Edit tour

Windows Analysis Report
https://shorturl.at/UrAsB

Overview

General Information

Sample URL:	https://shorturl.at/UrAsB
Analysis ID:	1573962
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7080 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1920,i,5359919322221688024,17665114260448229658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://shorturl.at/UrAsB" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/jsd/r/8f0f9337789b42cf HTTP/1.1Host: www.shorturl.atConnection: keep-aliveContent-Length: 15802sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: */*Origin: https://www.shorturl.atSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0

Source: chromecache_66.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/asap/v30/KFO9CniXp96a4Tc2DaTeuDAoKsE615hGW36MAA.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/asap/v30/KFO9CniXp96a4Tc2DaTeuDAoKsE615hHW36MAA.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/asap/v30/KFO9CniXp96a4Tc2DaTeuDAoKsE615hJW34.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwaPGR_p.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lqDY.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lqDY.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lqDY.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lqDY.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lqDY.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwkxduz8A.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlBduz8A.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmBduz8A.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmRduz8A.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmhduz8A.woff2)
Source: chromecache_67.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmxduz8A.woff2)
Source: chromecache_66.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_66.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_66.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_78.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-25YH9BB08G
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_78.1.dr	String found in binary or memory: https://www.shorturl.at/
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: classification engine

Classification label: clean1.win@17/30@10/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1920,i,5359919322221688024,17665114260448229658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://shorturl.at/UrAsB"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1920,i,5359919322221688024,17665114260448229658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://shorturl.at/UrAsB	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
www.shorturl.at	104.26.8.129	true	false	high
shorturl.at	172.67.69.88	true	false	high
www.google.com	142.250.181.36	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://shorturl.at/UrAsB	false	high
https://www.shorturl.at/cdn-cgi/challenge-platform/h/g/jsd/r/8f0f9337789b42cf	false	high
https://www.shorturl.at/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js?	false	high
https://a.nel.cloudflare.com/report/v4?s=fD1JBlywyeglG%2Fd4%2FLkLf9uBCFcLnL1EBU3ZuFn%2BIQWIcitg3j21uwELZ9NikkBOSliqF2D6jk7Vb45FLflF8EZ9AzhZ72JaY77%2B2a8RF93c1201Aya2eVaX32YUfI5vVg%3D%3D	false	high
https://www.shorturl.at/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js	false	high
https://a.nel.cloudflare.com/report/v4?s=Tsd3fdq9M95oG8psYkbKkRqyPtim2EM2ASSxtA1P1hDNjurx1ThNGlq1JLgQBqqvFWHeOgCdjdGAYQ88LHFLxr1RhjPcYnnTv3Rb%2BWI8AfVX%2F7J6y3DyCT0lBEg3dQwTFQ%3D%3D	false	high
https://www.shorturl.at/error.php	false	high
https://www.shorturl.at/favicon.ico	false	high
https://www.shorturl.at/cdn-cgi/challenge-platform/scripts/jsd/main.js	false	high
https://www.shorturl.at/UrAsB	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	chromecache_66.1.dr	false	high
https://www.youtube.com/iframe_api	chromecache_77.1.dr, chromecache_66.1.dr	false	high
https://stats.g.doubleclick.net/g/collect	chromecache_77.1.dr, chromecache_66.1.dr	false	high
https://www.shorturl.at/	chromecache_78.1.dr	false	high
https://td.doubleclick.net	chromecache_77.1.dr, chromecache_66.1.dr	false	high
https://www.merchant-center-analytics.goog	chromecache_77.1.dr, chromecache_66.1.dr	false	high
https://cct.google/taggy/agent.js	chromecache_77.1.dr, chromecache_66.1.dr	false	high
https://adservice.google.com/pagead/regclk?	chromecache_66.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.9.129	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.69.88	shorturl.at	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.36	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.26.8.129	www.shorturl.at	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573962
Start date and time:	2024-12-12 18:53:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://shorturl.at/UrAsB
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/30@10/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.99, 172.217.17.78, 74.125.131.84, 172.217.17.46, 199.232.214.172, 172.217.19.10, 172.217.17.67, 216.58.208.232, 142.250.181.78, 172.217.17.35, 172.217.19.206, 23.218.208.109, 172.202.163.200
Excluded domains from analysis (whitelisted): clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, www.googletagmanager.com, update.googleapis.com, clients.l.google.com, www.google-analytics.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://shorturl.at/UrAsB

Input	Output
URL: https://shorturl.at Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": true, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://shorturl.at
URL: https://www.shorturl.at/error.php Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Back to Homepage", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://www.shorturl.at/error.php Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Back to Homepage", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://www.shorturl.at/error.php Model: Joe Sandbox AI	{ "brands": "unknown" }

URL: https://www.shorturl.at/error.php Model: Joe Sandbox AI	{ "brands": "unknown" }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 12 16:53:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9847187975280183
Encrypted:	false
SSDEEP:	48:8AOdITswBHDeidAKZdA1FehwiZUklqeh+y+3:8A9vZMhy
MD5:	192382FC8D8DD29D4B2058F2D072FCAB
SHA1:	28AA34DE2E70A62138A192692E0255A035172016
SHA-256:	78EC2A809AD7CF2DD46E6274B5941A5ECED7383F095690BD9E422952AD1FB63F
SHA-512:	AC81A06B5B68ACFF67EE9446D4B6A9351453C3DC973E5A80E6D45CB4D441446739E1C6B79AB51FBD1712C638A34CBC5FE75156328431AE79867AF35301B4B9C2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....qY..L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O..k.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /UrAsB HTTP/1.1Host: shorturl.atConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /UrAsB HTTP/1.1Host: www.shorturl.atConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /error.php HTTP/1.1Host: www.shorturl.atConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1Host: www.shorturl.atConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.shorturl.at/error.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1Host: www.shorturl.atConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.shorturl.atConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.shorturl.at/error.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: www.shorturl.atConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.shorturl.atConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js? HTTP/1.1Host: www.shorturl.atConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js? HTTP/1.1Host: www.shorturl.atConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/8f0f9337789b42cf HTTP/1.1Host: www.shorturl.atConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/8f0f9337789b42cf HTTP/1.1Host: www.shorturl.atConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0

Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Bk:function(){e=nb()},Dd:function(){d()}}};var Vb=xa(["data-gtm-yt-inspected-"]),OD=["www.youtube.com","www.youtube-nocookie.com"],PD,QD=!1; equals www.youtube.com (Youtube)
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=uB(a,c,e);U(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return U(122),!0;if(d&&f){for(var m=yb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},xB=function(){var a=[],b=function(c){return bb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Gh:e,Eh:f,Fh:g,ji:k,ki:m,Ue:n,Jb:b},q=B.YT;if(q)return q.ready&&q.ready(d),b;var r=B.onYouTubeIframeAPIReady;B.onYouTubeIframeAPIReady=function(){r&&r();d()};H(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(ZD(w,"iframe_api")\|\|ZD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!QD&&XD(x[A],p.Ue))return mc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_77.1.dr, chromecache_66.1.dr	String found in binary or memory: var aD=function(a,b,c,d,e){var f=SA("fsl",c?"nv.mwt":"mwt",0),g;g=c?SA("fsl","nv.ids",[]):SA("fsl","ids",[]);if(!g.length)return!0;var k=XA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);U(121);if(m==="https://www.facebook.com/tr/")return U(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!Dz(k,Fz(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: shorturl.at
Source: global traffic	DNS traffic detected: DNS query: www.shorturl.at
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 18:53:32.211973906 CET	53	50288	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:32.222533941 CET	53	60584	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:32.988035917 CET	52165	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:32.988166094 CET	63384	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:33.128092051 CET	53	52165	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:33.143420935 CET	53	63384	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:34.830667973 CET	56234	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:34.830779076 CET	61374	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:34.974566936 CET	53	56234	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:34.974962950 CET	53	61374	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:35.168876886 CET	53	60086	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:36.898993015 CET	65061	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:36.899157047 CET	51402	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:37.040122032 CET	53	65061	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:37.040337086 CET	53	51402	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:38.820630074 CET	53	58591	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:40.501724005 CET	51702	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:40.501854897 CET	50349	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:40.640475988 CET	53	51702	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:40.640876055 CET	53	50349	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:41.555738926 CET	53	56859	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:45.306381941 CET	53	54541	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:45.394412994 CET	53	61638	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:51.639094114 CET	60519	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:51.639281034 CET	58034	53	192.168.2.16	1.1.1.1
Dec 12, 2024 18:53:51.776402950 CET	53	60519	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:51.777364969 CET	53	58034	1.1.1.1	192.168.2.16
Dec 12, 2024 18:53:52.086262941 CET	53	49943	1.1.1.1	192.168.2.16
Dec 12, 2024 18:54:11.166266918 CET	53	55239	1.1.1.1	192.168.2.16
Dec 12, 2024 18:54:32.162211895 CET	53	50087	1.1.1.1	192.168.2.16
Dec 12, 2024 18:54:33.582119942 CET	53	57827	1.1.1.1	192.168.2.16
Dec 12, 2024 18:54:36.073065042 CET	138	138	192.168.2.16	192.168.2.255
Dec 12, 2024 18:55:04.759155989 CET	53	59918	1.1.1.1	192.168.2.16

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:34 UTC	659	OUT	GET /UrAsB HTTP/1.1 Host: shorturl.at Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:53:34 UTC	948	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 12 Dec 2024 17:53:34 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close location: https://www.shorturl.at/UrAsB x-xss-protection: 1; mode=block x-content-type-options: nosniff x-nginx-upstream-cache-status: MISS x-server-powered-by: Engintron CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bXPrp35z9x%2BQbdGl5LSiz9ui%2B6kfAahO5mewIs074z8qDuUkTBNsbn8jIXsvL6aiezw5XgQq6npVuHp2wW%2BnqcwyqL5uyIeGgx%2BEEH%2BCMU4lmpwCctlcKmNKEon4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f931f895a43d5-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1560&min_rtt=1537&rtt_var=593&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1237&delivery_rate=1899804&cwnd=241&unsent_bytes=0&cid=638642a231cdcc8b&ts=469&x=0"
2024-12-12 17:53:34 UTC	243	IN	Data Raw: 65 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 68 6f 72 74 75 72 6c 2e 61 74 2f 55 72 41 73 42 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: ed<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.shorturl.at/UrAsB">here</a>.</p></body></html>
2024-12-12 17:53:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:36 UTC	663	OUT	GET /UrAsB HTTP/1.1 Host: www.shorturl.at Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:53:36 UTC	972	IN	HTTP/1.1 302 Found Date: Thu, 12 Dec 2024 17:53:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close location: https://www.shorturl.at/error.php x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff x-nginx-upstream-cache-status: MISS x-server-powered-by: Engintron CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y6zXvgN5sg7rlonnUIAu%2Ft4XTrrCpix%2F7cJjFZnQpu%2FS2PXwzuFZxBZfepFvrI0oEBiCn2sV0ZAHi1zAEbglld81u4e8x2DF3JFic0UV6xrK7tpiHlAXTD2QWO9Vmh0Nzg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f932b1bb7440c-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1649&min_rtt=1619&rtt_var=629&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1241&delivery_rate=1803582&cwnd=252&unsent_bytes=0&cid=09edbee784b6cad2&ts=743&x=0"
2024-12-12 17:53:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:38 UTC	667	OUT	GET /error.php HTTP/1.1 Host: www.shorturl.at Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:53:38 UTC	925	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 17:53:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding x-xss-protection: 1; mode=block x-content-type-options: nosniff x-nginx-upstream-cache-status: HIT x-server-powered-by: Engintron CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6W9Pb0OIo36C77Zz2kl4vsFqYAayogIYopo5Fa3SdjVSGue4kTGQrvQI09LrfUHioxV5v5DI1KtV%2BQXtM%2FxKuW7UQqI%2Baq%2FdOzcURS4mT%2B8f94OqIKdjxuoaY%2BC4XVojYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f9337789b42cf-EWR server-timing: cfL4;desc="?proto=TCP&rtt=13136&min_rtt=1785&rtt_var=7553&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1245&delivery_rate=1635854&cwnd=252&unsent_bytes=0&cid=f3c92f3ed390bb71&ts=478&x=0"
2024-12-12 17:53:38 UTC	444	IN	Data Raw: 33 35 38 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f Data Ascii: 358d<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>404 Page Not Found</title><meta name="description" content="404 Page not found."><meta name="viewpo
2024-12-12 17:53:38 UTC	1369	IN	Data Raw: 79 3d 73 77 61 70 29 3b 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 39 66 39 66 39 3b 66 6f 6e 74 3a 31 34 70 78 20 61 73 61 70 2c 61 72 69 61 6c 7d 68 31 7b 6d 61 72 67 69 6e 3a 30 20 30 20 2d 31 30 70 78 20 30 3b 66 6f 6e 74 3a 62 6f 6c 64 20 33 36 70 78 20 61 73 61 70 2c 61 72 69 61 6c 3b 63 6f 6c 6f 72 3a 23 35 35 35 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 2d 31 70 78 7d 68 32 7b 6d 61 72 67 69 6e 3a 30 20 30 20 2d 31 30 70 78 20 30 3b 66 6f 6e 74 3a 62 6f 6c 64 20 32 36 70 78 20 61 73 61 70 2c 61 72 69 61 6c 3b 63 6f 6c 6f 72 3a 23 35 35 35 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 30 7d 68 33 7b 6d 61 72 67 69 6e 3a 30 20 30 20 2d 31 30 70 78 20 30 3b 66 6f 6e 74 3a 62 6f 6c 64 20 32 30 70 78 20 61 Data Ascii: y=swap);body{margin:0;background:#f9f9f9;font:14px asap,arial}h1{margin:0 0 -10px 0;font:bold 36px asap,arial;color:#555;letter-spacing:-1px}h2{margin:0 0 -10px 0;font:bold 26px asap,arial;color:#555;letter-spacing:0}h3{margin:0 0 -10px 0;font:bold 20px a
2024-12-12 17:53:38 UTC	1369	IN	Data Raw: 74 3a 33 36 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 6c 6f 67 6f 7b 66 6f 6e 74 3a 62 6f 6c 64 20 34 30 70 78 20 61 72 69 61 6c 2c 74 61 68 6f 6d 61 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 7d 2e 74 65 78 74 73 6d 61 6c 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 39 39 39 7d 2e 74 65 78 74 73 6d 61 6c 6c 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 74 65 78 74 6d 65 64 69 75 6d 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 77 6f 72 64 2d 77 72 61 70 3a 6e 6f 72 6d 61 6c 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 6e 6f 72 6d 61 6c 7d 2e 74 65 78 74 62 69 67 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 Data Ascii: t:36px;vertical-align:middle}.logo{font:bold 40px arial,tahoma;color:#222;word-wrap:break-word}.textsmall{font-size:13px;color:#999}.textsmall:hover{text-decoration:none}.textmedium{font-size:14px;word-wrap:normal;word-break:normal}.textbig{font-size:15px
2024-12-12 17:53:38 UTC	1369	IN	Data Raw: 69 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 20 30 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 20 32 30 70 78 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 30 70 78 7d 73 65 63 74 69 6f 6e 23 75 72 6c 62 6f 78 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 20 32 30 70 78 20 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 37 35 38 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 34 70 78 20 23 63 63 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 36 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 33 30 70 78 20 35 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 73 65 63 74 69 6f 6e 23 75 72 6c 62 6f 78 20 68 31 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 Data Ascii: in{display:block;margin:0 auto 0 auto;padding:0 20px;max-width:1000px}section#urlbox{margin:0 auto 20px auto;max-width:758px;box-shadow:0 1px 4px #ccc;border-radius:6px;padding:10px 30px 5px;background:#fff;text-align:center}section#urlbox h1{margin:10px
2024-12-12 17:53:38 UTC	1369	IN	Data Raw: 6c 20 23 66 6f 72 6d 62 75 74 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 2d 63 65 6c 6c 3b 77 69 64 74 68 3a 31 25 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 23 66 6f 72 6d 75 72 6c 20 69 6e 70 75 74 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 2c 23 66 6f 72 6d 75 72 6c 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 7b 68 65 69 67 68 74 3a 35 36 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 31 36 70 78 3b 66 6f 6e 74 3a 62 6f 6c 64 20 31 37 70 78 20 6c 61 74 6f 2c 61 72 69 61 6c 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 63 38 37 63 35 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 76 65 72 Data Ascii: l #formbutton{display:table-cell;width:1%;box-sizing:border-box;vertical-align:middle}#formurl input[type=button],#formurl input[type=submit]{height:56px;padding:10px 16px;font:bold 17px lato,arial;color:#fff;background-color:#2c87c5;text-align:center;ver
2024-12-12 17:53:38 UTC	1369	IN	Data Raw: 63 35 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 62 6f 72 64 65 72 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 31 70 78 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 62 75 74 74 6f 6e 3b 6d 61 72 67 69 6e 3a 30 7d 66 6f 6f 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 3a 31 37 70 78 20 22 73 6f 75 72 63 65 20 73 61 6e Data Ascii: c5;text-align:center;vertical-align:middle;cursor:pointer;white-space:nowrap;border:0;border-radius:3px;border-top-left-radius:0;border-bottom-left-radius:0;margin-left:-1px;-webkit-appearance:button;margin:0}footer{text-align:center;font:17px "source san
2024-12-12 17:53:38 UTC	1369	IN	Data Raw: 6f 72 6d 61 6c 20 31 36 70 78 20 6c 61 74 6f 2c 61 72 69 61 6c 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 63 38 37 63 35 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 62 6f 72 64 65 72 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 7d 23 62 75 74 74 6f 6e 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 7d 2e 66 6f 72 6d 74 65 78 74 7b 66 6f 6e 74 3a 31 38 70 78 20 6c 61 74 6f 2c 61 72 69 61 6c 3b 63 6f 6c 6f 72 3a 23 32 32 32 7d 2e 66 6f 72 6d 65 6d 61 69 6c 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2a 7b 62 6f 78 Data Ascii: ormal 16px lato,arial;color:#fff;background-color:#2c87c5;text-align:center;vertical-align:middle;cursor:pointer;white-space:nowrap;border:0;border-radius:3px}#button{text-align:right}.formtext{font:18px lato,arial;color:#222}.formemail{display:none}*{box
2024-12-12 17:53:38 UTC	1369	IN	Data Raw: 69 6e 3a 33 30 70 78 20 61 75 74 6f 20 30 3b 66 6f 6e 74 3a 31 37 70 78 20 22 73 6f 75 72 63 65 20 73 61 6e 73 20 70 72 6f 22 2c 61 72 69 61 6c 3b 63 6f 6c 6f 72 3a 23 32 30 32 30 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 6d 61 78 2d 77 69 64 74 68 3a 33 35 30 70 78 7d 2e 65 62 75 74 74 6f 6e 7b 6d 61 72 67 69 6e 3a 34 30 70 78 20 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6c 6f 72 62 75 74 74 6f 6e 6d 65 64 69 75 6d 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 63 38 37 63 35 3b 66 6f 6e 74 3a 31 36 70 78 20 6c 61 74 6f 2c 61 72 69 61 6c 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 32 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 Data Ascii: in:30px auto 0;font:17px "source sans pro",arial;color:#202020;text-align:center;line-height:1.5;max-width:350px}.ebutton{margin:40px auto;text-align:center}.colorbuttonmedium{background:#2c87c5;font:16px lato,arial;color:#fff;padding:12px 20px;border-rad
2024-12-12 17:53:38 UTC	1369	IN	Data Raw: 61 78 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 20 37 70 78 20 38 70 78 20 37 70 78 7d 23 63 73 73 6d 65 6e 75 2e 65 78 70 61 6e 64 20 75 6c 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 23 63 73 73 6d 65 6e 75 20 75 6c 20 6c 69 7b 66 6c 6f 61 74 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 6e 6f 6e 65 7d 23 63 73 73 6d 65 6e 75 20 75 6c 20 6c 69 3a 6e 74 68 2d 63 68 69 6c 64 28 6e 2b 32 29 7b 6d 61 72 67 69 6e 3a 30 20 31 30 70 78 3b 70 61 64 64 69 6e 67 3a 38 70 78 20 30 20 32 38 70 78 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 30 30 31 31 32 31 7d 23 63 73 73 6d 65 6e 75 20 75 6c 20 6c 69 Data Ascii: ax-height:24px;overflow:hidden;margin:0 7px 8px 7px}#cssmenu.expand ul{max-height:100%}#cssmenu ul li{float:none;background:0 0;border-right:none}#cssmenu ul li:nth-child(n+2){margin:0 10px;padding:8px 0 28px;border-bottom:1px solid #001121}#cssmenu ul li
2024-12-12 17:53:38 UTC	1369	IN	Data Raw: 3c 2f 68 32 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 62 6f 78 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 74 72 79 69 6e 67 20 74 6f 20 61 63 63 65 73 73 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 6f 75 72 20 68 65 6c 70 2c 20 79 6f 75 20 63 61 6e 20 63 6f 6e 74 61 63 74 20 75 73 2e 3c 2f 64 69 76 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 62 75 74 74 6f 6e 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 68 6f 72 74 75 72 6c 2e 61 74 2f 22 20 63 6c 61 73 73 3d 22 63 6f 6c 6f 72 62 75 74 74 6f 6e 6d 65 64 69 75 6d 22 3e 42 61 63 6b 20 74 6f 20 48 6f 6d 65 70 61 67 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 62 72 3e 0d 0a 09 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a Data Ascii: </h2><div class="ebox">The page you are trying to access is unavailable. If you need our help, you can contact us.</div><div class="ebutton"><a href="https://www.shorturl.at/" class="colorbuttonmedium">Back to Homepage</a></div><br></section>

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:40 UTC	587	OUT	GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1 Host: www.shorturl.at Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.shorturl.at/error.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:53:40 UTC	752	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 17:53:40 GMT Content-Type: application/javascript Content-Length: 12332 Connection: close Last-Modified: Fri, 06 Dec 2024 15:31:09 GMT ETag: "675318bd-302c" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IglLjy82hlwXXZXS82x6RVKPObagKbFyrywW4je9uWc%2FClTFRBgiZ6LZY8HVoKs2mzRb4zUEmN52u2bQP%2BWehGTAwplvi2cDqNttlghju5qTQE8MlEAjViSdwyyTKel3gQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f9342effb7c7c-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Sat, 14 Dec 2024 17:53:40 GMT Cache-Control: max-age=172800 Cache-Control: public Accept-Ranges: bytes
2024-12-12 17:53:40 UTC	1369	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 22 63 66 2d 6d 61 72 6b 65 72 2d 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2e 74 6f 53 74 72 69 6e 67 28 29 2e 73 6c 69 63 65 28 32 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 28 6e 3d 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 7c 7c 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 29 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 6e 2c 5b 63 6f 6e 73 6f 6c 65 2c 22 5b 52 4f 43 4b 45 54 20 4c 4f 41 44 45 52 5d 20 22 5d 2e 63 6f 6e 63 61 74 28 74 29 29 3b 76 61 72 20 6e 7d 66 75 6e 63 Data Ascii: !function(){"use strict";function t(){return"cf-marker-"+Math.random().toString().slice(2)}function e(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];(n=console.warn\|\|console.log).call.apply(n,[console,"[ROCKET LOADER] "].concat(t));var n}func
2024-12-12 17:53:40 UTC	1369	IN	Data Raw: 20 66 28 74 29 7b 69 66 28 74 26 26 22 68 61 6e 64 6c 65 45 76 65 6e 74 22 69 6e 20 74 29 7b 76 61 72 20 65 3d 74 2e 68 61 6e 64 6c 65 45 76 65 6e 74 3b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 3f 65 2e 62 69 6e 64 28 74 29 3a 65 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 68 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 74 2c 6e 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 3b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 29 2e 66 6f 72 45 61 63 68 28 72 29 7d 66 75 6e 63 74 69 6f 6e 20 76 28 29 Data Ascii: f(t){if(t&&"handleEvent"in t){var e=t.handleEvent;return"function"==typeof e?e.bind(t):e}return t}function h(t,e,n){var r=n?function(t){return e.insertBefore(t,n)}:function(t){return e.appendChild(t)};Array.prototype.slice.call(t).forEach(r)}function v()
2024-12-12 17:53:40 UTC	1369	IN	Data Raw: 63 65 3a 74 2c 62 6c 6f 63 6b 69 6e 67 3a 21 31 2c 64 6f 63 57 72 69 74 65 53 69 6d 75 6c 61 74 6f 72 3a 6e 2c 63 61 6c 6c 62 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 5f 5f 63 66 52 4c 55 6e 62 6c 6f 63 6b 48 61 6e 64 6c 65 72 73 3d 21 30 2c 72 2e 72 65 6d 6f 76 65 50 72 65 6c 6f 61 64 48 69 6e 74 73 28 29 2c 50 28 74 29 7d 7d 29 3b 72 2e 69 6e 73 65 72 74 50 72 65 6c 6f 61 64 48 69 6e 74 73 28 29 2c 4d 2e 72 75 6e 4f 6e 4c 6f 61 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 72 75 6e 28 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 50 28 74 29 7b 76 61 72 20 65 3d 6e 65 77 20 4f 28 74 29 3b 4d 2e 73 69 6d 75 6c 61 74 65 53 74 61 74 65 42 65 66 6f 72 65 44 65 66 65 72 53 63 72 69 70 74 73 41 63 74 69 76 61 74 69 6f 6e 28 29 2c 65 2e 68 61 Data Ascii: ce:t,blocking:!1,docWriteSimulator:n,callback:function(){window.__cfRLUnblockHandlers=!0,r.removePreloadHints(),P(t)}});r.insertPreloadHints(),M.runOnLoad(function(){r.run()})}function P(t){var e=new O(t);M.simulateStateBeforeDeferScriptsActivation(),e.ha
2024-12-12 17:53:40 UTC	1369	IN	Data Raw: 68 3e 30 7d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 74 65 6d 73 2e 70 6f 70 28 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 68 69 73 2e 69 74 65 6d 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 73 63 72 69 70 74 3b 72 65 74 75 72 6e 20 74 28 6e 29 7d 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 72 76 65 73 74 53 63 72 69 70 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 2c 72 3d 65 2e 66 69 6c 74 65 72 2c 6f 3d 65 2e 6d 75 74 61 74 65 Data Ascii: h>0},enumerable:!0,configurable:!0}),t.prototype.pop=function(){return this.items.pop()},t.prototype.forEach=function(t){this.items.forEach(function(e){var n=e.script;return t(n)})},t.prototype.harvestScripts=function(t,e){var n=this,r=e.filter,o=e.mutate
2024-12-12 17:53:40 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 29 7b 65 2e 69 73 50 65 6e 64 69 6e 67 44 65 66 65 72 53 63 72 69 70 74 28 74 29 26 26 65 2e 6d 61 6b 65 4e 6f 6e 45 78 65 63 75 74 61 62 6c 65 28 74 29 7d 7d 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 72 65 61 74 65 50 6c 61 63 65 68 6f 6c 64 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 43 6f 6d 6d 65 6e 74 28 74 2e 6f 75 74 65 72 48 54 4d 4c 29 7d 2c 65 7d 28 44 29 2c 4f 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 26 26 74 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 74 68 69 73 7d 72 65 74 75 72 6e 20 79 28 65 2c 74 29 2c 65 2e 70 72 6f 74 6f 74 79 Data Ascii: function(t){e.isPendingDeferScript(t)&&e.makeNonExecutable(t)}})},e.prototype.createPlaceholder=function(t){return document.createComment(t.outerHTML)},e}(D),O=function(t){function e(){return null!==t&&t.apply(this,arguments)\|\|this}return y(e,t),e.prototy
2024-12-12 17:53:40 UTC	1369	IN	Data Raw: 66 65 72 2b 22 3c 2f 68 65 61 64 3e 22 2c 6f 3d 74 2e 70 61 72 73 65 46 72 6f 6d 53 74 72 69 6e 67 28 65 2c 22 74 65 78 74 2f 68 74 6d 6c 22 29 3b 69 66 28 74 68 69 73 2e 73 63 72 69 70 74 53 74 61 63 6b 2e 68 61 72 76 65 73 74 53 63 72 69 70 74 73 41 66 74 65 72 44 6f 63 57 72 69 74 65 28 6f 29 2c 6e 28 6f 2e 68 65 61 64 2e 63 68 69 6c 64 4e 6f 64 65 73 2c 74 68 69 73 2e 69 6e 73 65 72 74 69 6f 6e 50 6f 69 6e 74 4d 61 72 6b 65 72 29 2c 6f 2e 62 6f 64 79 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 29 7b 66 6f 72 28 76 61 72 20 69 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 6f 2e 62 6f 64 79 2e 63 68 69 6c 64 4e 6f 64 65 73 29 2c 61 3d 74 68 69 73 2e 69 6e 73 65 72 74 69 6f 6e 50 6f 69 6e 74 4d 61 72 6b 65 Data Ascii: fer+"</head>",o=t.parseFromString(e,"text/html");if(this.scriptStack.harvestScriptsAfterDocWrite(o),n(o.head.childNodes,this.insertionPointMarker),o.body.childNodes.length){for(var i=Array.prototype.slice.call(o.body.childNodes),a=this.insertionPointMarke
2024-12-12 17:53:40 UTC	1369	IN	Data Raw: 63 68 61 6e 67 65 22 29 2c 74 68 69 73 2e 70 72 6f 78 79 49 6e 6c 69 6e 65 48 61 6e 64 6c 65 72 28 77 69 6e 64 6f 77 2c 22 6f 6e 6c 6f 61 64 22 29 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 26 26 74 68 69 73 2e 70 72 6f 78 79 49 6e 6c 69 6e 65 48 61 6e 64 6c 65 72 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2c 22 6f 6e 6c 6f 61 64 22 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 69 6d 75 6c 61 74 65 53 74 61 74 65 42 65 66 6f 72 65 44 65 66 65 72 53 63 72 69 70 74 73 41 63 74 69 76 61 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 62 79 70 61 73 73 45 76 65 6e 74 73 49 6e 50 72 6f 78 69 65 73 3d 21 30 2c 74 68 69 73 2e 73 69 6d 75 6c 61 74 65 64 52 65 61 64 79 53 74 61 74 65 3d 22 69 6e 74 65 72 61 63 74 69 76 65 22 2c 6c 28 64 6f 63 75 6d Data Ascii: change"),this.proxyInlineHandler(window,"onload"),document.body&&this.proxyInlineHandler(document.body,"onload")},t.prototype.simulateStateBeforeDeferScriptsActivation=function(){this.bypassEventsInProxies=!0,this.simulatedReadyState="interactive",l(docum
2024-12-12 17:53:40 UTC	1369	IN	Data Raw: 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 6e 5b 6f 2d 32 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 69 3d 65 26 26 65 2e 5f 5f 72 6f 63 6b 65 74 4c 6f 61 64 65 72 50 72 6f 78 69 65 64 48 61 6e 64 6c 65 72 7c 7c 65 3b 72 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 72 2c 5b 74 68 69 73 2c 74 2c 69 5d 2e 63 6f 6e 63 61 74 28 6e 29 29 7d 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 78 79 49 6e 6c 69 6e 65 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 72 79 7b 76 61 72 20 6e 3d 74 5b 65 5d 3b 69 66 28 6e 26 26 21 6e 2e 5f 5f 72 6f 63 6b 65 74 4c 6f 61 64 65 72 49 6e 6c 69 6e 65 48 61 6e 64 6c 65 72 50 72 6f 78 79 29 7b 76 61 72 20 72 3d 74 68 69 73 3b 74 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 Data Ascii: rguments.length;o++)n[o-2]=arguments[o];var i=e&&e.__rocketLoaderProxiedHandler\|\|e;r.call.apply(r,[this,t,i].concat(n))}},t.prototype.proxyInlineHandler=function(t,e){try{var n=t[e];if(n&&!n.__rocketLoaderInlineHandlerProxy){var r=this;t[e]=function(t){if
2024-12-12 17:53:40 UTC	1369	IN	Data Raw: 20 6e 3d 65 2e 73 65 74 74 69 6e 67 73 2e 64 6f 63 57 72 69 74 65 53 69 6d 75 6c 61 74 6f 72 2c 72 3d 65 2e 73 63 72 69 70 74 53 74 61 63 6b 2e 70 6f 70 28 29 3b 6e 26 26 21 72 2e 61 73 79 6e 63 26 26 6e 2e 65 6e 61 62 6c 65 28 72 2e 70 6c 61 63 65 68 6f 6c 64 65 72 29 3b 76 61 72 20 6f 3d 65 2e 61 63 74 69 76 61 74 65 53 63 72 69 70 74 28 72 29 3b 72 65 74 75 72 6e 20 6f 3f 72 2e 65 78 74 65 72 6e 61 6c 26 26 72 2e 65 78 65 63 75 74 61 62 6c 65 26 26 21 72 2e 61 73 79 6e 63 3f 28 75 28 6f 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 66 69 6e 61 6c 69 7a 65 41 63 74 69 76 61 74 69 6f 6e 28 72 29 2c 74 2e 72 75 6e 28 29 7d 29 2c 7b 76 61 6c 75 65 3a 76 6f 69 64 20 30 7d 29 3a 76 6f 69 64 20 65 2e 66 69 6e 61 6c 69 7a 65 41 63 74 69 76 61 74 69 6f 6e 28 72 29 Data Ascii: n=e.settings.docWriteSimulator,r=e.scriptStack.pop();n&&!r.async&&n.enable(r.placeholder);var o=e.activateScript(r);return o?r.external&&r.executable&&!r.async?(u(o,function(){t.finalizeActivation(r),t.run()}),{value:void 0}):void e.finalizeActivation(r)
2024-12-12 17:53:40 UTC	11	IN	Data Raw: 2e 22 29 7d 28 29 7d 28 29 3b 0a Data Ascii: .")}()}();

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:41 UTC	402	OUT	GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1 Host: www.shorturl.at Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:53:42 UTC	754	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 17:53:42 GMT Content-Type: application/javascript Content-Length: 12332 Connection: close Last-Modified: Fri, 06 Dec 2024 15:31:09 GMT ETag: "675318bd-302c" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IcCAJloWIUGeiR3sDGTK5FlGj3IyYNRQUna%2FLOerjymffEDFuEqnWPzqe4xjRqVZt%2BGSlBREIQzuaW7mGDxAnpGa%2BnkerssvG8n0Tb3srnHdHq2iPry258UdSm9UWuBpEQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f934e6fbd41b4-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Sat, 14 Dec 2024 17:53:42 GMT Cache-Control: max-age=172800 Cache-Control: public Accept-Ranges: bytes
2024-12-12 17:53:42 UTC	615	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 22 63 66 2d 6d 61 72 6b 65 72 2d 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2e 74 6f 53 74 72 69 6e 67 28 29 2e 73 6c 69 63 65 28 32 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 28 6e 3d 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 7c 7c 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 29 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 6e 2c 5b 63 6f 6e 73 6f 6c 65 2c 22 5b 52 4f 43 4b 45 54 20 4c 4f 41 44 45 52 5d 20 22 5d 2e 63 6f 6e 63 61 74 28 74 29 29 3b 76 61 72 20 6e 7d 66 75 6e 63 Data Ascii: !function(){"use strict";function t(){return"cf-marker-"+Math.random().toString().slice(2)}function e(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];(n=console.warn\|\|console.log).call.apply(n,[console,"[ROCKET LOADER] "].concat(t));var n}func
2024-12-12 17:53:42 UTC	1369	IN	Data Raw: 7b 72 65 74 75 72 6e 20 61 28 74 2c 22 22 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 65 28 29 2c 74 29 72 65 74 75 72 6e 20 74 2e 63 61 6c 6c 28 74 68 69 73 2c 6e 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 74 2c 65 29 7b 74 2e 6f 6e 6c 6f 61 64 3d 73 28 74 2e 6f 6e 6c 6f 61 64 2c 65 29 2c 74 2e 6f 6e 65 72 72 6f 72 3d 73 28 74 2e 6f 6e 65 72 72 6f 72 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 74 29 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 4e 53 28 74 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 22 73 63 72 69 70 74 22 29 3b 65 2e 61 73 79 6e 63 3d 74 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 61 73 79 6e 63 22 29 2c 65 2e 74 65 78 74 Data Ascii: {return a(t,"")}function s(t,e){return function(n){if(e(),t)return t.call(this,n)}}function u(t,e){t.onload=s(t.onload,e),t.onerror=s(t.onerror,e)}function p(t){var e=document.createElementNS(t.namespaceURI,"script");e.async=t.hasAttribute("async"),e.text
2024-12-12 17:53:42 UTC	1369	IN	Data Raw: 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 6e 3d 65 2e 73 70 6c 69 74 28 54 29 3b 72 65 74 75 72 6e 7b 6e 6f 6e 63 65 3a 6e 5b 30 5d 2c 68 61 6e 64 6c 65 72 50 72 65 66 69 78 4c 65 6e 67 74 68 3a 2b 6e 5b 31 5d 2c 62 61 69 6c 6f 75 74 3a 21 74 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 65 66 65 72 22 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 28 74 29 7b 76 61 72 20 65 3d 42 2b 74 2e 6e 6f 6e 63 65 3b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 2e 63 61 6c 6c 28 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 22 2b 65 2b 22 5d 22 29 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 65 29 2c 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f Data Ascii: )return null;var n=e.split(T);return{nonce:n[0],handlerPrefixLength:+n[1],bailout:!t.hasAttribute("defer")}}function g(t){var e=B+t.nonce;Array.prototype.forEach.call(document.querySelectorAll("["+e+"]"),function(n){n.removeAttribute(e),Array.prototype.fo
2024-12-12 17:53:42 UTC	1369	IN	Data Raw: 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 31 22 3a 21 30 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 32 22 3a 21 30 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 33 22 3a 21 30 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 34 22 3a 21 30 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 31 2e 35 22 3a 21 30 2c 22 74 65 78 74 2f 6a 73 63 72 69 70 74 22 3a 21 30 2c 22 74 65 78 74 2f 6c 69 76 65 73 63 72 69 70 74 22 3a 21 30 2c 22 74 65 78 74 2f 78 2d 65 63 6d 61 73 63 72 69 70 74 22 3a 21 30 2c 22 74 65 78 74 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 22 3a 21 30 2c 6d 6f 64 75 6c 65 3a 21 30 7d 2c 6b 3d 76 6f 69 64 20 30 21 3d 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 Data Ascii: "text/javascript1.1":!0,"text/javascript1.2":!0,"text/javascript1.3":!0,"text/javascript1.4":!0,"text/javascript1.5":!0,"text/jscript":!0,"text/livescript":!0,"text/x-ecmascript":!0,"text/x-javascript":!0,module:!0},k=void 0!==document.createElement("scri
2024-12-12 17:53:42 UTC	1369	IN	Data Raw: 65 2e 68 61 73 4e 6f 6e 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 30 3d 3d 3d 28 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 74 68 69 73 2e 6e 6f 6e 63 65 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6d 6f 76 65 4e 6f 6e 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 74 79 70 65 3d 74 2e 74 79 70 65 2e 73 75 62 73 74 72 28 74 68 69 73 2e 6e 6f 6e 63 65 2e 6c 65 6e 67 74 68 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 6b 65 4e 6f 6e 45 78 65 63 75 74 61 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 74 79 70 65 3d 74 68 69 73 2e 6e 6f 6e 63 65 2b 74 2e 74 79 70 65 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 50 65 6e 64 69 6e 67 44 65 66 65 72 Data Ascii: e.hasNonce=function(t){return 0===(t.getAttribute("type")\|\|"").indexOf(this.nonce)},t.prototype.removeNonce=function(t){t.type=t.type.substr(this.nonce.length)},t.prototype.makeNonExecutable=function(t){t.type=this.nonce+t.type},t.prototype.isPendingDefer
2024-12-12 17:53:42 UTC	1369	IN	Data Raw: 65 6e 61 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 74 68 69 73 2e 69 6e 73 65 72 74 69 6f 6e 50 6f 69 6e 74 4d 61 72 6b 65 72 3d 74 2c 74 68 69 73 2e 62 75 66 66 65 72 3d 22 22 2c 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 72 65 74 75 72 6e 20 65 2e 77 72 69 74 65 28 74 2c 21 31 29 7d 2c 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 6c 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 5d 3d 61 72 67 Data Ascii: enable=function(t){var e=this;this.insertionPointMarker=t,this.buffer="",document.write=function(){for(var t=[],n=0;n<arguments.length;n++)t[n]=arguments[n];return e.write(t,!1)},document.writeln=function(){for(var t=[],n=0;n<arguments.length;n++)t[n]=arg
2024-12-12 17:53:42 UTC	1369	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 6e 26 26 69 28 6e 29 26 26 6e 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 61 73 79 6e 63 22 29 3f 28 72 3d 65 3f 5f 3a 4c 29 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 72 2c 5b 64 6f 63 75 6d 65 6e 74 5d 2e 63 6f 6e 63 61 74 28 74 29 29 3a 74 68 69 73 2e 62 75 66 66 65 72 2b 3d 74 2e 6d 61 70 28 53 74 72 69 6e 67 29 2e 6a 6f 69 6e 28 65 3f 22 5c 6e 22 3a 22 22 29 3b 76 61 72 20 72 7d 2c 74 7d 28 29 2c 6a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 73 69 6d 75 6c 61 74 65 64 52 65 61 64 79 53 74 61 74 65 3d 22 6c 6f 61 64 69 6e 67 22 2c 74 68 69 73 Data Ascii: te=function(t,e){var n=document.currentScript;n&&i(n)&&n.hasAttribute("async")?(r=e?_:L).call.apply(r,[document].concat(t)):this.buffer+=t.map(String).join(e?"\n":"");var r},t}(),j=function(){function t(){var t=this;this.simulatedReadyState="loading",this
2024-12-12 17:53:42 UTC	1369	IN	Data Raw: 78 69 65 73 3d 21 30 7d 2c 30 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 75 70 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 50 72 6f 78 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 45 76 65 6e 74 54 61 72 67 65 74 3f 5b 45 76 65 6e 74 54 61 72 67 65 74 2e 70 72 6f 74 6f 74 79 70 65 5d 3a 5b 4e 6f 64 65 2e 70 72 6f 74 6f 74 79 70 65 2c 57 69 6e 64 6f 77 2e 70 72 6f 74 6f 74 79 70 65 5d 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 70 61 74 63 68 45 76 65 6e 74 54 61 72 67 65 74 4d 65 74 68 6f 64 73 28 65 29 7d 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 61 74 63 68 45 76 65 6e 74 54 61 72 67 65 74 4d 65 74 68 6f Data Ascii: xies=!0},0)},t.prototype.setupEventListenerProxy=function(){var t=this;("undefined"!=typeof EventTarget?[EventTarget.prototype]:[Node.prototype,Window.prototype]).forEach(function(e){return t.patchEventTargetMethods(e)})},t.prototype.patchEventTargetMetho
2024-12-12 17:53:42 UTC	1369	IN	Data Raw: 22 2c 7b 76 61 6c 75 65 3a 6e 65 77 20 6a 7d 29 2c 74 2e 5f 5f 72 6f 63 6b 65 74 4c 6f 61 64 65 72 4c 6f 61 64 50 72 6f 67 72 65 73 73 53 69 6d 75 6c 61 74 6f 72 7d 28 29 2c 57 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 74 68 69 73 2e 73 63 72 69 70 74 53 74 61 63 6b 3d 74 2c 74 68 69 73 2e 73 65 74 74 69 6e 67 73 3d 65 2c 74 68 69 73 2e 70 72 65 6c 6f 61 64 48 69 6e 74 73 3d 5b 5d 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 73 65 72 74 50 72 65 6c 6f 61 64 48 69 6e 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 73 63 72 69 70 74 53 74 61 63 6b 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 61 28 65 2c 74 2e 73 65 74 74 69 6e Data Ascii: ",{value:new j}),t.__rocketLoaderLoadProgressSimulator}(),W=function(){function t(t,e){this.scriptStack=t,this.settings=e,this.preloadHints=[]}return t.prototype.insertPreloadHints=function(){var t=this;this.scriptStack.forEach(function(e){if(a(e,t.settin
2024-12-12 17:53:42 UTC	765	IN	Data Raw: 69 70 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 74 2e 73 63 72 69 70 74 2c 72 3d 74 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 6f 3d 74 2e 65 78 74 65 72 6e 61 6c 2c 69 3d 74 2e 61 73 79 6e 63 2c 61 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 69 66 28 21 64 6f 63 75 6d 65 6e 74 2e 63 6f 6e 74 61 69 6e 73 28 72 29 29 72 65 74 75 72 6e 20 65 28 22 50 6c 61 63 65 68 6f 6c 64 65 72 20 66 6f 72 20 73 63 72 69 70 74 20 5c 6e 22 2b 6e 2e 6f 75 74 65 72 48 54 4d 4c 2b 22 5c 6e 20 77 61 73 20 64 65 74 61 63 68 65 64 20 66 72 6f 6d 20 64 6f 63 75 6d 65 6e 74 2e 22 2c 22 53 63 72 69 70 74 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 65 78 65 63 75 74 65 64 2e 22 29 2c 6e 75 6c 6c 3b 76 61 72 20 63 3d 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 62 6c 6f 63 6b 69 Data Ascii: ipt=function(t){var n=t.script,r=t.placeholder,o=t.external,i=t.async,a=r.parentNode;if(!document.contains(r))return e("Placeholder for script \n"+n.outerHTML+"\n was detached from document.","Script will not be executed."),null;var c=this.settings.blocki

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5945)
Category:	downloaded
Size (bytes):	332912
Entropy (8bit):	5.5781779832147995
Encrypted:	false
SSDEEP:	6144:z4ooGUiz8zXNiZD9Wy9nnQyDy4VEx7D4xge8:EofzCXaD58rZ
MD5:	8A47757777ABA578E6232497A8604595
SHA1:	A6DBA8E00CDF8622B6AAC5687DC03BADF7CDE09A
SHA-256:	87C5064760161A7CE208EAF7555BFC790DE970F6EED754D94CA5B04144B725E9
SHA-512:	D0868606906CCD012FEA3D349AFCA3B78D20C8047EE187D24019F800E16DD966944EF308948C1A2A4B95DE479A25B2BF6BE1F94B4F6E8E2A94F98C690C0B1981
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-25YH9BB08G
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_dma","priority":13,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":8},{"function":"__ogt_1p_data_v2","priority":13,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_l

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	10276
Entropy (8bit):	5.458768610856901
Encrypted:	false
SSDEEP:	192:cNprUJ40rJ/M1C2MQk6vj+n6B3L0GgRqbPW33uzRZJ:cWGhDSw
MD5:	8D6974B092DF28C5BE785505F8BCAC3A
SHA1:	D392FCCA4828B893151E6441B19A7AEF3F8EB880
SHA-256:	79BF8BF9F27E983DE44FBD6BAA6D5F1269915C54460515EB66DF502C3204915A
SHA-512:	4E1764980DA54127DE8185734476BA86D84927F8937B2D62CCC80DB9B62BEA0CA974795D179E621D582FB03AC431682ECCCFB558CD5A01DD7D20F412FE164D5A
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Asap:400,700\|Lato:400,700,900\|Source+Sans+Pro:400,700&display=swap"
Preview:	/* vietnamese /.@font-face {. font-family: 'Asap';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/asap/v30/KFO9CniXp96a4Tc2DaTeuDAoKsE615hGW36MAA.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext /.@font-face {. font-family: 'Asap';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/asap/v30/KFO9CniXp96a4Tc2DaTeuDAoKsE615hHW36MAA.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'Asap';. font-style: normal;. font-weight: 400;. font-stretch: 100%;.

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:45 UTC	595	OUT	GET /favicon.ico HTTP/1.1 Host: www.shorturl.at Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.shorturl.at/error.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:53:45 UTC	1036	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 17:53:45 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close vary: Accept-Encoding last-modified: Sat, 14 Oct 2023 19:26:22 GMT expires: Sat, 01 Feb 2025 06:39:10 GMT Cache-Control: max-age=5184000 x-xss-protection: 1; mode=block x-content-type-options: nosniff x-nginx-upstream-cache-status: STALE x-server-powered-by: Engintron CF-Cache-Status: HIT Age: 818075 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2OrtkjL%2BEd3LRn63zC6JbykbssmdM8PqboE0jvvfq%2Fwd9xEaqUsX5JMJIkn8sy%2FKgKPH3%2BsOe5EUy7Afi6wPSgkcS5zb7jR1qB0btnsCaa9w9fQFiP5mlmH77O0D0Bq2gg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f93655f2f9e02-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1837&min_rtt=1831&rtt_var=699&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1173&delivery_rate=1553191&cwnd=244&unsent_bytes=0&cid=2627b19ede0ed0d8&ts=483&x=0"
2024-12-12 17:53:45 UTC	333	IN	Data Raw: 34 37 65 0d 0a 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e2 76 3e 31 e2 76 3e 97 e2 76 3e d8 e2 76 3e f9 e2 76 3e f9 e2 76 3e d8 e2 76 3e 97 e2 76 3e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e2 76 3e 09 e2 76 3e 9a e2 76 3e fe e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e fe e2 76 3e 9a e2 76 3e 09 00 00 00 00 00 00 00 00 00 00 00 00 e2 76 3e 09 e2 76 3e c1 e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e c1 e2 76 3e 09 Data Ascii: 47e h( v>1v>v>v>v>v>v>v>1v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>
2024-12-12 17:53:45 UTC	824	IN	Data Raw: 5a ff e7 db d4 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff e7 db d4 ff e2 88 5a ff e2 76 3e fe e2 76 3e 31 e2 76 3e 97 e2 76 3e ff e2 92 68 ff f4 f5 f6 ff f8 f8 f9 ff f8 f8 f9 ff f8 f8 f9 ff f8 f8 f9 ff f9 fa fa ff f4 f5 f6 ff ee ef f0 ff ee ef f0 ff f4 f5 f6 ff e2 92 68 ff e2 76 3e ff e2 76 3e 97 e2 76 3e da e2 76 3e ff e2 92 68 ff f4 f5 f6 ff f1 f2 f3 ff f1 f2 f3 ff f1 f2 f3 ff f1 f2 f3 ff f4 f5 f6 ff ee ef f0 ff e4 e6 e8 ff e4 e6 e8 ff f4 f5 f6 ff e2 92 68 ff e2 76 3e ff e2 76 3e d9 e2 76 3e f9 e2 76 3e ff e2 92 68 ff f4 f5 f6 ff f4 f5 f6 ff f4 f5 f6 ff f4 f5 f6 ff f4 f5 f6 ff f7 f7 f8 ff ee ef f0 ff e4 e6 e8 ff e4 e6 e8 ff f4 f5 f6 ff e2 92 68 ff e2 76 3e ff e2 76 3e f9 e2 76 3e f9 e2 76 3e ff e2 Data Ascii: ZZv>v>1v>v>hhv>v>v>v>hhv>v>v>v>hhv>v>v>v>
2024-12-12 17:53:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:45 UTC	526	OUT	GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1 Host: www.shorturl.at Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:53:46 UTC	888	IN	HTTP/1.1 302 Found Date: Thu, 12 Dec 2024 17:53:45 GMT Content-Length: 0 Connection: close location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js? cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public access-control-allow-origin: * Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JYtzljRNBdkYDqVEiSBxHz%2BU3zUnA34FStM7k7a6aYYtme1CdESdXrgyE8%2B9KzxChQLmAFm%2B2wUEQu%2BQ%2F6tB1me7QUNIBXbNCVONDt5kgLpVxqpT8mmBtw3JYRXOt5DoZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f93665e3f7d0e-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1790&rtt_var=895&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4188&recv_bytes=1104&delivery_rate=118472&cwnd=242&unsent_bytes=0&cid=b36ec9ef6e9061bf&ts=479&x=0"

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:47 UTC	444	OUT	GET /favicon.ico HTTP/1.1 Host: www.shorturl.at Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
2024-12-12 17:53:47 UTC	1036	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 17:53:47 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close vary: Accept-Encoding last-modified: Sat, 14 Oct 2023 19:26:22 GMT expires: Sat, 01 Feb 2025 06:39:10 GMT Cache-Control: max-age=5184000 x-xss-protection: 1; mode=block x-content-type-options: nosniff x-nginx-upstream-cache-status: STALE x-server-powered-by: Engintron CF-Cache-Status: HIT Age: 818077 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n9Z5dYE1Ar93YFdgAJPw7%2FZKSqLU1TrPH9CGd0bNs7bvTSrqOnaLa1x4Y6eewIlhcGcs0mOFiMOdu70wZc%2B358raO6T%2BTYix701pYfWnA6JALTUI1pEj34ElhwtgiIlb%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f936fe851de93-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1545&rtt_var=602&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1022&delivery_rate=1889967&cwnd=248&unsent_bytes=0&cid=a71e8210490f674d&ts=471&x=0"
2024-12-12 17:53:47 UTC	333	IN	Data Raw: 34 37 65 0d 0a 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e2 76 3e 31 e2 76 3e 97 e2 76 3e d8 e2 76 3e f9 e2 76 3e f9 e2 76 3e d8 e2 76 3e 97 e2 76 3e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e2 76 3e 09 e2 76 3e 9a e2 76 3e fe e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e fe e2 76 3e 9a e2 76 3e 09 00 00 00 00 00 00 00 00 00 00 00 00 e2 76 3e 09 e2 76 3e c1 e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e ff e2 76 3e c1 e2 76 3e 09 Data Ascii: 47e h( v>1v>v>v>v>v>v>v>1v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>v>
2024-12-12 17:53:47 UTC	824	IN	Data Raw: 5a ff e7 db d4 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff ea de d8 ff e7 db d4 ff e2 88 5a ff e2 76 3e fe e2 76 3e 31 e2 76 3e 97 e2 76 3e ff e2 92 68 ff f4 f5 f6 ff f8 f8 f9 ff f8 f8 f9 ff f8 f8 f9 ff f8 f8 f9 ff f9 fa fa ff f4 f5 f6 ff ee ef f0 ff ee ef f0 ff f4 f5 f6 ff e2 92 68 ff e2 76 3e ff e2 76 3e 97 e2 76 3e da e2 76 3e ff e2 92 68 ff f4 f5 f6 ff f1 f2 f3 ff f1 f2 f3 ff f1 f2 f3 ff f1 f2 f3 ff f4 f5 f6 ff ee ef f0 ff e4 e6 e8 ff e4 e6 e8 ff f4 f5 f6 ff e2 92 68 ff e2 76 3e ff e2 76 3e d9 e2 76 3e f9 e2 76 3e ff e2 92 68 ff f4 f5 f6 ff f4 f5 f6 ff f4 f5 f6 ff f4 f5 f6 ff f4 f5 f6 ff f7 f7 f8 ff ee ef f0 ff e4 e6 e8 ff e4 e6 e8 ff f4 f5 f6 ff e2 92 68 ff e2 76 3e ff e2 76 3e f9 e2 76 3e f9 e2 76 3e ff e2 Data Ascii: ZZv>v>1v>v>hhv>v>v>v>hhv>v>v>v>hhv>v>v>v>
2024-12-12 17:53:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:47 UTC	638	OUT	GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js? HTTP/1.1 Host: www.shorturl.at Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
2024-12-12 17:53:47 UTC	862	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 17:53:47 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 8794 Connection: close cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FBo3zDB7j9W5WjM10QIpHbvQw%2FB2da1wxLN3S5WeNiG1HksVqMFEqjNOGyMi6%2Fu8iItIXivfeZauiEyZlcm7I7iEW4MSTybxJJpfJ7TDMiPr9KqFFl9lQK7Uhq0%2FSmHQeg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f93714887c33d-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1661&min_rtt=1661&rtt_var=830&sent=7&recv=8&lost=0&retrans=1&sent_bytes=4190&recv_bytes=1216&delivery_rate=71765&cwnd=138&unsent_bytes=0&cid=a17c5181427a2299&ts=492&x=0"
2024-12-12 17:53:47 UTC	507	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 46 50 57 76 3a 27 67 27 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 57 2c 68 2c 69 2c 6a 2c 6b 2c 6f 2c 73 2c 42 29 7b 57 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 64 2c 65 2c 56 2c 66 2c 67 29 7b 66 6f 72 28 56 3d 62 2c 66 3d 64 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 67 3d 2d 70 61 72 73 65 49 6e 74 28 56 28 34 35 34 29 29 2f 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 56 28 34 38 34 29 29 2f 32 29 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 34 32 32 29 29 2f 33 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 34 33 30 29 29 2f 34 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 34 31 36 29 29 2f 35 2a 28 70 61 72 73 65 49 6e 74 28 56 28 34 32 36 29 29 2f 36 29 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 35 32 33 29 29 2f 37 2a 28 Data Ascii: window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,j,k,o,s,B){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=-parseInt(V(454))/1(-parseInt(V(484))/2)+-parseInt(V(422))/3+-parseInt(V(430))/4+-parseInt(V(416))/5(parseInt(V(426))/6)+-parseInt(V(523))/7*(
2024-12-12 17:53:47 UTC	1369	IN	Data Raw: 27 6e 27 2c 6a 5b 57 28 34 38 31 29 5d 3d 27 49 27 2c 6a 5b 57 28 34 35 36 29 5d 3d 27 62 27 2c 6b 3d 6a 2c 68 5b 57 28 34 39 33 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 45 2c 46 2c 47 2c 61 31 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 29 7b 69 66 28 61 31 3d 57 2c 45 3d 3d 3d 6e 75 6c 6c 7c 7c 45 3d 3d 3d 76 6f 69 64 20 30 29 72 65 74 75 72 6e 20 47 3b 66 6f 72 28 49 3d 6e 28 45 29 2c 67 5b 61 31 28 34 39 36 29 5d 5b 61 31 28 35 30 34 29 5d 26 26 28 49 3d 49 5b 61 31 28 34 37 38 29 5d 28 67 5b 61 31 28 34 39 36 29 5d 5b 61 31 28 35 30 34 29 5d 28 45 29 29 29 2c 49 3d 67 5b 61 31 28 34 31 31 29 5d 5b 61 31 28 35 31 36 29 5d 26 26 67 5b 61 31 28 35 30 37 29 5d 3f 67 5b 61 31 28 34 31 31 29 5d 5b 61 31 28 35 31 36 29 5d 28 6e 65 77 20 67 5b 28 61 31 28 35 30 37 Data Ascii: 'n',j[W(481)]='I',j[W(456)]='b',k=j,h[W(493)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,E===null\|\|E===void 0)return G;for(I=n(E),g[a1(496)][a1(504)]&&(I=I[a1(478)](g[a1(496)][a1(504)](E))),I=g[a1(411)][a1(516)]&&g[a1(507)]?g[a1(411)][a1(516)](new g[(a1(507
2024-12-12 17:53:47 UTC	1369	IN	Data Raw: 31 34 29 5d 5b 61 65 28 34 38 38 29 5d 28 49 2c 54 29 29 4b 3d 54 3b 65 6c 73 65 7b 69 66 28 4f 62 6a 65 63 74 5b 61 65 28 34 35 31 29 5d 5b 61 65 28 34 31 34 29 5d 5b 61 65 28 34 38 38 29 5d 28 4a 2c 4b 29 29 7b 69 66 28 32 35 36 3e 4b 5b 61 65 28 34 34 34 29 5d 28 30 29 29 7b 66 6f 72 28 48 3d 30 3b 48 3c 4e 3b 50 3c 3c 3d 31 2c 51 3d 3d 46 2d 31 3f 28 51 3d 30 2c 4f 5b 61 65 28 34 31 35 29 5d 28 47 28 50 29 29 2c 50 3d 30 29 3a 51 2b 2b 2c 48 2b 2b 29 3b 66 6f 72 28 55 3d 4b 5b 61 65 28 34 34 34 29 5d 28 30 29 2c 48 3d 30 3b 38 3e 48 3b 50 3d 55 26 31 2e 31 36 7c 50 3c 3c 31 2c 51 3d 3d 46 2d 31 3f 28 51 3d 30 2c 4f 5b 61 65 28 34 31 35 29 5d 28 47 28 50 29 29 2c 50 3d 30 29 3a 51 2b 2b 2c 55 3e 3e 3d 31 2c 48 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 Data Ascii: 14)][ae(488)](I,T))K=T;else{if(Object[ae(451)][ae(414)][ae(488)](J,K)){if(256>K[ae(444)](0)){for(H=0;H<N;P<<=1,Q==F-1?(Q=0,O[ae(415)](G(P)),P=0):Q++,H++);for(U=K[ae(444)](0),H=0;8>H;P=U&1.16\|P<<1,Q==F-1?(Q=0,O[ae(415)](G(P)),P=0):Q++,U>>=1,H++);}else{for(
2024-12-12 17:53:47 UTC	1369	IN	Data Raw: 27 3a 45 3d 3d 27 27 3f 6e 75 6c 6c 3a 66 2e 69 28 45 5b 61 66 28 34 32 39 29 5d 2c 33 32 37 36 38 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 61 67 29 7b 72 65 74 75 72 6e 20 61 67 3d 61 66 2c 45 5b 61 67 28 34 34 34 29 5d 28 46 29 7d 29 7d 2c 27 69 27 3a 66 75 6e 63 74 69 6f 6e 28 45 2c 46 2c 47 2c 61 68 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 50 2c 51 2c 52 2c 53 2c 55 2c 54 29 7b 66 6f 72 28 61 68 3d 61 63 2c 48 3d 5b 5d 2c 49 3d 34 2c 4a 3d 34 2c 4b 3d 33 2c 4c 3d 5b 5d 2c 4f 3d 47 28 30 29 2c 50 3d 46 2c 51 3d 31 2c 4d 3d 30 3b 33 3e 4d 3b 48 5b 4d 5d 3d 4d 2c 4d 2b 3d 31 29 3b 66 6f 72 28 52 3d 30 2c 53 3d 4d 61 74 68 5b 61 68 28 34 32 30 29 5d 28 32 2c 32 29 2c 4e 3d 31 3b 4e 21 3d 53 3b 54 3d 4f 26 50 2c 50 3e 3e 3d 31 2c 50 3d 3d 30 26 26 28 Data Ascii: ':E==''?null:f.i(E[af(429)],32768,function(F,ag){return ag=af,E[ag(444)](F)})},'i':function(E,F,G,ah,H,I,J,K,L,M,N,O,P,Q,R,S,U,T){for(ah=ac,H=[],I=4,J=4,K=3,L=[],O=G(0),P=F,Q=1,M=0;3>M;H[M]=M,M+=1);for(R=0,S=Math[ah(420)](2,2),N=1;N!=S;T=O&P,P>>=1,P==0&&(
2024-12-12 17:53:47 UTC	1369	IN	Data Raw: 62 6a 65 63 74 2c 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 2c 6f 6e 65 72 72 6f 72 2c 64 65 74 61 69 6c 2c 62 69 6e 64 2c 69 6e 64 65 78 4f 66 2c 32 31 36 36 39 33 77 44 55 62 50 59 2c 2f 6a 73 64 2f 72 2f 2c 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 2c 6b 65 79 73 2c 6e 61 76 69 67 61 74 6f 72 2c 53 65 74 2c 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 68 2f 2c 65 72 72 6f 72 20 6f 6e 20 63 66 5f 63 68 6c 5f 70 72 6f 70 73 2c 6f 6e 6c 6f 61 64 2c 65 72 72 6f 72 2c 5f 63 66 5f 63 68 6c 5f 6f 70 74 2c 73 79 6d 62 6f 6c 2c 75 6e 64 65 66 69 6e 65 64 2c 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2c 66 72 6f 6d 2c 66 72 6f 6d 43 68 61 72 43 6f 64 65 2c 72 65 70 6c 61 63 65 2c 69 73 4e 61 4e 2c 63 46 50 57 Data Ascii: bject,DOMContentLoaded,onerror,detail,bind,indexOf,216693wDUbPY,/jsd/r/,getOwnPropertyNames,keys,navigator,Set,/cdn-cgi/challenge-platform/h/,error on cf_chl_props,onload,error,_cf_chl_opt,symbol,undefined,Content-Type,from,fromCharCode,replace,isNaN,cFPW
2024-12-12 17:53:47 UTC	1369	IN	Data Raw: 71 75 65 73 74 2c 73 74 72 69 6e 67 2c 63 6f 6e 63 61 74 2c 6d 61 70 2c 63 68 6c 41 70 69 41 43 43 48 2c 62 69 67 69 6e 74 2c 5b 6e 61 74 69 76 65 20 63 6f 64 65 5d 2c 6a 6f 69 6e 2c 34 4f 59 6d 79 52 51 2c 73 70 6c 69 63 65 2c 6c 6f 61 64 69 6e 67 2c 63 68 6c 41 70 69 52 75 6d 57 69 64 67 65 74 41 67 65 4d 73 2c 63 61 6c 6c 2c 73 74 72 69 6e 67 69 66 79 2c 64 2e 63 6f 6f 6b 69 65 2c 46 75 6e 63 74 69 6f 6e 27 2e 73 70 6c 69 74 28 27 2c 27 29 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 6d 7d 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 63 2c 64 2c 65 29 7b 72 65 74 75 72 6e 20 65 3d 61 28 29 2c 62 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 67 2c 68 29 7b 72 65 74 75 72 6e 20 66 3d 66 2d 34 30 39 2c 68 3d 65 5b 66 5d 2c 68 7d 2c 62 28 63 Data Ascii: quest,string,concat,map,chlApiACCH,bigint,[native code],join,4OYmyRQ,splice,loading,chlApiRumWidgetAgeMs,call,stringify,d.cookie,Function'.split(','),a=function(){return am},a()}function b(c,d,e){return e=a(),b=function(f,g,h){return f=f-409,h=e[f],h},b(c
2024-12-12 17:53:47 UTC	1369	IN	Data Raw: 5b 58 28 34 39 31 29 5d 26 26 30 3c 64 5b 58 28 34 39 31 29 5d 5b 58 28 34 35 31 29 5d 5b 58 28 34 31 30 29 5d 5b 58 28 34 38 38 29 5d 28 65 29 5b 58 28 35 30 31 29 5d 28 58 28 34 38 32 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 67 2c 45 2c 59 2c 46 29 7b 59 3d 57 3b 74 72 79 7b 72 65 74 75 72 6e 20 67 5b 45 5d 5b 59 28 34 31 37 29 5d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 27 70 27 7d 63 61 74 63 68 28 47 29 7b 7d 74 72 79 7b 69 66 28 6e 75 6c 6c 3d 3d 67 5b 45 5d 29 72 65 74 75 72 6e 20 67 5b 45 5d 3d 3d 3d 76 6f 69 64 20 30 3f 27 75 27 3a 27 78 27 7d 63 61 74 63 68 28 48 29 7b 72 65 74 75 72 6e 27 69 27 7d 72 65 74 75 72 6e 20 65 5b 59 28 34 31 31 29 5d 5b 59 28 35 32 32 29 5d 28 67 5b 45 5d 29 3f 27 61 27 3a 67 5b 45 5d 3d 3d 3d 65 5b 59 28 Data Ascii: [X(491)]&&0<d[X(491)][X(451)][X(410)][X(488)](e)[X(501)](X(482))}function m(e,g,E,Y,F){Y=W;try{return g[E][Y(417)](function(){}),'p'}catch(G){}try{if(null==g[E])return g[E]===void 0?'u':'x'}catch(H){return'i'}return e[Y(411)][Y(522)](g[E])?'a':g[E]===e[Y(
2024-12-12 17:53:47 UTC	73	IN	Data Raw: 2e 74 29 29 2c 67 3d 4d 61 74 68 5b 61 36 28 34 33 34 29 5d 28 44 61 74 65 5b 61 36 28 35 33 33 29 5d 28 29 2f 31 65 33 29 2c 67 2d 66 3e 65 29 29 72 65 74 75 72 6e 21 5b 5d 3b 72 65 74 75 72 6e 21 21 5b 5d 7d 7d 28 29 Data Ascii: .t)),g=Math[a6(434)](Date[a6(533)]()/1e3),g-f>e))return![];return!![]}}()

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:49 UTC	497	OUT	GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js? HTTP/1.1 Host: www.shorturl.at Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
2024-12-12 17:53:49 UTC	865	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 17:53:49 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 8812 Connection: close cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l5AvxT0HSq8kUvuPI4tksVhfszOy4G40NUFatf%2BCHbQo%2BusmyvJ2lueAtLy5Ko43xCmwP6cmOnoDRsXgDcXYRC13risNBPPouckM91werDZJ1MCBKjycUOt%2BR4%2BihwmBwg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f937c79f34361-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1722&min_rtt=1722&rtt_var=861&sent=6&recv=8&lost=0&retrans=1&sent_bytes=4186&recv_bytes=1075&delivery_rate=120731&cwnd=221&unsent_bytes=0&cid=70b16f278135b81e&ts=486&x=0"
2024-12-12 17:53:49 UTC	504	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 46 50 57 76 3a 27 67 27 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 57 2c 68 2c 69 2c 6e 2c 6f 2c 73 2c 7a 2c 41 29 7b 57 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 56 2c 65 2c 66 29 7b 66 6f 72 28 56 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 56 28 32 36 36 29 29 2f 31 2b 70 61 72 73 65 49 6e 74 28 56 28 33 35 32 29 29 2f 32 2b 70 61 72 73 65 49 6e 74 28 56 28 32 35 36 29 29 2f 33 2a 28 2d 70 61 72 73 65 49 6e 74 28 56 28 32 36 31 29 29 2f 34 29 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 33 30 39 29 29 2f 35 2a 28 2d 70 61 72 73 65 49 6e 74 28 56 28 33 36 33 29 29 2f 36 29 2b 70 61 72 73 65 49 6e 74 28 56 28 32 37 31 29 29 2f 37 2a 28 70 61 72 Data Ascii: window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,n,o,s,z,A){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=parseInt(V(266))/1+parseInt(V(352))/2+parseInt(V(256))/3(-parseInt(V(261))/4)+-parseInt(V(309))/5(-parseInt(V(363))/6)+parseInt(V(271))/7*(par
2024-12-12 17:53:49 UTC	1369	IN	Data Raw: 29 5d 2c 65 3d 7b 27 68 27 3a 66 75 6e 63 74 69 6f 6e 28 45 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 45 3f 27 27 3a 65 2e 67 28 45 2c 36 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 61 35 29 7b 72 65 74 75 72 6e 20 61 35 3d 62 2c 61 35 28 32 38 36 29 5b 61 35 28 32 36 32 29 5d 28 46 29 7d 29 7d 2c 27 67 27 3a 66 75 6e 63 74 69 6f 6e 28 45 2c 46 2c 47 2c 61 36 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 50 2c 51 2c 52 2c 53 2c 54 2c 55 29 7b 69 66 28 61 36 3d 61 34 2c 6e 75 6c 6c 3d 3d 45 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 49 3d 7b 7d 2c 4a 3d 7b 7d 2c 4b 3d 27 27 2c 4c 3d 32 2c 4d 3d 33 2c 4e 3d 32 2c 4f 3d 5b 5d 2c 50 3d 30 2c 51 3d 30 2c 52 3d 30 3b 52 3c 45 5b 61 36 28 32 34 39 29 5d 3b 52 2b 3d 31 29 69 66 28 53 3d 45 5b 61 36 28 32 36 32 29 Data Ascii: )],e={'h':function(E){return null==E?'':e.g(E,6,function(F,a5){return a5=b,a5(286)[a5(262)](F)})},'g':function(E,F,G,a6,H,I,J,K,L,M,N,O,P,Q,R,S,T,U){if(a6=a4,null==E)return'';for(I={},J={},K='',L=2,M=3,N=2,O=[],P=0,Q=0,R=0;R<E[a6(249)];R+=1)if(S=E[a6(262)
2024-12-12 17:53:49 UTC	1369	IN	Data Raw: 7d 4c 2d 2d 2c 30 3d 3d 4c 26 26 28 4c 3d 4d 61 74 68 5b 61 36 28 32 39 39 29 5d 28 32 2c 4e 29 2c 4e 2b 2b 29 2c 64 65 6c 65 74 65 20 4a 5b 4b 5d 7d 65 6c 73 65 20 66 6f 72 28 55 3d 49 5b 4b 5d 2c 48 3d 30 3b 48 3c 4e 3b 50 3d 31 26 55 7c 50 3c 3c 31 2c 51 3d 3d 46 2d 31 3f 28 51 3d 30 2c 4f 5b 61 36 28 33 34 31 29 5d 28 47 28 50 29 29 2c 50 3d 30 29 3a 51 2b 2b 2c 55 3e 3e 3d 31 2c 48 2b 2b 29 3b 4c 2d 2d 2c 4c 3d 3d 30 26 26 4e 2b 2b 7d 66 6f 72 28 55 3d 32 2c 48 3d 30 3b 48 3c 4e 3b 50 3d 50 3c 3c 31 7c 31 2e 38 37 26 55 2c 51 3d 3d 46 2d 31 3f 28 51 3d 30 2c 4f 5b 61 36 28 33 34 31 29 5d 28 47 28 50 29 29 2c 50 3d 30 29 3a 51 2b 2b 2c 55 3e 3e 3d 31 2c 48 2b 2b 29 3b 66 6f 72 28 3b 3b 29 69 66 28 50 3c 3c 3d 31 2c 46 2d 31 3d 3d 51 29 7b 4f 5b 61 36 Data Ascii: }L--,0==L&&(L=Math[a6(299)](2,N),N++),delete J[K]}else for(U=I[K],H=0;H<N;P=1&U\|P<<1,Q==F-1?(Q=0,O[a6(341)](G(P)),P=0):Q++,U>>=1,H++);L--,L==0&&N++}for(U=2,H=0;H<N;P=P<<1\|1.87&U,Q==F-1?(Q=0,O[a6(341)](G(P)),P=0):Q++,U>>=1,H++);for(;;)if(P<<=1,F-1==Q){O[a6
2024-12-12 17:53:49 UTC	1369	IN	Data Raw: 55 3d 48 5b 55 5d 3b 65 6c 73 65 20 69 66 28 4a 3d 3d 3d 55 29 55 3d 4d 2b 4d 5b 61 39 28 32 36 32 29 5d 28 30 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 4c 5b 61 39 28 33 34 31 29 5d 28 55 29 2c 48 5b 4a 2b 2b 5d 3d 4d 2b 55 5b 61 39 28 32 36 32 29 5d 28 30 29 2c 49 2d 2d 2c 4d 3d 55 2c 30 3d 3d 49 26 26 28 49 3d 4d 61 74 68 5b 61 39 28 32 39 39 29 5d 28 32 2c 4b 29 2c 4b 2b 2b 29 7d 7d 7d 2c 66 3d 7b 7d 2c 66 5b 61 34 28 33 35 33 29 5d 3d 65 2e 68 2c 66 7d 28 29 2c 6f 3d 7b 7d 2c 6f 5b 57 28 32 37 33 29 5d 3d 27 6f 27 2c 6f 5b 57 28 33 33 30 29 5d 3d 27 73 27 2c 6f 5b 57 28 33 33 35 29 5d 3d 27 75 27 2c 6f 5b 57 28 33 30 38 29 5d 3d 27 7a 27 2c 6f 5b 57 28 33 36 39 29 5d 3d 27 6e 27 2c 6f 5b 57 28 33 30 30 29 5d 3d 27 49 27 2c 6f 5b 57 28 Data Ascii: U=H[U];else if(J===U)U=M+M[a9(262)](0);else return null;L[a9(341)](U),H[J++]=M+U[a9(262)](0),I--,M=U,0==I&&(I=Math[a9(299)](2,K),K++)}}},f={},f[a4(353)]=e.h,f}(),o={},o[W(273)]='o',o[W(330)]='s',o[W(335)]='u',o[W(308)]='z',o[W(369)]='n',o[W(300)]='I',o[W(
2024-12-12 17:53:49 UTC	1369	IN	Data Raw: 2c 44 41 73 6f 61 62 62 54 59 2c 6f 6e 6c 6f 61 64 2c 32 34 6b 51 79 75 4d 49 2c 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 2c 69 6e 64 65 78 4f 66 2c 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2c 34 34 36 32 35 34 30 63 55 6d 65 56 72 2c 62 6f 6f 6c 65 61 6e 2c 73 6f 75 72 63 65 2c 6e 57 73 53 58 32 2c 37 39 34 39 34 6a 74 5a 78 4a 6f 2c 46 75 6e 63 74 69 6f 6e 2c 73 70 6c 69 63 65 2c 78 68 72 2d 65 72 72 6f 72 2c 69 73 4e 61 4e 2c 74 61 62 49 6e 64 65 78 2c 6e 75 6d 62 65 72 2c 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 2c 43 6f 6e 74 65 6e 74 2d 74 79 70 65 2c 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 2c 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 2c 63 6f 6e 63 61 74 2c 6c 65 6e 67 74 68 2c 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 2c 6c Data Ascii: ,DAsoabbTY,onload,24kQyuMI,getOwnPropertyNames,indexOf,contentWindow,4462540cUmeVr,boolean,source,nWsSX2,79494jtZxJo,Function,splice,xhr-error,isNaN,tabIndex,number,createElement,Content-type,contentDocument,getPrototypeOf,concat,length,setRequestHeader,l
2024-12-12 17:53:49 UTC	1369	IN	Data Raw: 65 6f 75 74 2c 73 74 72 69 6e 67 69 66 79 2c 72 61 6e 64 6f 6d 2c 32 37 41 46 4e 76 64 72 2c 75 6e 64 65 66 69 6e 65 64 2c 6e 61 76 69 67 61 74 6f 72 2c 63 68 6c 41 70 69 53 69 74 65 6b 65 79 2c 63 61 74 63 68 27 2e 73 70 6c 69 74 28 27 2c 27 29 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 6d 7d 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 45 2c 46 2c 61 33 2c 47 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 50 29 7b 69 66 28 61 33 3d 57 2c 21 6a 28 2e 30 31 29 29 72 65 74 75 72 6e 21 5b 5d 3b 48 3d 28 47 3d 7b 7d 2c 47 5b 61 33 28 32 39 31 29 5d 3d 45 2c 47 5b 61 33 28 33 30 32 29 5d 3d 46 2c 47 29 3b 74 72 79 7b 69 66 28 49 3d 68 5b 61 33 28 32 39 34 29 5d 2c 4a 3d 61 33 28 33 31 35 29 2b 68 5b 61 33 28 33 34 30 29 5d 5b 61 Data Ascii: eout,stringify,random,27AFNvdr,undefined,navigator,chlApiSitekey,catch'.split(','),a=function(){return am},a()}function m(E,F,a3,G,H,I,J,K,L,M,N,O,P){if(a3=W,!j(.01))return![];H=(G={},G[a3(291)]=E,G[a3(302)]=F,G);try{if(I=h[a3(294)],J=a3(315)+h[a3(340)][a
2024-12-12 17:53:49 UTC	1369	IN	Data Raw: 65 3d 49 2c 48 7d 7d 66 75 6e 63 74 69 6f 6e 20 79 28 63 2c 61 63 2c 64 29 7b 66 6f 72 28 61 63 3d 57 2c 64 3d 5b 5d 3b 63 21 3d 3d 6e 75 6c 6c 3b 64 3d 64 5b 61 63 28 33 37 34 29 5d 28 4f 62 6a 65 63 74 5b 61 63 28 33 31 32 29 5d 28 63 29 29 2c 63 3d 4f 62 6a 65 63 74 5b 61 63 28 33 37 33 29 5d 28 63 29 29 3b 72 65 74 75 72 6e 20 64 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 59 2c 63 2c 64 2c 65 2c 66 29 7b 69 66 28 28 59 3d 57 2c 63 3d 68 5b 59 28 32 39 34 29 5d 2c 64 3d 33 36 30 30 2c 63 2e 74 29 26 26 28 65 3d 4d 61 74 68 5b 59 28 32 39 36 29 5d 28 2b 61 74 6f 62 28 63 2e 74 29 29 2c 66 3d 4d 61 74 68 5b 59 28 32 39 36 29 5d 28 44 61 74 65 5b 59 28 33 32 36 29 5d 28 29 2f 31 65 33 29 2c 66 2d 65 3e 64 29 29 72 65 74 75 72 6e 21 5b 5d 3b 72 65 74 75 72 6e 21 Data Ascii: e=I,H}}function y(c,ac,d){for(ac=W,d=[];c!==null;d=d[ac(374)](Object[ac(312)](c)),c=Object[ac(373)](c));return d}function k(Y,c,d,e,f){if((Y=W,c=h[Y(294)],d=3600,c.t)&&(e=Math[Y(296)](+atob(c.t)),f=Math[Y(296)](Date[Y(326)]()/1e3),f-e>d))return![];return!
2024-12-12 17:53:49 UTC	94	IN	Data Raw: 32 29 7b 61 32 3d 5a 2c 64 28 61 32 28 32 35 35 29 29 7d 2c 46 5b 5a 28 32 39 30 29 5d 28 4a 53 4f 4e 5b 5a 28 33 33 32 29 5d 28 45 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6a 28 63 2c 58 29 7b 72 65 74 75 72 6e 20 58 3d 57 2c 4d 61 74 68 5b 58 28 33 33 33 29 5d 28 29 3c 63 7d 7d 28 29 Data Ascii: 2){a2=Z,d(a2(255))},F[Z(290)](JSON[Z(332)](E))}function j(c,X){return X=W,Math[X(333)]()<c}}()

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:49 UTC	712	OUT	POST /cdn-cgi/challenge-platform/h/g/jsd/r/8f0f9337789b42cf HTTP/1.1 Host: www.shorturl.at Connection: keep-alive Content-Length: 15802 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: https://www.shorturl.at Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
2024-12-12 17:53:49 UTC	15802	OUT	Data Raw: 7b 22 77 70 22 3a 22 7a 57 6f 61 77 75 67 35 77 55 6f 77 36 72 63 67 59 67 4b 43 73 61 75 47 43 64 2d 43 68 6d 68 53 53 75 35 67 65 38 43 24 4c 47 56 4c 30 6f 43 2b 24 42 41 63 4c 55 67 44 43 36 59 6f 32 46 57 57 43 64 62 53 43 69 43 53 47 53 6f 67 43 31 53 67 6c 63 4a 61 62 55 57 4d 4e 4f 61 24 4c 51 57 2d 64 6a 44 4b 72 32 33 61 6c 51 77 37 2d 6b 67 6a 38 24 62 68 43 77 6f 6f 39 68 2b 75 4d 46 43 45 32 46 30 76 4d 43 76 61 72 2b 43 75 37 6f 43 68 61 75 75 61 51 36 61 68 43 67 4c 43 73 55 34 43 67 6b 4d 43 70 74 35 64 32 57 42 67 64 62 46 6f 43 75 74 4d 43 75 63 41 73 43 41 75 43 67 4d 31 30 54 6f 4f 44 2d 47 75 32 75 67 76 6c 2d 57 38 77 51 5a 58 76 24 43 6d 61 75 68 52 71 57 43 35 34 57 4c 72 30 24 66 31 32 43 41 58 76 62 51 6d 64 61 43 54 62 6d 30 68 Data Ascii: {"wp":"zWoawug5wUow6rcgYgKCsauGCd-ChmhSSu5ge8C$LGVL0oC+$BAcLUgDC6Yo2FWWCdbSCiCSGSogC1SglcJabUWMNOa$LQW-djDKr23alQw7-kgj8$bhCwoo9h+uMFCE2F0vMCvar+Cu7oChauuaQ6ahCgLCsU4CgkMCpt5d2WBgdbFoCutMCucAsCAuCgM10ToOD-Gu2ugvl-W8wQZXv$CmauhRqWC54WLr0$f12CAXvbQmdaCTbm0h
2024-12-12 17:53:49 UTC	1254	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 17:53:49 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=.shorturl.at; Priority=High; HttpOnly; Secure; SameSite=None Set-Cookie: cf_clearance=dkW_SA3duSycHpeFhILM316soNKgj85KkOxjrm_G9tM-1734026029-1.2.1.1-bqTgAL1CT8076SXVTRf95LM66l8vBQYo6Q9b5cO8fpBCdSn6Z76WRbpPvIJ_yOrBIpsgSTc94UwPWSb5mTsDhYXq64DRrIJHMdNKnE3mISr0CQyEVEsXUAEqIYNXpYV_2Rq5BzDAK4crhHe5OAWhT2Pwk.qYIRaKzcxd2Cd0agKfbpAGZlyLOieyLslCnyUR_MkqLaetlvoqieRJ8ERvL3pmMaurxPcYvAIG8Cr.Ml73dwEUI7HPpq6FD7MGZNBdEJyUp.11OBljy48xJK1f86KbINa8uXV7aXMz701j8IYPt1GSmHDjI1IzsP7Umj75TXEykyA_TSnO__essgWtOmAa8wR5IrGnSHLKmhD7Q9wbZsvmO9V7VUQefkqPy5Pp; Path=/; Expires=Fri, 12-Dec-25 17:53:49 GMT; Domain=.shorturl.at; Priority=High; HttpOnly; Secure; SameSite=None; Partitioned Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dc72dAwITjluqH1sx0G4SSn%2FGtVQftBY%2Bg6RxMeA8ATioHIk4g16NalMjZbl2Nkr5KjAcPugTlbzAj8jijcjAMJMjnqT%2Blv%2B0cEoLA0REQDdkmD7P9Ydnn1QWlbulJb83g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f937cf87c437a-EWR
2024-12-12 17:53:49 UTC	217	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 36 30 36 26 6d 69 6e 5f 72 74 74 3d 31 36 30 36 26 72 74 74 5f 76 61 72 3d 38 30 33 26 73 65 6e 74 3d 31 39 26 72 65 63 76 3d 32 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 31 26 73 65 6e 74 5f 62 79 74 65 73 3d 34 31 38 38 26 72 65 63 76 5f 62 79 74 65 73 3d 31 37 31 33 36 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 34 34 32 33 32 26 63 77 6e 64 3d 32 32 33 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 38 30 36 62 63 61 32 38 61 31 66 33 61 34 36 61 26 74 73 3d 35 36 36 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1606&rtt_var=803&sent=19&recv=23&lost=0&retrans=1&sent_bytes=4188&recv_bytes=17136&delivery_rate=44232&cwnd=223&unsent_bytes=0&cid=806bca28a1f3a46a&ts=566&x=0"

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:51 UTC	486	OUT	GET /cdn-cgi/challenge-platform/h/g/jsd/r/8f0f9337789b42cf HTTP/1.1 Host: www.shorturl.at Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
2024-12-12 17:53:51 UTC	713	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 12 Dec 2024 17:53:51 GMT Content-Length: 0 Connection: close allow: POST Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tsd3fdq9M95oG8psYkbKkRqyPtim2EM2ASSxtA1P1hDNjurx1ThNGlq1JLgQBqqvFWHeOgCdjdGAYQ88LHFLxr1RhjPcYnnTv3Rb%2BWI8AfVX%2F7J6y3DyCT0lBEg3dQwTFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f9388afe10f9f-EWR server-timing: cfL4;desc="?proto=TCP&rtt=5661&min_rtt=1720&rtt_var=3155&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1064&delivery_rate=1697674&cwnd=213&unsent_bytes=0&cid=50da2b0457b80bb0&ts=460&x=0"

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:52 UTC	486	OUT	GET /cdn-cgi/challenge-platform/h/g/jsd/r/8f0f9337789b42cf HTTP/1.1 Host: www.shorturl.at Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _ga=GA1.1.327237265.1734026024; _ga_25YH9BB08G=GS1.1.1734026024.1.0.1734026024.0.0.0
2024-12-12 17:53:53 UTC	719	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 12 Dec 2024 17:53:53 GMT Content-Length: 0 Connection: close allow: POST Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fD1JBlywyeglG%2Fd4%2FLkLf9uBCFcLnL1EBU3ZuFn%2BIQWIcitg3j21uwELZ9NikkBOSliqF2D6jk7Vb45FLflF8EZ9AzhZ72JaY77%2B2a8RF93c1201Aya2eVaX32YUfI5vVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0f93938a1a4246-EWR server-timing: cfL4;desc="?proto=TCP&rtt=18443&min_rtt=2189&rtt_var=10638&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=1064&delivery_rate=1333942&cwnd=229&unsent_bytes=0&cid=f0165130d105da55&ts=459&x=0"

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:53 UTC	536	OUT	OPTIONS /report/v4?s=Tsd3fdq9M95oG8psYkbKkRqyPtim2EM2ASSxtA1P1hDNjurx1ThNGlq1JLgQBqqvFWHeOgCdjdGAYQ88LHFLxr1RhjPcYnnTv3Rb%2BWI8AfVX%2F7J6y3DyCT0lBEg3dQwTFQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://www.shorturl.at Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:53:53 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Thu, 12 Dec 2024 17:53:53 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:53:54 UTC	478	OUT	POST /report/v4?s=Tsd3fdq9M95oG8psYkbKkRqyPtim2EM2ASSxtA1P1hDNjurx1ThNGlq1JLgQBqqvFWHeOgCdjdGAYQ88LHFLxr1RhjPcYnnTv3Rb%2BWI8AfVX%2F7J6y3DyCT0lBEg3dQwTFQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 438 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:53:54 UTC	438	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 36 37 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 36 2e 39 2e 31 32 39 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 35 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 68 6f 72 74 75 72 6c 2e 61 74 2f Data Ascii: [{"age":0,"body":{"elapsed_time":1678,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.26.9.129","status_code":405,"type":"http.error"},"type":"network-error","url":"https://www.shorturl.at/
2024-12-12 17:53:55 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 12 Dec 2024 17:53:54 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://shorturl.at/UrAsB

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
https://shorturl.at/UrAsB

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:54:52 UTC	540	OUT	OPTIONS /report/v4?s=fD1JBlywyeglG%2Fd4%2FLkLf9uBCFcLnL1EBU3ZuFn%2BIQWIcitg3j21uwELZ9NikkBOSliqF2D6jk7Vb45FLflF8EZ9AzhZ72JaY77%2B2a8RF93c1201Aya2eVaX32YUfI5vVg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://www.shorturl.at Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:54:53 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 12 Dec 2024 17:54:52 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-12-12 17:54:54 UTC	482	OUT	POST /report/v4?s=fD1JBlywyeglG%2Fd4%2FLkLf9uBCFcLnL1EBU3ZuFn%2BIQWIcitg3j21uwELZ9NikkBOSliqF2D6jk7Vb45FLflF8EZ9AzhZ72JaY77%2B2a8RF93c1201Aya2eVaX32YUfI5vVg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 442 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 17:54:54 UTC	442	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 38 32 36 36 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 37 34 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 36 2e 39 2e 31 32 39 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 35 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 68 6f 72 74 75 72 6c Data Ascii: [{"age":58266,"body":{"elapsed_time":1741,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.26.9.129","status_code":405,"type":"http.error"},"type":"network-error","url":"https://www.shorturl
2024-12-12 17:54:55 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 12 Dec 2024 17:54:54 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	12:53:30
Start date:	12/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	12:53:31
Start date:	12/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1920,i,5359919322221688024,17665114260448229658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	12:53:32
Start date:	12/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://shorturl.at/UrAsB"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre