcAno9IiFQ+PwfMbrDF/2DtivBOaPYe4M5PGuJK3E9qUobNCRfT5bbeZM6dg=; yandexuid=5073307901708375729User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /watch/3/1?wmode=7&page-url=https%3A%2F%2Fforms.yandex.com%2Fcloud%2F65c3b4dd90fa7b15775a8c25%2F%3F5bbb&page-ref&charset=utf-8&ut=noindex&browser-info=pv%3A1%3Avf%3Aqfujqr3nyxpmy96xs6n0cesb%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-GB%3Av%3A1251%3Acn%3A1%3Adp%3A0%3Als%3A196552167312%3Ahid%3A638196510%3Az%3A60%3Ai%3A20240219214855%3Aet%3A1708375735%3Ac%3A1%3Arn%3A1031222969%3Arqn%3A1%3Au%3A1708375735407725049%3Aw%3A1024x647%3As%3A1024x768x24%3Ask%3A1%3Aj%3A1%3Awv%3A2%3Ads%3A674%2C1114%2C443%2C924%2C0%2C0%2C%2C3833%2C0%2C%2C%2C%2C6638%3Aco%3A0%3Ans%3A1708375725986%3Ast%3A1708375736&t=clc%280-0-0%29rqnt%281%29aw%281%29rcm%280%29yu%285073307901708375729%29cdl%28na%29ti%281%29 HTTP/1.1Host: mc.yandex.comAccept: /Origin: https://forms.yandex.comCookie: yandexuid=5073307901708375729; ymex=1739911738.yrts.1708375738; yabs-sid=1701707111708375738; _yasc=TzePaB/Sttzo9E0OEXdvjql0FT4hGrewKJDoGOfNfpjNfoUvVUnVALasatpa8oa7; i=Po1loEkEoi3UIaHZZ3HuDx7TuUPZoC2jcAno9IiFQ+PwfMbrDF/2DtivBOaPYe4M5PGuJK3E9qUobNCRfT5bbeZM6dg=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /s3/cloud/forms/v26.108.2/public/i/icons/color/favicon-64.png HTTP/1.1Host: yastatic.netConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /s3/cloud/forms/v26.108.2/public/i/icons/color/favicon-16.png HTTP/1.1Host: yastatic.netConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /s3/cloud/forms/v26.108.2/public/i/icons/color/favicon-32.png HTTP/1.1Host: yastatic.netConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /s3/gdpr/v3/gdpr.js HTTP/1.1Host: yastatic.netConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /s3/cloud/forms/v26.108.2/public/i/icons/favicon.svg HTTP/1.1Host: yastatic.netAccept-Encoding: br, gzip, deflateConnection: keep-aliveAccept: image/png,image/svg+xml,image/;q=0.8,video/;q=0.8,/;q=0.5User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko)Accept-Language: en-gbReferer: https://yastatic.net/s3/cloud/forms/v26.108.2/public/i/icons/favicon.svgDNT: 1
Source: global traffic	HTTP traffic detected: GET /s3/home/fonts/ys/3/text-medium.woff2 HTTP/1.1Host: yastatic.netConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbAccept-Encoding: br, gzip, deflate

Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: .https://www.facebook.com/settings?tab=security_ equals www.facebook.com (Facebook)
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: 2https://www.linkedin.com/psettings/change-password_ equals www.linkedin.com (Linkedin)
Source: TopSites.plist.240.dr	String found in binary or memory: https://www.facebook.com/XFacebook equals www.facebook.com (Facebook)
Source: TopSites.plist.240.dr	String found in binary or memory: https://www.linkedin.com/XLinkedIn equals www.linkedin.com (Linkedin)
Source: TopSites.plist.240.dr	String found in binary or memory: https://www.yahoo.com/UYahoo equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: forms.yandex.com

Source: unknown

HTTP traffic detected: POST /clck/click HTTP/1.1Host: yandex.ruContent-Type: text/plain;charset=UTF-8Origin: https://forms.yandex.comAccept-Language: en-gbAccept-Encoding: br, gzip, deflateConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbbCache-Control: max-age=0Content-Length: 1388

Source: CloudHistoryRemoteConfiguration.plist.240.dr, login.keychain-db.sb-c132715d-w0EEPw.240.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: TopSites.plist.240.dr	String found in binary or memory: http://www.apple.com/uk/startpage/
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://247sports.com/my/settings/password/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.bbc.com/account/settings/edit/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.booking.com/account-recovery_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.docusign.com/me/changepassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.forbes.com/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.gmx.net/ciss/security/edit/passwordChange_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.idm.telekom.com/account-manager/password/index.xhtml_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.live.com/password/Change_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.magento.com/customer/account/changepassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.samsung.com/membership/contents/security/password/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://account.shodan.io/change_password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://accounts.autodesk.com/Profile/Security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://accounts.craigslist.org/pass_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://accounts.ebay.com/acctsec/security-center/chngpwd_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://accounts.intuit.com/app/account-manager/security/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://accounts.nintendo.com/password/edit_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://accounts.pch.com/forgotpass_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://accounts.shopify.com/accounts/186490458/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://acesso.gov.br/area-cidadao/#/alterarSenha_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://adultfriendfinder.com/p/update.cgi?p=my_account_update_account_password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://app.acorns.com/settings/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://app.carta.com/profiles/update/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://app.getflywheel.com/profile/security/change_password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://app.parkmobile.io/account/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://app.plex.tv/desktop#
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://app.prolific.co/account/general_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://app.sipgatebasic.de/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://app.stonly.com/app/general/userSettings/Account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://app.zeplin.io/profile/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://appleid.apple.com/account/manage_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://apps.anatel.gov.br/AnatelConsumidor/ConsumidorEditar.aspx_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://apps.jw.org/E_PASSCHG1_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://archive.org/account/index.php?settings=1_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://arxiv.org/user/change_own_password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://auth.astonmartinf1.com/Dashboard/ChangePassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://auth.danawa.com/modifyMember_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://auth.fandom.com/auth/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://auth.readymag.com/password/forgot_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://auth.redgifs.com/lo/reset?ticket=_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://auth.usnews.com/changePassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://bandcamp.com/settings#password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://benefitslogin.discoverybenefits.com/Profile/UpdatePassword.aspx_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://blend.io/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://bugzilla.kernel.org/userprefs.cgi?tab=account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://campus.tum.de_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://card.discover.com/cardmembersvcs/personalprofile/pp/UpdateDetails?ICMPGN=MYPROFILE_USERID_PA
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://censys.io/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://cfspart.impots.gouv.fr/monprofil-webapp/GererMonProfil_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://chaturbate.com/auth/password_change/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://classroom.udacity.com/settings/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://cloud.digitalocean.com/settings/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://cloud.linode.com/profile/auth_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://codepen.io/settings/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://consumercenter.mysynchrony.com/consumercenter/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://customer.xfinity.com/users/me/update-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://customercenter.marketwatch.com/account#password?mod=ql_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://customercenter.wsj.com/account#password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://dash.cloudflare.com/profile/authentication_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://dashboard.branch.io/account-settings/user_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://dashboard.dittomusic.com/account/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://dashboard.heroku.com/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://dashboard.messagebird.com/account/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://discord.com/settings/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://fetlife.com/settings/account/password_
Source: LastSession.plist.240.dr	String found in binary or memory: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://forum.wii-homebrew.com/index.php/AccountManagement/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://foursquare.com/change_password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://fps.fidelity.com/ftgw/Fps/Fidelity/RtlCust/ChangePIN/Init_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://genius.com/password_resets/new_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://github.com/settings/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://go.com/profile/account-settings/edit_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://help.steampowered.com/en/wizard/HelpChangePassword?redir=store/account/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://hibrain.net/mybrain/users/password/edit_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://home.thesun.co.uk/edit/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://hotels.com/profile/settings.html_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://hq1.appsflyer.com/account/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://id.atlassian.com/manage-profile/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://id.nfl.com/account/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://id.sonyentertainmentnetwork.com/id/management/#/p/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://imgur.com/account/settings/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://key.harvard.edu/manage-account/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://kundenportal.edeka-smart.de/edeka-csc/forgot-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://leetcode.com/accounts/password/set/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://legacy.memoriams.com/Network/Account/ChangePassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://linktr.ee/admin/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.aliexpress.com/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.aol.com/account/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.blockchain.com/en/#/security-center/advanced_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.coupang.com/login/userModify.pang_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.teamviewer.com/nav/profile/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.tmon.co.kr/user/info_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.usatoday.com/USAT-GUP/password-forgot/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.yahoo.com/account/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.yahoo.com/myaccount/security/change-password/?src=finance_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://login.yahoo.com/myaccount/security/change-password/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://logonservices.iam.target.com/change-password/?target=#
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://mail.protonmail.com/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://mastercard.syf.com/login/reset_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://mathworks.com/mwaccount/profiles/password/change_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://member.daum.net/change/password.daum_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://member.webmd.com/password-reset_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://membership.latimes.com/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://memberssl.auction.co.kr/membership/MyInfo/MyInfo.aspx_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://meuvivo.vivo.com.br/meuvivo/appmanager/portal/fixo_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://minhanet.net.com.br/webcenter/portal/MinhaNet/pages_alterarsenha_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://moncompte.lemonde.fr/gcustomer/account/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://my.foxbusiness.com/?p=account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://my.foxnews.com/?pieces=reset_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://my.ticketmaster.com/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://myaccount.ea.com/cp-ui/security/index_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://myaccount.google.com/signinoptions/password?continue=https://myaccount.google.com/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://myaccount.google.com/signinoptions/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://myaccounts.capitalone.com/Security/changePassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://mychart.clevelandclinic.org/inside.asp?mode=passwd_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://mypassword.uml.edu/#Change_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://myvpostpay.verizon.com/ui/bill/secure/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://na224.lightning.force.com/lightning/settings/personal/ChangePassword/home_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://nbcuniversal.nbc.com/request-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://news.ycombinator.com/changepw_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://nhentai.net/reset/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://nid.naver.com/user2/help/myInfo.nhn?m=viewChangePasswd_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://nypost.com/account/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://online.citi.com/US/ag/profile-update/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://onlyfans.com/my/settings/account/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://orcid.org/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://password.umsystem.edu/reset/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://play.hbomax.com/setting/account/edit/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://portal.edd.ca.gov/WebApp/Profile/UpdatePassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://portal.pilotflyingj.com/myrewards/forgot-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://portalpersonas.bancochile.cl/mibancochile-web/front/persona/index.html#/mi-perfil/datos-segu
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://portlandgeneral.com/secure/profile/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://poshmark.com/user/account-info_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://profile.callofduty.com/cod/info_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://profile.theguardian.com/reset_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://pwrecovery.ruc.dk_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://quizlet.com/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://redirect.pizza/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://reelgood.com/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://reg.usps.com/entreg/secure/ChangePasswordAction_input?returnActionName_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://rule34.xxx/index.php?page=account&s=change_password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://rumble.com/account/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://saude.sulamericaseguros.com.br/segurado/gerenciar-cadastro/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure-www.gap.com/my-account/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.aarp.org/account/editaccount?request_locale=en&nu=t_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.bankofamerica.com/auth/security-center/main/?activity=changePasscode_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.cecredentialtrust.com/account/editpassword/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.fnac.com/account/update-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.hulu.com/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.indeed.com/account/changepassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.maxpreps.com/utility/member/forgotpassword.aspx_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.npr.org/oauth2/login_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.orclinic.com/portal/editprofile.aspx_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure.ssa.gov/RIM/UpwdView.action_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://secure07ea.chase.com/web/auth/dashboard#/dashboard/myProfileSignInSecurity/resetPassword/res
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://selvbetjening.rejsekort.dk/CWS/CustomerManagement/ChangePassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://shein.com/user/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://shop.tmz.com/user?show=account-tab_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://slickdeals.net/forums/login.php?do=lostpw_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://soap2day.to/home/user/changepassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://soundcloud.com/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://spankbang.com/users/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://sslmember2.gmarket.co.kr/MYInfo/MemberInfo_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://stackoverflow.com/users/account-recovery_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://stacksocial.com/user?show=account-tab_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://stripchat.com/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://subscribe.washingtonpost.com/profile/#
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://support.opentable.com/s/login/ForgotPassword?language=en_US_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://thenounproject.com/accounts/password/change/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://todoist.com/prefs/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://trakt.tv/settings#password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://tripit.com/account/edit/section/change_password_
Source: TopSites.plist.240.dr	String found in binary or memory: https://twitter.com/WTwitter
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://twitter.com/settings/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://udapps.nss.udel.edu/myUDsettings/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://ui.attentivemobile.com/forgot-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://usa.experian.com/member/ngx-profile/account-info_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://user.manganelo.com/user_changes_pass_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://web.500px.com/settings/account/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://wordpress.com/me/security/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://worldstarhiphop.com/videos/reset.php_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.11st.co.kr/register/popupModifyPWD.tmall_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.1800contacts.com/account/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.aa.com/loyalty/profile/information_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.account.publishing.service.gov.uk/account/edit/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.ae.com/myaccount_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.aerlingus.com/html/user-profile.html_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.aesop.com/my-account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.airnewzealand.com/membership/profile/security/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.alaskaair.com/www2/ssl/myalaskaair/myalaskaair.aspx?view=myinformation&tab=email_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.alliantcreditunion.com/OnlineBanking/Settings/AccessAndSecurity/ChangePassword.aspx_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.allianz.com.br/alteracao-de-password-ecliente_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.allrecipes.com/account/profile#/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.alternate.de/html/myAccount/account/basicData.html_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.amctheatres.com/amcstubs/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.americanexpress.com/en-us/account/password/reset_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.ancestry.com/account/security/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.apartments.com/my-account/#_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.arlt.com/mein-passwort/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.att.com/acctmgmt/profile/overview_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.bathandbodyworks.com/my-account/edit-profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.bbq-grill-world.de/customer/account/edit/changepass/1/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.bedbathandbeyond.com/store/account/personalinfo_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.berlet.de/mein-konto.htm#my-account--edit-pass_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.bestbuy.com/identity/accountSettings/page/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.biblegateway.com/user/account/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.birkenstock.com/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.bloomberg.com/portal/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.blutdruck-shop.de/mein-passwort/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.boredpanda.com/settings/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.browserstack.com/accounts/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.businessinsider.com/#_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.buzzfeed.com/settings/password/change_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.cakeresume.com/settings/account?ref=navs_settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.canva.com/login?redirect=%2Fsettings%2Flogin-and-security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.cargurus.com/Cars/myAccount#/accountSettings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.cbsnews.com/user/change-password/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.cbssports.com/settings/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.chegg.com/my/account-next_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.chess.com/settings/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.chewy.com/app/resetpassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.clien.net/service/mypage/myInfoComfrim_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.cnbc.com/account/#profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.cnn.com/account/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.columbia.com/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.consumidor.gov.br/pages/usuario/editar_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.costco.com/AccountInformationView?identifier=manage-membership_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.crackle.com/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.creditkarma.com/myprofile/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.crunchyroll.com/resetpw_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.cvs.com/my-account/profile/sign-in-and-security/edit-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.dailymail.co.uk/registration/profile/change-password.html_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.darty.com/espace_client/donnees-personnelles/mot-de-passe/edition_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.delta.com/myprofile/security-settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.deviantart.com/settings/general_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.dickssportinggoods.com/MyAccount/AccountSettings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.disneyplus.com/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.dominos.com/en/pages/customer/#
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.doordash.com/accounts/password/reset/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.dropbox.com/account/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.dsw.com/en/us/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.dwr.com/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.eporner.com/profile/mturk_eporn/my/edit-pass/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.espn.com/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.etsy.com/your/account?ref=hdr_user_menu-settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.eventbrite.com/account-settings/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.evite.com/reset_password/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.expedia.com/user/forgotpassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.fanfiction.net/account/password.php_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.fedex.com/en-us/create-account/how-to-reset-forgot-password.html_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.fitbit.com/settings/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.foodnetwork.com/user-profile-page_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.foxsports.com/#_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.gamespot.com/change-details/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.geocaching.com/account/settings/changepassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.glassdoor.com/member/profile/settings.htm_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.gog.com/account/settings/security_
Source: TopSites.plist.240.dr	String found in binary or memory: https://www.google.com/?client=safari&channel=mac_bmVGoogle
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.grubhub.com/account/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.happycow.net/members/profile/update/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.homedepot.com/myaccount/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.huffpost.com/member/edit-profile_
Source: TopSites.plist.240.dr	String found in binary or memory: https://www.icloud.com/ViCloud
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.ign.com/account/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.insider.com/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.instacart.com/store/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.instagram.com/accounts/password/change/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.jcpenney.com/account/dashboard/personal/info_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.kohls.com/myaccount/accountsettings.jsp_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.kroger.com/account/update_
Source: TopSites.plist.240.dr	String found in binary or memory: https://www.linkedin.com/XLinkedIn
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.linkedin.com/psettings/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.livejasmin.com/en/girls/#
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.lowes.com/mylowes/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.marktplaats.nl/account/password-reset/confirm.html_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.marriott.com/loyalty/myAccount/changePassword.mi_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.meliuz.com.br/minha-conta/meus-dados/senha_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.mercari.com/mypage/email_password/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.michaels.com/on/demandware.store/Sites-MichaelsUS-Site/default/Account-EditProfile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.mlb.com/account/general_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.myfreecams.com/php/account.php?request=status&vcc=1674246522#change_password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.mylo.id/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.nba.com/account/nbaprofile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.netflix.com/password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.newsweek.com/contact_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.nike.com/member/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.nordstrom.com/my-account/sign-in-info_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.nordstromrack.com/my-account/sign-in-info_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.nytimes.com/account/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.overleaf.com/user/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.paramountplus.com/account/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.patreon.com/settings/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.paypal.com/myaccount/security/password/change_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.peacocktv.com/forgot_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.pearson.com/store/en-us/my-account/update-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.pinterest.com/settings/account-settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.politico.com/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.pornhub.com/user/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.ppomppu.co.kr/myinfo/profile.php_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.prowlapp.com/settings.php_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.quora.com/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.rakuten.com/account-settings.htm_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.realtor.com/myaccount/profile/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.reddit.com/prefs/update/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.redfin.com/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.redtube.com/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.rei.com/YourAccountCredentials_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.reuters.com/account/forgot-password/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.roblox.com/my/account#
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.rottentomatoes.com/user/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.samsclub.com/account/personal-info?xid=hdr_account_change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.santahelenasaude.com.br/beneficiario/#/alterar-senha_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.saturn.de/webapp/wcs/stores/servlet/MultiChannelMAChangePassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.sephora.com/profile/MyAccount_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.serasa.com.br/meus-dados/alterar-senha_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.shoop.de/einstellungen/benutzerdaten_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.shopback.co.kr/account/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.shutterfly.com/account-settings/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.sonos.com/myaccount/user/profile/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.southwest.com/loyalty/myaccount/profile-security.html_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.spectrum.net/user-preferences/your-info/manage/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.speedway.com/my-account/security/passcode_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.splunk.com/my-account/#/profile-details
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.spotify.com/in-en/account/change-password/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.tasteofhome.com/login/updatepassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.temu.com/bgp_account_security.html_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.thetrainline.com/my-account/change-password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.thetvdb.com/dashboard/account/changepass_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.tiktok.com/login/email/forget-password_
Source: TopSites.plist.240.dr	String found in binary or memory: https://www.tripadvisor.com/
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.tripadvisor.com/Settings-cp_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.trulia.com/account/user_profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.tumblr.com/settings/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.twilio.com/console/user/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.twitch.tv/settings/security_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.ulta.com/myaccount/index.jsp_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.united.com/ual/en/US/account/security/setpassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.ups.com/lasso/updatePass?loc=en_US_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.ventrachicago.com/account/manage-account/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.victoriassecret.com/us/account/profile#changePassword_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.walgreens.com/account/user_and_password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.walmart.com/account/profile_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.wayfair.com/v/account/personal_info/edit_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.wikihow.com/Special:ChangeCredentials/MediaWiki%5CAuth%5CPasswordAuthenticationRequest_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.wunderground.com/member/settings_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.xvideos.com/account/security_
Source: TopSites.plist.240.dr	String found in binary or memory: https://www.yahoo.com/UYahoo
Source: TopSites.plist.240.dr	String found in binary or memory: https://www.yelp.com/TYelp
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.youporn.com/settings/change/password/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.zhihu.com/settings/account_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.zillow.com/myzillow/profile/_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.ziprecruiter.com/login/forgot-password?realm=candidates_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://www.zocdoc.com/patient/editprofile?section=Password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://xhamster.com/password-recovery_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://yelp.com/profile_password_
Source: AutoFillQuirks.plist.240.dr	String found in binary or memory: https://zoom.us/profile#pwd-form_

Source: unknown	Network traffic detected: HTTP traffic on port 49265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49262
Source: unknown	Network traffic detected: HTTP traffic on port 49242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49258
Source: unknown	Network traffic detected: HTTP traffic on port 49266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49251
Source: unknown	Network traffic detected: HTTP traffic on port 49262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49250
Source: unknown	Network traffic detected: HTTP traffic on port 49249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49249
Source: unknown	Network traffic detected: HTTP traffic on port 49267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49240
Source: unknown	Network traffic detected: HTTP traffic on port 49248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49239
Source: unknown	Network traffic detected: HTTP traffic on port 49250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49238
Source: unknown	Network traffic detected: HTTP traffic on port 49243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49234
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49253 -> 443

Source: unknown	HTTPS traffic detected: 17.248.193.18:443 -> 192.168.11.12:49212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.180.204.73:443 -> 192.168.11.12:49234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.154.131.215:443 -> 192.168.11.12:49235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.154.131.215:443 -> 192.168.11.12:49236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.88.21.119:443 -> 192.168.11.12:49241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.88.55.88:443 -> 192.168.11.12:49242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.88.21.119:443 -> 192.168.11.12:49243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.154.131.215:443 -> 192.168.11.12:49249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.154.131.215:443 -> 192.168.11.12:49250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49254 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49255 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49258 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49264 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49266 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49267 version: TLS 1.2

Source: classification engine

Classification label: clean0.mac@0/19@6/0

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)

Random device file read: /dev/urandom

Jump to behavior

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior
Source: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker (PID: 612)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	Binary plist file created: /Users/bernard/Library/Containers/com.apple.Safari/Data/Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 2)/AutoFillQuirks.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownSitesUsingPlugIns.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/SitesAllowedToAutoplay.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/TopSites.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist	Jump to dropped file

Source: /usr/bin/open (PID: 602)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 603)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker (PID: 612)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://www.dailymail.co.uk/registration/profile/change-password.html_	0%	Avira URL Cloud	safe
https://legacy.memoriams.com/Network/Account/ChangePassword_	0%	Avira URL Cloud	safe
https://pwrecovery.ruc.dk_	0%	Avira URL Cloud	safe
https://www.serasa.com.br/meus-dados/alterar-senha_	0%	Avira URL Cloud	safe
https://acesso.gov.br/area-cidadao/#/alterarSenha_	0%	Avira URL Cloud	safe
https://meuvivo.vivo.com.br/meuvivo/appmanager/portal/fixo_	0%	Avira URL Cloud	safe
https://www.11st.co.kr/register/popupModifyPWD.tmall_	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
mc.yandex.ru	77.88.21.119	true	false	high
yandex.ru	77.88.55.88	true	false	high
apis.apple.map.fastly.net	151.101.195.6	true	false	unknown
forms-public-www.awacs-b.yandex.net	213.180.204.73	true	false	high
yastatic.net	178.154.131.215	true	false	high
forms.yandex.com	unknown	unknown	false	high
mc.yandex.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mc.yandex.ru/metrika/tag.js	false		high
https://yastatic.net/s3/cloud/forms/v26.108.2/public/i/icons/favicon.svg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.sephora.com/profile/MyAccount_	AutoFillQuirks.plist.240.dr	false		high
https://accounts.ebay.com/acctsec/security-center/chngpwd_	AutoFillQuirks.plist.240.dr	false		high
https://www.southwest.com/loyalty/myaccount/profile-security.html_	AutoFillQuirks.plist.240.dr	false		high
https://xhamster.com/password-recovery_	AutoFillQuirks.plist.240.dr	false		high
https://acesso.gov.br/area-cidadao/#/alterarSenha_	AutoFillQuirks.plist.240.dr	false	Avira URL Cloud: safe	unknown
https://hotels.com/profile/settings.html_	AutoFillQuirks.plist.240.dr	false		high
https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_	AutoFillQuirks.plist.240.dr	false		high
https://www.amctheatres.com/amcstubs/account_	AutoFillQuirks.plist.240.dr	false		high
https://customer.xfinity.com/users/me/update-password_	AutoFillQuirks.plist.240.dr	false		high
https://www.walmart.com/account/profile_	AutoFillQuirks.plist.240.dr	false		high
https://moncompte.lemonde.fr/gcustomer/account/password_	AutoFillQuirks.plist.240.dr	false		high
https://shein.com/user/security_	AutoFillQuirks.plist.240.dr	false		high
https://zoom.us/profile#pwd-form_	AutoFillQuirks.plist.240.dr	false		high
https://support.opentable.com/s/login/ForgotPassword?language=en_US_	AutoFillQuirks.plist.240.dr	false		high
https://forum.wii-homebrew.com/index.php/AccountManagement/_	AutoFillQuirks.plist.240.dr	false		high
https://www.twitch.tv/settings/security_	AutoFillQuirks.plist.240.dr	false		high
https://fps.fidelity.com/ftgw/Fps/Fidelity/RtlCust/ChangePIN/Init_	AutoFillQuirks.plist.240.dr	false		high
https://www.instacart.com/store/account_	AutoFillQuirks.plist.240.dr	false		high
https://www.newsweek.com/contact_	AutoFillQuirks.plist.240.dr	false		high
https://www.victoriassecret.com/us/account/profile#changePassword_	AutoFillQuirks.plist.240.dr	false		high
https://dashboard.dittomusic.com/account/password_	AutoFillQuirks.plist.240.dr	false		high
https://www.birkenstock.com/profile_	AutoFillQuirks.plist.240.dr	false		high
https://www.delta.com/myprofile/security-settings_	AutoFillQuirks.plist.240.dr	false		high
https://www.fanfiction.net/account/password.php_	AutoFillQuirks.plist.240.dr	false		high
https://id.sonyentertainmentnetwork.com/id/management/#/p/security_	AutoFillQuirks.plist.240.dr	false		high
https://www.nba.com/account/nbaprofile_	AutoFillQuirks.plist.240.dr	false		high
https://cloud.linode.com/profile/auth_	AutoFillQuirks.plist.240.dr	false		high
https://meuvivo.vivo.com.br/meuvivo/appmanager/portal/fixo_	AutoFillQuirks.plist.240.dr	false	Avira URL Cloud: safe	unknown
https://www.livejasmin.com/en/girls/#	AutoFillQuirks.plist.240.dr	false		high
https://slickdeals.net/forums/login.php?do=lostpw_	AutoFillQuirks.plist.240.dr	false		high
https://www.alaskaair.com/www2/ssl/myalaskaair/myalaskaair.aspx?view=myinformation&tab=email_	AutoFillQuirks.plist.240.dr	false		high
https://www.linkedin.com/psettings/change-password_	AutoFillQuirks.plist.240.dr	false		high
https://bugzilla.kernel.org/userprefs.cgi?tab=account_	AutoFillQuirks.plist.240.dr	false		high
https://codepen.io/settings/account_	AutoFillQuirks.plist.240.dr	false		high
https://www.roblox.com/my/account#	AutoFillQuirks.plist.240.dr	false		high
https://www.serasa.com.br/meus-dados/alterar-senha_	AutoFillQuirks.plist.240.dr	false	Avira URL Cloud: safe	unknown
https://reg.usps.com/entreg/secure/ChangePasswordAction_input?returnActionName_	AutoFillQuirks.plist.240.dr	false		high
https://www.allrecipes.com/account/profile#/change-password_	AutoFillQuirks.plist.240.dr	false		high
https://user.manganelo.com/user_changes_pass_	AutoFillQuirks.plist.240.dr	false		high
https://www.dailymail.co.uk/registration/profile/change-password.html_	AutoFillQuirks.plist.240.dr	false	Avira URL Cloud: safe	unknown
https://www.11st.co.kr/register/popupModifyPWD.tmall_	AutoFillQuirks.plist.240.dr	false	Avira URL Cloud: safe	unknown
https://app.plex.tv/desktop#	AutoFillQuirks.plist.240.dr	false		high
https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_	AutoFillQuirks.plist.240.dr	false		unknown
https://account.samsung.com/membership/contents/security/password/change-password_	AutoFillQuirks.plist.240.dr	false		high
https://www.creditkarma.com/myprofile/security_	AutoFillQuirks.plist.240.dr	false		high
https://auth.readymag.com/password/forgot_	AutoFillQuirks.plist.240.dr	false		high
https://archive.org/account/index.php?settings=1_	AutoFillQuirks.plist.240.dr	false		high
https://secure07ea.chase.com/web/auth/dashboard#/dashboard/myProfileSignInSecurity/resetPassword/res	AutoFillQuirks.plist.240.dr	false		high
https://account.magento.com/customer/account/changepassword_	AutoFillQuirks.plist.240.dr	false		high
https://accounts.nintendo.com/password/edit_	AutoFillQuirks.plist.240.dr	false		high
https://www.nordstrom.com/my-account/sign-in-info_	AutoFillQuirks.plist.240.dr	false		high
https://www.dominos.com/en/pages/customer/#	AutoFillQuirks.plist.240.dr	false		high
https://profile.theguardian.com/reset_	AutoFillQuirks.plist.240.dr	false		high
https://reelgood.com/account_	AutoFillQuirks.plist.240.dr	false		high
https://www.dropbox.com/account/security_	AutoFillQuirks.plist.240.dr	false		high
https://customercenter.wsj.com/account#password_	AutoFillQuirks.plist.240.dr	false		high
https://go.com/profile/account-settings/edit_	AutoFillQuirks.plist.240.dr	false		high
https://chaturbate.com/auth/password_change/_	AutoFillQuirks.plist.240.dr	false		high
https://genius.com/password_resets/new_	AutoFillQuirks.plist.240.dr	false		high
https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef	AutoFillQuirks.plist.240.dr	false		high
https://www.alternate.de/html/myAccount/account/basicData.html_	AutoFillQuirks.plist.240.dr	false		high
https://blend.io/settings_	AutoFillQuirks.plist.240.dr	false		high
https://www.cnn.com/account/settings_	AutoFillQuirks.plist.240.dr	false		high
https://www.instagram.com/accounts/password/change/_	AutoFillQuirks.plist.240.dr	false		high
https://www.redtube.com/settings_	AutoFillQuirks.plist.240.dr	false		high
https://www.aesop.com/my-account_	AutoFillQuirks.plist.240.dr	false		high
https://member.daum.net/change/password.daum_	AutoFillQuirks.plist.240.dr	false		high
https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_	AutoFillQuirks.plist.240.dr	false		high
https://mastercard.syf.com/login/reset_	AutoFillQuirks.plist.240.dr	false		high
https://www.jcpenney.com/account/dashboard/personal/info_	AutoFillQuirks.plist.240.dr	false		high
https://www.pearson.com/store/en-us/my-account/update-password_	AutoFillQuirks.plist.240.dr	false		high
https://www.yahoo.com/UYahoo	TopSites.plist.240.dr	false		high
https://worldstarhiphop.com/videos/reset.php_	AutoFillQuirks.plist.240.dr	false		high
https://www.boredpanda.com/settings/_	AutoFillQuirks.plist.240.dr	false		high
https://www.shoop.de/einstellungen/benutzerdaten_	AutoFillQuirks.plist.240.dr	false		high
https://mypassword.uml.edu/#Change_	AutoFillQuirks.plist.240.dr	false		high
https://stripchat.com/settings_	AutoFillQuirks.plist.240.dr	false		high
https://accounts.shopify.com/accounts/186490458/security_	AutoFillQuirks.plist.240.dr	false		high
https://www.redfin.com/change-password_	AutoFillQuirks.plist.240.dr	false		high
https://hibrain.net/mybrain/users/password/edit_	AutoFillQuirks.plist.240.dr	false		high
https://app.carta.com/profiles/update/_	AutoFillQuirks.plist.240.dr	false		high
https://legacy.memoriams.com/Network/Account/ChangePassword_	AutoFillQuirks.plist.240.dr	false	Avira URL Cloud: safe	unknown
https://www.ups.com/lasso/updatePass?loc=en_US_	AutoFillQuirks.plist.240.dr	false		high
https://www.pinterest.com/settings/account-settings_	AutoFillQuirks.plist.240.dr	false		high
https://profile.callofduty.com/cod/info_	AutoFillQuirks.plist.240.dr	false		high
https://bandcamp.com/settings#password_	AutoFillQuirks.plist.240.dr	false		high
https://www.crackle.com/profile_	AutoFillQuirks.plist.240.dr	false		high
https://secure.hulu.com/account_	AutoFillQuirks.plist.240.dr	false		high
https://www.yelp.com/TYelp	TopSites.plist.240.dr	false		high
https://app.acorns.com/settings/change-password_	AutoFillQuirks.plist.240.dr	false		high
https://news.ycombinator.com/changepw_	AutoFillQuirks.plist.240.dr	false		high
https://classroom.udacity.com/settings/password_	AutoFillQuirks.plist.240.dr	false		high
https://pwrecovery.ruc.dk_	AutoFillQuirks.plist.240.dr	false	Avira URL Cloud: safe	low
https://rumble.com/account/profile_	AutoFillQuirks.plist.240.dr	false		high
https://www.michaels.com/on/demandware.store/Sites-MichaelsUS-Site/default/Account-EditProfile_	AutoFillQuirks.plist.240.dr	false		high
https://www.splunk.com/my-account/#/profile-details	AutoFillQuirks.plist.240.dr	false		high
https://secure.ssa.gov/RIM/UpwdView.action_	AutoFillQuirks.plist.240.dr	false		high
https://www.realtor.com/myaccount/profile/settings_	AutoFillQuirks.plist.240.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
178.154.131.215	yastatic.net	Russian Federation	13238	YANDEXRU	false
77.88.21.119	mc.yandex.ru	Russian Federation	13238	YANDEXRU	false
77.88.55.88	yandex.ru	Russian Federation	13238	YANDEXRU	false
151.101.195.6	apis.apple.map.fastly.net	United States	54113	FASTLYUS	false
213.180.204.73	forms-public-www.awacs-b.yandex.net	Russian Federation	13238	YANDEXRU	false
151.101.67.6	unknown	United States	54113	FASTLYUS	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	167
Entropy (8bit):	5.1935780890523855
Encrypted:	false
SSDEEP:	3:N6nscvUwCB93dCjRBHW6qxyDAA6f9WRuhRYA53QwloW29ta:NMNUwCr3AjjHWLhvoW29ta
MD5:	DE8E6A9215E60E19F52F3136E07E6327
SHA1:	97B3B8D9B958AF45BDE482A4E24E532A309D2A35
SHA-256:	411C91F675626C60C854C1EE0A3ADA877AD0A81C9FE8314BA6AD4C6EEAE20945
SHA-512:	CA74496AAFABFC555365BD123DBB0FBEA1F637551C4CC1E53D6D2D64653EC04E0A5D0DCF18127685627F2139E4BC06E0D7191327A4BD08ABF7568829205B77C5
Malicious:	false
Reputation:	low
Preview:	bplist00.........^operatingDates_..browsingStatistics_..endOfGrandfatheringTimestampWversion.....Tdate#A.t......#A.w>J....... 5T\^afopy...............................{

Process:	/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker
File Type:	ASCII text, with very long lines (341)
Category:	dropped
Size (bytes):	765
Entropy (8bit):	5.13954059950434
Encrypted:	false
SSDEEP:	12:qQFOr3J4f9QHOomEVg2+LgV5e9LgVCqosgQFOr+f9QH8iomEVg2+LgV5e9LgV5sw:qvr3J4FQ48EDxxvr+FQz8EDxodlj
MD5:	32715F19C9D897ACDA729D6CE35A04B9
SHA1:	B05D6E1CCEC80E9C75BBEAF701803A25254A2AC4
SHA-256:	C96C460D3E09CD44352313C703769513E6A4C40B84128231F0D1FEE656876195
SHA-512:	9FB83018140520FF0AF8C266825FA955CE44E7D25AC4BF3FFC7F369253FFB4CAC5D35A2FF0E2C862A8FE1A137807B437CBDAA93A5886CFA2B59CA3414A51BDC0
Malicious:	false
Reputation:	low
Preview:	objc[612]: Class PurpleButtonCell is implemented in both /System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari (0x7fff893b53b0) and /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker (0x102aedec8). One of the two will be used. Which one is undefined..objc[612]: Class PurpleButton is implemented in both /System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari (0x7fff893b5400) and /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker (0x102aedf18). One of the two will be used. Which one is undefined..2024-02-19 21:48:44.795 com.apple.Safari.SandboxBroker[612:4293] ApplePersistence=NO.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2024 21:48:47.314233065 CET	62426	53	192.168.11.12	1.1.1.1
Feb 19, 2024 21:48:47.978936911 CET	53	62426	1.1.1.1	192.168.11.12
Feb 19, 2024 21:48:49.645064116 CET	55752	53	192.168.11.12	1.1.1.1
Feb 19, 2024 21:48:49.801335096 CET	53	55752	1.1.1.1	192.168.11.12
Feb 19, 2024 21:48:53.464015007 CET	61223	53	192.168.11.12	1.1.1.1
Feb 19, 2024 21:48:53.627437115 CET	53	61223	1.1.1.1	192.168.11.12
Feb 19, 2024 21:48:53.752752066 CET	57836	53	192.168.11.12	1.1.1.1
Feb 19, 2024 21:48:53.916971922 CET	53	57836	1.1.1.1	192.168.11.12
Feb 19, 2024 21:48:56.622386932 CET	58543	53	192.168.11.12	1.1.1.1
Feb 19, 2024 21:48:56.786262035 CET	53	58543	1.1.1.1	192.168.11.12
Feb 19, 2024 21:49:01.687547922 CET	53	60406	1.1.1.1	192.168.11.12
Feb 19, 2024 21:49:15.104212999 CET	50237	53	192.168.11.12	1.1.1.1
Feb 19, 2024 21:49:15.268543959 CET	53	50237	1.1.1.1	192.168.11.12

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 19, 2024 21:48:38.819792032 CET	17.248.193.18	443	192.168.11.12	49212	CN=gateway.icloud.com, O=Apple Inc., ST=California, C=US C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1 C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1	C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1 CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE CN=Apple Root CA, OU=Apple Certification Authority, O=Apple Inc., C=US	Wed Nov 01 09:04:18 CET 2023 Wed Dec 12 13:00:00 CET 2018 Thu Apr 28 23:38:00 CEST 2022	Sat Nov 30 09:04:17 CET 2024 Wed May 07 14:00:00 CEST 2025 Wed May 07 02:00:00 CEST 2025
					C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Dec 12 13:00:00 CET 2018	Wed May 07 14:00:00 CEST 2025
					C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1	CN=Apple Root CA, OU=Apple Certification Authority, O=Apple Inc., C=US	Thu Apr 28 23:38:00 CEST 2022	Wed May 07 02:00:00 CEST 2025
Feb 19, 2024 21:48:39.065805912 CET	151.101.67.6	443	192.168.11.12	49214	CN=bag.itunes.apple.com, O=Apple Inc., L=Cupertino, ST=California, C=US, SERIALNUMBER=C0806592, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 27 22:00:02 CET 2023 Wed Apr 29 14:54:50 CEST 2020	Sat May 25 23:10:02 CEST 2024 Thu Apr 11 01:59:59 CEST 2030	771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-13172-18-16-11-10,29-23-24-25,0	5c118da645babe52f060d0754256a73c
Feb 19, 2024 21:48:39.065805912 CET	151.101.67.6	443	192.168.11.12	49214	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Apr 29 14:54:50 CEST 2020	Thu Apr 11 01:59:59 CEST 2030		5c118da645babe52f060d0754256a73c

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:49 UTC	368	OUT	GET /cloud/65c3b4dd90fa7b15775a8c25/?5bbb HTTP/1.1 Host: forms.yandex.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-gb Connection: keep-alive Accept-Encoding: br, gzip, deflate User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
2024-02-19 20:48:49 UTC	2686	IN	HTTP/1.1 200 OK Cache-Control: no-store, max-age=0, must-revalidate, proxy-revalidate Connection: Close Content-Length: 35838 Content-Security-Policy: report-to default-group; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'nonce-kDpEPt4ho/TajUo2qikXWg==' yastatic.net yastat.net mc.yandex.ru mc.webvisor.com mc.webvisor.org yandex.com mc.yandex.kg mc.yandex.uz; style-src 'self' 'unsafe-inline' yastatic.net yastat.net; font-src 'self' yastatic.net yastat.net; img-src 'self' data: yastatic.net yastat.net mc.webvisor.com mc.webvisor.org mc.yandex.ru mc.admetrica.ru avatars.mds.yandex.net ; frame-src 'self' blob: mc.yandex.ru mc.yandex.md; child-src 'self' blob: mc.yandex.ru; connect-src 'self' yandexmetrica.com: mc.webvisor.com mc.webvisor.org mc.yandex.ru mc.admetrica.ru https://yandex.ru https://yandex.com mail.yandex.com yastatic.net mc.yandex.by mc.yandex.kz mc.yandex.ua mc.yandex.com mc.yandex.com.tr mc.yandex.kg mc.yandex.uz api.passport.yandex.com; media-src yastatic.net yastat.net; frame-ancestors webvisor.com .webvisor.com http://webvisor.com http://.webvisor.com *; report-uri https://csp.yandex.net/csp?yandexuid=5073307901708375729&from=forms-www.business&project=forms-www; Content-Type: text/html; charset=utf-8 Date: Mon, 19 Feb 2024 20:48:49 GMT P3P: CP="This is not a P3P policy!" Report-To: {"group":"default-group","endpoints":[{"url":"https://csp.yandex.net/csp?yandexuid=5073307901708375729&from=forms-www.business&project=forms-www"}],"max_age":1800,"include_subdomains":true} Set-Cookie: cookieon=1; Path=/; HttpOnly; Secure Set-Cookie: CSRF-TOKEN=46917c2d5a8418f42590578a9abd77e44ac72a44%3A1708375729; Max-Age=2592000; Path=/; Expires=Wed, 20 Mar 2024 20:48:49 GMT; Secure; SameSite=Strict Set-Cookie: forms:sid=eXycDdCSTZsWlhs1; Max-Age=2592000; Path=/; Expires=Wed, 20 Mar 2024 20:48:49 GMT; HttpOnly Set-Cookie: _ya_ru=1; Path=/ Set-Cookie: _com=1; Path=/ Set-Cookie: _forms_yandexuid=1; Path=/ Set-Cookie: _new_ui_all=1; Path=/ Set-Cookie: _transparent_iframe_background=1; Path=/ Set-Cookie: _yasc=TzePaB/Sttzo9E0OEXdvjql0FT4hGrewKJDoGOfNfpjNfoUvVUnVALasatpa8oa7; domain=.yandex.com; path=/; expires=Thu, 16 Feb 2034 20:48:49 GMT; secure Set-Cookie: i=Po1loEkEoi3UIaHZZ3HuDx7TuUPZoC2jcAno9IiFQ+PwfMbrDF/2DtivBOaPYe4M5PGuJK3E9qUobNCRfT5bbeZM6dg=; Expires=Wed, 18-Feb-2026 20:48:49 GMT; Domain=.yandex.com; Path=/; Secure; HttpOnly Set-Cookie: yandexuid=5073307901708375729; Expires=Wed, 18-Feb-2026 20:48:49 GMT; Domain=.yandex.com; Path=/; Secure Surrogate-Control: no-store Vary: Accept-Encoding X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block x-request-id: 1708375729286307-12587892262460458469
2024-02-19 20:48:49 UTC	5930	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 59 61 6e 64 65 78 20 46 6f 72 6d 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 2f 2f 79 61 73 74 61 74 69 63 2e 6e 65 74 2f 73 33 2f 63 6c 6f 75 64 2f 66 6f 72 6d 73 2f 76 32 36 2e 31 30 38 2e 32 2f 70 75 62 6c 69 63 2f 69 2f 69 63 6f 6e 73 2f 63 6f 6c 6f 72 2f 66 61 76 69 63 6f 6e 2d 31 36 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Yandex Forms</title> <link rel="icon" type="image/png" sizes="16x16" href="//yastatic.net/s3/cloud/forms/v26.108.2/public/i/icons/color/favicon-16.png"> <link href="http
2024-02-19 20:48:49 UTC	8168	IN	Data Raw: 63 74 69 6f 6e 28 65 2c 69 2c 6e 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 6f 3d 59 61 2e 52 75 6d 2e 67 65 74 53 65 74 74 69 6e 67 28 22 66 6f 72 63 65 50 61 69 6e 74 54 69 6d 65 53 65 6e 64 69 6e 67 22 29 3b 21 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 69 66 28 6f 7c 7c 21 74 2e 69 73 56 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 64 28 29 29 7b 76 61 72 20 73 3d 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 69 3f 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 69 29 3a 69 3b 73 3f 6e 65 77 20 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 66 75 6e 63 74 69 6f 6e 28 69 2c 6e 29 7b 21 6f 26 26 74 2e 69 73 56 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 64 28 29 7c 7c 28 59 61 2e 52 75 6d 2e 73 65 6e 64 54 69 6d 65 4d Data Ascii: ction(e,i,n){var t=this,o=Ya.Rum.getSetting("forcePaintTimeSending");!function r(){if(o\|\|!t.isVisibilityChanged()){var s="string"==typeof i?document.querySelector(i):i;s?new IntersectionObserver(function(i,n){!o&&t.isVisibilityChanged()\|\|(Ya.Rum.sendTimeM
2024-02-19 20:48:49 UTC	3578	IN	Data Raw: 75 6d 29 2e 6c 6f 67 41 6a 61 78 45 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 69 2c 6f 2c 6e 29 7b 61 2e 74 79 70 65 3d 22 6e 65 74 77 6f 72 6b 22 2c 61 2e 61 64 64 69 74 69 6f 6e 61 6c 3d 61 2e 61 64 64 69 74 69 6f 6e 61 6c 7c 7c 7b 7d 2c 22 74 69 6d 65 6f 75 74 22 3d 3d 3d 6f 3f 61 2e 61 64 64 69 74 69 6f 6e 61 6c 2e 74 69 6d 65 6f 75 74 3d 31 3a 69 2e 73 74 61 74 75 73 26 26 28 61 2e 61 64 64 69 74 69 6f 6e 61 6c 2e 73 74 61 74 75 73 3d 69 2e 73 74 61 74 75 73 29 2c 74 2e 6c 6f 67 45 72 72 6f 72 28 61 2c 6e 29 7d 7d 28 29 3b 0a 0a 20 20 20 20 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 27 75 73 65 20 73 74 72 69 63 74 27 3b 0a 0a 28 66 75 6e 63 74 69 6f 6e 28 72 75 6d 29 20 7b 0a 20 20 20 20 2f 2f 20 d0 b8 d0 b4 d0 b5 d0 bd d1 82 d0 Data Ascii: um).logAjaxError=function(a,i,o,n){a.type="network",a.additional=a.additional\|\|{},"timeout"===o?a.additional.timeout=1:i.status&&(a.additional.status=i.status),t.logError(a,n)}}(); (function () {'use strict';(function(rum) { //
2024-02-19 20:48:49 UTC	4590	IN	Data Raw: 74 29 7b 65 2e 5f 76 61 72 73 5b 74 5d 3d 6e 5b 74 5d 7d 29 2c 49 28 29 2c 4d 28 29 7d 3b 76 61 72 20 74 2c 69 2c 72 3d 22 36 39 30 2e 31 30 33 33 22 2c 6f 3d 22 36 39 30 2e 32 30 39 36 2e 32 30 37 22 2c 61 3d 22 36 39 30 2e 32 30 39 36 2e 32 38 37 37 22 2c 73 3d 22 36 39 30 2e 32 30 39 36 2e 32 38 39 32 22 2c 63 3d 22 36 39 30 2e 32 30 39 36 2e 32 30 34 34 22 2c 75 3d 22 36 39 30 2e 32 30 39 36 2e 33 36 31 22 2c 64 3d 22 36 39 30 2e 32 30 39 36 2e 34 30 30 34 22 2c 66 3d 33 2c 6c 3d 33 65 33 2c 76 3d 7b 63 6f 6e 6e 65 63 74 45 6e 64 3a 32 31 31 36 2c 63 6f 6e 6e 65 63 74 53 74 61 72 74 3a 32 31 31 34 2c 64 65 63 6f 64 65 64 42 6f 64 79 53 69 7a 65 3a 32 38 38 36 2c 64 6f 6d 43 6f 6d 70 6c 65 74 65 3a 32 31 32 34 2c 64 6f 6d 43 6f 6e 74 65 6e 74 4c 6f 61 Data Ascii: t){e._vars[t]=n[t]}),I(),M()};var t,i,r="690.1033",o="690.2096.207",a="690.2096.2877",s="690.2096.2892",c="690.2096.2044",u="690.2096.361",d="690.2096.4004",f=3,l=3e3,v={connectEnd:2116,connectStart:2114,decodedBodySize:2886,domComplete:2124,domContentLoa
2024-02-19 20:48:49 UTC	8168	IN	Data Raw: 20 53 26 26 53 5b 65 5d 26 26 73 2e 70 75 73 68 28 76 5b 65 5d 2b 22 3d 22 2b 67 65 28 53 5b 65 5d 2c 5f 29 29 7d 29 2c 65 2e 76 73 53 74 61 72 74 3f 28 73 2e 70 75 73 68 28 22 31 34 38 34 3d 22 2b 28 67 5b 65 2e 76 73 53 74 61 72 74 5d 7c 7c 32 37 37 31 29 29 2c 65 2e 76 73 43 68 61 6e 67 65 64 26 26 73 2e 70 75 73 68 28 22 31 34 38 34 2e 37 31 39 3d 31 22 29 29 3a 73 2e 70 75 73 68 28 22 31 34 38 34 3d 22 2b 67 2e 76 69 73 69 62 6c 65 29 2c 62 26 26 28 62 2e 72 65 64 69 72 65 63 74 43 6f 75 6e 74 26 26 73 2e 70 75 73 68 28 22 31 33 38 34 2e 31 33 38 35 3d 22 2b 62 2e 72 65 64 69 72 65 63 74 43 6f 75 6e 74 29 2c 31 21 3d 3d 62 2e 74 79 70 65 26 26 32 21 3d 3d 62 2e 74 79 70 65 7c 7c 73 2e 70 75 73 68 28 22 37 37 30 2e 37 36 3d 22 2b 62 2e 74 79 70 65 29 Data Ascii: S&&S[e]&&s.push(v[e]+"="+ge(S[e],_))}),e.vsStart?(s.push("1484="+(g[e.vsStart]\|\|2771)),e.vsChanged&&s.push("1484.719=1")):s.push("1484="+g.visible),b&&(b.redirectCount&&s.push("1384.1385="+b.redirectCount),1!==b.type&&2!==b.type\|\|s.push("770.76="+b.type)
2024-02-19 20:48:49 UTC	2912	IN	Data Raw: 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 39 35 25 3b 0a 20 20 20 20 0a 7d 0a 2e 6c 61 79 6f 75 74 2d 77 61 72 6e 69 6e 67 5f 5f 73 75 62 2d 74 69 74 6c 65 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 38 70 78 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 35 29 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 30 70 78 3b 0a 7d 0a 2e 6c 61 79 6f 75 74 2d 77 61 72 6e 69 6e 67 5f 5f 74 69 74 6c 65 20 7b 0a 20 20 20 20 66 Data Ascii: left: 50%; top: 50%; position: absolute; max-width: 95%; }.layout-warning__sub-title { margin: 0 0 8px; color: rgba(0, 0, 0, 0.5); font-weight: 400; font-size: 15px; line-height: 20px;}.layout-warning__title { f
2024-02-19 20:48:50 UTC	2492	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 2e 6c 6f 63 61 6c 5f 77 72 61 70 70 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 67 2d 72 6f 6f 74 5f 74 68 65 6d 65 5f 64 61 72 6b 20 2e 6c 6f 63 61 6c 5f 77 72 61 70 70 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c Data Ascii: .local_wrapper { width: 100%; height: 100%; display: flex; align-items: center; justify-content: center; } .g-root_theme_dark .local_wrapper { background-col

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:50 UTC	388	OUT	GET /s3/cloud/forms/static/freeze/i18n/en.92fb2885.js HTTP/1.1 Host: yastatic.net Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:48:51 UTC	775	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 19 Feb 2024 20:48:51 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 8788 Connection: close Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: immutable, max-age=31536000 Etag: "342bea2d263253f03f9ec943820448da" Expires: Tue, 18 Feb 2025 20:48:51 GMT Last-Modified: Fri, 02 Feb 2024 14:06:53 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=31536000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Robots-Tag: noindex, noarchive, nofollow
2024-02-19 20:48:51 UTC	8788	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 28 72 6f 6f 74 2c 20 66 61 63 74 6f 72 79 29 20 7b 0a 20 20 20 20 69 66 20 28 74 79 70 65 6f 66 20 64 65 66 69 6e 65 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 20 26 26 20 64 65 66 69 6e 65 2e 61 6d 64 29 20 7b 0a 20 20 20 20 20 20 20 20 64 65 66 69 6e 65 28 5b 5d 2c 20 66 61 63 74 6f 72 79 29 3b 0a 20 20 20 20 7d 20 65 6c 73 65 20 69 66 20 28 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 20 3d 3d 3d 20 27 6f 62 6a 65 63 74 27 29 20 7b 0a 20 20 20 20 20 20 20 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 20 3d 20 66 61 63 74 6f 72 79 28 29 3b 0a 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 72 6f 6f 74 2e 59 43 5f 49 31 38 4e 20 3d 20 66 61 63 74 6f 72 79 28 29 3b 0a 20 20 7d 0a 7d 28 74 79 70 65 6f 66 20 73 65 Data Ascii: (function (root, factory) { if (typeof define === 'function' && define.amd) { define([], factory); } else if (typeof exports === 'object') { module.exports = factory(); } else { root.YC_I18N = factory(); }}(typeof se

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:50 UTC	425	OUT	GET /s3/cloud/forms/static/freeze/js/runtime.ca06ac31.js HTTP/1.1 Host: yastatic.net Origin: https://forms.yandex.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:48:51 UTC	760	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 19 Feb 2024 20:48:51 GMT Content-Type: application/javascript Content-Length: 2369 Connection: close Access-Control-Allow-Origin: * Cache-Control: immutable, max-age=31536000 Etag: "7ba29ac322255719bc377cbec1039b49" Expires: Tue, 18 Feb 2025 20:48:51 GMT Last-Modified: Tue, 29 Aug 2023 14:20:54 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=31536000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Robots-Tag: noindex, noarchive, nofollow Accept-Ranges: bytes
2024-02-19 20:48:51 UTC	2369	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 72 2c 74 2c 6f 3d 7b 7d 2c 6e 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 76 61 72 20 72 3d 6e 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 29 72 65 74 75 72 6e 20 72 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 6e 5b 65 5d 3d 7b 69 64 3a 65 2c 6c 6f 61 64 65 64 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 6f 5b 65 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 69 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 69 2e 6d 3d 6f 2c 65 3d 5b 5d 2c 69 2e 4f 3d 28 72 2c 74 2c 6f 2c 6e 29 3d 3e 7b 69 66 28 21 74 29 7b 76 61 72 20 61 3d 31 2f 30 3b 66 6f 72 28 75 3d 30 3b 75 3c 65 2e 6c Data Ascii: (()=>{"use strict";var e,r,t,o={},n={};function i(e){var r=n[e];if(void 0!==r)return r.exports;var t=n[e]={id:e,loaded:!1,exports:{}};return o[e].call(t.exports,t,t.exports,i),t.loaded=!0,t.exports}i.m=o,e=[],i.O=(r,t,o,n)=>{if(!t){var a=1/0;for(u=0;u<e.l

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:51 UTC	423	OUT	GET /s3/cloud/forms/static/freeze/js/index.a79d0d51.js HTTP/1.1 Host: yastatic.net Origin: https://forms.yandex.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:48:51 UTC	777	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 19 Feb 2024 20:48:51 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 812578 Connection: close Access-Control-Allow-Origin: * Cache-Control: immutable, max-age=31536000 Etag: "126f00f34bf9d6cc25274a083f33bc0e" Expires: Tue, 18 Feb 2025 20:48:51 GMT Last-Modified: Wed, 07 Feb 2024 08:32:13 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=31536000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Robots-Tag: noindex, noarchive, nofollow Accept-Ranges: bytes
2024-02-19 20:48:51 UTC	15607	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 69 6e 64 65 78 2e 61 37 39 64 30 64 35 31 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 66 6f 72 6d 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 66 6f 72 6d 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 32 36 5d 2c 7b 37 38 35 33 3a 28 65 2c 74 2c 72 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 7b 7d 3b 72 2e 72 28 6e 29 2c 72 2e 64 28 6e 2c 7b 73 65 74 45 72 72 6f 72 3a 28 29 3d 3e 44 6c 2c 73 65 74 54 68 65 6d 65 3a 28 29 3d 3e 6e 63 7d 29 3b 76 61 72 20 6f 3d 7b 7d 3b 72 2e 72 28 6f 29 2c 72 2e 64 28 6f 2c 7b 70 72 65 70 61 72 65 49 6e 74 Data Ascii: /! For license information please see index.a79d0d51.js.LICENSE.txt /(self.webpackChunkforms=self.webpackChunkforms\|\|[]).push([[826],{7853:(e,t,r)=>{"use strict";var n={};r.r(n),r.d(n,{setError:()=>Dl,setTheme:()=>nc});var o={};r.r(o),r.d(o,{prepareInt
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 65 72 2c 7b 63 68 69 6c 64 72 65 6e 3a 72 2c 76 61 6c 75 65 3a 6d 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6b 65 28 65 29 7b 6c 65 74 7b 63 68 69 6c 64 72 65 6e 3a 74 2c 6c 6f 63 61 74 69 6f 6e 3a 72 7d 3d 65 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 68 65 28 65 2c 74 29 7d 28 43 65 28 74 29 2c 72 29 7d 64 2e 73 74 61 72 74 54 72 61 6e 73 69 74 69 6f 6e 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 28 29 3d 3e 7b 7d 29 29 3b 63 6c 61 73 73 20 53 65 20 65 78 74 65 6e 64 73 20 75 2e 43 6f 6d 70 6f 6e 65 6e 74 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 73 75 70 65 72 28 65 29 2c 74 68 69 73 2e 73 74 61 74 65 3d 7b 65 72 72 6f 72 3a 6e 75 6c 6c 7d 7d 73 74 61 74 69 63 20 67 65 74 44 65 72 69 76 65 64 53 74 61 74 65 Data Ascii: er,{children:r,value:m}))}function ke(e){let{children:t,location:r}=e;return function(e,t){return he(e,t)}(Ce(t),r)}d.startTransition,new Promise((()=>{}));class Se extends u.Component{constructor(e){super(e),this.state={error:null}}static getDerivedState
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 2e 5a 29 28 7b 7d 2c 71 74 2e 45 6d 70 74 79 2c 7b 76 32 3a 21 30 7d 29 29 2c 28 30 2c 56 74 2e 5a 29 28 77 74 2c 4a 74 2e 50 72 6f 6a 65 63 74 2c 28 30 2c 56 74 2e 5a 29 28 7b 7d 2c 71 74 2e 45 6d 70 74 79 2c 7b 76 32 3a 21 30 7d 29 29 2c 28 30 2c 56 74 2e 5a 29 28 77 74 2c 4a 74 2e 47 65 6e 65 72 69 63 2c 7b 7d 29 2c 77 74 29 29 2c 28 30 2c 56 74 2e 5a 29 28 55 74 2c 48 74 2e 44 6e 73 2c 28 5f 74 3d 7b 7d 2c 28 30 2c 56 74 2e 5a 29 28 5f 74 2c 58 74 2e 52 65 63 6f 72 64 73 2c 28 78 74 3d 7b 7d 2c 28 30 2c 56 74 2e 5a 29 28 78 74 2c 71 74 2e 45 6d 70 74 79 2c 7b 76 31 3a 21 30 7d 29 2c 28 30 2c 56 74 2e 5a 29 28 78 74 2c 71 74 2e 4e 6f 53 65 61 72 63 68 52 65 73 75 6c 74 73 2c 7b 76 31 3a 21 30 7d 29 2c 78 74 29 29 2c 28 30 2c 56 74 2e 5a 29 28 5f 74 2c Data Ascii: .Z)({},qt.Empty,{v2:!0})),(0,Vt.Z)(wt,Jt.Project,(0,Vt.Z)({},qt.Empty,{v2:!0})),(0,Vt.Z)(wt,Jt.Generic,{}),wt)),(0,Vt.Z)(Ut,Ht.Dns,(_t={},(0,Vt.Z)(_t,Xt.Records,(xt={},(0,Vt.Z)(xt,qt.Empty,{v1:!0}),(0,Vt.Z)(xt,qt.NoSearchResults,{v1:!0}),xt)),(0,Vt.Z)(_t,
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 65 22 2c 65 2e 41 42 43 3d 22 61 62 63 5f 73 65 72 76 69 63 65 22 2c 65 7d 28 7b 7d 29 2c 6e 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 52 65 71 75 69 72 65 64 3d 22 72 65 71 75 69 72 65 64 22 2c 65 2e 4d 69 6e 3d 22 6d 69 6e 22 2c 65 2e 4d 61 78 3d 22 6d 61 78 22 2c 65 2e 53 69 7a 65 3d 22 73 69 7a 65 22 2c 65 2e 43 6f 75 6e 74 3d 22 63 6f 75 6e 74 22 2c 65 2e 44 65 63 69 6d 61 6c 3d 22 64 65 63 69 6d 61 6c 22 2c 65 2e 45 6d 61 69 6c 3d 22 65 6d 61 69 6c 22 2c 65 2e 55 52 4c 3d 22 75 72 6c 22 2c 65 2e 50 68 6f 6e 65 3d 22 70 68 6f 6e 65 22 2c 65 2e 49 4e 4e 3d 22 69 6e 6e 22 2c 65 2e 52 75 73 73 69 61 6e 3d 22 72 75 73 73 69 61 6e 22 2c 65 2e 52 65 67 45 78 70 3d 22 72 65 67 65 78 70 22 2c 65 7d 28 7b 7d 29 2c 6f 6e 3d 66 75 6e Data Ascii: e",e.ABC="abc_service",e}({}),nn=function(e){return e.Required="required",e.Min="min",e.Max="max",e.Size="size",e.Count="count",e.Decimal="decimal",e.Email="email",e.URL="url",e.Phone="phone",e.INN="inn",e.Russian="russian",e.RegExp="regexp",e}({}),on=fun
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 6e 5b 22 68 74 6d 6c 22 2c 22 62 6f 64 79 22 2c 22 23 64 6f 63 75 6d 65 6e 74 22 5d 2e 69 6e 64 65 78 4f 66 28 4f 6f 28 65 29 29 3e 3d 30 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3a 79 6f 28 65 29 26 26 50 6f 28 65 29 3f 65 3a 54 6f 28 41 6f 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 24 6f 28 65 2c 74 29 7b 76 61 72 20 72 3b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 5b 5d 29 3b 76 61 72 20 6e 3d 54 6f 28 65 29 2c 6f 3d 6e 3d 3d 3d 28 6e 75 6c 6c 3d 3d 28 72 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 29 3f 76 6f 69 64 20 30 3a 72 2e 62 6f 64 79 29 2c 61 3d 76 6f 28 6e 29 2c 69 3d 6f 3f 5b 61 5d 2e 63 6f 6e 63 61 74 28 61 2e 76 69 73 75 61 6c 56 69 65 77 70 6f 72 74 7c 7c 5b 5d 2c 50 6f 28 6e 29 3f 6e 3a 5b 5d 29 3a 6e 2c 73 3d Data Ascii: n["html","body","#document"].indexOf(Oo(e))>=0?e.ownerDocument.body:yo(e)&&Po(e)?e:To(Ao(e))}function $o(e,t){var r;void 0===t&&(t=[]);var n=To(e),o=n===(null==(r=e.ownerDocument)?void 0:r.body),a=vo(n),i=o?[a].concat(a.visualViewport\|\|[],Po(n)?n:[]):n,s=
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 72 2e 75 70 64 61 74 65 2c 6e 61 29 7d 7d 2c 64 61 74 61 3a 7b 7d 7d 2c 6c 61 2c 7b 6e 61 6d 65 3a 22 63 6f 6d 70 75 74 65 53 74 79 6c 65 73 22 2c 65 6e 61 62 6c 65 64 3a 21 30 2c 70 68 61 73 65 3a 22 62 65 66 6f 72 65 57 72 69 74 65 22 2c 66 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 73 74 61 74 65 2c 72 3d 65 2e 6f 70 74 69 6f 6e 73 2c 6e 3d 72 2e 67 70 75 41 63 63 65 6c 65 72 61 74 69 6f 6e 2c 6f 3d 76 6f 69 64 20 30 3d 3d 3d 6e 7c 7c 6e 2c 61 3d 72 2e 61 64 61 70 74 69 76 65 2c 69 3d 76 6f 69 64 20 30 3d 3d 3d 61 7c 7c 61 2c 73 3d 72 2e 72 6f 75 6e 64 4f 66 66 73 65 74 73 2c 6c 3d 76 6f 69 64 20 30 3d 3d 3d 73 7c 7c 73 2c 63 3d 7b 70 6c 61 63 65 6d 65 6e 74 3a 6f 61 28 74 2e 70 6c 61 63 65 Data Ascii: ner("resize",r.update,na)}},data:{}},la,{name:"computeStyles",enabled:!0,phase:"beforeWrite",fn:function(e){var t=e.state,r=e.options,n=r.gpuAcceleration,o=void 0===n\|\|n,a=r.adaptive,i=void 0===a\|\|a,s=r.roundOffsets,l=void 0===s\|\|s,c={placement:oa(t.place
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 22 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 22 69 6e 20 77 69 6e 64 6f 77 3f 6e 65 77 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 6f 6d 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 66 72 6f 6d 28 65 2e 72 65 6d 6f 76 65 64 4e 6f 64 65 73 29 2e 73 6f 6d 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 69 2e 6d 6f 73 74 52 65 63 65 6e 74 6c 79 46 6f 63 75 73 65 64 4e 6f 64 65 7d 29 29 7d 29 29 26 26 66 28 75 28 29 29 7d 29 29 3a 76 6f 69 64 20 30 2c 45 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 78 26 26 28 78 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 2c 69 2e 61 63 74 69 76 65 26 Data Ascii: d"!=typeof window&&"MutationObserver"in window?new MutationObserver((function(e){e.some((function(e){return Array.from(e.removedNodes).some((function(e){return e===i.mostRecentlyFocusedNode}))}))&&f(u())})):void 0,E=function(){x&&(x.disconnect(),i.active&
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 3a 6a 7d 2c 75 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 24 69 2c 7b 63 6c 6f 73 65 54 6f 6f 6c 74 69 70 3a 57 2c 6f 70 65 6e 54 6f 6f 6c 74 69 70 3a 71 2c 6f 70 65 6e 3a 55 2c 6f 70 65 6e 4f 6e 48 6f 76 65 72 3a 6e 2c 63 6c 61 73 73 4e 61 6d 65 3a 4e 69 28 22 68 61 6e 64 6c 65 72 22 29 2c 64 69 73 61 62 6c 65 64 3a 74 2c 6f 6e 43 6c 69 63 6b 3a 49 2c 63 6c 6f 73 65 64 4d 61 6e 75 61 6c 6c 79 3a 7a 7d 2c 79 29 2c 4a 29 7d 29 29 3b 42 69 2e 64 69 73 70 6c 61 79 4e 61 6d 65 3d 22 50 6f 70 6f 76 65 72 22 3b 63 6f 6e 73 74 20 7a 69 3d 2f 7b 7b 28 2e 2a 3f 29 7d 7d 2f 67 3b 76 61 72 20 5a 69 3b 66 75 6e 63 74 69 6f 6e 20 55 69 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 30 3d 3d 3d 65 3f 74 2e 4e 6f 6e 65 3a 31 3d 3d 3d 65 7c 7c 2d 31 3d 3d 3d 65 3f 74 2e 4f 6e Data Ascii: :j},u.createElement($i,{closeTooltip:W,openTooltip:q,open:U,openOnHover:n,className:Ni("handler"),disabled:t,onClick:I,closedManually:z},y),J)}));Bi.displayName="Popover";const zi=/{{(.*?)}}/g;var Zi;function Ui(e,t){return 0===e?t.None:1===e\|\|-1===e?t.On
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 29 2e 6c 61 73 74 52 65 71 75 65 73 74 54 69 6d 65 3d 44 61 74 65 2e 6e 6f 77 28 29 2c 65 29 29 29 2c 6e 3d 65 2e 69 6e 74 65 72 63 65 70 74 6f 72 73 2e 72 65 73 70 6f 6e 73 65 2e 75 73 65 28 6e 75 6c 6c 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 54 73 28 28 66 75 6e 63 74 69 6f 6e 2a 28 72 29 7b 76 61 72 7b 63 6f 6e 66 69 67 3a 6e 7d 3d 72 3b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 72 65 6a 65 63 74 28 72 29 3b 76 61 72 7b 72 65 74 72 69 65 73 3a 6f 3d 33 2c 72 65 74 72 79 43 6f 6e 64 69 74 69 6f 6e 3a 61 3d 71 73 2c 72 65 74 72 79 44 65 6c 61 79 3a 69 3d 48 73 2c 73 68 6f 75 6c 64 52 65 73 65 74 54 69 6d 65 6f 75 74 3a 73 3d 21 31 2c 6f 6e 52 65 74 72 79 3a 6c 3d 28 28 29 3d 3e 7b 7d 29 7d 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ).lastRequestTime=Date.now(),e))),n=e.interceptors.response.use(null,function(){var r=Ts((function*(r){var{config:n}=r;if(!n)return Promise.reject(r);var{retries:o=3,retryCondition:a=qs,retryDelay:i=Hs,shouldResetTimeout:s=!1,onRetry:l=(()=>{})}=function(
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 3f 22 66 75 6e 63 74 69 6f 6e 20 22 2b 28 65 2e 6e 61 6d 65 7c 7c 22 75 6e 6e 61 6d 65 64 22 29 2b 22 28 29 22 3a 74 79 70 65 6f 66 20 65 7d 29 29 2e 6a 6f 69 6e 28 22 2c 20 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 63 72 65 61 74 65 53 65 6c 65 63 74 6f 72 20 65 78 70 65 63 74 73 20 61 6c 6c 20 69 6e 70 75 74 2d 73 65 6c 65 63 74 6f 72 73 20 74 6f 20 62 65 20 66 75 6e 63 74 69 6f 6e 73 2c 20 62 75 74 20 72 65 63 65 69 76 65 64 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 74 79 70 65 73 3a 20 5b 22 2b 72 2b 22 5d 22 29 7d 72 65 74 75 72 6e 20 74 7d 28 6e 29 2c 70 3d 65 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 Data Ascii: return"function"==typeof e?"function "+(e.name\|\|"unnamed")+"()":typeof e})).join(", ");throw new Error("createSelector expects all input-selectors to be functions, but received the following types: ["+r+"]")}return t}(n),p=e.apply(void 0,[function(){retur

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:51 UTC	425	OUT	GET /s3/cloud/forms/static/freeze/js/vendors.13027535.js HTTP/1.1 Host: yastatic.net Origin: https://forms.yandex.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:48:51 UTC	777	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 19 Feb 2024 20:48:51 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 225270 Connection: close Access-Control-Allow-Origin: * Cache-Control: immutable, max-age=31536000 Etag: "a0f5ad2e69150aff2ac8f5b3040f680d" Expires: Tue, 18 Feb 2025 20:48:51 GMT Last-Modified: Mon, 04 Dec 2023 07:47:57 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=31536000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Robots-Tag: noindex, noarchive, nofollow Accept-Ranges: bytes
2024-02-19 20:48:51 UTC	15607	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 31 33 30 32 37 35 33 35 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 66 6f 72 6d 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 66 6f 72 6d 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 31 36 5d 2c 7b 37 32 38 31 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 50 48 3a 28 29 3d 3e 5f 2c 68 67 3a 28 29 3d 3e 7a 2c 6f 4d 3a 28 29 3d 3e 43 2c 78 43 3a 28 29 3d 3e 45 7d 29 3b 76 61 72 20 72 2c 6f 3d 6e 28 34 38 32 29 2c 61 3d 6e 28 37 36 37 30 29 2c 69 3d 6e 28 36 34 34 31 29 2c 6c 3d 28 72 3d 66 75 6e Data Ascii: /! For license information please see vendors.13027535.js.LICENSE.txt /(self.webpackChunkforms=self.webpackChunkforms\|\|[]).push([[216],{7281:(e,t,n)=>{"use strict";n.d(t,{PH:()=>_,hg:()=>z,oM:()=>C,xC:()=>E});var r,o=n(482),a=n(7670),i=n(6441),l=(r=fun
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 66 6f 72 28 76 61 72 20 6f 3d 65 2e 6c 65 6e 67 74 68 2c 61 3d 6e 2b 28 72 3f 31 3a 2d 31 29 3b 72 3f 61 2d 2d 3a 2b 2b 61 3c 6f 3b 29 69 66 28 74 28 65 5b 61 5d 2c 61 2c 65 29 29 72 65 74 75 72 6e 20 61 3b 72 65 74 75 72 6e 2d 31 7d 7d 2c 32 31 35 33 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 76 61 72 20 72 3d 6e 28 32 38 32 34 29 2c 6f 3d 6e 28 36 36 34 38 29 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 2c 61 2c 69 2c 6c 29 7b 76 61 72 20 75 3d 2d 31 2c 73 3d 74 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 61 7c 7c 28 61 3d 6f 29 2c 6c 7c 7c 28 6c 3d 5b 5d 29 3b 2b 2b 75 3c 73 3b 29 7b 76 61 72 20 63 3d 74 5b 75 5d 3b 6e 3e 30 26 26 61 28 63 29 3f 6e 3e 31 3f 65 28 63 2c 6e 2d 31 2c 61 2c 69 2c 6c 29 Data Ascii: tion(e,t,n,r){for(var o=e.length,a=n+(r?1:-1);r?a--:++a<o;)if(t(e[a],a,e))return a;return-1}},2153:(e,t,n)=>{var r=n(2824),o=n(6648);e.exports=function e(t,n,a,i,l){var u=-1,s=t.length;for(a\|\|(a=o),l\|\|(l=[]);++u<s;){var c=t[u];n>0&&a(c)?n>1?e(c,n-1,a,i,l)
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 31 36 41 72 72 61 79 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 49 6e 74 33 32 41 72 72 61 79 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 55 69 6e 74 38 41 72 72 61 79 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 55 69 6e 74 31 36 41 72 72 61 79 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 55 69 6e 74 33 32 41 72 72 61 79 5d 22 3a 72 65 74 75 72 6e 20 6c 28 65 2c 6e 29 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 4d 61 70 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 53 65 74 5d 22 3a 72 65 74 75 72 6e 20 6e 65 77 20 75 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 4e 75 6d 62 65 72 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 53 74 72 69 6e 67 Data Ascii: 16Array]":case"[object Int32Array]":case"[object Uint8Array]":case"[object Uint8ClampedArray]":case"[object Uint16Array]":case"[object Uint32Array]":return l(e,n);case"[object Map]":case"[object Set]":return new u;case"[object Number]":case"[object String
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 69 2e 43 6f 6e 73 75 6d 65 72 2c 6e 75 6c 6c 29 29 3f 69 3a 41 7d 29 2c 5b 69 2c 41 5d 29 2c 68 3d 28 30 2c 72 2e 75 73 65 43 6f 6e 74 65 78 74 29 28 70 29 2c 6d 3d 42 6f 6f 6c 65 61 6e 28 6e 2e 73 74 6f 72 65 29 26 26 42 6f 6f 6c 65 61 6e 28 6e 2e 73 74 6f 72 65 2e 67 65 74 53 74 61 74 65 29 26 26 42 6f 6f 6c 65 61 6e 28 6e 2e 73 74 6f 72 65 2e 64 69 73 70 61 74 63 68 29 3b 42 6f 6f 6c 65 61 6e 28 68 29 26 26 42 6f 6f 6c 65 61 6e 28 68 2e 73 74 6f 72 65 29 3b 76 61 72 20 5f 3d 6d 3f 6e 2e 73 74 6f 72 65 3a 68 2e 73 74 6f 72 65 2c 43 3d 28 30 2c 72 2e 75 73 65 4d 65 6d 6f 29 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 28 74 2e 64 69 73 70 61 74 63 68 2c 61 29 7d 28 5f 29 7d 29 2c Data Ascii: i.Consumer,null))?i:A}),[i,A]),h=(0,r.useContext)(p),m=Boolean(n.store)&&Boolean(n.store.getState)&&Boolean(n.store.dispatch);Boolean(h)&&Boolean(h.store);var _=m?n.store:h.store,C=(0,r.useMemo)((function(){return function(t){return e(t.dispatch,a)}(_)}),
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 3c 6e 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 22 24 22 2b 6e 5b 6f 5d 5d 3d 21 30 3b 66 6f 72 28 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 6f 3d 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 24 22 2b 65 5b 6e 5d 2e 76 61 6c 75 65 29 2c 65 5b 6e 5d 2e 73 65 6c 65 63 74 65 64 21 3d 3d 6f 26 26 28 65 5b 6e 5d 2e 73 65 6c 65 63 74 65 64 3d 6f 29 2c 6f 26 26 72 26 26 28 65 5b 6e 5d 2e 64 65 66 61 75 6c 74 53 65 6c 65 63 74 65 64 3d 21 30 29 7d 65 6c 73 65 7b 66 6f 72 28 6e 3d 22 22 2b 57 28 6e 29 2c 74 3d 6e 75 6c 6c 2c 6f 3d 30 3b 6f 3c 65 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 7b 69 66 28 65 5b 6f 5d 2e 76 61 6c 75 65 3d 3d 3d 6e 29 72 65 74 75 72 6e 20 65 5b 6f 5d 2e 73 65 6c 65 63 74 65 64 3d 21 30 2c 76 6f 69 64 28 72 26 26 28 65 5b Data Ascii: <n.length;o++)t["$"+n[o]]=!0;for(n=0;n<e.length;n++)o=t.hasOwnProperty("$"+e[n].value),e[n].selected!==o&&(e[n].selected=o),o&&r&&(e[n].defaultSelected=!0)}else{for(n=""+W(n),t=null,o=0;o<e.length;o++){if(e[o].value===n)return e[o].selected=!0,void(r&&(e[
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 31 34 35 3a 22 53 63 72 6f 6c 6c 4c 6f 63 6b 22 2c 32 32 34 3a 22 4d 65 74 61 22 7d 2c 6b 6e 3d 7b 41 6c 74 3a 22 61 6c 74 4b 65 79 22 2c 43 6f 6e 74 72 6f 6c 3a 22 63 74 72 6c 4b 65 79 22 2c 4d 65 74 61 3a 22 6d 65 74 61 4b 65 79 22 2c 53 68 69 66 74 3a 22 73 68 69 66 74 4b 65 79 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 45 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6e 61 74 69 76 65 45 76 65 6e 74 3b 72 65 74 75 72 6e 20 74 2e 67 65 74 4d 6f 64 69 66 69 65 72 53 74 61 74 65 3f 74 2e 67 65 74 4d 6f 64 69 66 69 65 72 53 74 61 74 65 28 65 29 3a 21 21 28 65 3d 6b 6e 5b 65 5d 29 26 26 21 21 74 5b 65 5d 7d 66 75 6e 63 74 69 6f 6e 20 5f 6e 28 29 7b 72 65 74 75 72 6e 20 45 6e 7d 76 61 72 20 4f 6e 3d 46 28 7b 7d 2c 66 6e 2c 7b 6b 65 79 3a 66 75 6e 63 74 69 6f 6e Data Ascii: 145:"ScrollLock",224:"Meta"},kn={Alt:"altKey",Control:"ctrlKey",Meta:"metaKey",Shift:"shiftKey"};function En(e){var t=this.nativeEvent;return t.getModifierState?t.getModifierState(e):!!(e=kn[e])&&!!t[e]}function _n(){return En}var On=F({},fn,{key:function
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 3d 3d 6e 26 26 22 24 3f 22 21 3d 3d 6e 26 26 22 24 21 22 21 3d 3d 6e 7c 7c 72 2b 2b 3b 6e 3d 6f 7d 77 68 69 6c 65 28 6e 29 3b 56 74 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 73 6f 28 65 29 7b 66 6f 72 28 3b 6e 75 6c 6c 21 3d 65 3b 65 3d 65 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 7b 76 61 72 20 74 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 31 3d 3d 3d 74 7c 7c 33 3d 3d 3d 74 29 62 72 65 61 6b 3b 69 66 28 38 3d 3d 3d 74 29 7b 69 66 28 22 24 22 3d 3d 3d 28 74 3d 65 2e 64 61 74 61 29 7c 7c 22 24 21 22 3d 3d 3d 74 7c 7c 22 24 3f 22 3d 3d 3d 74 29 62 72 65 61 6b 3b 69 66 28 22 2f 24 22 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 63 6f 28 65 29 7b 65 3d 65 2e 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e Data Ascii: ==n&&"$?"!==n&&"$!"!==n\|\|r++;n=o}while(n);Vt(t)}function so(e){for(;null!=e;e=e.nextSibling){var t=e.nodeType;if(1===t\|\|3===t)break;if(8===t){if("$"===(t=e.data)\|\|"$!"===t\|\|"$?"===t)break;if("/$"===t)return null}}return e}function co(e){e=e.previousSiblin
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 72 2e 6d 6f 64 65 2c 75 2c 69 2e 6b 65 79 29 29 2e 72 65 74 75 72 6e 3d 72 2c 72 3d 61 29 3a 28 28 75 3d 4c 73 28 69 2e 74 79 70 65 2c 69 2e 6b 65 79 2c 69 2e 70 72 6f 70 73 2c 6e 75 6c 6c 2c 72 2e 6d 6f 64 65 2c 75 29 29 2e 72 65 66 3d 51 61 28 72 2c 61 2c 69 29 2c 75 2e 72 65 74 75 72 6e 3d 72 2c 72 3d 75 29 7d 72 65 74 75 72 6e 20 6c 28 72 29 3b 63 61 73 65 20 78 3a 65 3a 7b 66 6f 72 28 63 3d 69 2e 6b 65 79 3b 6e 75 6c 6c 21 3d 3d 61 3b 29 7b 69 66 28 61 2e 6b 65 79 3d 3d 3d 63 29 7b 69 66 28 34 3d 3d 3d 61 2e 74 61 67 26 26 61 2e 73 74 61 74 65 4e 6f 64 65 2e 63 6f 6e 74 61 69 6e 65 72 49 6e 66 6f 3d 3d 3d 69 2e 63 6f 6e 74 61 69 6e 65 72 49 6e 66 6f 26 26 61 2e 73 74 61 74 65 4e 6f 64 65 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 3d 3d 3d 69 2e 69 Data Ascii: r.mode,u,i.key)).return=r,r=a):((u=Ls(i.type,i.key,i.props,null,r.mode,u)).ref=Qa(r,a,i),u.return=r,r=u)}return l(r);case x:e:{for(c=i.key;null!==a;){if(a.key===c){if(4===a.tag&&a.stateNode.containerInfo===i.containerInfo&&a.stateNode.implementation===i.i
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 2e 63 6f 6e 74 65 78 74 3d 75 2c 72 3d 73 29 3a 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 69 2e 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 55 70 64 61 74 65 7c 7c 6c 3d 3d 3d 65 2e 6d 65 6d 6f 69 7a 65 64 50 72 6f 70 73 26 26 64 3d 3d 3d 65 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 7c 7c 28 74 2e 66 6c 61 67 73 7c 3d 34 29 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 53 6e 61 70 73 68 6f 74 42 65 66 6f 72 65 55 70 64 61 74 65 7c 7c 6c 3d 3d 3d 65 2e 6d 65 6d 6f 69 7a 65 64 50 72 6f 70 73 26 26 64 3d 3d 3d 65 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 7c 7c 28 74 2e 66 6c 61 67 73 7c 3d 31 30 32 34 29 2c 72 3d 21 31 29 7d 72 65 74 75 72 6e 20 4e 6c 28 65 2c 74 2c 6e 2c 72 2c 61 2c 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: .context=u,r=s):("function"!=typeof i.componentDidUpdate\|\|l===e.memoizedProps&&d===e.memoizedState\|\|(t.flags\|=4),"function"!=typeof i.getSnapshotBeforeUpdate\|\|l===e.memoizedProps&&d===e.memoizedState\|\|(t.flags\|=1024),r=!1)}return Nl(e,t,n,r,a,o)}function
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 6e 75 6c 6c 21 3d 3d 74 26 26 28 65 2e 61 6c 74 65 72 6e 61 74 65 3d 6e 75 6c 6c 2c 69 75 28 74 29 29 2c 65 2e 63 68 69 6c 64 3d 6e 75 6c 6c 2c 65 2e 64 65 6c 65 74 69 6f 6e 73 3d 6e 75 6c 6c 2c 65 2e 73 69 62 6c 69 6e 67 3d 6e 75 6c 6c 2c 35 3d 3d 3d 65 2e 74 61 67 26 26 6e 75 6c 6c 21 3d 3d 28 74 3d 65 2e 73 74 61 74 65 4e 6f 64 65 29 26 26 28 64 65 6c 65 74 65 20 74 5b 70 6f 5d 2c 64 65 6c 65 74 65 20 74 5b 68 6f 5d 2c 64 65 6c 65 74 65 20 74 5b 6d 6f 5d 2c 64 65 6c 65 74 65 20 74 5b 79 6f 5d 2c 64 65 6c 65 74 65 20 74 5b 67 6f 5d 29 2c 65 2e 73 74 61 74 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 65 2e 72 65 74 75 72 6e 3d 6e 75 6c 6c 2c 65 2e 64 65 70 65 6e 64 65 6e 63 69 65 73 3d 6e 75 6c 6c 2c 65 2e 6d 65 6d 6f 69 7a 65 64 50 72 6f 70 73 3d 6e 75 6c 6c 2c 65 Data Ascii: null!==t&&(e.alternate=null,iu(t)),e.child=null,e.deletions=null,e.sibling=null,5===e.tag&&null!==(t=e.stateNode)&&(delete t[po],delete t[ho],delete t[mo],delete t[yo],delete t[go]),e.stateNode=null,e.return=null,e.dependencies=null,e.memoizedProps=null,e

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:51 UTC	406	OUT	GET /s3/cloud/forms/static/freeze/css/index.047651d7.css HTTP/1.1 Host: yastatic.net Connection: keep-alive Accept: text/css,/;q=0.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:48:52 UTC	763	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 19 Feb 2024 20:48:51 GMT Content-Type: text/css; charset=utf-8 Content-Length: 286792 Connection: close Access-Control-Allow-Origin: * Cache-Control: immutable, max-age=31536000 Etag: "499b1ca9638c77a0106ab850975d4758" Expires: Tue, 18 Feb 2025 20:48:51 GMT Last-Modified: Wed, 07 Feb 2024 08:32:13 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=31536000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Robots-Tag: noindex, noarchive, nofollow Accept-Ranges: bytes
2024-02-19 20:48:52 UTC	15621	IN	Data Raw: 2e 63 63 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2d 63 6f 6e 74 61 69 6e 65 72 7b 2d 2d 63 63 2d 70 63 2d 70 61 64 64 69 6e 67 3a 34 30 70 78 3b 2d 2d 63 63 2d 70 63 2d 68 74 6d 6c 2d 6d 61 78 2d 77 69 64 74 68 3a 36 30 30 70 78 3b 2d 2d 63 63 2d 70 63 2d 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 2d 6d 61 72 67 69 6e 3a 34 30 70 78 3b 2d 2d 63 63 2d 70 63 2d 69 6d 61 67 65 2d 73 6d 61 6c 6c 2d 73 69 7a 65 3a 31 30 30 70 78 3b 2d 2d 63 63 2d 70 63 2d 69 6d 61 67 65 2d 6d 65 64 69 75 6d 2d 73 69 7a 65 3a 31 35 30 70 78 3b 2d 2d 63 63 2d 70 63 2d 69 6d 61 67 65 2d 6c 61 72 67 65 2d 73 69 7a 65 3a 32 33 30 70 78 3b 2d 2d 63 63 2d 70 63 2d 69 6d 61 67 65 2d 70 72 6f 6d 6f 2d 73 69 7a 65 3a 32 30 30 70 78 3b 2d 2d 63 63 2d 70 63 2d 63 6f 6c 75 6d 6e 2d 63 6f 6e 74 65 6e Data Ascii: .cc-placeholder-container{--cc-pc-padding:40px;--cc-pc-html-max-width:600px;--cc-pc-content-left-margin:40px;--cc-pc-image-small-size:100px;--cc-pc-image-medium-size:150px;--cc-pc-image-large-size:230px;--cc-pc-image-promo-size:200px;--cc-pc-column-conten
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 73 61 62 6c 65 64 3a 6e 6f 74 28 2e 79 63 2d 62 75 74 74 6f 6e 5f 6c 6f 61 64 69 6e 67 29 7b 2d 2d 79 63 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 2d 2d 79 63 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 68 6f 76 65 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 2d 63 6f 6c 6f 72 2d 74 65 78 74 2d 6c 69 67 68 74 2d 68 69 6e 74 29 7d 2e 79 63 2d 62 75 74 74 6f 6e 5f 76 69 65 77 5f 6e 6f 72 6d 61 6c 2d 63 6f 6e 74 72 61 73 74 2e 79 63 2d 62 75 74 74 6f 6e 5f 64 69 73 61 62 6c 65 64 3a 6e 6f 74 28 2e 79 63 2d 62 75 74 74 6f 6e 5f 6c 6f 61 64 69 6e 67 29 2c 2e 79 63 2d 62 75 74 74 6f 6e 5f 76 69 65 77 5f 6e 6f 72 6d 61 6c 2d 63 Data Ascii: sabled:not(.yc-button_loading){--yc-button-background-color:transparent;--yc-button-background-color-hover:transparent;color:var(--g-color-text-light-hint)}.yc-button_view_normal-contrast.yc-button_disabled:not(.yc-button_loading),.yc-button_view_normal-c
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 30 20 38 70 78 7d 2e 79 63 2d 74 65 78 74 2d 69 6e 70 75 74 5f 73 69 7a 65 5f 6d 2e 79 63 2d 74 65 78 74 2d 69 6e 70 75 74 5f 68 61 73 2d 6c 65 66 74 2d 63 6f 6e 74 65 6e 74 20 2e 79 63 2d 74 65 78 74 2d 69 6e 70 75 74 5f 5f 6c 61 62 65 6c 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 70 78 7d 2e 79 63 2d 74 65 78 74 2d 69 6e 70 75 74 5f 73 69 7a 65 5f 6d 20 2e 79 63 2d 74 65 78 74 2d 69 6e 70 75 74 5f 5f 61 64 64 69 74 69 6f 6e 61 6c 2d 63 6f 6e 74 65 6e 74 7b 68 65 69 67 68 74 3a 32 36 70 78 7d 2e 79 63 2d 74 65 78 74 2d 69 6e 70 75 74 5f 73 69 7a 65 5f 6d 20 2e 79 63 2d 74 65 78 74 2d 69 6e 70 75 74 5f 5f 61 64 64 69 74 69 6f 6e 61 6c 2d 63 6f 6e 74 65 6e 74 5f 70 6c 61 63 65 6d 65 6e 74 5f 6c 65 66 74 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 70 78 Data Ascii: 0 8px}.yc-text-input_size_m.yc-text-input_has-left-content .yc-text-input__label{padding-left:2px}.yc-text-input_size_m .yc-text-input__additional-content{height:26px}.yc-text-input_size_m .yc-text-input__additional-content_placement_left{padding-left:1px
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 65 72 5f 5f 64 65 73 63 72 69 70 74 69 6f 6e 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 2d 63 6f 6c 6f 72 2d 74 65 78 74 2d 73 65 63 6f 6e 64 61 72 79 29 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 79 63 2d 75 73 65 72 2d 64 72 6f 70 64 6f 77 6e 2d 61 76 61 74 61 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 79 63 2d 75 73 65 72 2d 64 72 6f 70 64 6f 77 6e 2d 61 76 61 74 61 72 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 79 63 2d 75 73 65 72 2d 64 72 6f 70 64 6f 77 6e 2d 61 76 61 74 61 72 3a 66 6f 63 75 73 20 2e 79 63 2d 75 73 65 72 2d 64 72 6f 70 64 6f 77 6e 2d 61 76 61 74 61 72 Data Ascii: er__description{color:var(--g-color-text-secondary);white-space:nowrap;text-overflow:ellipsis;overflow:hidden}.yc-user-dropdown-avatar{display:inline-block}.yc-user-dropdown-avatar:focus{outline:none}.yc-user-dropdown-avatar:focus .yc-user-dropdown-avatar
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 5f 74 68 65 6d 65 5f 73 75 63 63 65 73 73 2e 79 63 2d 63 61 72 64 5f 76 69 65 77 5f 6f 75 74 6c 69 6e 65 64 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 67 2d 63 6f 6c 6f 72 2d 6c 69 6e 65 2d 70 6f 73 69 74 69 76 65 29 7d 2e 79 63 2d 63 61 72 64 5f 74 79 70 65 5f 63 6f 6e 74 61 69 6e 65 72 2e 79 63 2d 63 61 72 64 5f 74 68 65 6d 65 5f 70 6f 73 69 74 69 76 65 2e 79 63 2d 63 61 72 64 5f 76 69 65 77 5f 66 69 6c 6c 65 64 2c 2e 79 63 2d 63 61 72 64 5f 74 79 70 65 5f 63 6f 6e 74 61 69 6e 65 72 2e 79 63 2d 63 61 72 64 5f 74 68 65 6d 65 5f 73 75 63 63 65 73 73 2e 79 63 2d 63 61 72 64 5f 76 69 65 77 5f 66 69 6c 6c 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 70 6f 73 Data Ascii: _theme_success.yc-card_view_outlined{border:1px solid var(--g-color-line-positive)}.yc-card_type_container.yc-card_theme_positive.yc-card_view_filled,.yc-card_type_container.yc-card_theme_success.yc-card_view_filled{background-color:var(--g-color-base-pos
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 70 61 63 65 2d 6c 29 7d 2e 41 6e 73 77 65 72 53 74 61 74 2d 50 65 72 63 65 6e 74 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 71 75 65 73 74 69 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 73 70 61 63 65 2d 6d 29 7d 2e 41 6e 73 77 65 72 53 74 61 74 2d 48 65 61 64 65 72 7b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 3b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 65 6e 64 3a 76 61 72 28 2d 2d 73 70 61 63 65 2d 78 73 29 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 2e 41 6e 73 77 65 72 53 74 61 74 2d 41 6e 73 77 65 72 7b 77 6f 72 64 2d 62 72 65 61 6b Data Ascii: pace-l)}.AnswerStat-Percent{color:var(--question-text-color);flex-shrink:0;margin-inline-start:var(--space-m)}.AnswerStat-Header{justify-content:space-between;align-items:flex-end;margin-block-end:var(--space-xs);display:flex}.AnswerStat-Answer{word-break
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 69 6f 6e 20 2e 44 72 6f 70 64 6f 77 6e 51 75 65 73 74 69 6f 6e 2d 43 6f 6e 74 72 6f 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 69 6e 70 75 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 67 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 2d 6c 29 3b 77 69 64 74 68 3a 33 36 30 70 78 7d 2e 44 72 6f 70 64 6f 77 6e 51 75 65 73 74 69 6f 6e 2d 4f 70 74 69 6f 6e 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 68 65 69 67 68 74 3a 33 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 44 72 6f 70 64 6f 77 6e 51 75 65 73 74 69 Data Ascii: ion .DropdownQuestion-Control{background-color:var(--input-background-color);border-radius:var(--g-border-radius-l);width:360px}.DropdownQuestion-Option{white-space:nowrap;text-overflow:ellipsis;height:32px;line-height:32px;overflow:hidden}.DropdownQuesti
2024-02-19 20:48:52 UTC	16384	IN	Data Raw: 61 63 63 65 6e 74 2d 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 77 69 64 74 68 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 67 2d 73 65 6c 65 63 74 2d 6c 69 73 74 5f 5f 69 74 65 6d 2e 79 63 2d 6c 69 73 74 5f 5f 69 74 65 6d 5f 73 65 6c 65 63 74 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 7d 2e 67 2d 73 65 6c 65 63 74 2d 6c 69 73 74 5f 5f 69 74 65 6d 2e 79 63 2d 6c 69 73 74 5f 5f 69 74 65 6d 5f 73 65 6c 65 63 74 65 64 3a 68 6f 76 65 72 2c 2e 67 2d 73 65 6c 65 63 74 2d 6c 69 73 74 5f 5f 69 74 65 6d 2e 79 63 2d 6c 69 73 74 5f 5f 69 74 65 6d 5f 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 67 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 73 69 6d 70 6c 65 2d 68 6f 76 65 72 29 7d 2e 67 2d 73 65 6c 65 63 74 2d 6c 69 73 Data Ascii: accent-font-weight);width:100%;overflow:hidden}.g-select-list__item.yc-list__item_selected{background:0 0}.g-select-list__item.yc-list__item_selected:hover,.g-select-list__item.yc-list__item_active{background:var(--g-color-base-simple-hover)}.g-select-lis
2024-02-19 20:48:53 UTC	16384	IN	Data Raw: 64 69 6e 67 3a 33 70 78 20 38 70 78 7d 2e 67 2d 74 65 78 74 2d 61 72 65 61 5f 73 69 7a 65 5f 73 2e 67 2d 74 65 78 74 2d 61 72 65 61 5f 68 61 73 2d 63 6c 65 61 72 20 2e 67 2d 74 65 78 74 2d 61 72 65 61 5f 5f 63 6f 6e 74 72 6f 6c 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 36 70 78 7d 2e 67 2d 74 65 78 74 2d 61 72 65 61 5f 73 69 7a 65 5f 6d 7b 2d 2d 5f 2d 2d 74 65 78 74 2d 61 72 65 61 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 67 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 2d 6d 29 7d 2e 67 2d 74 65 78 74 2d 61 72 65 61 5f 73 69 7a 65 5f 6d 20 2e 67 2d 74 65 78 74 2d 61 72 65 61 5f 5f 63 6f 6e 74 72 6f 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 67 2d 74 65 78 74 2d 62 6f 64 79 2d 73 68 6f 72 74 2d 66 6f 6e 74 2d 73 69 7a 65 Data Ascii: ding:3px 8px}.g-text-area_size_s.g-text-area_has-clear .g-text-area__control{padding-right:26px}.g-text-area_size_m{--_--text-area-border-radius:var(--g-border-radius-m)}.g-text-area_size_m .g-text-area__control{font-size:var(--g-text-body-short-font-size
2024-02-19 20:48:53 UTC	16384	IN	Data Raw: 63 6f 6c 6f 72 2d 62 61 73 65 2d 64 61 6e 67 65 72 2d 6c 69 67 68 74 2d 68 6f 76 65 72 29 3b 2d 2d 79 63 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 6d 69 73 63 3a 76 61 72 28 2d 2d 67 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 6d 69 73 63 2d 6c 69 67 68 74 29 3b 2d 2d 79 63 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 6d 69 73 63 2d 68 6f 76 65 72 3a 76 61 72 28 2d 2d 67 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 6d 69 73 63 2d 6c 69 67 68 74 2d 68 6f 76 65 72 29 3b 2d 2d 79 63 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 6e 65 75 74 72 61 6c 3a 76 61 72 28 2d 2d 67 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 6e 65 75 74 72 61 6c 2d 6c 69 67 68 74 29 3b 2d 2d 79 63 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 6e 65 75 74 72 61 6c 2d 68 6f 76 65 72 3a 76 61 72 28 2d 2d 67 2d 63 6f 6c 6f 72 2d 62 61 73 65 2d 6e Data Ascii: color-base-danger-light-hover);--yc-color-base-misc:var(--g-color-base-misc-light);--yc-color-base-misc-hover:var(--g-color-base-misc-light-hover);--yc-color-base-neutral:var(--g-color-base-neutral-light);--yc-color-base-neutral-hover:var(--g-color-base-n

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:54 UTC	377	OUT	GET /s3/home/fonts/ys/3/text-regular.woff2 HTTP/1.1 Host: yastatic.net Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:48:55 UTC	793	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 19 Feb 2024 20:48:54 GMT Content-Type: font/woff2 Content-Length: 41400 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31556952 Etag: "1a3a8242666bc247a05759e43a0555e9" Expires: Wed, 19 Feb 2025 02:38:06 GMT Last-Modified: Fri, 23 Sep 2022 09:05:41 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=43200000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Amz-Meta-Owner: {"role":"admin","login":"4eb0da"} X-Nginx-Request-Id: 23c4f4a9a17902d8 Accept-Ranges: bytes
2024-02-19 20:48:55 UTC	15591	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 a1 b8 00 0e 00 00 00 01 cb 6c 00 00 a1 5b 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 83 84 2c 1c 9d 78 06 60 00 8d 22 11 08 0a 82 f0 04 82 a8 3f 0b 8e 20 00 01 36 02 24 03 9c 08 04 20 05 88 32 07 c0 6b 0c 07 5b 92 9f b1 00 22 e5 f0 4e 5f 92 0f 05 25 45 b2 6d 76 8e b6 c5 e7 08 52 ff 7b e3 1a 65 0c 31 45 f1 bb 9d a3 99 c3 25 56 df 6b 54 32 dd e6 21 02 dd 01 f7 88 ab 55 bb ec ff ff ff ff ff ff ff ff 55 c9 0f 19 db df bd cd 77 b7 31 00 00 13 11 34 4d d3 aa fe 17 22 f3 94 2b 29 94 52 c3 ca 1a 48 dc a2 26 a0 d3 bd 2a 6d d7 92 80 a1 03 a1 11 b1 31 d8 11 8e 93 ec bd d4 aa d4 e8 cd 4c 32 95 1d 84 e6 ec 92 32 67 95 e7 2c a6 12 dd c5 34 29 a4 a4 fa 98 96 82 2a 69 5d 28 2e ad ae f5 3e fc e0 d0 20 0d 52 9d Data Ascii: wOF2l[,x`"? 6$ 2k["N_%EmvR{e1E%VkT2!UUw14M"+)RH&m1L22g,4)i](.> R
2024-02-19 20:48:55 UTC	16384	IN	Data Raw: a7 5d 60 a0 88 d1 1a 80 53 2a 84 d0 10 40 8a a9 b3 af 6e 09 d4 2b bb c4 01 e0 98 10 85 44 78 53 b4 45 a4 5d 60 62 7c 94 12 21 c4 e1 2d 18 1d 03 86 91 ca 9d e3 73 9c 4b 9c ac 61 14 0c 18 a6 34 69 13 e6 e8 32 f5 5c 01 0c 30 18 54 c0 28 21 01 23 10 26 79 83 62 6e 82 91 32 8d 30 47 77 69 e6 1e cb 31 d1 31 1d 44 c0 50 c0 8b 7b d8 45 3d 8f 6b 66 cb 4f e6 49 78 3a cf de d4 e7 f3 1c 73 7a e6 45 56 c7 10 22 88 15 f3 d6 22 84 e8 db 02 ab 59 db 27 e6 47 5b e4 96 ac c1 8c 09 23 a6 9a 51 c7 f0 c7 82 3f 16 24 58 91 60 c0 0e 5f f8 d6 1e de da 15 8b ab aa 91 80 2e 6e 09 00 7e f8 e2 87 2f 06 ec 2b 11 10 dc f1 8c e1 22 65 0b 46 c1 80 a1 40 85 08 04 82 bb 88 ef 05 62 6d d0 06 83 4a 08 11 d6 86 6e 81 d4 0c 14 8e 08 2d 3d b6 8e 81 c2 01 16 e5 c8 8c b9 e3 01 03 2a 4e c5 99 cd Data Ascii: ]`S@n+DxSE]`b\|!-sKa4i2\0T(!#&ybn20Gwi11DP{E=kfOIx:szEV""Y'G[#Q?$X`_.n~/+"eF@bmJn-=N
2024-02-19 20:48:55 UTC	9425	IN	Data Raw: 55 4b f2 9b cb 5e 9a 5a 98 46 9a bb c6 45 5b 38 d9 65 31 69 85 3c 86 fd e8 1b 36 30 ee 07 9e cd e1 79 c9 2c 17 c8 c7 29 ea 79 82 36 a3 43 f1 c1 c8 6a 1b 79 70 51 c6 66 e2 51 86 ae 99 5d 44 e1 f8 22 fc f2 1a a6 4c 49 94 24 12 a1 7c b5 de 57 72 d4 06 92 41 de ff 3a dc 88 62 c7 9e 30 13 4b db c4 f2 06 a4 04 5e 48 d1 90 54 7b ab e4 83 55 43 58 6e e2 40 34 93 38 5f 63 50 a0 5f 57 4d 19 49 2f 4b 01 7f 0c c5 09 03 06 69 b4 e6 07 74 a5 9a cb 4e 6a 15 24 fc a0 0c b5 51 33 14 f9 1a 9b db 18 d0 ae 6b b1 fa 5e 44 3e 77 87 e6 4d d6 e6 f0 69 48 88 26 d4 45 cd 50 b2 8d ee 22 5b 40 1f f8 72 d0 4e f7 51 38 b4 57 ad dc db d6 a6 dc d3 8b a2 ea 55 88 72 77 5b ab 72 6a 95 56 ad a2 61 34 6a 67 59 39 b5 c3 48 a3 e5 9b 68 79 1d e5 65 d4 4e 13 0d 88 ad d8 c6 f1 a2 0f f7 c2 c0 bf Data Ascii: UK^ZFE[8e1i<60y,)y6CjypQfQ]D"LI$\|WrA:b0K^HT{UCXn@48_cP_WMI/KitNj$Q3k^D>wMiH&EP"[@rNQ8WUrw[rjVa4jgY9HhyeN

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:54 UTC	354	OUT	GET /metrika/tag.js HTTP/1.1 Host: mc.yandex.ru Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:48:55 UTC	1160	IN	HTTP/1.1 200 OK Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 208426 Content-Type: application/javascript Date: Mon, 19 Feb 2024 20:48:54 GMT ETag: "65d36484-32e2a" Expires: Mon, 19 Feb 2024 21:48:54 GMT Last-Modified: Mon, 19 Feb 2024 14:24:04 GMT Set-Cookie: _yasc=sS1328OBotBYEEenGJszXG6O/v1HFBQOxTCeP7EYBY12YT/KF6tPSUxJ5b9y2HwJxQ==; domain=.yandex.ru; path=/; expires=Thu, 16 Feb 2034 20:48:54 GMT; secure Set-Cookie: i=72M7wCUs09ivjSNHQ9ZXU3ScwdrBEnrkA9w+l5H7H17CwYhU+V0YgxiNGRbftHIv0NY6zU0d1nGowOMnxG52cjcaKuI=; Expires=Wed, 18-Feb-2026 20:48:54 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly Set-Cookie: yandexuid=9173685651708375734; Expires=Wed, 18-Feb-2026 20:48:54 GMT; Domain=.yandex.ru; Path=/; Secure Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: *
2024-02-19 20:48:55 UTC	7766	IN	Data Raw: ef bb bf 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 55 65 28 61 2c 63 2c 62 2c 64 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 42 28 77 69 6e 64 6f 77 2c 22 63 2e 69 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 66 28 78 29 7b 28 78 3d 56 65 28 6b 2c 6c 2c 22 22 2c 78 29 28 6b 2c 6c 29 29 26 26 28 61 61 28 78 2e 74 68 65 6e 29 3f 78 2e 74 68 65 6e 28 67 29 3a 67 28 78 29 29 3b 72 65 74 75 72 6e 20 78 7d 66 75 6e 63 74 69 6f 6e 20 67 28 78 29 7b 78 26 26 28 61 61 28 78 29 3f 6d 2e 70 75 73 68 28 78 29 3a 70 61 28 78 29 26 26 79 28 66 75 6e 63 74 69 6f 6e 28 46 29 7b 76 61 72 20 4f 3d 46 5b 30 5d 3b 46 3d 46 5b 31 5d 3b 61 61 28 46 29 26 26 28 22 75 22 3d Data Ascii: (function(){try{(function(){function Ue(a,c,b,d){var e=this;return B(window,"c.i",function(){function f(x){(x=Ve(k,l,"",x)(k,l))&&(aa(x.then)?x.then(g):g(x));return x}function g(x){x&&(aa(x)?m.push(x):pa(x)&&y(function(F){var O=F[0];F=F[1];aa(F)&&("u"=
2024-02-19 20:48:55 UTC	8168	IN	Data Raw: 75 72 6e 20 64 26 26 65 26 26 67 26 26 66 3f 48 6d 28 61 2c 62 2e 6a 63 2c 7b 61 67 3a 49 6d 7d 29 28 67 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 4a 6d 28 62 2c 7b 41 62 3a 64 2c 4e 62 3a 65 2c 53 66 3a 66 7d 2c 68 2e 68 61 2c 67 2c 68 2e 7a 61 29 7d 29 5b 22 63 61 74 63 68 22 5d 28 45 29 3a 4a 2e 72 65 73 6f 6c 76 65 28 29 7d 66 75 6e 63 74 69 6f 6e 20 49 6d 28 61 2c 63 2c 62 29 7b 61 3d 4b 6d 28 62 2e 51 62 29 3b 69 66 28 22 68 72 65 66 22 3d 3d 3d 62 2e 64 65 29 7b 76 61 72 20 64 3d 62 2e 71 62 3b 63 3d 64 2e 68 72 65 66 3b 62 3d 63 2e 72 65 70 6c 61 63 65 28 61 2c 62 2e 24 61 29 3b 69 66 28 63 21 3d 3d 62 29 72 65 74 75 72 6e 20 64 2e 68 72 65 66 3d 62 2c 21 30 7d 65 6c 73 65 20 69 66 28 28 61 3d 6e 75 6c 6c 3d 3d Data Ascii: urn d&&e&&g&&f?Hm(a,b.jc,{ag:Im})(g).then(function(h){return Jm(b,{Ab:d,Nb:e,Sf:f},h.ha,g,h.za)})["catch"](E):J.resolve()}function Im(a,c,b){a=Km(b.Qb);if("href"===b.de){var d=b.qb;c=d.href;b=c.replace(a,b.$a);if(c!==b)return d.href=b,!0}else if((a=null==
2024-02-19 20:48:55 UTC	1340	IN	Data Raw: 61 2c 63 29 29 3f 28 67 2e 6d 62 3d 65 2c 67 2e 76 61 6c 75 65 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 51 41 41 41 43 31 48 41 77 43 41 41 41 41 43 30 6c 45 51 56 52 34 32 6d 4e 6b 59 41 41 41 41 41 59 41 41 6a 43 42 30 43 38 41 41 41 41 41 53 55 56 4f 52 4b 35 43 59 49 49 3d 22 29 3a 67 2e 76 61 6c 75 65 3d 28 63 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 73 65 74 22 29 3f 63 2e 63 75 72 72 65 6e 74 53 72 63 3a 22 22 29 7c 7c 63 2e 73 72 63 3b 65 6c 73 65 20 69 66 28 22 41 22 3d 3d 3d 66 26 26 22 68 72 65 66 22 3d 3d 3d 62 29 67 2e 76 61 6c 75 65 3d 64 3f 22 23 22 3a 22 22 3b 65 6c 73 65 20 69 66 28 49 28 62 2c Data Ascii: a,c))?(g.mb=e,g.value="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII="):g.value=(c.getAttribute("srcset")?c.currentSrc:"")\|\|c.src;else if("A"===f&&"href"===b)g.value=d?"#":"";else if(I(b,
2024-02-19 20:48:55 UTC	6828	IN	Data Raw: 2b 72 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 78 3d 74 2e 74 79 70 65 7d 63 61 74 63 68 28 46 29 7b 72 65 74 75 72 6e 7d 78 3d 49 28 78 2c 64 29 3b 63 2e 70 75 73 68 28 74 2c 0a 7b 74 79 70 65 3a 72 7d 29 3b 78 26 26 6c 28 29 7d 29 28 29 7d 29 2c 70 3d 42 28 61 2c 22 73 66 76 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 62 28 61 29 2c 74 3d 73 6e 28 61 29 3b 79 28 66 75 6e 63 74 69 6f 6e 28 78 29 7b 66 2e 70 75 73 68 28 67 2e 46 28 78 2e 74 61 72 67 65 74 2c 5b 78 2e 65 76 65 6e 74 5d 2c 6d 28 78 2e 74 79 70 65 29 29 29 7d 2c 72 29 3b 79 28 66 75 6e 63 74 69 6f 6e 28 78 29 7b 66 2e 70 75 73 68 28 67 2e 46 28 78 2e 74 61 72 67 65 74 2c 5b 78 2e 65 76 65 6e 74 5d 2c 42 28 61 2c 22 68 66 66 2e 22 2b 78 2e 74 79 70 65 2b 22 2e Data Ascii: +r,function(){try{var x=t.type}catch(F){return}x=I(x,d);c.push(t,{type:r});x&&l()})()}),p=B(a,"sfv",function(){var r=b(a),t=sn(a);y(function(x){f.push(g.F(x.target,[x.event],m(x.type)))},r);y(function(x){f.push(g.F(x.target,[x.event],B(a,"hff."+x.type+".
2024-02-19 20:48:55 UTC	8168	IN	Data Raw: 61 2e 63 6f 6e 74 65 6e 74 2c 59 68 5d 2c 5b 37 38 35 2c 61 2e 74 61 62 49 64 2c 62 61 5d 2c 5b 37 30 35 2c 61 2e 72 65 63 6f 72 64 53 74 61 6d 70 2c 6a 6f 5d 2c 5b 36 35 36 2c 61 2e 6c 6f 63 61 74 69 6f 6e 2c 6b 6f 5d 2c 5b 35 39 32 2c 61 2e 76 69 65 77 70 6f 72 74 2c 5a 68 5d 2c 5b 35 32 38 2c 61 2e 73 63 72 65 65 6e 2c 5a 68 5d 2c 5b 34 34 39 2c 61 2e 68 61 73 42 61 73 65 2c 72 63 5d 2c 5b 34 30 31 2c 61 2e 62 61 73 65 2c 62 61 5d 2c 5b 33 33 37 2c 61 2e 72 65 66 65 72 72 65 72 2c 62 61 5d 2c 5b 32 37 33 2c 61 2e 75 61 2c 62 61 5d 2c 5b 32 30 39 2c 61 2e 61 64 64 72 65 73 73 2c 62 61 5d 2c 5b 31 34 35 2c 61 2e 74 69 74 6c 65 2c 62 61 5d 2c 5b 38 31 2c 61 2e 64 6f 63 74 79 70 65 2c 62 61 5d 5d 7d 66 75 6e 63 74 69 6f 6e 20 6b 6f 28 61 29 7b 72 65 74 75 Data Ascii: a.content,Yh],[785,a.tabId,ba],[705,a.recordStamp,jo],[656,a.location,ko],[592,a.viewport,Zh],[528,a.screen,Zh],[449,a.hasBase,rc],[401,a.base,ba],[337,a.referrer,ba],[273,a.ua,ba],[209,a.address,ba],[145,a.title,ba],[81,a.doctype,ba]]}function ko(a){retu
2024-02-19 20:48:55 UTC	8168	IN	Data Raw: 6d 6f 76 65 22 3a 64 61 28 66 29 26 26 66 2e 6c 65 6e 67 74 68 3f 28 64 3d 5a 6f 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 70 61 28 67 29 26 26 28 6d 61 28 67 2e 69 64 29 7c 7c 6f 65 28 62 2c 67 2e 69 64 29 7c 7c 6d 61 28 67 2e 6e 61 6d 65 29 29 7d 2c 66 29 29 7c 7c 28 65 3d 22 41 6c 6c 20 69 74 65 6d 73 20 69 6e 20 27 67 6f 6f 64 73 27 20 73 68 6f 75 6c 64 20 62 65 20 6f 62 6a 65 63 74 73 20 61 6e 64 20 63 6f 6e 74 61 69 6e 20 27 69 64 27 20 6f 72 20 27 6e 61 6d 65 27 20 66 69 65 6c 64 22 29 3a 65 3d 22 45 63 6f 6d 6d 65 72 63 65 20 64 61 74 61 20 73 68 6f 75 6c 64 20 63 6f 6e 74 61 69 6e 20 27 67 6f 6f 64 73 27 20 6e 6f 6e 2d 65 6d 70 74 79 20 61 72 72 61 79 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 70 75 72 63 68 61 73 65 22 3a 6f 65 Data Ascii: move":da(f)&&f.length?(d=Zo(function(g){return pa(g)&&(ma(g.id)\|\|oe(b,g.id)\|\|ma(g.name))},f))\|\|(e="All items in 'goods' should be objects and contain 'id' or 'name' field"):e="Ecommerce data should contain 'goods' non-empty array";break;case "purchase":oe
2024-02-19 20:48:55 UTC	8168	IN	Data Raw: 63 29 29 29 66 6f 72 28 63 3d 61 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 54 72 65 65 57 61 6c 6b 65 72 28 63 2c 65 2c 64 3f 7b 61 63 63 65 70 74 4e 6f 64 65 3a 66 7d 3a 6e 75 6c 6c 2c 21 31 29 3b 63 2e 6e 65 78 74 4e 6f 64 65 28 29 26 26 21 31 21 3d 3d 62 28 63 2e 63 75 72 72 65 6e 74 4e 6f 64 65 29 3b 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 45 69 28 61 2c 63 2c 62 29 7b 76 61 72 20 64 3d 5b 5d 2c 65 3d 77 28 54 2c 55 61 28 22 70 75 73 68 22 2c 64 29 29 3b 61 61 28 62 29 3f 28 62 3d 62 28 63 29 2c 28 6b 61 28 62 29 7c 7c 62 3d 3d 3d 61 2e 4e 6f 64 65 46 69 6c 74 65 72 2e 46 49 4c 54 45 52 5f 41 43 43 45 50 54 29 26 26 65 28 63 29 29 3a 65 28 63 29 3b 69 66 28 63 2e 63 68 69 6c 64 4e 6f 64 65 73 26 26 30 3c 63 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 Data Ascii: c)))for(c=a.document.createTreeWalker(c,e,d?{acceptNode:f}:null,!1);c.nextNode()&&!1!==b(c.currentNode););}function Ei(a,c,b){var d=[],e=w(T,Ua("push",d));aa(b)?(b=b(c),(ka(b)\|\|b===a.NodeFilter.FILTER_ACCEPT)&&e(c)):e(c);if(c.childNodes&&0<c.childNodes.le
2024-02-19 20:48:55 UTC	8168	IN	Data Raw: 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 4d 66 28 61 2c 63 2c 62 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 4d 70 28 61 2c 63 29 7b 4e 66 28 61 29 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 64 65 6c 65 74 65 20 62 5b 63 5d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 4d 66 28 61 2c 63 2c 62 29 7b 4e 66 28 61 29 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 64 5b 63 5d 3d 7a 28 64 5b 63 5d 7c 7c 7b 7d 2c 62 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 4e 66 28 61 29 7b 61 3d 47 28 61 29 3b 76 61 72 20 63 3d 61 2e 43 28 22 64 73 6a 66 22 29 7c 7c 43 61 28 7b 7d 29 3b 61 2e 42 61 28 22 64 73 6a 66 22 2c 63 29 3b 72 65 74 75 72 6e 20 63 7d 66 75 6e 63 74 69 6f 6e 20 4e 70 28 61 2c 63 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 64 2c 65 2c 66 3d 78 61 28 61 2c 63 Data Ascii: function(b){Mf(a,c,b)}}function Mp(a,c){Nf(a)(function(b){delete b[c]})}function Mf(a,c,b){Nf(a)(function(d){d[c]=z(d[c]\|\|{},b)})}function Nf(a){a=G(a);var c=a.C("dsjf")\|\|Ca({});a.Ba("dsjf",c);return c}function Np(a,c){return function(b){var d,e,f=xa(a,c
2024-02-19 20:48:55 UTC	4690	IN	Data Raw: 22 29 3b 62 7c 7c 28 62 3d 53 61 28 61 29 2c 63 2e 44 28 22 68 69 74 49 64 22 2c 62 29 29 3b 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 5a 64 28 61 2c 63 2c 62 29 7b 76 61 72 20 64 3d 4a 61 28 63 29 3b 72 65 74 75 72 6e 20 64 26 26 4a 69 28 61 2c 63 2c 41 61 28 5b 22 70 22 2c 6d 71 5b 64 5d 2c 22 63 22 5d 29 2c 46 66 2c 62 29 7d 66 75 6e 63 74 69 6f 6e 20 59 64 28 61 2c 63 29 7b 76 61 72 20 62 3d 62 63 28 55 66 2c 61 2c 63 29 3b 69 66 28 21 62 29 7b 76 61 72 20 64 3d 62 63 28 22 64 69 76 22 2c 61 2c 63 29 3b 64 26 26 28 70 62 28 55 66 2b 22 2c 64 69 76 22 2c 64 29 2e 6c 65 6e 67 74 68 7c 7c 28 62 3d 64 29 29 7d 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 4a 69 28 61 2c 63 2c 62 2c 64 2c 65 29 7b 72 65 74 75 72 6e 20 4b 28 66 75 6e 63 Data Ascii: ");b\|\|(b=Sa(a),c.D("hitId",b));return b}function Zd(a,c,b){var d=Ja(c);return d&&Ji(a,c,Aa(["p",mq[d],"c"]),Ff,b)}function Yd(a,c){var b=bc(Uf,a,c);if(!b){var d=bc("div",a,c);d&&(pb(Uf+",div",d).length\|\|(b=d))}return b}function Ji(a,c,b,d,e){return K(func
2024-02-19 20:48:55 UTC	8168	IN	Data Raw: 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 26 26 61 2e 67 65 74 42 6f 75 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 28 29 7d 63 61 74 63 68 28 63 29 7b 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 3d 74 79 70 65 6f 66 20 63 26 26 6e 75 6c 6c 21 3d 3d 63 26 26 31 36 33 38 39 3d 3d 3d 28 63 2e 71 66 26 26 63 2e 71 66 26 36 35 35 33 35 29 3f 7b 74 6f 70 3a 30 2c 62 6f 74 74 6f 6d 3a 30 2c 6c 65 66 74 3a 30 2c 77 69 64 74 68 3a 30 2c 68 65 69 67 68 74 3a 30 2c 72 69 67 68 74 3a 30 7d 3a 6e 75 6c 6c 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 66 28 61 29 7b 76 61 72 20 63 3d 0a 79 63 28 61 29 2c 62 3d 6e 28 61 2c 22 64 6f 63 75 6d 65 6e 74 22 29 3b 72 65 74 75 72 6e 7b 78 3a 61 2e 70 61 67 65 58 4f 66 66 73 65 74 7c 7c 62 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d Data Ascii: ndingClientRect&&a.getBoundingClientRect()}catch(c){return"object"===typeof c&&null!==c&&16389===(c.qf&&c.qf&65535)?{top:0,bottom:0,left:0,width:0,height:0,right:0}:null}}function If(a){var c=yc(a),b=n(a,"document");return{x:a.pageXOffset\|\|b.documentElem

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:54 UTC	470	OUT	POST /clck/click HTTP/1.1 Host: yandex.ru Content-Type: text/plain;charset=UTF-8 Origin: https://forms.yandex.com Accept-Language: en-gb Accept-Encoding: br, gzip, deflate Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Cache-Control: max-age=0 Content-Length: 1388
2024-02-19 20:48:54 UTC	1388	OUT	Data Raw: 2f 72 65 71 69 64 3d 31 37 30 38 33 37 35 37 32 39 32 38 36 33 30 37 2d 31 32 35 38 37 38 39 32 32 36 32 34 36 30 34 35 38 34 36 39 2f 70 61 74 68 3d 36 39 30 2e 32 33 36 31 2f 73 6c 6f 74 73 3d 2f 76 61 72 73 3d 2d 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 79 61 73 74 61 74 69 63 2e 6e 65 74 25 32 46 73 33 25 32 46 63 6c 6f 75 64 25 32 46 66 6f 72 6d 73 25 32 46 73 74 61 74 69 63 25 32 46 66 72 65 65 7a 65 25 32 46 6a 73 25 32 46 69 6e 64 65 78 2e 61 37 39 64 30 64 35 31 2e 6a 73 2c 2d 6c 69 6e 65 3d 38 2c 2d 6d 73 67 3d 53 79 6e 74 61 78 45 72 72 6f 72 25 33 41 25 32 30 55 6e 65 78 70 65 63 74 65 64 25 32 30 74 6f 6b 65 6e 25 32 30 27 25 33 46 27 2c 2d 65 6e 76 3d 70 72 6f 64 75 63 74 69 6f 6e 2c 2d 70 72 6f 6a 65 63 74 3d 66 6f 72 6d 73 2c Data Ascii: /reqid=1708375729286307-12587892262460458469/path=690.2361/slots=/vars=-url=https%3A%2F%2Fyastatic.net%2Fs3%2Fcloud%2Fforms%2Fstatic%2Ffreeze%2Fjs%2Findex.a79d0d51.js,-line=8,-msg=SyntaxError%3A%20Unexpected%20token%20'%3F',-env=production,-project=forms,
2024-02-19 20:48:55 UTC	1172	IN	Data Raw: 48 54 54 50 2f 31 2e 30 20 32 30 30 20 4f 6b 0d 0a 41 63 63 65 70 74 2d 43 48 3a 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 62 69 6c 65 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 64 65 6c 2c 20 53 65 63 2d 43 48 2d 55 41 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2d 4c 69 73 74 2c 20 53 65 63 2d 43 48 2d 55 41 2d 57 6f 57 36 34 2c 20 53 65 63 2d 43 48 2d 55 41 2d 41 72 63 68 2c 20 53 65 63 2d 43 48 2d 55 41 2d 42 69 74 6e 65 73 73 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 56 69 65 77 70 6f 72 74 2d 57 69 64 74 68 2c 20 44 50 52 2c 20 44 65 76 69 63 65 2d Data Ascii: HTTP/1.0 200 OkAccept-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-
2024-02-19 20:48:55 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:57 UTC	1222	OUT	GET /watch/3?wmode=7&page-url=https%3A%2F%2Fforms.yandex.com%2Fcloud%2F65c3b4dd90fa7b15775a8c25%2F%3F5bbb&page-ref=&charset=utf-8&ut=noindex&browser-info=pv%3A1%3Avf%3Aqfujqr3nyxpmy96xs6n0cesb%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-GB%3Av%3A1251%3Acn%3A1%3Adp%3A0%3Als%3A196552167312%3Ahid%3A638196510%3Az%3A60%3Ai%3A20240219214855%3Aet%3A1708375735%3Ac%3A1%3Arn%3A1031222969%3Arqn%3A1%3Au%3A1708375735407725049%3Aw%3A1024x647%3As%3A1024x768x24%3Ask%3A1%3Aj%3A1%3Awv%3A2%3Ads%3A674%2C1114%2C443%2C924%2C0%2C0%2C%2C3833%2C0%2C%2C%2C%2C6638%3Aco%3A0%3Ans%3A1708375725986%3Ast%3A1708375736&t=clc(0-0-0)rqnt(1)aw(1)rcm(0)yu(5073307901708375729)cdl(na)ti(1) HTTP/1.1 Host: mc.yandex.com Origin: https://forms.yandex.com Cookie: _yasc=TzePaB/Sttzo9E0OEXdvjql0FT4hGrewKJDoGOfNfpjNfoUvVUnVALasatpa8oa7; i=Po1loEkEoi3UIaHZZ3HuDx7TuUPZoC2jcAno9IiFQ+PwfMbrDF/2DtivBOaPYe4M5PGuJK3E9qUobNCRfT5bbeZM6dg=; yandexuid=5073307901708375729 Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:48:58 UTC	1711	IN	HTTP/1.1 302 Moved temporarily Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://forms.yandex.com Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Date: Mon, 19 Feb 2024 20:48:58 GMT Expires: Mon, 19-Feb-2024 20:48:58 GMT Last-Modified: Mon, 19-Feb-2024 20:48:58 GMT Location: /watch/3/1?wmode=7&page-url=https%3A%2F%2Fforms.yandex.com%2Fcloud%2F65c3b4dd90fa7b15775a8c25%2F%3F5bbb&page-ref&charset=utf-8&ut=noindex&browser-info=pv%3A1%3Avf%3Aqfujqr3nyxpmy96xs6n0cesb%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-GB%3Av%3A1251%3Acn%3A1%3Adp%3A0%3Als%3A196552167312%3Ahid%3A638196510%3Az%3A60%3Ai%3A20240219214855%3Aet%3A1708375735%3Ac%3A1%3Arn%3A1031222969%3Arqn%3A1%3Au%3A1708375735407725049%3Aw%3A1024x647%3As%3A1024x768x24%3Ask%3A1%3Aj%3A1%3Awv%3A2%3Ads%3A674%2C1114%2C443%2C924%2C0%2C0%2C%2C3833%2C0%2C%2C%2C%2C6638%3Aco%3A0%3Ans%3A1708375725986%3Ast%3A1708375736&t=clc%280-0-0%29rqnt%281%29aw%281%29rcm%280%29yu%285073307901708375729%29cdl%28na%29ti%281%29 Pragma: no-cache Set-Cookie: yabs-sid=1701707111708375738; Path=/ Set-Cookie: yandexuid=5073307901708375729; Expires=Tue, 18-Feb-2025 20:48:58 GMT; Domain=.yandex.com; Path=/ Set-Cookie: ymex=1739911738.yrts.1708375738; Expires=Tue, 18-Feb-2025 20:48:58 GMT; Domain=.yandex.com; Path=/ Strict-Transport-Security: max-age=31536000 Transfer-Encoding: chunked X-XSS-Protection: 1; mode=block
2024-02-19 20:48:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:58 UTC	624	OUT	GET /metrika/advert.gif HTTP/1.1 Host: mc.yandex.com Accept: image/png,image/svg+xml,image/;q=0.8,video/;q=0.8,/;q=0.5 Connection: keep-alive Cookie: _yasc=TzePaB/Sttzo9E0OEXdvjql0FT4hGrewKJDoGOfNfpjNfoUvVUnVALasatpa8oa7; i=Po1loEkEoi3UIaHZZ3HuDx7TuUPZoC2jcAno9IiFQ+PwfMbrDF/2DtivBOaPYe4M5PGuJK3E9qUobNCRfT5bbeZM6dg=; yandexuid=5073307901708375729 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:48:58 UTC	669	IN	HTTP/1.1 200 OK Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 43 Content-Type: image/gif Date: Mon, 19 Feb 2024 20:48:58 GMT ETag: "65d36484-2b" Expires: Mon, 19 Feb 2024 21:48:58 GMT Last-Modified: Mon, 19 Feb 2024 14:24:04 GMT Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: *
2024-02-19 20:48:58 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:58 UTC	1254	OUT	GET /watch/3/1?wmode=7&page-url=https%3A%2F%2Fforms.yandex.com%2Fcloud%2F65c3b4dd90fa7b15775a8c25%2F%3F5bbb&page-ref&charset=utf-8&ut=noindex&browser-info=pv%3A1%3Avf%3Aqfujqr3nyxpmy96xs6n0cesb%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-GB%3Av%3A1251%3Acn%3A1%3Adp%3A0%3Als%3A196552167312%3Ahid%3A638196510%3Az%3A60%3Ai%3A20240219214855%3Aet%3A1708375735%3Ac%3A1%3Arn%3A1031222969%3Arqn%3A1%3Au%3A1708375735407725049%3Aw%3A1024x647%3As%3A1024x768x24%3Ask%3A1%3Aj%3A1%3Awv%3A2%3Ads%3A674%2C1114%2C443%2C924%2C0%2C0%2C%2C3833%2C0%2C%2C%2C%2C6638%3Aco%3A0%3Ans%3A1708375725986%3Ast%3A1708375736&t=clc%280-0-0%29rqnt%281%29aw%281%29rcm%280%29yu%285073307901708375729%29cdl%28na%29ti%281%29 HTTP/1.1 Host: mc.yandex.com Accept: / Origin: https://forms.yandex.com Cookie: yandexuid=5073307901708375729; ymex=1739911738.yrts.1708375738; yabs-sid=1701707111708375738; _yasc=TzePaB/Sttzo9E0OEXdvjql0FT4hGrewKJDoGOfNfpjNfoUvVUnVALasatpa8oa7; i=Po1loEkEoi3UIaHZZ3HuDx7TuUPZoC2jcAno9IiFQ+PwfMbrDF/2DtivBOaPYe4M5PGuJK3E9qUobNCRfT5bbeZM6dg= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Connection: keep-alive
2024-02-19 20:48:59 UTC	815	IN	HTTP/1.1 200 Ok Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://forms.yandex.com Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Content-Length: 286 Content-Type: application/json; charset=utf-8 Date: Mon, 19 Feb 2024 20:48:59 GMT Expires: Mon, 19-Feb-2024 20:48:59 GMT Last-Modified: Mon, 19-Feb-2024 20:48:59 GMT Pragma: no-cache Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2024-02-19 20:48:59 UTC	286	IN	Data Raw: 7b 22 73 65 74 74 69 6e 67 73 22 3a 7b 22 73 62 70 22 3a 20 7b 22 61 22 3a 22 6a 6e 41 33 69 6d 43 30 41 54 64 69 5a 46 57 5a 78 4f 70 62 7a 34 64 63 73 72 72 77 59 38 5a 2b 58 34 74 72 4c 79 35 69 73 51 68 78 67 43 6b 36 32 77 51 31 78 74 36 62 35 52 73 53 58 37 6a 78 22 2c 20 22 62 22 3a 22 6a 70 4a 73 47 4e 6b 39 75 34 51 69 51 6c 68 55 33 6e 31 2f 73 6e 55 50 39 6a 6c 54 52 38 46 34 6c 70 30 5a 49 59 34 67 4f 7a 6e 67 75 35 53 48 49 75 69 49 68 6f 4f 4d 50 62 54 79 31 5a 52 75 22 7d 2c 22 65 75 22 3a 31 2c 22 68 69 74 74 6f 6b 65 6e 22 3a 22 31 37 30 38 33 37 35 37 33 39 5f 36 39 65 33 31 35 33 36 33 61 65 38 37 35 39 61 39 35 30 36 61 64 30 35 66 36 62 38 65 39 35 62 31 38 62 66 33 34 64 63 32 32 35 36 61 62 64 33 39 61 66 39 64 38 38 63 30 38 66 31 Data Ascii: {"settings":{"sbp": {"a":"jnA3imC0ATdiZFWZxOpbz4dcsrrwY8Z+X4trLy5isQhxgCk62wQ1xt6b5RsSX7jx", "b":"jpJsGNk9u4QiQlhU3n1/snUP9jlTR8F4lp0ZIY4gOzngu5SHIuiIhoOMPbTy1ZRu"},"eu":1,"hittoken":"1708375739_69e315363ae8759a9506ad05f6b8e95b18bf34dc2256abd39af9d88c08f1

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:48:59 UTC	400	OUT	GET /s3/cloud/forms/v26.108.2/public/i/icons/color/favicon-64.png HTTP/1.1 Host: yastatic.net Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:49:00 UTC	740	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 19 Feb 2024 20:49:00 GMT Content-Type: image/png Content-Length: 4054 Connection: close Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, max-age=3600 Etag: "739cd8273aa180f8199ddde075d3ae34" Expires: Mon, 19 Feb 2024 21:49:00 GMT Last-Modified: Wed, 07 Feb 2024 08:28:25 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=43200000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Robots-Tag: noindex, noarchive, nofollow
2024-02-19 20:49:00 UTC	4054	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 06 00 00 00 ad 58 ae 9e 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 0f 53 49 44 41 54 78 9c ed dd 7b 90 95 f5 7d c7 f1 f7 f7 39 8b 20 37 b9 b9 80 41 2e 1a 41 e5 16 3b e3 1d 04 ad 35 d5 44 65 d9 6c aa 55 d4 d8 d6 a6 d3 24 63 9a 36 99 10 81 e3 e2 2d 49 9b ce 98 69 a7 66 5a 63 44 4d 75 bb 10 af 51 eb 5d 09 35 51 2b 17 2f ac 82 68 55 40 45 41 76 45 d8 3d cf af 7f 3c ac ee 2e bb cf 9e b3 e7 f2 7b f6 9c cf 6b 66 67 60 9f 73 9e e7 b3 c0 87 f3 7b ce 79 9e df cf 48 b8 ba eb dc a1 6d 21 d3 2c c3 34 8c a9 c0 54 Data Ascii: PNGIHDRXsBIT\|dpHYs.#.#x?vtEXtSoftwarewww.inkscape.org<SIDATx{}9 7A.A;5DelU$c6-IifZcDMuQ]5Q+/hU@EAvE=<.{kfg`s{yHm!,4T

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:49:00 UTC	358	OUT	GET /s3/gdpr/v3/gdpr.js HTTP/1.1 Host: yastatic.net Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:49:01 UTC	755	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 19 Feb 2024 20:49:00 GMT Content-Type: application/javascript Content-Length: 127664 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=3600 Etag: "fd1feb0e81456ffc50d6cf33a2fc248e" Expires: Mon, 19 Feb 2024 21:47:51 GMT Last-Modified: Mon, 27 Nov 2023 11:29:20 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=43200000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Robots-Tag: noindex, noarchive, nofollow Accept-Ranges: bytes
2024-02-19 20:49:01 UTC	15629	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 61 2c 6f 29 7b 69 66 28 6f 7c 7c 32 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 74 2c 6e 3d 30 2c 73 3d 61 2e 6c 65 6e 67 74 68 3b 6e 3c 73 3b 6e 2b 2b 29 28 74 7c 7c 21 28 6e 20 69 6e 20 61 29 29 26 26 28 74 7c 7c 28 74 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 2c 30 2c 6e 29 29 2c 74 5b 6e 5d 3d 61 5b 6e 5d 29 3b 72 65 74 75 72 6e 20 65 2e 63 6f 6e 63 61 74 28 74 7c 7c 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 29 29 7d 76 61 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 69 2c 61 3d 21 31 3b 72 65 74 75 Data Ascii: (function(){"use strict";function e(e,a,o){if(o\|\|2===arguments.length)for(var t,n=0,s=a.length;n<s;n++)(t\|\|!(n in a))&&(t\|\|(t=Array.prototype.slice.call(a,0,n)),t[n]=a[n]);return e.concat(t\|\|Array.prototype.slice.call(a))}var i=function(e){var i,a=!1;retu
2024-02-19 20:49:01 UTC	16384	IN	Data Raw: 63 6b 3a 59 26 26 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 6b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 45 5b 65 5d 7d 2c 75 28 45 29 29 3b 6f 28 65 2c 21 30 29 7d 7d 29 2c 46 28 7b 63 6f 6e 74 65 6e 74 3a 63 2c 74 68 65 6d 65 3a 22 64 61 72 6b 22 2c 69 64 3a 22 73 65 74 74 69 6e 67 73 2d 6d 61 6e 64 61 74 6f 72 79 22 2c 6f 6e 43 6c 69 63 6b 3a 59 26 26 4d 28 6f 2c 5b 55 2e 74 65 63 68 6e 69 63 61 6c 5d 2c 21 30 29 7d 29 5d 3b 69 66 28 21 6a 29 4b 2e 75 6e 73 68 69 66 74 28 48 29 3b 65 6c 73 65 7b 76 61 72 20 56 3d 57 28 42 2c 22 2e 22 2e 63 6f 6e 63 61 74 28 51 28 22 73 65 74 74 69 6e 67 73 2d 74 69 74 6c 65 22 29 29 29 3b 56 2e 66 69 72 73 74 43 68 69 6c 64 3f 56 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 48 2c 56 2e 66 69 72 Data Ascii: ck:Y&&function(){var e=k(function(e){return E[e]},u(E));o(e,!0)}}),F({content:c,theme:"dark",id:"settings-mandatory",onClick:Y&&M(o,[U.technical],!0)})];if(!j)K.unshift(H);else{var V=W(B,".".concat(Q("settings-title")));V.firstChild?V.insertBefore(H,V.fir
2024-02-19 20:49:01 UTC	16384	IN	Data Raw: 77 65 6e 64 69 67 2c 20 77 69 65 20 7a 2e 5c 78 41 30 42 2e 20 41 75 74 6f 72 69 73 69 65 72 75 6e 67 20 6f 64 65 72 20 4e 61 76 69 67 61 74 69 6f 6e 2e 20 53 69 65 20 73 69 6e 64 20 77 65 73 65 6e 74 6c 69 63 68 20 66 5c 78 46 43 72 20 64 69 65 20 46 75 6e 6b 74 69 6f 6e 61 6c 69 74 5c 78 45 34 74 20 64 65 73 20 44 69 65 6e 73 74 65 73 2c 20 64 61 68 65 72 20 77 65 72 64 65 6e 20 73 69 65 20 73 74 61 6e 64 61 72 64 6d 5c 78 45 34 5c 78 44 46 69 67 20 76 65 72 77 65 6e 64 65 74 2e 22 2c 74 65 63 68 6e 69 63 61 6c 43 6f 6f 6b 69 65 73 4c 61 62 65 6c 3a 22 54 65 63 68 6e 69 73 63 68 2c 20 69 6d 6d 65 72 20 61 6b 74 69 76 22 7d 2c 65 6c 3a 7b 61 63 63 65 70 74 41 6c 6c 42 75 74 74 6f 6e 54 65 78 74 3a 22 5c 75 30 33 39 31 5c 75 30 33 43 30 5c 75 30 33 42 46 Data Ascii: wendig, wie z.\xA0B. Autorisierung oder Navigation. Sie sind wesentlich f\xFCr die Funktionalit\xE4t des Dienstes, daher werden sie standardm\xE4\xDFig verwendet.",technicalCookiesLabel:"Technisch, immer aktiv"},el:{acceptAllButtonText:"\u0391\u03C0\u03BF
2024-02-19 20:49:01 UTC	16384	IN	Data Raw: 20 64 65 73 20 63 6f 6f 6b 69 65 73 20 74 65 63 68 6e 69 71 75 65 73 20 70 6f 75 72 20 67 61 72 61 6e 74 69 72 20 6c 65 20 62 6f 6e 20 66 6f 6e 63 74 69 6f 6e 6e 65 6d 65 6e 74 20 64 75 20 73 69 74 65 20 6f 75 20 64 65 20 6c 5c 75 32 30 31 39 61 70 70 6c 69 63 61 74 69 6f 6e 2e 20 54 6f 75 74 65 66 6f 69 73 2c 20 6e 6f 75 73 20 73 6f 75 68 61 69 74 6f 6e 73 20 5c 78 45 39 67 61 6c 65 6d 65 6e 74 20 75 74 69 6c 69 73 65 72 20 64 65 73 20 63 6f 6f 6b 69 65 73 20 6f 70 74 69 6f 6e 6e 65 6c 73 20 64 65 20 6d 61 72 6b 65 74 69 6e 67 2c 20 64 5c 75 32 30 31 39 61 6e 61 6c 79 73 65 20 65 74 20 64 5c 75 32 30 31 39 61 75 74 72 65 73 20 74 79 70 65 73 20 64 65 20 63 6f 6f 6b 69 65 73 2e 20 43 65 73 20 63 6f 6f 6b 69 65 73 20 61 69 64 65 6e 74 20 59 61 6e 64 65 78 Data Ascii: des cookies techniques pour garantir le bon fonctionnement du site ou de l\u2019application. Toutefois, nous souhaitons \xE9galement utiliser des cookies optionnels de marketing, d\u2019analyse et d\u2019autres types de cookies. Ces cookies aident Yandex
2024-02-19 20:49:01 UTC	16384	IN	Data Raw: 44 35 5c 75 31 30 44 30 3c 2f 61 3e 22 2c 73 65 74 74 69 6e 67 73 42 75 74 74 6f 6e 54 65 78 74 3a 22 5c 75 31 30 44 45 5c 75 31 30 44 30 5c 75 31 30 45 30 5c 75 31 30 44 30 5c 75 31 30 44 42 5c 75 31 30 44 34 5c 75 31 30 45 32 5c 75 31 30 45 30 5c 75 31 30 44 34 5c 75 31 30 44 31 5c 75 31 30 44 38 5c 75 31 30 45 31 20 5c 75 31 30 44 33 5c 75 31 30 44 30 5c 75 31 30 45 37 5c 75 31 30 44 34 5c 75 31 30 44 43 5c 75 31 30 44 34 5c 75 31 30 44 31 5c 75 31 30 44 30 22 2c 73 65 74 74 69 6e 67 73 43 6f 6e 74 65 6e 74 3a 22 59 61 6e 64 65 78 20 5c 75 31 30 44 38 5c 75 31 30 45 37 5c 75 31 30 44 34 5c 75 31 30 44 43 5c 75 31 30 44 34 5c 75 31 30 44 31 5c 75 31 30 45 31 20 5c 75 31 30 45 32 5c 75 31 30 44 34 5c 75 31 30 45 35 5c 75 31 30 44 43 5c 75 31 30 44 38 5c Data Ascii: D5\u10D0</a>",settingsButtonText:"\u10DE\u10D0\u10E0\u10D0\u10DB\u10D4\u10E2\u10E0\u10D4\u10D1\u10D8\u10E1 \u10D3\u10D0\u10E7\u10D4\u10DC\u10D4\u10D1\u10D0",settingsContent:"Yandex \u10D8\u10E7\u10D4\u10DC\u10D4\u10D1\u10E1 \u10E2\u10D4\u10E5\u10DC\u10D8\
2024-02-19 20:49:01 UTC	16384	IN	Data Raw: 33 45 5c 75 30 34 33 44 20 5c 75 30 34 33 43 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 41 5c 75 30 34 33 35 5c 75 30 34 34 32 5c 75 30 34 33 38 5c 75 30 34 33 44 5c 75 30 34 33 33 5c 75 30 34 33 34 5c 75 30 34 33 38 5c 75 30 34 33 41 2c 20 5c 75 30 34 33 30 5c 75 30 34 33 44 5c 75 30 34 33 30 5c 75 30 34 33 42 5c 75 30 34 33 38 5c 75 30 34 34 32 5c 75 30 34 33 38 5c 75 30 34 33 41 5c 75 30 34 33 30 5c 75 30 34 33 42 5c 75 30 34 34 42 5c 75 30 34 33 41 20 5c 75 30 34 33 36 5c 75 30 34 33 30 5c 75 30 34 33 44 5c 75 30 34 33 30 20 5c 75 30 34 33 31 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 41 5c 75 30 34 33 30 20 63 6f 6f 6b 69 65 2d 5c 75 30 34 34 34 5c 75 30 34 33 30 5c 75 30 34 33 39 5c 75 30 34 33 42 5c 75 30 34 33 34 5c 75 30 34 33 30 Data Ascii: 3E\u043D \u043C\u0430\u0440\u043A\u0435\u0442\u0438\u043D\u0433\u0434\u0438\u043A, \u0430\u043D\u0430\u043B\u0438\u0442\u0438\u043A\u0430\u043B\u044B\u043A \u0436\u0430\u043D\u0430 \u0431\u0430\u0448\u043A\u0430 cookie-\u0444\u0430\u0439\u043B\u0434\u0430
2024-02-19 20:49:01 UTC	16384	IN	Data Raw: 6f 6e 3a 22 41 63 65 73 74 65 20 6d 6f 64 75 6c 65 20 63 6f 6f 6b 69 65 20 6e 75 20 73 75 6e 74 20 65 73 65 6e 5c 75 30 32 31 42 69 61 6c 65 2e 20 53 63 6f 70 75 6c 20 61 63 65 73 74 6f 72 61 20 65 73 74 65 20 61 63 65 6c 61 20 64 65 20 61 20 5c 78 45 45 6d 62 75 6e 5c 75 30 31 30 33 74 5c 75 30 31 30 33 5c 75 30 32 31 42 69 20 65 78 70 65 72 69 65 6e 5c 75 30 32 31 42 61 20 6c 75 63 72 75 6c 75 69 20 63 75 20 73 65 72 76 69 63 69 69 6c 65 20 5c 75 30 32 31 39 69 20 73 69 74 65 2d 75 72 69 6c 65 20 77 65 62 20 59 61 6e 64 65 78 2e 20 41 63 65 73 74 65 61 20 61 6a 75 74 5c 75 30 31 30 33 20 6c 61 20 72 65 73 74 61 62 69 6c 69 72 65 61 20 73 65 73 69 75 6e 69 6c 6f 72 20 70 65 20 70 61 67 69 6e 69 6c 65 20 77 65 62 2c 20 72 65 5c 75 30 32 31 42 69 6e 65 72 Data Ascii: on:"Aceste module cookie nu sunt esen\u021Biale. Scopul acestora este acela de a \xEEmbun\u0103t\u0103\u021Bi experien\u021Ba lucrului cu serviciile \u0219i site-urile web Yandex. Acestea ajut\u0103 la restabilirea sesiunilor pe paginile web, re\u021Biner
2024-02-19 20:49:02 UTC	13731	IN	Data Raw: 34 33 38 20 5c 75 30 34 34 30 5c 75 30 34 33 35 5c 75 30 34 33 41 5c 75 30 34 33 42 5c 75 30 34 33 30 5c 75 30 34 33 43 5c 75 30 34 33 30 5c 75 30 34 33 38 20 5c 75 30 34 34 30 5c 75 30 34 33 35 5c 75 30 34 33 42 5c 75 30 34 33 35 5c 75 30 34 33 32 5c 75 30 34 33 30 5c 75 30 34 33 44 5c 75 30 34 34 32 5c 75 30 34 45 33 20 5c 75 30 34 33 38 5c 75 30 34 33 43 5c 75 30 34 33 41 5c 75 30 34 33 45 5c 75 30 34 33 44 20 5c 75 30 34 33 43 5c 75 30 34 33 35 5c 75 30 34 33 34 5c 75 30 34 33 38 5c 75 30 34 42 33 5c 75 30 34 33 30 5c 75 30 34 33 44 5c 75 30 34 33 34 2e 22 2c 61 6e 61 6c 79 74 69 63 73 43 6f 6f 6b 69 65 73 4c 61 62 65 6c 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 30 5c 75 30 34 42 33 5c 75 30 34 33 42 5c 75 30 34 33 38 5c 75 30 34 33 42 5c 75 30 34 45 33 Data Ascii: 438 \u0440\u0435\u043A\u043B\u0430\u043C\u0430\u0438 \u0440\u0435\u043B\u0435\u0432\u0430\u043D\u0442\u04E3 \u0438\u043C\u043A\u043E\u043D \u043C\u0435\u0434\u0438\u04B3\u0430\u043D\u0434.",analyticsCookiesLabel:"\u0422\u0430\u04B3\u043B\u0438\u043B\u04E3

Timestamp	Bytes transferred	Direction	Data
2024-02-19 20:49:02 UTC	376	OUT	GET /s3/home/fonts/ys/3/text-medium.woff2 HTTP/1.1 Host: yastatic.net Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb Accept-Encoding: br, gzip, deflate
2024-02-19 20:49:03 UTC	793	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 19 Feb 2024 20:49:03 GMT Content-Type: font/woff2 Content-Length: 49400 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31556952 Etag: "b9cbf8a5e84f0f710c514d5f8b603b91" Expires: Wed, 19 Feb 2025 02:38:15 GMT Last-Modified: Fri, 23 Sep 2022 09:05:40 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=43200000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Amz-Meta-Owner: {"role":"admin","login":"4eb0da"} X-Nginx-Request-Id: fc8de3158ac58a3e Accept-Ranges: bytes
2024-02-19 20:49:03 UTC	15591	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 c0 f8 00 0e 00 00 00 02 00 38 00 00 c0 9d 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 83 ef 02 1c 9d 78 06 60 00 8d 22 11 08 0a 82 ee 5c 82 a7 04 0b 8e 20 00 01 36 02 24 03 9c 12 04 20 05 88 42 07 c0 6b 0c 07 5b 47 d4 b1 49 9d c8 9a 3d ec 90 f5 eb de 29 a8 a8 17 54 54 a7 88 6a aa 0d 40 0c cd 9b 6e fa d2 1a 65 0e 3b fc 25 da 35 bc 80 17 aa d5 92 cb 0e a9 0b 1b 07 f0 80 ef 5d d9 ff ff ff ff ff ff ff ff ff ff af 4c 16 b2 66 bb 93 30 9b 40 f8 ab a0 28 fe b5 9f f6 b1 bd 13 02 b3 10 24 e6 45 92 bc ac 54 ad 82 a4 12 34 39 8c 6d 04 5d 88 b0 7f aa d4 82 8b 46 aa a5 b2 60 06 49 34 98 69 72 24 b2 95 21 5b d1 14 b9 ee d4 54 4d 9b bc 8e 6a a2 da ce 3b b8 9f 75 ab cc 5c 63 6b c8 cc 90 8d 6e 87 16 76 ba f0 50 Data Ascii: wOF28x`"\ 6$ Bk[GI=)TTj@ne;%5]Lf0@($ET49m]F`I4ir$![TMj;u\cknvP
2024-02-19 20:49:03 UTC	16384	IN	Data Raw: 88 76 51 4e dd 9d dd b6 b0 9d 1d 55 3a ce dc 7a 16 e8 96 07 25 31 cf 77 c6 49 49 d4 73 93 75 3b ec 7a 7e f6 bb 9e 7e e8 ee fc fc 84 2f 01 40 08 46 50 0c 27 48 8a 66 58 8e 17 44 49 ae 1f 4c ad ae 6f 2d b1 52 bd 96 57 77 b6 61 bb 1d f7 77 66 e0 4d 0e ec db 83 a9 8e e4 97 bd 7f 32 15 3f f5 e9 bc e6 6c 7c c1 05 26 86 fa fe 6c 29 3b 8a 52 f1 6d a0 23 d0 a7 cd 57 17 f7 c3 29 14 39 ed b3 d5 fa 82 64 12 89 64 41 63 0c c7 71 dc 9c f6 35 a6 d7 05 b5 68 d5 a6 5d 87 4e 5d d5 cd b6 cd 76 3b 64 c9 4e ea 74 b1 06 4a 86 54 8d 78 a6 0c ad c3 53 5c 53 c8 fa d8 b8 f0 d2 d1 b4 ea 5a 8f 26 02 02 63 06 22 f8 b2 52 3a 44 44 44 44 44 44 44 e4 9f ba 94 d3 ca 06 a5 a1 82 4a aa 12 20 52 52 52 52 52 52 d2 33 a5 cb 0c 96 8b 2f f1 21 9d 49 97 23 d4 99 b3 39 6e d9 b8 7f 97 72 51 ee 4e Data Ascii: vQNU:z%1wIIsu;z~~/@FP'HfXDILo-RWwawfM2?l\|&l);Rm#W)9ddAcq5h]N]v;dNtJTxS\SZ&c"R:DDDDDDDJ RRRRRR3/!I#9nrQN
2024-02-19 20:49:03 UTC	16384	IN	Data Raw: 56 c4 e7 3c 29 43 46 4a aa f9 f3 74 8e 1d 06 d4 ca 34 75 54 aa 8f 44 8b 98 4c b4 a8 9f 44 a3 68 89 07 e2 2c ad 5b 57 6a c5 5a 2a 55 a9 d1 e9 95 6a 0a 55 a2 01 06 f0 81 c9 ed 83 03 53 db 07 bd 9b ed 25 fc 0c d4 e1 53 a7 0e a8 b9 e5 76 7a 05 a0 10 13 3d 12 24 51 1b 94 d5 b3 19 e1 e5 80 a0 75 bb ba 81 46 0d 90 e8 d1 1d 46 9d 5c 43 a1 c8 75 1a 9d 4c 43 a5 c8 d5 e0 14 7c fb b6 ed 83 6a 46 77 a8 51 d8 1f 39 b4 7e c2 97 c0 95 73 d5 16 79 ad 5d 54 3b 7e 0d c7 a5 9d fc 43 f1 00 78 71 d6 95 9d 43 3e 54 89 f8 5b 9c b5 7b 69 2b 0b 3d be d6 b9 1f 09 4d 09 7f c5 9e 7f 3a 5b fe 4c f3 5c 73 45 39 2f c1 2a b7 81 7f 03 cd 4a 4b b4 34 f9 8d b9 c5 1f 38 49 65 99 95 69 f8 c4 9d d6 9d 8b 00 82 a2 fa 88 b4 76 b5 a6 b1 dd 57 4f 23 2b b1 7d 71 e9 d8 ea 66 58 71 6a 87 b8 be 25 46 Data Ascii: V<)CFJt4uTDLDh,[WjZUjUS%Svz=$QuFF\CuLC\|jFwQ9~sy]T;~CxqC>T[{i+=M:[L\sE9/JK48IeivWO#+}qfXqj%F
2024-02-19 20:49:04 UTC	1041	IN	Data Raw: a1 11 b6 8b b1 c7 96 d3 2a ac 4f 65 3a aa 81 e7 91 45 cf bd 98 38 2d 66 22 41 71 28 da 91 36 37 30 ca c7 bb 5e e5 52 cc e5 c6 20 0a 89 3d 9e a6 e9 b9 6e 77 ee d4 09 e9 43 ee be 09 09 bf 8b b9 65 e7 02 3e 83 90 6c a4 6c f1 f0 7f 26 10 ff a8 43 b2 41 52 81 ec c9 e5 8a e8 e7 ac 0f a9 ed e7 6f 1c fa 3b 80 bd 13 bd a0 80 03 ad 5d e9 54 38 f2 e9 02 2c 2c 57 20 c3 ee 0e 79 11 73 87 82 bf a8 92 c7 ee 18 e7 dd 72 6a bf f3 00 6d ed 2c 79 a8 bc 54 70 c1 01 a6 25 79 e1 da cc 94 5b 95 9c f7 c7 9c f0 c1 b0 8e 03 ac cc 5d 30 4b 3a 81 18 ca c0 d9 87 94 d6 44 a2 c0 80 f8 e2 65 84 64 db 2f 77 15 0f 34 79 bd 2a 78 b9 6b bb 4e be 74 a9 8f b5 7e a4 fe cb 73 33 c7 c4 90 5b 56 ef 67 30 6a 02 51 bb 24 59 2f bd 8b bf 0b f9 ea 34 4e 8e ff 0b 5e 83 d2 0f 23 40 9c b2 99 35 4f 54 3c Data Ascii: Oe:E8-f"Aq(670^R =nwCe>ll&CARo;]T8,,W ysrjm,yTp%y[]0K:Ded/w4yxkNt~s3[Vg0jQ$Y/4N^#@5OT<

Start time (UTC):	20:48:39
Start date (UTC):	19/02/2024
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/Users/bernard/Library/Containers/com.apple.Safari/Data/Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist

/Users/bernard/Library/Keychains/login.keychain-db.sb-c132715d-w0EEPw

/Users/bernard/Library/Safari/Template Icons/5339740EC4681059F8DD6AE77672D9C4.png.sb-c132715d-84Wxsm

/dev/null

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/com.apple.scriptmanager2.le.cache

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsDirectory.db_

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsObject.db_

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 2)/AutoFillQuirks.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/6D52C8C200BD44ED47049CCBABA552F3

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/B35D61E6B31548E0722D60F6075F388C

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownSitesUsingPlugIns.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/SitesAllowedToAutoplay.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/TopSites.plist

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Connections

HTTPS Proxied Packets

System Behavior

Analysis Process: mono-sgen32 PID: 602, Parent PID: 531

General

File Activities

File Read (Anonymous Pipes)

Process Activities

macOS Analysis Report
https://forms.yandex.com/cloud/65c3b4dd90fa7b15775a8c25/?5bbb

Start time (UTC):	20:48:40
Start date (UTC):	19/02/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	20:48:44
Start date (UTC):	19/02/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	20:48:45
Start date (UTC):	19/02/2024
Path:	/usr/libexec/nsurlstoraged
Arguments:	/usr/libexec/nsurlstoraged --privileged
File size:	246624 bytes
MD5 hash:	321b0a40e24b45f0af49ba42742b3f64

Start time (UTC):	20:49:03
Start date (UTC):	19/02/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre