Edit tour

Windows Analysis Report
https://wkybcnfuqpgjx.ltd/

Overview

General Information

Sample URL:	https://wkybcnfuqpgjx.ltd/
Analysis ID:	1589319
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious Javascript

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2104,i,16676233379117246194,8042529587182153952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5532 --field-trial-handle=2104,i,16676233379117246194,8042529587182153952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://wkybcnfuqpgjx.ltd/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /apiw1 HTTP/1.1Host: zws2.web.telegram.orgConnection: keep-aliveContent-Length: 0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Origin: https://wkybcnfuqpgjx.ltdSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://wkybcnfuqpgjx.ltd/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1ec.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ef-1f1f2.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1fe.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f0.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1f7.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1f3.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1fb-1f1e8.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1ff.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1ea.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f5-1f1ed.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1f9.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1f2.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/main.d54bfa037348b154a941.js	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1fb.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/5284.41380bbee618193f889a.js	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1e9.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1ec.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ea-1f1f7.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1ed.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f0-1f1fc.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1ea.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1e9.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1fb-1f1ec.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1ee.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1fe.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1ea.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1f2.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1ff.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f4.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/compatTest.js	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/rlottie-wasm.f013598f1b2ba719f25e.js	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1ea.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e9-1f1f2.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1f3.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/notification.mp3	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1f7.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1f3.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1f6.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1fe.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1fc.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ed-1f1f9.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1e7.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1f0.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.324b1e6d0f5ae7c6ab42.woff2	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1f7.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/7784.df07a876b22e3b2a83e9.js	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/redirect.js	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ee-1f1f6.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1ff.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1e9.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/chat-bg-pattern-light.ee148af944f6580293ae.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f8.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1e6.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1ed.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1ef.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ea-1f1ea.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ef-1f1f5.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f0-1f1ff.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f0-1f1f5.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1fd.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1fc.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1f3.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1eb-1f1f2.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ff-1f1e6.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1f0.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1fa.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1f1.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f5-1f1fc.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ea-1f1e8.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1e9.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e9-1f1ea.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1f2.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1eb.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1e6.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1f7.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1ee.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1fa-1f1ec.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1f9.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f3.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1ed.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f7-1f1fa.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1ed.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1eb.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1f2.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1fc.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e9-1f1ff.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ee-1f1e9.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1eb-1f1f7.png	Avira URL Cloud: Label: phishing
Source: https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1e6.png	Avira URL Cloud: Label: phishing

Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://wkybcnfuqpgjx.ltd/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge platform, the overall behavior is highly suspicious and indicative of malicious intent.
Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://wkybcnfuqpgjx.ltd/... This script uses obfuscated code to modify the `navigator.userAgent` property, which could be used for malicious purposes such as fingerprinting or impersonation. While the intent is not entirely clear, the use of heavy obfuscation and modification of sensitive browser properties is concerning and warrants further investigation.

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50826 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: wkybcnfuqpgjx.ltd
Source: global traffic	DNS traffic detected: DNS query: hu.bafanglaicai.app
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: telegram.me
Source: global traffic	DNS traffic detected: DNS query: zws2.web.telegram.org
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: zws2-1.web.telegram.org

Source: chromecache_316.3.dr, chromecache_383.3.dr	String found in binary or memory: http://telegram.org/dl
Source: chromecache_366.3.dr	String found in binary or memory: https://github.com/rastikerdar/vazirmatn
Source: chromecache_431.3.dr	String found in binary or memory: https://hu.bafanglaicai.app/script.js
Source: chromecache_431.3.dr	String found in binary or memory: https://ss3.4sqi.net/img/categories_v2/
Source: chromecache_431.3.dr	String found in binary or memory: https://t.me/_websync_
Source: chromecache_431.3.dr	String found in binary or memory: https://telegram.me/_websync_
Source: chromecache_484.3.dr, chromecache_185.3.dr	String found in binary or memory: https://telegram.org/tos/mini-apps
Source: chromecache_431.3.dr	String found in binary or memory: https://web.telegram.org/
Source: chromecache_259.3.dr, chromecache_238.3.dr	String found in binary or memory: https://web.telegram.org/a

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2104,i,16676233379117246194,8042529587182153952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://wkybcnfuqpgjx.ltd/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5532 --field-trial-handle=2104,i,16676233379117246194,8042529587182153952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2104,i,16676233379117246194,8042529587182153952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5532 --field-trial-handle=2104,i,16676233379117246194,8042529587182153952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1ec.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ef-1f1f2.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1fe.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f0.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1f7.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1f3.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1fb-1f1e8.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1ff.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1ea.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f5-1f1ed.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1f9.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1f2.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/main.d54bfa037348b154a941.js	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1fb.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/5284.41380bbee618193f889a.js	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1e9.png	100%	Avira URL Cloud	phishing
https://hu.bafanglaicai.app/script.js	0%	Avira URL Cloud	safe
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1ec.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ea-1f1f7.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1ed.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f0-1f1fc.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1ea.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1e9.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1fb-1f1ec.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1ee.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1fe.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1ea.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1f2.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1ff.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f4.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/compatTest.js	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/favicon.ico	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/rlottie-wasm.f013598f1b2ba719f25e.js	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1ea.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e9-1f1f2.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1f3.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/notification.mp3	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1f7.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1f3.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1f6.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1fe.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1fc.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ed-1f1f9.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1e7.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1f0.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.324b1e6d0f5ae7c6ab42.woff2	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1f7.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/7784.df07a876b22e3b2a83e9.js	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/redirect.js	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ee-1f1f6.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1ff.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1e9.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/chat-bg-pattern-light.ee148af944f6580293ae.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f8.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1e6.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1ed.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1ef.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ea-1f1ea.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ef-1f1f5.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f0-1f1ff.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f0-1f1f5.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1fd.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1fc.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1f3.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1eb-1f1f2.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ff-1f1e6.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1f0.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1fa.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1f1.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f5-1f1fc.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ea-1f1e8.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1e9.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e9-1f1ea.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1f2.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1eb.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1e6.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1f7.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1ee.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1fa-1f1ec.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1f9.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f3.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1ed.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f7-1f1fa.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1ed.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1eb.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1f2.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1fc.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e9-1f1ff.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ee-1f1e9.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1eb-1f1f7.png	100%	Avira URL Cloud	phishing
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1e6.png	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
zws2.web.telegram.org	149.154.167.99	true	false	high
wkybcnfuqpgjx.ltd	172.67.137.41	true	true	unknown
telegram.me	149.154.167.99	true	false	high
t.me	149.154.167.99	true	false	high
www.google.com	216.58.206.36	true	false	high
zws2-1.web.telegram.org	149.154.167.99	true	false	high
hu.bafanglaicai.app	104.21.42.79	true	false	unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:47 GMTContent-Type: text/htmlContent-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:49 GMTContent-Type: text/htmlContent-Length: 169Connection: closePragma: no-cacheCache-control: no-storeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:50 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:52 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:54 GMTContent-Type: text/htmlContent-Length: 169Connection: closePragma: no-cacheCache-control: no-storeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:54 GMTContent-Type: text/htmlContent-Length: 169Connection: closePragma: no-cacheCache-control: no-store
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:54 GMTContent-Type: text/htmlContent-Length: 169Connection: closePragma: no-cacheCache-control: no-storeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:55 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:55 GMTContent-Type: text/htmlContent-Length: 169Connection: closePragma: no-cacheCache-control: no-store
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:56 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:57 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:57 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:58 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:03:59 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:00 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:01 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:02 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:02 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:03 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:04 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:04 GMTContent-Type: text/htmlContent-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:05 GMTContent-Type: text/htmlContent-Length: 169Connection: closePragma: no-cacheCache-control: no-storeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:06 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:07 GMTContent-Type: text/htmlContent-Length: 169Connection: closePragma: no-cacheCache-control: no-storeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:08 GMTContent-Type: text/htmlContent-Length: 169Connection: closePragma: no-cacheCache-control: no-storeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:09 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:10 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:10 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:11 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:12 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:13 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:14 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:15 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:15 GMTContent-Type: text/htmlContent-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:16 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:17 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:18 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:18 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:19 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 12 Jan 2025 00:04:20 GMTContent-Type: text/htmlContent-Length: 169Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, OPTIONSAccess-Control-Allow-Headers: origin, content-typeAccess-Control-Max-Age: 1728000

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.42.79	hu.bafanglaicai.app	United States	13335	CLOUDFLARENETUS	false
172.67.159.63	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
149.154.167.99	zws2.web.telegram.org	United Kingdom	62041	TELEGRAMRU	false
172.67.137.41	wkybcnfuqpgjx.ltd	United States	13335	CLOUDFLARENETUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

IP
192.168.2.4
192.168.2.6

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589319
Start date and time:	2025-01-12 01:02:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://wkybcnfuqpgjx.ltd/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.win@18/691@32/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Name	Malicious	Antivirus Detection	Reputation
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1f7.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f0.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f5-1f1ed.png	true	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=XUwKmjpcSDfeSwpONtGBRtsQkHNwzdRTXV29zWBNB%2FFsjFHH5fXaSegB0OFnbrvCqmOIaVQVE4CrA5b5iCpDjFfM56lC1nyx3OS61FuNiK4X1hxqArPSA%2FnkSJVe%2FB1QJr2ewg%3D%3D	false		high
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ef-1f1f2.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1ec.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1ff.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1f3.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1fb-1f1e8.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1ea.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1fe.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1f9.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1f2.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/main.d54bfa037348b154a941.js	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1fb.png	true	Avira URL Cloud: phishing	unknown
https://hu.bafanglaicai.app/script.js	false	Avira URL Cloud: safe	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ea-1f1f7.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1e9.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1ec.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/5284.41380bbee618193f889a.js	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1ed.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f0-1f1fc.png	true	Avira URL Cloud: phishing	unknown
https://zws2-1.web.telegram.org/apiws	false		high
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1e9.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1ea.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1ea.png	true	Avira URL Cloud: phishing	unknown
https://zws2.web.telegram.org/apiws	false		high
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1f2.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1ee.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1fe.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1fb-1f1ec.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/	true		unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1ff.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f4.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/compatTest.js	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/favicon.ico	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/rlottie-wasm.f013598f1b2ba719f25e.js	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e9-1f1f2.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1ea.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1f3.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/notification.mp3	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1f3.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1f7.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1f6.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1fe.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ed-1f1f9.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1fc.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1e7.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1f0.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.324b1e6d0f5ae7c6ab42.woff2	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1f7.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ee-1f1f6.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/7784.df07a876b22e3b2a83e9.js	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/redirect.js	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1ff.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1e9.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/chat-bg-pattern-light.ee148af944f6580293ae.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f8.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ef-1f1f5.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f1-1f1e6.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1ed.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ea-1f1ea.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1ef.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1fc.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f0-1f1ff.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1fd.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f0-1f1f5.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1f3.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1eb-1f1f2.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ff-1f1e6.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1f0.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1fa.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f5-1f1fc.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f9-1f1f1.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ea-1f1e8.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1e9.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e9-1f1ea.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1f2.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1e6.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f3-1f1eb.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1f7.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e8-1f1ee.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1fa-1f1ec.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1ed.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e7-1f1f9.png	true	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=%2F%2BX7FWk81LDOT34xUgcuOMWwnzaX8wTb%2F9QNP1p7JHLKt%2FxM%2FpgRdKuoSYXULY%2F9dmMkC1lxEb4Sxgl6zdhykoqyv%2FcrIpgdXSZMWGDeRDodc%2B%2BWOYQBVdSyUgnwAZad1fjpuily	false		high
https://wkybcnfuqpgjx.ltd/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f2-1f1f3.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f8-1f1ed.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f7-1f1fa.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1eb.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e6-1f1f2.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1e9-1f1ff.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1fc.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ee-1f1e9.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1ec-1f1e6.png	true	Avira URL Cloud: phishing	unknown
https://wkybcnfuqpgjx.ltd/img-apple-160/1f1eb-1f1f7.png	true	Avira URL Cloud: phishing	unknown

Name	Source	Malicious	Reputation
https://telegram.org/tos/mini-apps	chromecache_484.3.dr, chromecache_185.3.dr	false	high
https://web.telegram.org/	chromecache_431.3.dr	false	high
http://telegram.org/dl	chromecache_316.3.dr, chromecache_383.3.dr	false	high

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 160 x 160, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3986
Entropy (8bit):	7.89342242843146
Encrypted:	false
SSDEEP:	96:Li0QlwcV8WFPwEX9zQXsrTCDeSsaCuY8TdoXmdibMtx:G00wcV8WB9zQXsTCDeHazoXmc2
MD5:	9596CF715CC1FE885F6000866C7F165C
SHA1:	C1C8DBE7B96FDD1817B393DF070C1B6DF4FD8253
SHA-256:	FE7C25755248B8BE3BB2EFB4AFFCB90D67A3FEBAE1953B70DE593C209322C916
SHA-512:	06A4F10A25A61C3B9430FE9B753BD451D961D73E783B15B953F0155DA0CD6067DD225238EF80C04B1CCA548F88DF402D9543FF1561B599AF84EA606C4EB84635
Malicious:	false
Reputation:	low
URL:	https://wkybcnfuqpgjx.ltd/img-apple-160/1f1f5-1f1f8.png
Preview:	.PNG........IHDR.....................PLTEGpLOZONWN8K8(C(ggg'C')F)eee-@,...9]9...nnnbbbD(D(ccc.--u..m...>>r99'D(eeen..$=%hhh9M9)E)hhh%A%eee]]])E)gggaaakkk&:%.J.kkk]]] < -J-.:.%A%..............................................................................................................................................................~...rr...s.sh.h}.}[.[[.[zzzZ.Z.XXY.YY.YX.XV.VuuuU.UT.TR.RU.U.IIqqqP.PN.NH.HL.LkkkN}NI.IhhhD.DH~H.AAI{I.::E\|E.>>dddDzDHwH.;;CxC9}Aaaa.::GrGAvA.M<.88CrC>u?^^^.77>r>.22.55CmC<q<[[[.C7-w;.33:o:4r6.)0.22?j?XXX:m9.116n6aX5?g>7l7.//UUU6j6...sJ2.(SSS2i3.--RRR.64.0/;a:.,,.?.4d4PPP.9^9.!"NNNKKK.((1]16Y6.//m::HHHu44.&&#`$3T3.V.EEE1P1ABBR/M/.""T77.""===I:::x..&E&t..666!@!j..222R#.)33.;.---**)))(((&&&%%%$$$###"""!!! ...:..............................................G....tRNS...!08?KRTcccddfvx~~~.........................}.".....IDATx.....W....Y.tu.l....\....77....AP.H,..,.J.&!.....x@B.......-..&CH....HX...x...J.SUS.3=...A.U.tO.....w..v..,y..

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 12, 2025 01:03:37.879725933 CET	192.168.2.6	1.1.1.1	0x59c0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:37.880431890 CET	192.168.2.6	1.1.1.1	0x95ef	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 12, 2025 01:03:38.814745903 CET	192.168.2.6	1.1.1.1	0x4192	Standard query (0)	wkybcnfuqpgjx.ltd	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:38.815193892 CET	192.168.2.6	1.1.1.1	0x1a80	Standard query (0)	wkybcnfuqpgjx.ltd	65	IN (0x0001)	false
Jan 12, 2025 01:03:40.694892883 CET	192.168.2.6	1.1.1.1	0x7442	Standard query (0)	wkybcnfuqpgjx.ltd	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:40.695038080 CET	192.168.2.6	1.1.1.1	0x2253	Standard query (0)	wkybcnfuqpgjx.ltd	65	IN (0x0001)	false
Jan 12, 2025 01:03:41.951606035 CET	192.168.2.6	1.1.1.1	0x7dc4	Standard query (0)	hu.bafanglaicai.app	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:41.952893972 CET	192.168.2.6	1.1.1.1	0x81fd	Standard query (0)	hu.bafanglaicai.app	65	IN (0x0001)	false
Jan 12, 2025 01:03:42.958205938 CET	192.168.2.6	1.1.1.1	0x8b49	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:42.959350109 CET	192.168.2.6	1.1.1.1	0x45f3	Standard query (0)	t.me	65	IN (0x0001)	false
Jan 12, 2025 01:03:42.960127115 CET	192.168.2.6	1.1.1.1	0x5cab	Standard query (0)	telegram.me	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:42.960592985 CET	192.168.2.6	1.1.1.1	0x5c82	Standard query (0)	telegram.me	65	IN (0x0001)	false
Jan 12, 2025 01:03:43.892787933 CET	192.168.2.6	1.1.1.1	0xee29	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:43.892970085 CET	192.168.2.6	1.1.1.1	0x84dd	Standard query (0)	t.me	65	IN (0x0001)	false
Jan 12, 2025 01:03:43.907664061 CET	192.168.2.6	1.1.1.1	0x7915	Standard query (0)	telegram.me	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:43.907906055 CET	192.168.2.6	1.1.1.1	0xf9d2	Standard query (0)	telegram.me	65	IN (0x0001)	false
Jan 12, 2025 01:03:43.934813976 CET	192.168.2.6	1.1.1.1	0xfbf	Standard query (0)	hu.bafanglaicai.app	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:43.935034037 CET	192.168.2.6	1.1.1.1	0x7405	Standard query (0)	hu.bafanglaicai.app	65	IN (0x0001)	false
Jan 12, 2025 01:03:46.284107924 CET	192.168.2.6	1.1.1.1	0x1a3	Standard query (0)	zws2.web.telegram.org	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:46.284265995 CET	192.168.2.6	1.1.1.1	0x42e5	Standard query (0)	zws2.web.telegram.org	65	IN (0x0001)	false
Jan 12, 2025 01:03:50.205571890 CET	192.168.2.6	1.1.1.1	0x2ed8	Standard query (0)	zws2.web.telegram.org	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:50.205697060 CET	192.168.2.6	1.1.1.1	0xac3d	Standard query (0)	zws2.web.telegram.org	65	IN (0x0001)	false
Jan 12, 2025 01:03:51.785002947 CET	192.168.2.6	1.1.1.1	0x6b55	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:51.785155058 CET	192.168.2.6	1.1.1.1	0xb3e0	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jan 12, 2025 01:03:55.141649961 CET	192.168.2.6	1.1.1.1	0xd65b	Standard query (0)	zws2-1.web.telegram.org	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:55.141803980 CET	192.168.2.6	1.1.1.1	0xb64c	Standard query (0)	zws2-1.web.telegram.org	65	IN (0x0001)	false
Jan 12, 2025 01:04:46.324713945 CET	192.168.2.6	1.1.1.1	0xe353	Standard query (0)	zws2.web.telegram.org	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:04:46.324856997 CET	192.168.2.6	1.1.1.1	0xe707	Standard query (0)	zws2.web.telegram.org	65	IN (0x0001)	false
Jan 12, 2025 01:04:50.339332104 CET	192.168.2.6	1.1.1.1	0x2412	Standard query (0)	zws2.web.telegram.org	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:04:50.339483976 CET	192.168.2.6	1.1.1.1	0x261c	Standard query (0)	zws2.web.telegram.org	65	IN (0x0001)	false
Jan 12, 2025 01:04:51.786183119 CET	192.168.2.6	1.1.1.1	0x1e9d	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:04:51.786333084 CET	192.168.2.6	1.1.1.1	0x5ca2	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 12, 2025 01:03:37.886758089 CET	1.1.1.1	192.168.2.6	0x59c0	No error (0)	www.google.com	216.58.206.36	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:37.887068033 CET	1.1.1.1	192.168.2.6	0x95ef	No error (0)	www.google.com		65	IN (0x0001)	false
Jan 12, 2025 01:03:38.832230091 CET	1.1.1.1	192.168.2.6	0x4192	No error (0)	wkybcnfuqpgjx.ltd	172.67.137.41	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:38.832230091 CET	1.1.1.1	192.168.2.6	0x4192	No error (0)	wkybcnfuqpgjx.ltd	104.21.7.183	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:38.833036900 CET	1.1.1.1	192.168.2.6	0x1a80	No error (0)	wkybcnfuqpgjx.ltd		65	IN (0x0001)	false
Jan 12, 2025 01:03:40.712790012 CET	1.1.1.1	192.168.2.6	0x2253	No error (0)	wkybcnfuqpgjx.ltd		65	IN (0x0001)	false
Jan 12, 2025 01:03:40.713857889 CET	1.1.1.1	192.168.2.6	0x7442	No error (0)	wkybcnfuqpgjx.ltd	172.67.137.41	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:40.713857889 CET	1.1.1.1	192.168.2.6	0x7442	No error (0)	wkybcnfuqpgjx.ltd	104.21.7.183	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:41.986269951 CET	1.1.1.1	192.168.2.6	0x81fd	No error (0)	hu.bafanglaicai.app		65	IN (0x0001)	false
Jan 12, 2025 01:03:42.010348082 CET	1.1.1.1	192.168.2.6	0x7dc4	No error (0)	hu.bafanglaicai.app	104.21.42.79	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:42.010348082 CET	1.1.1.1	192.168.2.6	0x7dc4	No error (0)	hu.bafanglaicai.app	172.67.159.63	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:42.964962959 CET	1.1.1.1	192.168.2.6	0x8b49	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:42.966939926 CET	1.1.1.1	192.168.2.6	0x5cab	No error (0)	telegram.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:43.899648905 CET	1.1.1.1	192.168.2.6	0xee29	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:43.914695024 CET	1.1.1.1	192.168.2.6	0x7915	No error (0)	telegram.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:43.973202944 CET	1.1.1.1	192.168.2.6	0xfbf	No error (0)	hu.bafanglaicai.app	172.67.159.63	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:43.973202944 CET	1.1.1.1	192.168.2.6	0xfbf	No error (0)	hu.bafanglaicai.app	104.21.42.79	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:43.973481894 CET	1.1.1.1	192.168.2.6	0x7405	No error (0)	hu.bafanglaicai.app		65	IN (0x0001)	false
Jan 12, 2025 01:03:46.304897070 CET	1.1.1.1	192.168.2.6	0x1a3	No error (0)	zws2.web.telegram.org	149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:50.212141037 CET	1.1.1.1	192.168.2.6	0x2ed8	No error (0)	zws2.web.telegram.org	149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:51.791810989 CET	1.1.1.1	192.168.2.6	0x6b55	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:03:55.150365114 CET	1.1.1.1	192.168.2.6	0xd65b	No error (0)	zws2-1.web.telegram.org	149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:04:46.331861973 CET	1.1.1.1	192.168.2.6	0xe353	No error (0)	zws2.web.telegram.org	149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:04:50.346601009 CET	1.1.1.1	192.168.2.6	0x2412	No error (0)	zws2.web.telegram.org	149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:04:51.793313026 CET	1.1.1.1	192.168.2.6	0x1e9d	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 34 58 48 4a 2b 77 70 78 45 36 67 42 2f 36 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 35 34 31 33 32 36 63 37 35 30 65 64 64 64 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: b4XHJ+wpxE6gB/6q.1Context: 4541326c750eddd0
2025-01-12 00:03:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-12 00:03:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 34 58 48 4a 2b 77 70 78 45 36 67 42 2f 36 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 35 34 31 33 32 36 63 37 35 30 65 64 64 64 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 35 41 7a 6f 46 32 68 39 41 6f 44 47 6d 6f 72 76 2f 53 70 54 2b 57 55 51 62 70 2f 49 4a 4c 31 43 62 44 33 6d 38 36 4b 6f 34 61 64 51 46 64 75 2b 31 53 78 66 38 76 7a 4e 6a 57 31 6e 34 7a 65 37 63 6f 44 5a 49 46 66 4d 62 55 4a 63 6a 58 5a 57 2b 70 4d 74 4b 78 61 2f 30 64 33 48 56 43 2b 2f 54 58 2b 75 62 6a 67 33 75 44 67 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: b4XHJ+wpxE6gB/6q.2Context: 4541326c750eddd0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAR5AzoF2h9AoDGmorv/SpT+WUQbp/IJL1CbD3m86Ko4adQFdu+1Sxf8vzNjW1n4ze7coDZIFfMbUJcjXZW+pMtKxa/0d3HVC+/TX+ubjg3uDgw
2025-01-12 00:03:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 34 58 48 4a 2b 77 70 78 45 36 67 42 2f 36 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 35 34 31 33 32 36 63 37 35 30 65 64 64 64 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: b4XHJ+wpxE6gB/6q.3Context: 4541326c750eddd0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-12 00:03:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-12 00:03:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 50 6f 55 62 36 65 58 6a 6a 30 75 63 42 74 31 47 31 33 55 57 48 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: PoUb6eXjj0ucBt1G13UWHA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:39 UTC	660	OUT	GET / HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:40 UTC	847	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Sat, 14 Dec 2024 10:26:51 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QQGuqZJmpWONcbV1Lwf8n9sImf1xLVjpLZGZXh55Eo471ylaBr1aTWPxEtEjup0o8pvjJXS9v63MCzlMO%2ByJ4CY%2BUZeFrvRbxhY73v1krNH3G9t1qS9TXF87m62cElidvfghrA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e27f1b8942b8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3747&min_rtt=1721&rtt_var=2027&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1238&delivery_rate=1696687&cwnd=234&unsent_bytes=0&cid=1713239a247d8f05&ts=687&x=0"
2025-01-12 00:03:40 UTC	522	IN	Data Raw: 65 37 62 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 74 72 61 6e 73 6c 61 74 65 3d 22 6e 6f 22 20 63 6c 61 73 73 3d 22 6e 6f 74 72 61 6e 73 6c 61 74 65 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 20 69 73 20 61 20 63 6c 6f 75 64 2d 62 61 73 65 64 20 6d 6f 62 69 6c 65 20 61 6e 64 20 64 65 73 6b 74 6f 70 20 6d 65 73 73 61 67 69 6e 67 20 61 70 70 20 77 69 Data Ascii: e7b<!doctype html><html lang="en" translate="no" class="notranslate"><head><meta charset="UTF-8"><title>Telegram</title><meta name="title" content="Telegram"><meta name="description" content="Telegram is a cloud-based mobile and desktop messaging app wi
2025-01-12 00:03:40 UTC	1369	IN	Data Raw: 65 67 72 61 6d 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 32 62 35 37 39 37 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 63 6f 6e Data Ascii: egram"><meta name="apple-mobile-web-app-capable" content="yes"><meta name="apple-mobile-web-app-title" content="Telegram"><meta name="application-name" content="Telegram"><meta name="msapplication-TileColor" content="#2b5797"><meta name="msapplication-con
2025-01-12 00:03:40 UTC	1369	IN	Data Raw: 63 65 68 6f 6c 64 65 72 22 20 68 72 65 66 3d 22 2e 2f 73 69 74 65 2e 77 65 62 6d 61 6e 69 66 65 73 74 22 3e 3c 73 63 72 69 70 74 3e 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 77 69 6e 64 6f 77 5b 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 22 62 6d 46 32 61 57 64 68 64 47 39 79 22 29 29 29 5d 2c 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 22 64 58 4e 6c 63 6b 46 6e 5a 57 35 30 22 29 29 29 2c 7b 76 61 6c 75 65 3a 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 22 56 47 56 73 5a 57 64 79 59 57 30 67 55 32 56 6a 64 58 4a 70 64 48 6b 67 51 32 68 6c 59 32 73 3d 22 29 29 29 2c 77 72 69 74 61 62 6c Data Ascii: ceholder" href="./site.webmanifest"><script>Object.defineProperty(window[decodeURIComponent(escape(atob("bmF2aWdhdG9y")))],decodeURIComponent(escape(atob("dXNlckFnZW50"))),{value:decodeURIComponent(escape(atob("VGVsZWdyYW0gU2VjdXJpdHkgQ2hlY2s="))),writabl
2025-01-12 00:03:40 UTC	454	IN	Data Raw: 61 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 27 61 62 73 6f 6c 75 74 65 27 3b 61 2e 73 74 79 6c 65 2e 74 6f 70 3d 30 3b 61 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 30 3b 61 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 3d 27 6e 6f 6e 65 27 3b 61 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 27 68 69 64 64 65 6e 27 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 69 66 28 27 6c 6f 61 64 69 6e 67 27 21 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 29 63 28 29 3b 65 6c 73 65 20 69 66 28 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 63 29 3b Data Ascii: a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);
2025-01-12 00:03:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:40 UTC	530	OUT	GET /redirect.js HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://wkybcnfuqpgjx.ltd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:40 UTC	915	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:40 GMT Content-Type: application/javascript Content-Length: 325 Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:40 GMT ETag: "674840b0-145" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2794 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FyNy5rSsxafgLZD5Sme4ddkF%2FKaxl%2FZRWy7vcVsM9XEYCMW4V9TdNwgs0b2CwjARHFqOlVja3jUjQxva1ZEY2c1QCX7EDF84HBncsQpLmloryDrDlcRE%2FJK7EbiF4d8yRo3y0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e282e9c943fe-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9430&min_rtt=2403&rtt_var=5304&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1108&delivery_rate=1215147&cwnd=236&unsent_bytes=0&cid=1ac0f8c4bdeec463&ts=837&x=0"
2025-01-12 00:03:40 UTC	325	IN	Data Raw: 63 6f 6e 73 74 20 7b 20 70 61 74 68 6e 61 6d 65 2c 20 68 6f 73 74 6e 61 6d 65 2c 20 68 72 65 66 20 7d 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3b 0a 0a 69 66 20 28 70 61 74 68 6e 61 6d 65 2e 73 74 61 72 74 73 57 69 74 68 28 27 2f 7a 27 29 29 20 7b 0a 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 68 72 65 66 2e 72 65 70 6c 61 63 65 28 27 2f 7a 27 2c 20 27 2f 61 27 29 3b 0a 7d 0a 0a 69 66 20 28 0a 20 20 28 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 77 65 62 61 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 27 20 7c 7c 20 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 77 65 62 7a 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 27 29 20 26 26 20 21 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 27 74 74 2d 67 6c 6f 62 61 6c Data Ascii: const { pathname, hostname, href } = window.location;if (pathname.startsWith('/z')) { window.location.href = href.replace('/z', '/a');}if ( (hostname === 'weba.telegram.org' \|\| hostname === 'webz.telegram.org') && !localStorage.getItem('tt-global

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:41 UTC	562	OUT	GET /main.949acaf34f3882f511ff.css HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://wkybcnfuqpgjx.ltd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:41 UTC	910	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:41 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:39 GMT Vary: Accept-Encoding etag: W/"674840af-1ba95" Age: 6949 Cache-Control: max-age=14400 cf-cache-status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N9WIwXG%2F%2B5nYQgPaLCfWLX323zwiq51YJ1GxmFzX%2BjFWCxqsvCL5mKTW76DAAc11ak5GJb94RGDfUldHkDF6HQShQvhSLw8fJqD0LWXvQfDhQkgNhSSk7ZWbAsB69TV7w09noQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e289a86a0f36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1637&min_rtt=1591&rtt_var=629&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1140&delivery_rate=1835323&cwnd=231&unsent_bytes=0&cid=f4dadbe15b207cc8&ts=157&x=0"
2025-01-12 00:03:41 UTC	459	IN	Data Raw: 37 63 65 38 0d 0a 2e 4b 55 36 37 55 75 72 30 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 79 5f 75 52 5a 58 74 41 7b 2d 77 65 62 6b 69 74 2d 6d 61 73 6b 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 74 6f 70 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 30 70 78 2c 20 62 6c 61 63 6b 20 31 72 65 6d 29 3b 6d 61 73 6b 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 74 6f 70 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 30 70 78 2c 20 62 6c 61 63 6b 20 31 72 65 6d 29 7d 2e 4a 4e 56 54 32 44 55 39 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2e 31 32 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 31 32 35 72 65 6d 3b 6d 61 78 2d 68 65 69 67 68 74 Data Ascii: 7ce8.KU67Uur0{display:inline-block;width:100%}.y_uRZXtA{-webkit-mask-image:linear-gradient(to top, transparent 0px, black 1rem);mask-image:linear-gradient(to top, transparent 0px, black 1rem)}.JNVT2DU9{margin-top:.125rem;margin-bottom:.125rem;max-height
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 74 65 3b 74 6f 70 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 31 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 7d 2e 61 75 43 4e 74 4c 51 34 2c 2e 61 34 34 5a 4e 33 68 44 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 3b 70 61 64 64 69 6e 67 3a 2e 31 32 35 72 65 6d 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 31 32 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 2e 31 32 35 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 20 2e 31 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 63 75 72 73 6f 72 3a Data Ascii: te;top:0;right:0;bottom:0;left:0;pointer-events:none;opacity:0;transition:opacity .15s ease-in-out}.auCNtLQ4,.a44ZN3hD{display:flex;font-size:1.25rem;padding:.125rem;border-radius:.125rem;margin:.125rem;transition:background-color .15s ease-in-out;cursor:
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 43 6f 64 65 42 6c 6f 63 6b 20 2e 63 6f 64 65 2d 62 6c 6f 63 6b 2e 6e 6f 2d 77 6f 72 64 2d 77 72 61 70 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 2e 32 35 72 65 6d 7d 68 74 6d 6c 2e 74 68 65 6d 65 2d 6c 69 67 68 74 20 2e 43 6f 64 65 42 6c 6f 63 6b 20 2e 63 6f 64 65 2d 62 6c 6f 63 6b 7b 2d 2d 63 6f 6c 6f 72 2d 74 79 70 65 3a 20 23 30 30 35 33 64 34 3b 2d 2d 63 6f 6c 6f 72 2d 6b 65 79 77 6f 72 64 3a 20 23 33 38 38 65 32 32 3b 2d 2d 63 6f 6c 6f 72 2d 63 6c 61 73 73 3a 20 23 33 65 36 63 32 30 3b 2d 2d 63 6f 6c 6f 72 2d 73 74 72 69 6e 67 3a 20 23 39 61 31 31 31 31 3b 2d 2d 63 6f 6c 6f 72 2d 74 65 6d 70 6c 61 74 65 3a 20 23 39 61 35 33 33 34 3b 2d 2d 63 6f 6c 6f 72 2d 73 65 6c 65 63 74 6f 72 3a 20 23 39 61 35 Data Ascii: CodeBlock .code-block.no-word-wrap{white-space:pre;padding-bottom:.25rem}html.theme-light .CodeBlock .code-block{--color-type: #0053d4;--color-keyword: #388e22;--color-class: #3e6c20;--color-string: #9a1111;--color-template: #9a5334;--color-selector: #9a5
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 68 6c 6a 73 2d 62 75 69 6c 74 5f 69 6e 2c 2e 68 6c 6a 73 2d 74 79 70 65 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 74 79 70 65 29 7d 2e 68 6c 6a 73 2d 6e 75 6d 62 65 72 2c 2e 68 6c 6a 73 2d 63 6c 61 73 73 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 63 6c 61 73 73 29 7d 2e 68 6c 6a 73 2d 73 74 72 69 6e 67 2c 2e 68 6c 6a 73 2d 6d 65 74 61 20 2e 68 6c 6a 73 2d 73 74 72 69 6e 67 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 73 74 72 69 6e 67 29 7d 2e 68 6c 6a 73 2d 72 65 67 65 78 70 2c 2e 68 6c 6a 73 2d 74 65 6d 70 6c 61 74 65 2d 74 61 67 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 74 65 6d 70 6c 61 74 65 29 7d 2e 68 6c 6a 73 2d 73 75 62 73 74 2c 2e 68 6c 6a 73 Data Ascii: tion:underline}.hljs-built_in,.hljs-type{color:var(--color-type)}.hljs-number,.hljs-class{color:var(--color-class)}.hljs-string,.hljs-meta .hljs-string{color:var(--color-string)}.hljs-regexp,.hljs-template-tag{color:var(--color-template)}.hljs-subst,.hljs
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 69 65 2d 63 61 6e 76 61 73 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 44 4b 69 31 31 37 37 73 7b 77 69 64 74 68 3a 38 35 25 3b 68 65 69 67 68 74 3a 38 35 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 31 31 39 2c 31 31 39 2c 31 31 39 2c 2e 30 39 38 30 33 39 32 31 35 37 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 33 31 32 35 72 65 6d 7d 2e 4f 5f 54 61 44 78 57 67 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 77 71 6a 75 30 32 68 52 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 65 6d 6f 6a 69 2d 73 69 7a 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 65 6d 6f 6a 69 Data Ascii: ie-canvas{display:block}.DKi1177s{width:85%;height:85%;background-color:rgba(119,119,119,.0980392157);border-radius:.3125rem}.O_TaDxWg{width:100%;height:100%;pointer-events:none}.wqju02hR{width:var(--custom-emoji-size) !important;height:var(--custom-emoji
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 7d 0a 2e 71 45 68 67 4a 45 70 6d 7b 2d 2d 63 6f 6c 6f 72 2d 66 69 6c 6c 3a 20 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 70 72 69 6d 61 72 79 29 3b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 77 69 64 74 68 3a 31 72 65 6d 3b 68 65 69 67 68 74 3a 31 72 65 6d 7d 2e 47 6a 78 50 6e 77 5a 52 7b 77 69 64 74 68 3a 31 2e 32 35 72 65 6d 3b 68 65 69 67 68 74 3a 31 2e 32 35 72 65 6d 7d 2e 48 52 4c 72 6e 5a 76 51 7b 77 69 64 74 68 3a 31 2e 35 72 65 6d 3b 68 65 69 67 68 74 3a 31 2e 35 72 65 6d 7d 2e 65 62 4f 32 57 4a 6b 76 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 65 6d 3b 68 65 69 67 68 74 3a 31 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 Data Ascii: }.qEhgJEpm{--color-fill: var(--color-primary);flex-shrink:0;display:flex;width:1rem;height:1rem}.GjxPnwZR{width:1.25rem;height:1.25rem}.HRLrnZvQ{width:1.5rem;height:1.5rem}.ebO2WJkv{display:inline-block;width:1em;height:1em;line-height:1;vertical-align:t
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 74 72 69 63 74 7d 23 72 6f 6f 74 20 2e 54 72 61 6e 73 69 74 69 6f 6e 2d 73 6c 69 64 65 4f 70 74 69 6d 69 7a 65 64 3e 2e 54 72 61 6e 73 69 74 69 6f 6e 5f 73 6c 69 64 65 2c 23 72 6f 6f 74 20 2e 54 72 61 6e 73 69 74 69 6f 6e 2d 73 6c 69 64 65 4f 70 74 69 6d 69 7a 65 64 42 61 63 6b 77 61 72 64 73 3e 2e 54 72 61 6e 73 69 74 69 6f 6e 5f 73 6c 69 64 65 2c 23 72 6f 6f 74 20 2e 54 72 61 6e 73 69 74 69 6f 6e 2d 73 6c 69 64 65 4f 70 74 69 6d 69 7a 65 64 52 74 6c 3e 2e 54 72 61 6e 73 69 74 69 6f 6e 5f 73 6c 69 64 65 2c 23 72 6f 6f 74 20 2e 54 72 61 6e 73 69 74 69 6f 6e 2d 73 6c 69 64 65 4f 70 74 69 6d 69 7a 65 64 52 74 6c 42 61 63 6b 77 61 72 64 73 3e 2e 54 72 61 6e 73 69 74 69 6f 6e 5f 73 6c 69 64 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 Data Ascii: trict}#root .Transition-slideOptimized>.Transition_slide,#root .Transition-slideOptimizedBackwards>.Transition_slide,#root .Transition-slideOptimizedRtl>.Transition_slide,#root .Transition-slideOptimizedRtlBackwards>.Transition_slide{position:absolute;top
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 6c 69 64 65 2d 76 65 72 74 69 63 61 6c 2d 6f 75 74 20 76 61 72 28 2d 2d 73 6c 69 64 65 2d 74 72 61 6e 73 69 74 69 6f 6e 29 7d 2e 54 72 61 6e 73 69 74 69 6f 6e 2d 73 6c 69 64 65 56 65 72 74 69 63 61 6c 42 61 63 6b 77 61 72 64 73 3e 2e 54 72 61 6e 73 69 74 69 6f 6e 5f 73 6c 69 64 65 2d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 31 30 30 25 29 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 6c 69 64 65 2d 76 65 72 74 69 63 61 6c 2d 6f 75 74 2d 62 61 63 6b 77 61 72 64 73 20 76 61 72 28 2d 2d 73 6c 69 64 65 2d 74 72 61 6e 73 69 74 69 6f 6e 29 7d 2e 54 72 61 6e 73 69 74 69 6f 6e 2d 73 6c 69 64 65 56 65 72 74 69 63 61 6c 42 61 63 6b 77 61 72 64 73 3e 2e 54 72 61 6e 73 69 74 69 6f 6e 5f 73 6c 69 64 65 2d 66 Data Ascii: {animation:slide-vertical-out var(--slide-transition)}.Transition-slideVerticalBackwards>.Transition_slide-to{transform:translateY(-100%);animation:slide-vertical-out-backwards var(--slide-transition)}.Transition-slideVerticalBackwards>.Transition_slide-f
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 76 61 72 28 2d 2d 73 6c 69 64 65 2d 74 72 61 6e 73 69 74 69 6f 6e 29 2c 73 6c 69 64 65 2d 66 61 64 65 2d 69 6e 2d 62 61 63 6b 77 61 72 64 73 2d 6d 6f 76 65 20 76 61 72 28 2d 2d 73 6c 69 64 65 2d 74 72 61 6e 73 69 74 69 6f 6e 29 7d 2e 54 72 61 6e 73 69 74 69 6f 6e 2d 73 6c 69 64 65 46 61 64 65 42 61 63 6b 77 61 72 64 73 3e 2e 54 72 61 6e 73 69 74 69 6f 6e 5f 73 6c 69 64 65 2d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 2d 31 2e 35 72 65 6d 29 3b 6f 70 61 63 69 74 79 3a 30 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 6f 75 74 2d 62 61 63 6b 77 61 72 64 73 2d 6f 70 61 63 69 74 79 20 76 61 72 28 2d 2d 73 6c 69 64 65 2d 74 72 61 6e 73 69 74 69 6f 6e 29 2c 73 6c 69 64 65 2d 66 61 64 65 2d 6f 75 74 2d 62 61 63 6b 77 61 72 64 73 2d Data Ascii: var(--slide-transition),slide-fade-in-backwards-move var(--slide-transition)}.Transition-slideFadeBackwards>.Transition_slide-to{transform:translateX(-1.5rem);opacity:0;animation:fade-out-backwards-opacity var(--slide-transition),slide-fade-out-backwards-
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 73 69 74 69 6f 6e 5f 73 6c 69 64 65 2d 66 72 6f 6d 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 2d 62 61 63 6b 77 61 72 64 73 2d 6f 70 61 63 69 74 79 20 2e 31 73 20 65 61 73 65 2c 7a 6f 6f 6d 2d 66 61 64 65 2d 69 6e 2d 62 61 63 6b 77 61 72 64 73 2d 6d 6f 76 65 20 2e 31 35 73 20 65 61 73 65 7d 2e 54 72 61 6e 73 69 74 69 6f 6e 2d 7a 6f 6f 6d 46 61 64 65 42 61 63 6b 77 61 72 64 73 3e 2e 54 72 61 6e 73 69 74 69 6f 6e 5f 73 6c 69 64 65 2d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 30 2e 39 35 29 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 6f 75 74 2d 62 61 63 6b 77 61 72 64 73 2d 6f 70 61 63 69 74 79 20 2e 31 35 73 20 65 61 73 65 2c 7a 6f 6f 6d 2d 66 61 64 65 2d 6f 75 74 2d 62 Data Ascii: sition_slide-from{transform:scale(1);animation:fade-in-backwards-opacity .1s ease,zoom-fade-in-backwards-move .15s ease}.Transition-zoomFadeBackwards>.Transition_slide-to{transform:scale(0.95);animation:fade-out-backwards-opacity .15s ease,zoom-fade-out-b

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:41 UTC	532	OUT	GET /compatTest.js HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://wkybcnfuqpgjx.ltd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:41 UTC	920	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:41 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:40 GMT Vary: Accept-Encoding ETag: W/"674840b0-9f0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2795 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0S7BKtJW88re0Omw4kWm3lCymSuvzDXsRLfEfiepliNb6KjptLuioDX0PaZNrnS0QY%2B%2BiptAQoqW795feWTzU57S7QuKPQTPvhCv6wNu4YEvHnBckcoVfYMPfDmFEWohYbNvGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e289c87c0f8f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1504&min_rtt=1490&rtt_var=588&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1110&delivery_rate=1817050&cwnd=232&unsent_bytes=0&cid=b8b5ac80e7582d61&ts=148&x=0"
2025-01-12 00:03:41 UTC	449	IN	Data Raw: 39 66 30 0d 0a 66 75 6e 63 74 69 6f 6e 20 63 6f 6d 70 61 74 54 65 73 74 28 29 20 7b 0a 20 20 76 61 72 20 68 61 73 50 72 6f 6d 69 73 65 20 3d 20 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 57 65 62 53 6f 63 6b 65 74 73 20 3d 20 74 79 70 65 6f 66 20 57 65 62 53 6f 63 6b 65 74 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 57 65 62 43 72 79 70 74 6f 20 3d 20 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 20 26 26 20 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 2e 73 75 62 74 6c 65 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 4f 62 6a 65 63 74 46 72 6f 6d 45 6e 74 72 69 65 73 20 3d 20 74 79 70 65 6f 66 20 Data Ascii: 9f0function compatTest() { var hasPromise = typeof Promise !== 'undefined'; var hasWebSockets = typeof WebSocket !== 'undefined'; var hasWebCrypto = window.crypto && typeof window.crypto.subtle !== 'undefined'; var hasObjectFromEntries = typeof
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 68 61 73 49 6e 74 6c 20 3d 20 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 49 6e 74 6c 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 44 69 73 70 6c 61 79 4e 61 6d 65 73 20 3d 20 68 61 73 49 6e 74 6c 20 26 26 20 74 79 70 65 6f 66 20 49 6e 74 6c 2e 44 69 73 70 6c 61 79 4e 61 6d 65 73 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 50 6c 75 72 61 6c 52 75 6c 65 73 20 3d 20 68 61 73 49 6e 74 6c 20 26 26 20 74 79 70 65 6f 66 20 49 6e 74 6c 2e 50 6c 75 72 61 6c 52 75 6c 65 73 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 4e 75 6d 62 65 72 46 6f 72 6d 61 74 20 3d 20 68 61 73 49 6e 74 6c 20 26 26 20 74 79 70 65 6f 66 20 49 6e 74 6c 2e 4e 75 6d 62 65 72 46 6f 72 6d Data Ascii: hasIntl = typeof window.Intl !== 'undefined'; var hasDisplayNames = hasIntl && typeof Intl.DisplayNames !== 'undefined'; var hasPluralRules = hasIntl && typeof Intl.PluralRules !== 'undefined'; var hasNumberFormat = hasIntl && typeof Intl.NumberForm
2025-01-12 00:03:41 UTC	733	IN	Data Raw: 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 27 29 3b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 63 6f 6c 6c 61 70 73 65 3a 63 6f 6c 6c 61 70 73 65 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 22 3e 3c 69 6d 67 20 73 72 63 3d 2e 2f 75 6e 73 75 70 70 6f 72 74 65 64 2e 70 6e 67 3e 3c 68 33 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 6e 6f 74 20 73 75 Data Ascii: ica, sans-serif;'); document.body.innerHTML = '<table style="width:100%;height:100%;border-collapse:collapse"><tr><td style="vertical-align:middle;text-align:center"><div style="display:inline-block"><img src=./unsupported.png><h3>Your browser is not su
2025-01-12 00:03:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://wkybcnfuqpgjx.ltd/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Windows Analysis Report
https://wkybcnfuqpgjx.ltd/

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:41 UTC	547	OUT	GET /main.d54bfa037348b154a941.js HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://wkybcnfuqpgjx.ltd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:41 UTC	924	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:41 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:39 GMT Vary: Accept-Encoding ETag: W/"674840af-48637" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2795 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tBjxSqtn1nXPp6WH5abl4uoZ9t8VHhLQPD3alQCe2EI5nKq4B%2Fv4m3lbofM%2FpSLFcB6Hv9B5uFOl3hQ2I0PeZo0T2ROEMq%2BwHUbOQuJqHgxp86EDg7u2cAF1Z8tPvsrRa0mlmQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e289df06c34e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1599&min_rtt=1585&rtt_var=604&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1125&delivery_rate=1842271&cwnd=224&unsent_bytes=0&cid=0dfb54ac9e1fbc96&ts=161&x=0"
2025-01-12 00:03:41 UTC	445	IN	Data Raw: 37 63 64 62 0d 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 2c 6e 2c 6f 2c 72 3d 7b 34 38 37 35 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 64 28 74 2c 7b 70 78 3a 28 29 3d 3e 4d 2c 65 5a 3a 28 29 3d 3e 4e 2c 41 72 3a 28 29 3d 3e 46 2c 50 48 3a 28 29 3d 3e 4f 2c 48 6e 3a 28 29 3d 3e 78 2c 52 75 3a 28 29 3d 3e 6b 2c 65 75 3a 28 29 3d 3e 4c 2c 69 42 3a 28 29 3d 3e 50 2c 66 6a 3a 28 29 3d 3e 54 7d 29 3b 76 61 72 20 6f 3d 6e 28 31 34 38 31 29 2c 72 3d 6e 28 31 31 38 32 29 2c 61 3d 6e 28 39 37 30 35 29 2c 73 3d 6e 28 34 34 38 37 29 2c 64 3d 6e 28 34 32 33 35 29 2c 69 3d 6e 28 37 38 33 36 29 2c 63 3d 6e 28 32 33 39 33 29 3b 63 6f 6e 73 74 20 75 3d 31 35 30 2c 6c 3d 35 65 33 2c 66 3d 6e 65 77 20 53 65 74 28 5b 22 64 65 73 74 72 6f Data Ascii: 7cdb(()=>{"use strict";var e,t,n,o,r={4875:(e,t,n)=>{n.d(t,{px:()=>M,eZ:()=>N,Ar:()=>F,PH:()=>O,Hn:()=>x,Ru:()=>k,eu:()=>L,iB:()=>P,fj:()=>T});var o=n(1481),r=n(1182),a=n(9705),s=n(4487),d=n(4235),i=n(7836),c=n(2393);const u=150,l=5e3,f=new Set(["destro
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 7d 29 29 3b 63 6f 6e 73 74 20 76 3d 63 2e 62 73 3f 6e 65 77 20 42 72 6f 61 64 63 61 73 74 43 68 61 6e 6e 65 6c 28 6f 2e 72 4c 46 29 3a 76 6f 69 64 20 30 2c 77 3d 28 30 2c 69 2e 46 65 29 28 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 67 3b 67 3d 5b 5d 2c 68 3f 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 7b 70 61 79 6c 6f 61 64 73 3a 65 7d 29 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 43 28 65 29 7b 67 2e 70 75 73 68 28 65 29 2c 77 28 29 7d 6c 65 74 20 41 2c 53 3d 5b 5d 2c 45 3d 5b 5d 2c 49 3d 21 31 3b 66 75 6e 63 74 69 6f 6e 20 6b 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 41 3d 65 2c 62 3f 28 68 7c 7c 28 6f 2e 4f 69 67 26 26 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 3e 3e 3e 20 53 54 41 52 54 20 4c 4f 41 44 20 57 4f 52 4b 45 52 22 29 2c 68 3d 6e 65 77 20 57 6f 72 6b 65 72 Data Ascii: }));const v=c.bs?new BroadcastChannel(o.rLF):void 0,w=(0,i.Fe)((()=>{const e=g;g=[],h?.postMessage({payloads:e})}));function C(e){g.push(e),w()}let A,S=[],E=[],I=!1;function k(e,t){return A=e,b?(h\|\|(o.Oig&&console.log(">>> START LOAD WORKER"),h=new Worker
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 67 73 3a 65 7d 29 7d 28 74 29 2c 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 29 29 7d 66 75 6e 63 74 69 6f 6e 20 54 28 65 2c 74 2c 6e 29 7b 79 5b 65 5d 5b 74 5d 3d 6e 7d 66 75 6e 63 74 69 6f 6e 20 50 28 65 29 7b 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 79 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 65 29 7b 72 65 74 75 72 6e 20 42 28 7b 74 79 70 65 3a 22 74 6f 67 67 6c 65 44 65 62 75 67 4d 6f 64 65 22 2c 69 73 45 6e 61 62 6c 65 64 3a 65 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6e 3d 6e 65 77 20 41 72 72 61 79 28 74 3e 31 3f 74 2d 31 3a 30 29 2c 72 3d 31 3b 72 3c 74 3b 72 2b 2b 29 6e 5b 72 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 69 66 28 21 49 29 7b Data Ascii: gs:e})}(t),Promise.resolve())}function T(e,t,n){y[e][t]=n}function P(e){Object.assign(y,e)}function L(e){return B({type:"toggleDebugMode",isEnabled:e})}function N(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];if(!I){
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 6f 6e 73 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 4f 28 65 29 7b 6d 2e 67 65 74 28 65 2e 6d 65 73 73 61 67 65 49 64 29 3f 2e 63 61 6c 6c 62 61 63 6b 3f 2e 28 2e 2e 2e 65 2e 63 61 6c 6c 62 61 63 6b 41 72 67 73 29 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 29 7b 63 6f 6e 73 74 20 74 3d 28 30 2c 64 2e 41 29 28 29 2c 6e 3d 7b 6d 65 73 73 61 67 65 49 64 3a 74 2c 2e 2e 2e 65 7d 2c 6f 3d 7b 6d 65 73 73 61 67 65 49 64 3a 74 7d 2c 72 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 28 65 2c 74 29 3d 3e 7b 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 6f 2c 7b 72 65 73 6f 6c 76 65 3a 65 2c 72 65 6a 65 63 74 3a 74 7d 29 7d 29 29 3b 69 66 28 22 61 72 67 73 22 69 6e 20 6e 26 26 22 6e 61 6d 65 22 69 6e 20 6e 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 2e 61 72 67 Data Ascii: onse))}function O(e){m.get(e.messageId)?.callback?.(...e.callbackArgs)}function B(e){const t=(0,d.A)(),n={messageId:t,...e},o={messageId:t},r=new Promise(((e,t)=>{Object.assign(o,{resolve:e,reject:t})}));if("args"in n&&"name"in n&&"function"==typeof n.arg
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 6e 74 69 6f 6e 3d 22 4d 65 73 73 61 67 65 45 6e 74 69 74 79 4d 65 6e 74 69 6f 6e 22 2c 65 2e 50 68 6f 6e 65 3d 22 4d 65 73 73 61 67 65 45 6e 74 69 74 79 50 68 6f 6e 65 22 2c 65 2e 50 72 65 3d 22 4d 65 73 73 61 67 65 45 6e 74 69 74 79 50 72 65 22 2c 65 2e 53 74 72 69 6b 65 3d 22 4d 65 73 73 61 67 65 45 6e 74 69 74 79 53 74 72 69 6b 65 22 2c 65 2e 54 65 78 74 55 72 6c 3d 22 4d 65 73 73 61 67 65 45 6e 74 69 74 79 54 65 78 74 55 72 6c 22 2c 65 2e 55 72 6c 3d 22 4d 65 73 73 61 67 65 45 6e 74 69 74 79 55 72 6c 22 2c 65 2e 55 6e 64 65 72 6c 69 6e 65 3d 22 4d 65 73 73 61 67 65 45 6e 74 69 74 79 55 6e 64 65 72 6c 69 6e 65 22 2c 65 2e 53 70 6f 69 6c 65 72 3d 22 4d 65 73 73 61 67 65 45 6e 74 69 74 79 53 70 6f 69 6c 65 72 22 2c 65 2e 43 75 73 74 6f 6d 45 6d 6f 6a 69 Data Ascii: ntion="MessageEntityMention",e.Phone="MessageEntityPhone",e.Pre="MessageEntityPre",e.Strike="MessageEntityStrike",e.TextUrl="MessageEntityTextUrl",e.Url="MessageEntityUrl",e.Underline="MessageEntityUnderline",e.Spoiler="MessageEntitySpoiler",e.CustomEmoji
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 2c 5b 73 65 2c 64 65 2c 69 65 5d 3d 28 30 2c 67 2e 41 29 28 21 28 30 2c 6f 2e 4f 56 29 28 29 7c 7c 61 65 29 3b 28 30 2c 79 2e 41 79 29 28 69 65 2c 64 65 2c 61 65 29 2c 28 30 2c 6f 2e 76 4a 29 28 28 28 29 3d 3e 7b 61 65 26 26 64 65 28 29 7d 29 2c 5b 61 65 5d 29 2c 28 30 2c 45 2e 41 29 28 28 28 29 3d 3e 7b 69 66 28 55 26 26 21 5a 29 7b 63 6f 6e 73 74 7b 72 3a 65 2c 67 3a 74 2c 62 3a 6e 7d 3d 28 30 2c 66 2e 45 32 29 28 55 29 3b 72 65 2e 63 75 72 72 65 6e 74 3d 5b 65 2c 74 2c 6e 5d 7d 65 6c 73 65 20 72 65 2e 63 75 72 72 65 6e 74 3d 76 6f 69 64 20 30 7d 29 2c 5b 55 2c 5a 5d 29 3b 63 6f 6e 73 74 20 63 65 3d 28 30 2c 6f 2e 6c 69 29 28 21 31 29 3b 28 30 2c 6f 2e 5f 57 29 28 28 28 29 3d 3e 7b 63 65 2e 63 75 72 72 65 6e 74 3d 21 30 7d 29 29 3b 63 6f 6e 73 74 20 75 Data Ascii: ,[se,de,ie]=(0,g.A)(!(0,o.OV)()\|\|ae);(0,y.Ay)(ie,de,ae),(0,o.vJ)((()=>{ae&&de()}),[ae]),(0,E.A)((()=>{if(U&&!Z){const{r:e,g:t,b:n}=(0,f.E2)(U);re.current=[e,t,n]}else re.current=void 0}),[U,Z]);const ce=(0,o.li)(!1);(0,o._W)((()=>{ce.current=!0}));const u
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3b 63 6f 6e 73 74 20 72 3d 28 30 2c 62 2e 41 29 28 65 29 2c 61 3d 28 30 2c 62 2e 41 29 28 74 29 3b 28 30 2c 6f 2e 76 4a 29 28 28 28 29 3d 3e 7b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 77 2e 61 64 64 43 61 6c 6c 62 61 63 6b 28 72 29 2c 43 2e 61 64 64 43 61 6c 6c 62 61 63 6b 28 61 29 2c 28 29 3d 3e 7b 43 2e 72 65 6d 6f 76 65 43 61 6c 6c 62 61 63 6b 28 61 29 2c 77 2e 72 65 6d 6f 76 65 43 61 6c 6c 62 61 63 6b 28 72 29 7d 7d 29 2c 5b 6e 2c 72 2c 61 5d 29 7d 28 6d 65 2c 66 65 2c 21 74 65 7c 7c 5f 29 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6c 65 74 20 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e Data Ascii: d 0!==arguments[2]&&arguments[2];const r=(0,b.A)(e),a=(0,b.A)(t);(0,o.vJ)((()=>{if(!n)return w.addCallback(r),C.addCallback(a),()=>{C.removeCallback(a),w.removeCallback(r)}}),[n,r,a])}(me,fe,!te\|\|_),function(e,t){let n=arguments.length>2&&void 0!==argumen
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 74 20 6e 3d 5b 5d 2c 6f 3d 5b 5d 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6c 65 74 20 61 2c 73 2c 63 2c 66 2c 70 2c 67 2c 79 2c 62 2c 76 2c 77 2c 43 2c 41 2c 53 3b 66 6f 72 28 61 3d 31 32 38 2c 63 3d 30 2c 66 3d 37 32 2c 70 3d 65 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2d 22 29 2c 70 3c 30 26 26 28 70 3d 30 29 2c 67 3d 30 3b 67 3c 70 3b 2b 2b 67 29 7b 69 66 28 74 26 26 28 6f 5b 6e 2e 6c 65 6e 67 74 68 5d 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 67 29 2d 36 35 3c 32 36 29 2c 65 2e 63 68 61 72 43 6f 64 65 41 74 28 67 29 3e 3d 31 32 38 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 49 6c 6c 65 67 61 6c 20 69 6e 70 75 74 20 3e 3d 20 30 78 38 30 22 29 3b 6e 2e 70 75 73 68 28 65 2e 63 68 61 72 43 6f 64 65 41 74 28 67 29 29 7d 66 6f 72 28 79 Data Ascii: t n=[],o=[],r=e.length;let a,s,c,f,p,g,y,b,v,w,C,A,S;for(a=128,c=0,f=72,p=e.lastIndexOf("-"),p<0&&(p=0),g=0;g<p;++g){if(t&&(o[n.length]=e.charCodeAt(g)-65<26),e.charCodeAt(g)>=128)throw new RangeError("Illegal input >= 0x80");n.push(e.charCodeAt(g))}for(y
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 74 29 7d 7d 63 6f 6e 73 74 20 77 3d 65 3d 3e 7b 6c 65 74 7b 75 72 6c 3a 74 2c 74 65 78 74 3a 6e 2c 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 63 68 69 6c 64 72 65 6e 3a 64 2c 77 69 74 68 4e 6f 72 6d 61 6c 57 6f 72 64 42 72 65 61 6b 3a 69 2c 69 73 52 74 6c 3a 63 7d 3d 65 3b 63 6f 6e 73 74 7b 6f 70 65 6e 55 72 6c 3a 75 7d 3d 28 30 2c 72 2e 6b 6f 29 28 29 2c 6c 3d 64 7c 7c 6e 2c 66 3d 74 3d 3d 3d 6e 2c 68 3d 28 30 2c 62 2e 41 29 28 28 65 3d 3e 21 74 7c 7c 28 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 75 28 7b 75 72 6c 3a 74 2c 73 68 6f 75 6c 64 53 6b 69 70 4d 6f 64 61 6c 3a 66 7d 29 2c 21 31 29 29 29 3b 69 66 28 21 74 29 72 65 74 75 72 6e 3b 63 6f 6e 73 74 20 6d 3d 28 30 2c 67 2e 41 29 28 73 7c 7c 22 74 65 78 74 2d 65 6e 74 69 74 79 2d 6c 69 6e 6b 22 Data Ascii: t)}}const w=e=>{let{url:t,text:n,className:s,children:d,withNormalWordBreak:i,isRtl:c}=e;const{openUrl:u}=(0,r.ko)(),l=d\|\|n,f=t===n,h=(0,b.A)((e=>!t\|\|(e.preventDefault(),u({url:t,shouldSkipModal:f}),!1)));if(!t)return;const m=(0,g.A)(s\|\|"text-entity-link"
2025-01-12 00:03:41 UTC	1369	IN	Data Raw: 72 53 65 74 75 70 4d 6f 6e 6b 65 79 54 72 61 63 6b 69 6e 67 2e 65 62 35 61 37 61 36 66 31 36 36 66 62 37 35 38 39 63 31 32 2e 74 67 73 22 2c 53 3d 6e 2e 70 2b 22 52 65 61 64 54 69 6d 65 2e 30 31 35 64 36 65 36 66 37 33 66 37 36 38 66 31 65 39 66 65 2e 74 67 73 22 2c 45 3d 6e 2e 70 2b 22 52 65 70 6f 72 74 2e 34 61 35 64 64 61 30 32 32 37 65 61 38 36 66 36 66 61 35 65 2e 74 67 73 22 2c 49 3d 6e 2e 70 2b 22 43 6f 6e 67 72 61 74 75 6c 61 74 69 6f 6e 73 2e 62 36 36 32 33 62 38 65 66 63 36 66 65 64 65 63 39 64 33 33 2e 74 67 73 22 2c 6b 3d 6e 2e 70 2b 22 44 69 73 63 75 73 73 69 6f 6e 47 72 6f 75 70 73 44 75 63 6b 73 2e 39 65 61 34 35 33 64 31 62 65 39 64 31 62 30 65 65 37 37 61 2e 74 67 73 22 2c 54 3d 6e 2e 70 2b 22 45 78 70 65 72 69 6d 65 6e 74 61 6c 2e 34 33 Data Ascii: rSetupMonkeyTracking.eb5a7a6f166fb7589c12.tgs",S=n.p+"ReadTime.015d6e6f73f768f1e9fe.tgs",E=n.p+"Report.4a5dda0227ea86f6fa5e.tgs",I=n.p+"Congratulations.b6623b8efc6fedec9d33.tgs",k=n.p+"DiscussionGroupsDucks.9ea453d1be9d1b0ee77a.tgs",T=n.p+"Experimental.43

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:43 UTC	354	OUT	GET /compatTest.js HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:43 UTC	919	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:43 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:40 GMT Vary: Accept-Encoding ETag: W/"674840b0-9f0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2797 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q5lzDU1VeOmy%2BUubGJDZj5nyYDj5PoBv8Gh4jSoExe9RUuCOybBU8O9XJ30IfGlVeJ5DgtfWYeB4CXxEUbmk53hNCMnta2YKx8uCB12O8LImpfKCPs60sNvGE2ok%2FI2scp7Jtg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e2943aaa433e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1878&min_rtt=1649&rtt_var=782&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=932&delivery_rate=1770770&cwnd=249&unsent_bytes=0&cid=41c17b5b2cbf3d28&ts=145&x=0"
2025-01-12 00:03:43 UTC	450	IN	Data Raw: 39 66 30 0d 0a 66 75 6e 63 74 69 6f 6e 20 63 6f 6d 70 61 74 54 65 73 74 28 29 20 7b 0a 20 20 76 61 72 20 68 61 73 50 72 6f 6d 69 73 65 20 3d 20 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 57 65 62 53 6f 63 6b 65 74 73 20 3d 20 74 79 70 65 6f 66 20 57 65 62 53 6f 63 6b 65 74 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 57 65 62 43 72 79 70 74 6f 20 3d 20 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 20 26 26 20 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 2e 73 75 62 74 6c 65 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 4f 62 6a 65 63 74 46 72 6f 6d 45 6e 74 72 69 65 73 20 3d 20 74 79 70 65 6f 66 20 Data Ascii: 9f0function compatTest() { var hasPromise = typeof Promise !== 'undefined'; var hasWebSockets = typeof WebSocket !== 'undefined'; var hasWebCrypto = window.crypto && typeof window.crypto.subtle !== 'undefined'; var hasObjectFromEntries = typeof
2025-01-12 00:03:43 UTC	1369	IN	Data Raw: 61 73 49 6e 74 6c 20 3d 20 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 49 6e 74 6c 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 44 69 73 70 6c 61 79 4e 61 6d 65 73 20 3d 20 68 61 73 49 6e 74 6c 20 26 26 20 74 79 70 65 6f 66 20 49 6e 74 6c 2e 44 69 73 70 6c 61 79 4e 61 6d 65 73 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 50 6c 75 72 61 6c 52 75 6c 65 73 20 3d 20 68 61 73 49 6e 74 6c 20 26 26 20 74 79 70 65 6f 66 20 49 6e 74 6c 2e 50 6c 75 72 61 6c 52 75 6c 65 73 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 3b 0a 20 20 76 61 72 20 68 61 73 4e 75 6d 62 65 72 46 6f 72 6d 61 74 20 3d 20 68 61 73 49 6e 74 6c 20 26 26 20 74 79 70 65 6f 66 20 49 6e 74 6c 2e 4e 75 6d 62 65 72 46 6f 72 6d 61 Data Ascii: asIntl = typeof window.Intl !== 'undefined'; var hasDisplayNames = hasIntl && typeof Intl.DisplayNames !== 'undefined'; var hasPluralRules = hasIntl && typeof Intl.PluralRules !== 'undefined'; var hasNumberFormat = hasIntl && typeof Intl.NumberForma
2025-01-12 00:03:43 UTC	732	IN	Data Raw: 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 27 29 3b 0a 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 63 6f 6c 6c 61 70 73 65 3a 63 6f 6c 6c 61 70 73 65 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 22 3e 3c 69 6d 67 20 73 72 63 3d 2e 2f 75 6e 73 75 70 70 6f 72 74 65 64 2e 70 6e 67 3e 3c 68 33 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 6e 6f 74 20 73 75 70 Data Ascii: ca, sans-serif;'); document.body.innerHTML = '<table style="width:100%;height:100%;border-collapse:collapse"><tr><td style="vertical-align:middle;text-align:center"><div style="display:inline-block"><img src=./unsupported.png><h3>Your browser is not sup
2025-01-12 00:03:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:43 UTC	529	OUT	GET /script.js HTTP/1.1 Host: hu.bafanglaicai.app Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://wkybcnfuqpgjx.ltd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:43 UTC	1199	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:43 GMT Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: on Content-Security-Policy: default-src 'self';img-src * data:;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self' undefined Cache-Control: public, max-age=14400 Last-Modified: Wed, 28 Aug 2024 02:52:03 GMT ETag: W/"a11-19196e5b838" Vary: Accept-Encoding CF-Cache-Status: REVALIDATED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dx1AFizJYFefBoYDJZ90uc1bB%2Bw%2Fu4x5sQ6rOrw6RdttRDnTZAeRA6ZIp%2BdhwdXLpT7AgOm67REy4eJqGJpx%2F6YeQsFWYtiZfkQhOlrZJk%2FiMB2%2FkVHWnV%2F24AbudFND6fyoI1V6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e294187041e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1840&min_rtt=1753&rtt_var=720&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1107&delivery_rate=1665715&cwnd=202&unsent_bytes=0&cid=3a091723055c9573&ts=607&x=0"
2025-01-12 00:03:43 UTC	170	IN	Data Raw: 61 31 31 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 3d 3e 7b 63 6f 6e 73 74 7b 73 63 72 65 65 6e 3a 7b 77 69 64 74 68 3a 65 2c 68 65 69 67 68 74 3a 61 7d 2c 6e 61 76 69 67 61 74 6f 72 3a 7b 6c 61 6e 67 75 61 67 65 3a 72 7d 2c 6c 6f 63 61 74 69 6f 6e 3a 6e 2c 6c 6f 63 61 6c 53 74 6f 72 61 67 65 3a 69 2c 64 6f 63 75 6d 65 6e 74 3a 63 2c 68 69 73 74 6f 72 79 3a 6f 7d 3d 74 2c 7b 68 6f 73 74 6e 61 6d 65 3a 73 2c 68 72 65 66 3a 75 7d 3d 6e 2c 7b 63 75 72 72 65 6e 74 Data Ascii: a11!function(){"use strict";(t=>{const{screen:{width:e,height:a},navigator:{language:r},location:n,localStorage:i,document:c,history:o}=t,{hostname:s,href:u}=n,{current
2025-01-12 00:03:43 UTC	1369	IN	Data Raw: 53 63 72 69 70 74 3a 6c 2c 72 65 66 65 72 72 65 72 3a 64 7d 3d 63 3b 69 66 28 21 6c 29 72 65 74 75 72 6e 3b 63 6f 6e 73 74 20 66 3d 22 64 61 74 61 2d 22 2c 6d 3d 6c 2e 67 65 74 41 74 74 72 69 62 75 74 65 2e 62 69 6e 64 28 6c 29 2c 68 3d 6d 28 66 2b 22 77 65 62 73 69 74 65 2d 69 64 22 29 2c 70 3d 6d 28 66 2b 22 68 6f 73 74 2d 75 72 6c 22 29 2c 67 3d 6d 28 66 2b 22 74 61 67 22 29 2c 79 3d 22 66 61 6c 73 65 22 21 3d 3d 6d 28 66 2b 22 61 75 74 6f 2d 74 72 61 63 6b 22 29 2c 62 3d 22 74 72 75 65 22 3d 3d 3d 6d 28 66 2b 22 65 78 63 6c 75 64 65 2d 73 65 61 72 63 68 22 29 2c 76 3d 6d 28 66 2b 22 64 6f 6d 61 69 6e 73 22 29 7c 7c 22 22 2c 53 3d 76 2e 73 70 6c 69 74 28 22 2c 22 29 2e 6d 61 70 28 28 74 3d 3e 74 2e 74 72 69 6d 28 29 29 29 2c 77 3d 60 24 7b 28 70 7c 7c Data Ascii: Script:l,referrer:d}=c;if(!l)return;const f="data-",m=l.getAttribute.bind(l),h=m(f+"website-id"),p=m(f+"host-url"),g=m(f+"tag"),y="false"!==m(f+"auto-track"),b="true"===m(f+"exclude-search"),v=m(f+"domains")\|\|"",S=v.split(",").map((t=>t.trim())),w=`${(p\|\|
2025-01-12 00:03:43 UTC	1045	IN	Data Raw: 68 61 72 61 63 74 65 72 44 61 74 61 3a 21 30 2c 63 68 69 6c 64 4c 69 73 74 3a 21 30 7d 29 7d 29 28 29 2c 63 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 28 61 73 79 6e 63 20 74 3d 3e 7b 63 6f 6e 73 74 20 65 3d 74 3d 3e 5b 22 42 55 54 54 4f 4e 22 2c 22 41 22 5d 2e 69 6e 63 6c 75 64 65 73 28 74 29 2c 61 3d 61 73 79 6e 63 20 74 3d 3e 7b 63 6f 6e 73 74 20 65 3d 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 2e 62 69 6e 64 28 74 29 2c 61 3d 65 28 41 29 3b 69 66 28 61 29 7b 63 6f 6e 73 74 20 72 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 61 6d 65 73 28 29 2e 66 6f 72 45 61 63 68 28 28 74 3d 3e 7b 63 6f 6e 73 74 20 61 3d 74 2e 6d 61 74 63 68 28 54 29 3b 61 26 26 28 72 5b 61 5b 31 5d 5d 3d 65 28 74 29 Data Ascii: haracterData:!0,childList:!0})})(),c.addEventListener("click",(async t=>{const e=t=>["BUTTON","A"].includes(t),a=async t=>{const e=t.getAttribute.bind(t),a=e(A);if(a){const r={};return t.getAttributeNames().forEach((t=>{const a=t.match(T);a&&(r[a[1]]=e(t)
2025-01-12 00:03:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:43 UTC	541	OUT	GET /_websync_?authed=0&version=10.9.21+A HTTP/1.1 Host: t.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://wkybcnfuqpgjx.ltd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:43 UTC	482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 12 Jan 2025 00:03:43 GMT Content-Type: application/json; charset=utf-8 Content-Length: 4 Connection: close Set-Cookie: stel_web_auth=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; samesite=None; secure; HttpOnly Set-Cookie: stel_web_force=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store Strict-Transport-Security: max-age=35768000
2025-01-12 00:03:43 UTC	4	IN	Data Raw: 74 72 75 65 Data Ascii: true

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:43 UTC	635	OUT	GET /KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.324b1e6d0f5ae7c6ab42.woff2 HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://wkybcnfuqpgjx.ltd sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://wkybcnfuqpgjx.ltd/main.949acaf34f3882f511ff.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:43 UTC	911	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:43 GMT Content-Type: font/woff2 Content-Length: 11056 Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:39 GMT ETag: "674840af-2b30" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6950 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wfbl%2F9nM33mYRp3QrFHQGp0TyonvemLEYqdwDqcjAl8dPm78R4EXG5zeLSrVF9xX%2B0YVvqWEW9bGO3tb6PbSX%2BCB5Lr8HYQGqeuZm23Opw5f%2B8hSoR4%2FD%2BeFdbDwGQ8X5erNhQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e29798a715c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11997&min_rtt=1548&rtt_var=6907&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1213&delivery_rate=1886304&cwnd=252&unsent_bytes=0&cid=9d96d0bd3d405b68&ts=159&x=0"
2025-01-12 00:03:43 UTC	458	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 2b 30 00 0e 00 00 00 00 54 7c 00 00 2a d8 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 64 1b 9a 1e 1c 83 7c 06 60 00 87 6c 11 0c 0a ef 48 d8 6c 0b 83 72 00 01 36 02 24 03 87 60 04 20 05 83 00 07 20 1b 3b 46 33 03 c1 c6 01 00 50 67 26 a3 91 11 6c 1c 00 14 6d 50 14 65 83 b2 25 f8 3f 24 68 0b 86 e0 b5 07 ad 89 09 63 62 0c 8a 9a 29 4b 6b 11 08 63 20 99 c2 78 79 ad 96 1d f2 f5 e3 ac e9 e5 7c 57 ad 75 77 b5 1e 31 f6 d5 9f 09 71 08 a2 7f 6a cc f1 63 cc 23 db c7 c2 0f 00 c4 8e d1 d0 48 62 12 44 76 c1 7f 75 4f cf ed 13 9d 89 8e cc 90 88 18 84 42 04 28 83 3f 78 f3 03 3f b7 de 5f 41 4b a9 08 da a0 4d c5 08 47 8e c8 9c 94 b8 51 39 46 b5 44 4b 85 03 41 11 45 aa 0c f4 80 43 2c 4a 2c 7a 8a e7 89 52 00 ff 44 d5 Data Ascii: wOF2+0T\|*d\|`lHlr6$` ;F3Pg&lmPe%?$hcb)Kkc xy\|Wuw1qjc#HbDvuOB(?x?_AKMGQ9FDKAEC,J,zRD
2025-01-12 00:03:43 UTC	1369	IN	Data Raw: 6c 5f 85 ab b2 f7 7f fb 7d ab f3 16 b1 f4 09 e9 93 ac 24 ce d6 34 ef ce d3 99 79 cf bf cd 5f 53 0d 65 89 5e 69 e2 92 34 6d e2 90 f6 50 3d 42 88 1e 0a 21 91 23 24 d1 50 08 b1 10 69 c0 e3 d6 7f ef 3d f1 8d d3 fe af 84 10 82 04 11 b1 ad bc d5 30 8b 5d 15 86 17 56 07 a3 96 b1 55 c1 75 20 19 73 e8 c7 bf 52 40 e1 04 e0 00 28 ac 84 29 43 68 70 80 08 15 0a 11 2b 16 22 5e 3c 04 0d 0d 22 59 32 44 aa 74 88 3a 8d 50 fa 7c 87 40 a0 80 45 80 25 20 40 40 84 42 80 85 88 51 86 d9 6d 0f 3d 33 10 38 35 34 d0 07 04 ce 0c 74 bf 01 02 e7 39 93 fd 40 00 06 30 22 80 38 f7 f4 40 3f 60 06 02 08 18 28 20 b1 d6 b5 10 c5 30 c0 5e 21 52 01 15 10 52 a1 d9 76 0b 30 2b 14 67 ec 97 9c b9 4c f1 a7 40 0a 25 3e f5 d2 2f 63 ea 64 e6 64 61 59 65 47 e3 6a 47 ca a1 1c ca ad a9 37 8b 22 35 72 91 Data Ascii: l_}$4y_Se^i4mP=B!#$Pi=0]VUu sR@()Chp+"^<"Y2Dt:P\|@E% @@BQm=3854t9@0"8@?`( 0^!RRv0+gL@%>/cddaYeGjG7"5r
2025-01-12 00:03:43 UTC	1369	IN	Data Raw: 77 e8 c1 8a 2c 78 18 79 f1 10 b2 21 17 df 9e d6 86 d0 15 89 ec 0d d1 88 b1 d0 cc 21 84 25 b1 b3 26 2c 9b 9d 99 77 88 cc 16 87 78 08 25 8d 50 d2 37 47 e4 bb ed c8 56 91 1b f9 90 1b f9 2c 3e 4f 90 47 40 9c 44 ed 13 51 c8 82 6c c0 34 67 15 b2 49 44 87 18 be 65 17 16 99 15 f7 5b 52 d5 4a fd 75 5c ce 6a f5 70 dc 85 69 e7 63 34 4e b3 d9 d5 c4 4c 05 f7 30 51 29 54 dc df 50 af 48 ef 00 15 0b 3a c4 50 3f 78 98 89 ae b4 49 c0 0a 21 71 26 76 81 d6 d1 9f ac fa 08 a0 6e cf 74 da 05 fe be 70 f5 3f ed e9 00 12 e7 79 7b 3a 83 a2 42 d5 fb 1b 9c e7 ef ea 03 16 17 50 7c 03 c1 ae 97 e7 43 03 4c 34 6b 36 28 1d b3 62 84 6b 16 f0 41 ef 89 8b 10 2d 81 68 e8 5e 41 80 c0 1c 91 48 b3 3c 07 86 27 09 02 a8 81 72 6a 80 a6 43 5f 1d 14 fd e8 d4 c7 b1 91 8c d4 4b a3 d4 5d 75 06 61 46 1e Data Ascii: w,xy!!%&,wx%P7GV,>OG@DQl4gIDe[RJu\jpic4NL0Q)TPH:P?xI!q&vntp?y{:BP\|CL4k6(bkA-h^AH<'rjC_K]uaF
2025-01-12 00:03:43 UTC	1369	IN	Data Raw: ee d3 e7 98 43 86 93 dc f8 f3 af ba aa 12 17 cc 66 f5 a3 09 f9 96 d7 24 aa 5e 08 ad 48 56 f5 b1 b0 e3 26 8c fb b9 b4 55 d5 fc bc 69 f2 0d 67 c1 07 f6 7f 71 b8 ac 1d 5d aa b7 b6 82 c5 85 ac b1 3d 92 8c fe 7d 26 e9 f6 95 70 ae be d7 5b 2c ba 5e f8 53 cc 03 1d 9e 04 ed 1d 3b 36 6b aa 96 17 1d 7a 7e 85 1b 4b 6d ec e6 03 11 d2 f1 02 40 99 ae 53 b1 fe 04 98 db 4b 37 c8 d5 39 b9 2d 98 c5 d6 8d 68 19 36 73 81 de c9 8e e3 33 b8 d8 23 28 77 e0 50 b9 6c 14 b3 d4 e3 28 7b 4e a6 10 ee f8 dc b6 f8 46 52 13 74 88 ce 26 fa db 5c ed ab d9 3f 4b 2e 3a a7 f0 2e a3 62 33 2a 5f a8 58 8f cd cf 37 d8 d6 d2 8d 5f f5 6c 71 c1 1a 5f a4 24 65 0f 17 9f d1 7b c0 6d b6 47 52 e6 54 ee 96 c6 9a bd 7f 76 64 f8 da 16 4f 15 6d 25 66 06 ea fb b5 f0 76 b3 ae e5 d2 7e 3b fb 46 d1 e8 87 ce 6a Data Ascii: Cf$^HV&Uigq]=}&p[,^S;6kz~Km@SK79-h6s3#(wPl({NFRt&\?K.:.b3*_X7_lq_$e{mGRTvdOm%fv~;Fj
2025-01-12 00:03:43 UTC	1369	IN	Data Raw: df 41 f9 59 7f 4f b0 85 da 3e d4 93 b0 e3 ae 3e 40 5f 23 d0 1d c7 f8 d9 69 6a 9b 02 91 81 b2 e3 dc 37 7d 41 86 01 4b 1f 46 bb db 01 96 89 3b 4e 23 68 8b 2d 78 a5 0a 8d d8 27 fd 8f 89 86 c8 96 97 08 19 0d 5c 14 25 79 6d 9d 18 12 95 97 25 6a 53 0f 06 dc d2 c1 67 e3 52 d9 db ae 26 1d ea c2 f3 a2 45 dd a2 06 ba af 4f e5 58 79 39 46 05 b7 7e 45 3d 61 4b eb e4 74 c5 a6 2f f9 ae fc 77 54 5e 3d 45 76 51 fc f1 b9 08 92 e2 11 e6 37 fc 7e 5b 69 08 7f 8e f8 51 37 31 db c2 bb 50 f9 b6 95 bf f7 fb f0 6e 54 40 96 b3 d3 0d 4f 67 4b 92 d7 c1 66 b6 a1 ab 87 74 82 4d e3 f3 97 dd 3c 43 15 83 23 87 67 b6 46 19 51 51 c9 e4 c0 20 5f c0 49 15 52 1b 1b 52 d2 1a 1a 92 b5 e2 1b ea 53 12 db 6a d2 1a b1 1a 7a 66 d7 95 75 cd b4 b5 35 f4 cc a3 74 2c 88 67 ce 89 d1 5a 6b 13 93 5a 6a d3 Data Ascii: AYO>>@_#ij7}AKF;N#h-x'\%ym%jSgR&EOXy9F~E=aKt/wT^=EvQ7~[iQ71PnT@OgKftM<C#gFQQ _IRRSjzfu5t,gZkZj
2025-01-12 00:03:43 UTC	1369	IN	Data Raw: 89 a9 89 62 da fd 71 48 75 d8 87 8a 7d 1b 56 5d 91 04 71 d1 7f 5e 62 7e cc ad fe fc f8 6c 9f 1c 48 f6 f5 08 a1 05 83 34 b9 a6 6d 94 e9 02 9a 53 5b 1a ff 48 1c a7 9e 1b ba 72 15 b2 26 f2 27 73 9e 1e 08 4e 8c d0 05 d4 ed 04 a4 ec 88 fc 0e bc c8 1f 2b b0 ea d2 25 30 e3 cc 1f b3 28 a1 33 18 07 c0 9f 8b 79 2c 2c 87 6b b8 d8 c9 c1 f1 1b 8c 97 3b e6 72 55 79 5a ee b5 f3 b5 dc be 0e d3 26 b3 b7 35 9c 37 ea c6 d3 94 4f 80 99 7d cc ee 7d a4 a1 a6 1b 90 af 66 db 3d d8 ba 86 ce 83 3d c8 3a 7e 42 cc 4b 73 ed fb c9 3f 2f e7 f8 37 fe 5c 9d 14 4b 4c 8f 0a 09 ca 4c 8b 44 64 c1 38 a7 e3 45 9c 08 c5 ea d7 60 75 ae f4 f7 a7 9a 74 fe 61 7b 27 5d fd 0f 66 ef c1 9f 86 ea 35 bf 98 af 77 b3 d4 37 16 34 89 09 88 d3 8f 1a ec 73 2f cd e5 a4 0d 47 4a 69 3a 70 1c 52 fa 8d 89 c9 8c 09 Data Ascii: bqHu}V]q^b~lH4mS[Hr&'sN+%0(3y,,k;rUyZ&57O}}f==:~BKs?/7\KLLDd8E`uta{']f5w74s/GJi:pR
2025-01-12 00:03:43 UTC	1369	IN	Data Raw: 4f ea 41 60 e1 ae 1c fa ef f4 a7 2e f3 2e f3 af 2f d0 7f ef ca 89 a6 76 49 b4 af 3e 1c 5f 1a ec 18 5c 1a 79 d4 b1 da 29 01 fa 43 3c f4 de f7 19 3a 11 b2 45 49 aa a7 cf ab e9 79 9a 0d 34 77 2d e4 e9 50 f1 59 f1 aa 67 2e a8 99 fa 9b 41 63 fe 4b 84 8a 42 b8 28 b2 72 44 1d 15 55 a2 8e 9c 2c 51 47 55 85 a8 03 06 ad d6 c1 9e 58 c3 55 74 e2 f0 d3 6c c1 af e3 5f ef 9f 99 3a f9 f6 f8 ec d4 a9 fb 67 96 c6 17 cb 04 bb ff 45 97 ac e2 1c 29 64 db b5 43 b2 40 a4 47 b5 c0 be 39 ee 6e e2 75 b3 6e 98 38 36 69 e2 75 d9 cf 16 d7 5d 35 56 c2 b4 33 f9 eb cb ed 4f af bb 7f 38 7a 79 39 58 7b c4 7a 31 ef c8 8e 81 da f4 8d f2 a8 a9 c9 b2 c8 98 f8 b4 4c 5a 92 6b c9 c8 b8 4f 4d 66 4e 5a 66 7a 56 71 60 ff 60 31 39 2b 37 3d 2b f7 36 a9 7c 72 c0 b9 24 25 2d 3d 4b 2e 2e 3c c4 f7 59 2f Data Ascii: OA`../vI>_\y)C<:EIy4w-PYg.AcKB(rDU,QGUXUtl_:gE)dC@G9nun86iu]5V3O8zy9X{z1LZkOMfNZfzVq``19+7=+6\|r$%-=K..<Y/
2025-01-12 00:03:43 UTC	1369	IN	Data Raw: 66 46 b6 fb 8b a1 42 42 0f 2d b3 b7 3e 41 cc f1 ec f7 f9 b3 fc 5d e9 d2 eb ce 97 9d 3e ca 3f 97 c4 5c 97 27 6f 77 c1 aa 52 32 3c a9 0f d4 02 79 7e 2e 8b 0c 76 d4 67 67 aa 64 5c f2 0e a2 8f 2c 0b e3 76 31 75 71 0f 83 c8 b5 c4 31 f0 0c 08 9c 06 d7 3a de d0 7a e6 9c 5c 76 a4 11 df 92 c5 cd 9a df 10 1e a0 76 bf 12 e6 fe b8 45 ff 23 2d b1 e3 ae 9e ec 72 37 39 6c ab da 9e c3 23 99 81 f6 69 b0 39 ff 1f a7 c8 e2 af 04 3a c1 f4 be bd 0f cc 6d a0 d6 93 9a 58 53 b2 ca 28 d6 19 97 34 c5 0d ca 34 95 9f 12 42 7e a6 b6 26 b4 ee ad 70 5c 45 ed 30 37 25 3c 0c 0d 4e e8 ee af a3 f5 86 50 12 1f 2a 73 f5 98 07 27 f1 86 74 1d f3 0f 08 05 29 a9 6f 6c 43 f9 25 79 25 03 1c 9c bc 99 70 d8 e3 b2 7d 74 58 53 44 b0 93 b3 7a ec a6 a8 30 ae 17 a2 2a 04 11 51 c2 75 31 11 65 55 17 9c 0b Data Ascii: fFBB->A]>?\'owR2<y~.vggd\,v1uq1:z\vvE#-r79l#i9:mXS(44B~&p\E07%<NPs't)olC%y%p}tXSDz0Qu1eU
2025-01-12 00:03:43 UTC	1015	IN	Data Raw: 59 92 4f 3a 9d 6e a6 67 53 ef b6 a1 90 5a 19 8a 36 40 5f 3f ec 3d 64 7c 2e f1 b8 d6 cc cc ac 2e 83 45 4c 96 3c 2c 9f e1 01 7d 97 49 e6 62 b2 ec 2a 43 0d 5e 1e 8f b9 62 7d eb c3 f2 40 ed 37 29 5d 4c 79 63 96 31 0e e2 b1 b2 b2 1a e4 55 b8 c6 54 f2 f2 98 73 f4 39 f3 a6 41 93 07 fa f2 d3 55 1e 63 bd 9f 9c 64 60 b2 71 82 28 91 ce ea ed 0f 26 1b c2 60 02 f5 b1 cd e6 6c ed f7 0c b0 23 be be a7 9e 32 78 0e 0c e7 8a ed 47 19 30 1d eb c5 36 83 3d 42 7d 4f 18 9d 20 ee ec bf 64 82 3c 1b d7 78 60 9c d1 ff 1f cd 77 bf b8 8f 08 05 ed 5f 7d 8f 21 a7 53 9a 01 76 24 1e 2b ec 4f 05 3b db cf fe b0 23 61 0c f6 f9 be 6d 2e 42 d8 36 4c da 7e b0 e9 d3 db f7 24 60 6c 5d 80 9c fe fd 03 c8 b5 97 da ec 93 2e 76 c7 c5 15 ff ce 7c 6c 01 00 bc f6 3b f7 66 80 8f c2 e4 e7 ff 85 fe 3f cb Data Ascii: YO:ngSZ6@_?=d\|..EL<,}Ib*C^b}@7)]Lyc1UTs9AUcd`q(&`l#2xG06=B}O d<x`w_}!Sv$+O;#am.B6L~$`l].v\|l;f?

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:43 UTC	631	OUT	GET /KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://wkybcnfuqpgjx.ltd sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://wkybcnfuqpgjx.ltd/main.949acaf34f3882f511ff.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:44 UTC	901	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:44 GMT Content-Type: font/woff2 Content-Length: 11016 Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:39 GMT ETag: "674840af-2b08" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6951 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eWp2OhXaUK0edCBSyXlHEweSic6zHnOda6OxzNFOq0Je5EVMgBTiuBU63maVr7SFtd0ECJbPrq0goQ0iEZZvEEdOldujG%2Br%2FI37joiggoIOTcxoSUeoZ2e6geBx1s6ZEZkGHxA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e29818ee8cc3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1908&min_rtt=1801&rtt_var=752&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1209&delivery_rate=1621321&cwnd=224&unsent_bytes=0&cid=adecd19429bee1e9&ts=154&x=0"
2025-01-12 00:03:44 UTC	468	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 2b 08 00 0e 00 00 00 00 54 70 00 00 2a b1 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 64 1b 99 64 1c 83 7c 06 60 00 87 6c 11 0c 0a f0 04 d9 26 0b 83 72 00 01 36 02 24 03 87 60 04 20 05 82 74 07 20 1b 2f 46 b3 a2 ac ef 52 9c e2 bf 4e e0 c6 50 78 0d b5 17 2e 89 a5 30 9d 8a cc ce bc d5 74 11 25 10 03 36 5f c6 4d 71 dd 3b f4 0b 1e 5d 6c ce e4 da 4e 84 96 11 92 cc 12 3c df 9f bc 73 95 7c b3 7d b5 b1 96 b1 a7 91 73 40 73 bb 5f 31 a2 06 62 14 a0 60 14 2d 2d 29 51 2d d1 a3 42 72 d0 a3 4b 68 19 f4 86 4a 94 a2 12 65 d1 62 d0 66 1c e9 b4 66 64 c9 30 a3 b5 1e 88 6a 6e ef aa 07 5a ed 2a 76 2e 40 4e a2 03 16 4c b3 4a 3a 29 69 1f a1 68 ef fb ef a8 94 ed c0 3f d3 f3 ec bc ea 6f 22 30 10 1a 50 af c1 01 ce ed 9b Data Ascii: wOF2+Tpdd\|`l&r6$` t /FRNPx.0t%6_Mq;]lN<s\|}s@s_1b`--)Q-BrKhJebffd0jnZv.@NLJ:)ih?o"0P
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 08 21 7a c0 b1 7d 88 4e ee 70 ec 40 3b 7f 2f 38 06 03 88 ff 10 48 07 ec 45 f4 02 3c 90 80 04 03 05 64 0c f5 26 44 11 0c b0 6e ba 5a c5 aa 58 12 49 37 cb 48 99 2d db 65 2d 69 66 16 14 67 d9 ce c7 f2 d9 2c 99 35 b3 57 8e 9a 0f 3b 2b 05 7b 31 b7 ef c5 c2 56 2f 96 8b 14 d9 a2 59 05 ca 2d 0c 0d af 62 25 cf 1e 53 b6 cb 48 46 a8 72 0d ba 6e 8b 0f 18 35 01 02 09 b1 1f 20 10 aa 30 70 18 31 e1 c0 e7 9c f3 2e b8 e8 1a 01 c2 44 88 12 23 4e 92 14 19 b2 6e 50 a3 4e 93 0e 3d fa 0c 18 33 65 ce 82 15 1b f9 0a 14 29 d6 6f c0 a0 21 c3 46 8c 1a 33 ee a1 47 26 4c 9b 31 6b ce bc 17 d6 6d 78 6d d3 96 6d 3b 76 ed d9 f7 d9 17 5f 7d f3 1d 42 3c 9e c3 90 c4 49 0a 81 0c 2e 2f 70 41 70 04 37 01 6c c1 85 10 5c f8 c2 d8 d5 c1 0f 10 c7 49 39 56 a8 c4 0e 55 82 1a 34 60 00 a3 2b 36 8e b7 Data Ascii: !z}Np@;/8HE<d&DnZXI7H-e-ifg,5W;+{1V/Y-b%SHFrn5 0p1.D#NnPN=3e)o!F3G&L1kmxmm;v_}B<I./pAp7l\I9VU4`+6
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: e7 4c b7 e7 c1 de 9e 70 f9 bf e5 59 02 84 0e 74 75 b6 03 e9 4b a6 70 d3 da 07 7a 3b 78 80 f1 c1 01 9e 44 b0 04 12 3a 0a 30 94 03 25 6a cd 6d f0 c0 ee 09 20 33 37 81 cd 59 aa 88 48 28 66 db 27 24 f8 83 40 4e 53 b2 60 5a 84 5c 06 d4 04 16 f5 89 69 ac a5 16 8a 57 92 dc e8 09 d6 c0 75 d5 09 5d cc bd aa 9b 61 e9 bd 38 e0 02 b4 0e 27 40 dc 8a 41 83 ba a0 b2 0c ee d0 a5 22 c1 c8 5d 93 c6 e0 ae 16 cd 5a 51 b4 69 d7 a1 33 6f 2d 71 ec e9 ee 16 ca 8f bf 1e bd a8 68 fa dc 83 82 e0 74 12 28 95 f4 32 60 41 bb ac c2 20 cd 5a 9b 51 5e 76 cb 6b ad d5 d0 63 c0 3c b4 0d e8 9d e7 6c 9d 4d 74 54 40 0e c4 df 17 fe 81 bd fb 45 01 6e c8 d5 80 ba 7c a3 e0 c6 0d 0d 5e c4 0c 07 dd da b7 37 06 90 6e 81 49 a9 c0 ba e4 60 e1 81 91 22 55 68 d6 a2 df 98 29 6f 1d f8 8f 08 26 83 7c 2f 63 Data Ascii: LpYtuKpz;xD:0%jm 37YH(f'$@NS`Z\iWu]a8'@A"]ZQi3o-qht(2`A ZQ^vkc<lMtT@En\|^7nI`"Uh)o&\|/c
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 9a 11 d5 02 e0 14 93 74 3c c0 fa 38 06 27 ff e8 b2 cf 8d 23 56 66 64 e8 47 70 9b dc 0e 43 2f 72 24 95 b9 f6 df aa a1 06 f7 47 d5 31 a6 93 aa 96 04 6d b1 0f 3b 21 46 42 81 42 15 fb 51 c0 8a 2d 05 ee 13 9e 62 86 14 33 ed c9 54 64 7c bd a0 f5 af d8 b9 b0 70 a4 22 58 ce a9 3c f7 fc 74 a1 b2 ef da ec 01 8b 13 83 8e ed 15 f5 31 98 7d 6b 4c 47 6e d3 67 e6 8f 9a 1a dc 3f 39 ab 98 0b ca 89 5e d5 6b ad b2 79 e8 36 0b 13 6a 57 a0 77 80 6e be 84 d9 78 db 4f d5 9e ca 74 2f de 3b 85 c6 0e 61 41 74 33 78 a7 74 db 4e 9f a9 07 d3 e3 2e d3 a6 f6 2e 09 b7 45 4a 9e c4 56 b8 b8 a6 a6 9c d1 df 5c be a4 bc bd 43 bb db 94 ee 72 b6 bf b2 dc a7 a0 e4 f5 db e1 0e 64 cf e2 20 54 30 84 a2 fc 31 a6 a8 22 44 96 ea 84 52 de a1 82 59 1d 68 8b 6f ff 2c 05 ee e4 96 f9 28 aa a2 1c 7b 2e 42 Data Ascii: t<8'#VfdGpC/r$G1m;!FBBQ-b3Td\|p"X<t1}kLGng?9^ky6jWwnxOt/;aAt3xtN..EJV\Crd T01"DRYho,({.B
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 43 3d dc 80 dd 28 f8 a4 93 37 ec a5 32 27 94 f3 c2 9f 42 bc 4e 21 f9 ea f2 0e 92 e8 95 ec 50 29 27 f5 ca c9 a2 e0 95 8c 1d 9e a4 bc 5b d8 61 3d e9 f7 9a a9 19 a5 bc f8 f6 2a c5 83 68 74 90 65 54 44 81 d0 bc dc d0 74 65 cd 83 99 5a 8e 57 b9 4b 75 5c b4 9d a7 bd 69 f1 77 88 41 11 a1 5e b7 e2 82 05 ec 1b 03 75 4b dd 1a 26 9e 76 13 fa 73 fa a9 6c b3 6f c7 a8 29 99 b9 a4 d8 dc 08 c0 e5 14 c4 d6 36 c4 c6 d7 34 26 aa c4 d5 d6 46 c7 34 d4 a6 24 e1 b4 4d 1c d5 55 8c ed 8c d4 b4 8d 9c 72 8c 9c f4 cf 74 5c 8b ad ad c7 d5 d5 a5 a8 98 10 23 a9 63 75 7e 00 a9 1a d9 1b a9 eb 18 3b a8 a9 98 da 1b fe f8 e4 22 7f d9 9f e8 22 0f 8e 24 57 ff d6 1a 7f db 00 79 b2 4a ed 70 5f 7d de f0 dd 78 53 d3 1c 2f 3d 37 6d c5 18 c5 e8 f2 ba ff 65 dd d4 8f 15 5b a2 9a fc 98 92 f3 02 b2 be Data Ascii: C=(72'BN!P)'[a=*hteTDteZWKu\iwA^uK&vslo)64&F4$MUrt\#cu~;""$WyJp_}xS/=7me[
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: cc 2b f3 f6 f6 83 2a 2f ea 95 2f ce ce fd a0 9b d5 b0 48 96 a5 ab a3 34 d3 d7 67 89 23 4f 5d 67 33 e5 19 1a 9b 5b 19 ea c9 72 0b 0f 10 f4 14 67 5f f7 34 27 ea ab fb ef d9 53 54 da 63 16 d4 1f 70 91 90 c4 fc d8 38 7a c0 f2 f9 d1 3c 7e f3 bb 71 89 59 51 75 46 52 4c 75 71 3a ca 11 74 09 0d 73 f1 02 c1 46 e8 c7 31 c1 42 9f 55 d8 75 f5 ef 40 61 68 28 4b 2c f4 03 f2 84 eb 41 17 94 7e 4d 9f f6 17 d3 1f 68 1a 6b d9 f7 43 66 e3 1b 7e 75 31 31 eb 51 8c a0 91 2b d3 64 e6 d6 39 72 7d 76 78 42 05 39 1f f8 c1 28 f1 db cd b5 c9 82 66 c2 da 52 de b6 5f d4 e3 90 c1 b8 ba bc c2 f4 b2 70 6f b3 bc 50 37 a7 27 a1 f6 d5 de 6d 1c f3 ef f2 d0 c4 d4 f1 db 83 71 43 05 d5 05 95 61 8b b9 fe a0 16 40 98 07 2c a1 1f b0 84 b9 b2 5b a0 7e 87 b2 02 4f 01 fb 8a 95 e7 e0 38 82 ac af 3d 78 Data Ascii: +*//H4g#O]g3[rg_4'STcp8z<~qYQuFRLuq:tsF1BUu@ah(K,A~MhkCf~u11Q+d9r}vxB9(fR_poP7'mqCa@,[~O8=x
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: e6 39 87 98 72 35 c3 ef a3 a1 16 e3 98 1d 4c 67 da 8a 8d 18 7d 48 3e ba 45 dd 6e e7 19 3f be 74 66 fe d1 09 0a f7 06 75 35 97 ab 7f 0e 9b 3b 11 95 a2 57 db 80 27 dd ab 22 19 f3 65 28 c1 97 6a 05 0b c6 20 36 78 ba a5 3b a5 15 78 f4 f8 97 bd 87 0f 96 e7 da fa dd 23 c3 bc 5d a3 0b 23 f0 e8 1b a5 a0 f4 c1 a7 2c 76 66 aa 2c 3a 3e 21 9a 94 9c ea 5c 3c 31 e9 5d 95 95 17 9d 90 95 5b 1a 34 3c 52 16 9c 93 1f 9b 98 57 e8 59 f5 78 c4 a9 2c 9d 1c 9b 20 89 0a 0b 23 ce 0d 87 6c 0c 87 fa cc 86 d1 3c 23 c1 3e be c3 41 0b f7 03 78 3a 8e 0a e7 2d 78 4d 61 23 94 ee 28 85 2b 29 0c 2a c8 86 cb de 91 8d a0 93 55 fc 39 64 31 1f a6 1d 7e 48 fb 46 03 95 cc d6 fb 54 43 25 01 95 04 c7 7a f4 d8 a6 cf c3 eb ca e2 c9 3e 4f a9 48 4c 47 5e 49 e2 1d 7f 5b b3 34 97 69 99 ae 6b fd 5e 96 45 Data Ascii: 9r5Lg}H>En?tfu5;W'"e(j 6x;x#]#,vf,:>!\<1][4<RWYx, #l<#>Ax:-xMa#(+)*U9d1~HFTC%z>OHLG^I[4ik^E
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 85 37 70 dc fc d9 f0 4b ae 34 08 b3 ac 22 77 dc d7 89 39 dd 83 c5 a3 65 70 13 99 94 98 1b da 06 5b fe 8a e0 bf 2f 13 d3 93 1e fa 4b 3b c8 39 0d 13 7d a6 b6 fe ee f8 4f e2 1a aa 47 48 f7 82 dc d5 22 12 63 bf 26 3c f1 96 75 90 b1 1f f3 21 2d d1 5d fb d7 8b ef 29 7f 96 92 54 be 38 d9 5d f1 3c 39 a1 72 41 61 7a d1 21 b7 ea 50 12 cb b1 88 c4 5c 10 70 dc 67 28 cc 6d c8 69 28 64 fa ca ea 03 bc 01 51 26 61 fe 16 96 a1 01 cd a1 21 bd a1 21 ea 46 d7 14 14 05 05 14 e5 ed 15 94 04 85 e4 95 41 f8 cd 92 47 68 bc e5 85 0e 5b 99 e6 13 17 ca 04 c3 70 ee c1 29 56 67 fc 6c 24 78 4e 5f 12 57 bc 02 6c 6f 39 5c 55 2c 23 51 59 89 bd fe b7 6c c7 81 3e 87 cb 45 c5 32 1a 45 ce e8 89 01 07 db 31 48 3d e6 a2 6a 1e 89 ca 0c a4 3a 3a d9 3f 82 d4 cb 2e 2a e6 89 a8 02 2a b5 c6 c3 7e 76 Data Ascii: 7pK4"w9ep[/K;9}OGH"c&<u!-])T8]<9rAaz!P\pg(mi(dQ&a!!FAGh[p)Vgl$xN_Wlo9\U,#QYl>E2E1H=j::?.**~v
2025-01-12 00:03:44 UTC	965	IN	Data Raw: bc 7d 32 05 0d 94 f0 bc 8d 68 00 75 ed be 02 54 d2 fd 5f 03 e9 58 77 17 0a c8 9b 41 8f 2d ac 8d 85 e2 ce 7d ba fc 2d d3 86 d0 f1 0a 8c dd 87 9e 4e 1c 9a ce f6 c5 fd 95 ba 15 a6 f1 13 5b e4 7e 63 05 f5 de a2 78 9e 80 b3 dd 03 58 ad ed ca d1 fc 8a 2c 58 0e 94 fe 76 ab 36 2b c1 e7 fa 60 3d 75 3d 31 06 d2 3e ed 3f 7c 04 f2 32 d0 ff bf 88 05 71 ef e5 af d9 46 a4 82 f2 61 db 65 81 13 30 22 3d 80 56 a9 be 6d 54 a2 7e 96 ea 83 0d 93 6b a0 f1 47 71 c0 76 4d e7 ca e3 6f 7c 4a 25 e4 33 30 17 ad 5c 49 e5 f9 4f 40 9e 63 dc db 8a fb 05 36 ac d2 bf e3 8f 0e 01 c0 63 3f fb 55 00 5e 5f fa bf fd 3a fe 77 61 a8 c0 10 3f 60 28 14 40 02 fd 03 07 4c 00 43 d7 cb 68 ff d4 a9 b9 73 b5 9e bf 4a 2a 47 85 f4 ef cb 0b 9a 47 43 45 26 4b ac 7b 82 6a 24 af b6 c4 b5 fe e4 94 9c 38 e7 7b Data Ascii: }2huT_XwA-}-N[~cxX,Xv6+`=u=1>?\|2qFae0"=VmT~kGqvMo\|J%30\IO@c6c?U^_:wa?`(@LChsJ*GGCE&K{j$8{

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:43 UTC	551	OUT	GET /3559.80b270ba0e217557b392.js HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://wkybcnfuqpgjx.ltd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:44 UTC	926	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:44 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:39 GMT Vary: Accept-Encoding ETag: W/"674840af-92ae6" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6951 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tid%2BRE2RnNaIWbm8Bh3kHhf8SgE4KPKVJ7RPhOTdsw6l24Nt2grW1OAhyGRZAi2UU%2FnlBXmqiBmQPrZz11qE0p8HOGoFox15c722gQdmLEHTZXKcLw%2BYVBTrR3GE3cn7%2FtrXAw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e2983e637d16-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1783&min_rtt=1775&rtt_var=683&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1129&delivery_rate=1582655&cwnd=217&unsent_bytes=0&cid=eca9751324680c63&ts=162&x=0"
2025-01-12 00:03:44 UTC	443	IN	Data Raw: 37 63 64 38 0d 0a 28 28 29 3d 3e 7b 76 61 72 20 65 2c 74 2c 73 3d 7b 36 34 35 33 3a 28 65 2c 74 2c 73 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 73 2e 64 28 74 2c 7b 41 3a 28 29 3d 3e 6e 7d 29 3b 63 6c 61 73 73 20 6e 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 74 68 69 73 2e 69 73 55 70 6c 6f 61 64 3d 65 7d 7d 7d 2c 33 35 35 39 3a 28 65 2c 74 2c 73 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 7b 7d 3b 73 2e 72 28 6e 29 2c 73 2e 64 28 6e 2c 7b 54 79 70 65 3a 28 29 3d 3e 5f 6f 2c 63 6c 65 61 72 3a 28 29 3d 3e 53 6f 2c 66 65 74 63 68 3a 28 29 3d 3e 62 6f 2c 69 73 43 61 63 68 65 41 70 69 53 75 70 70 6f 72 74 65 64 3a 28 29 3d 3e 79 6f 2c 72 65 6d 6f 76 65 3a 28 29 3d 3e 76 6f 2c 73 61 76 65 3a 28 29 3d 3e 77 6f 7d 29 3b 76 Data Ascii: 7cd8(()=>{var e,t,s={6453:(e,t,s)=>{"use strict";s.d(t,{A:()=>n});class n{constructor(e){this.isUpload=e}}},3559:(e,t,s)=>{"use strict";var n={};s.r(n),s.d(n,{Type:()=>_o,clear:()=>So,fetch:()=>bo,isCacheApiSupported:()=>yo,remove:()=>vo,save:()=>wo});v
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 2c 61 64 64 43 68 61 74 4d 65 6d 62 65 72 73 3a 28 29 3d 3e 77 72 2c 61 6c 6c 6f 77 42 6f 74 53 65 6e 64 4d 65 73 73 61 67 65 73 3a 28 29 3d 3e 74 70 2c 61 6e 73 77 65 72 43 61 6c 6c 62 61 63 6b 42 75 74 74 6f 6e 3a 28 29 3d 3e 44 6c 2c 61 70 70 6c 79 42 6f 6f 73 74 3a 28 29 3d 3e 4c 66 2c 61 70 70 6c 79 47 69 66 74 43 6f 64 65 3a 28 29 3d 3e 24 66 2c 62 6c 6f 63 6b 55 73 65 72 3a 28 29 3d 3e 71 75 2c 62 72 6f 61 64 63 61 73 74 4c 6f 63 61 6c 44 62 55 70 64 61 74 65 46 75 6c 6c 3a 28 29 3d 3e 44 65 2c 63 68 61 6e 67 65 53 65 73 73 69 6f 6e 53 65 74 74 69 6e 67 73 3a 28 29 3d 3e 78 64 2c 63 68 61 6e 67 65 53 65 73 73 69 6f 6e 54 74 6c 3a 28 29 3d 3e 56 64 2c 63 68 61 6e 67 65 53 74 61 72 73 53 75 62 73 63 72 69 70 74 69 6f 6e 3a 28 29 3d 3e 72 67 2c 63 68 Data Ascii: ,addChatMembers:()=>wr,allowBotSendMessages:()=>tp,answerCallbackButton:()=>Dl,applyBoost:()=>Lf,applyGiftCode:()=>$f,blockUser:()=>qu,broadcastLocalDbUpdateFull:()=>De,changeSessionSettings:()=>xd,changeSessionTtl:()=>Vd,changeStarsSubscription:()=>rg,ch
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 69 74 45 78 70 6f 72 74 65 64 43 68 61 74 49 6e 76 69 74 65 3a 28 29 3d 3e 5f 75 2c 65 64 69 74 47 72 6f 75 70 43 61 6c 6c 50 61 72 74 69 63 69 70 61 6e 74 3a 28 29 3d 3e 64 70 2c 65 64 69 74 47 72 6f 75 70 43 61 6c 6c 54 69 74 6c 65 3a 28 29 3d 3e 75 70 2c 65 64 69 74 4d 65 73 73 61 67 65 3a 28 29 3d 3e 73 63 2c 65 64 69 74 53 74 6f 72 79 50 72 69 76 61 63 79 3a 28 29 3d 3e 6b 66 2c 65 64 69 74 54 6f 70 69 63 3a 28 29 3d 3e 78 72 2c 65 6e 63 6f 64 65 50 68 6f 6e 65 43 61 6c 6c 44 61 74 61 3a 28 29 3d 3e 75 66 2c 65 78 70 6f 72 74 43 68 61 74 49 6e 76 69 74 65 3a 28 29 3d 3e 62 75 2c 65 78 70 6f 72 74 47 72 6f 75 70 43 61 6c 6c 49 6e 76 69 74 65 3a 28 29 3d 3e 6c 70 2c 65 78 70 6f 72 74 4d 65 73 73 61 67 65 4c 69 6e 6b 3a 28 29 3d 3e 51 63 2c 66 61 76 65 Data Ascii: itExportedChatInvite:()=>_u,editGroupCallParticipant:()=>dp,editGroupCallTitle:()=>up,editMessage:()=>sc,editStoryPrivacy:()=>kf,editTopic:()=>xr,encodePhoneCallData:()=>uf,exportChatInvite:()=>bu,exportGroupCallInvite:()=>lp,exportMessageLink:()=>Qc,fave
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 73 3a 28 29 3d 3e 4c 64 2c 66 65 74 63 68 46 75 6c 6c 43 68 61 74 3a 28 29 3d 3e 44 6f 2c 66 65 74 63 68 46 75 6c 6c 55 73 65 72 3a 28 29 3d 3e 58 63 2c 66 65 74 63 68 47 65 6e 65 72 69 63 45 6d 6f 6a 69 45 66 66 65 63 74 73 3a 28 29 3d 3e 59 64 2c 66 65 74 63 68 47 69 76 65 61 77 61 79 49 6e 66 6f 3a 28 29 3d 3e 7a 66 2c 66 65 74 63 68 47 6c 6f 62 61 6c 50 72 69 76 61 63 79 53 65 74 74 69 6e 67 73 3a 28 29 3d 3e 6d 6c 2c 66 65 74 63 68 47 72 6f 75 70 43 61 6c 6c 50 61 72 74 69 63 69 70 61 6e 74 73 3a 28 29 3d 3e 70 70 2c 66 65 74 63 68 47 72 6f 75 70 53 74 61 74 69 73 74 69 63 73 3a 28 29 3d 3e 6a 70 2c 66 65 74 63 68 47 72 6f 75 70 73 46 6f 72 44 69 73 63 75 73 73 69 6f 6e 3a 28 29 3d 3e 6d 72 2c 66 65 74 63 68 49 6e 6c 69 6e 65 42 6f 74 3a 28 29 3d 3e Data Ascii: s:()=>Ld,fetchFullChat:()=>Do,fetchFullUser:()=>Xc,fetchGenericEmojiEffects:()=>Yd,fetchGiveawayInfo:()=>zf,fetchGlobalPrivacySettings:()=>ml,fetchGroupCallParticipants:()=>pp,fetchGroupStatistics:()=>jp,fetchGroupsForDiscussion:()=>mr,fetchInlineBot:()=>
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 65 65 6e 42 79 3a 28 29 3d 3e 44 63 2c 66 65 74 63 68 53 65 6e 64 41 73 3a 28 29 3d 3e 55 63 2c 66 65 74 63 68 53 70 6f 6e 73 6f 72 65 64 4d 65 73 73 61 67 65 73 3a 28 29 3d 3e 56 63 2c 66 65 74 63 68 53 74 61 72 47 69 66 74 73 3a 28 29 3d 3e 59 66 2c 66 65 74 63 68 53 74 61 72 73 47 69 76 65 61 77 61 79 4f 70 74 69 6f 6e 73 3a 28 29 3d 3e 58 66 2c 66 65 74 63 68 53 74 61 72 73 53 74 61 74 75 73 3a 28 29 3d 3e 6e 67 2c 66 65 74 63 68 53 74 61 72 73 53 75 62 73 63 72 69 70 74 69 6f 6e 73 3a 28 29 3d 3e 6f 67 2c 66 65 74 63 68 53 74 61 72 73 54 6f 70 75 70 4f 70 74 69 6f 6e 73 3a 28 29 3d 3e 64 67 2c 66 65 74 63 68 53 74 61 72 73 54 72 61 6e 73 61 63 74 69 6f 6e 42 79 49 64 3a 28 29 3d 3e 69 67 2c 66 65 74 63 68 53 74 61 72 73 54 72 61 6e 73 61 63 74 69 6f Data Ascii: eenBy:()=>Dc,fetchSendAs:()=>Uc,fetchSponsoredMessages:()=>Vc,fetchStarGifts:()=>Yf,fetchStarsGiveawayOptions:()=>Xf,fetchStarsStatus:()=>ng,fetchStarsSubscriptions:()=>og,fetchStarsTopupOptions:()=>dg,fetchStarsTransactionById:()=>ig,fetchStarsTransactio
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 28 29 3d 3e 50 75 2c 69 6d 70 6f 72 74 43 68 61 74 49 6e 76 69 74 65 3a 28 29 3d 3e 50 72 2c 69 6d 70 6f 72 74 43 6f 6e 74 61 63 74 3a 28 29 3d 3e 6e 64 2c 69 6e 73 74 61 6c 6c 53 74 69 63 6b 65 72 53 65 74 3a 28 29 3d 3e 69 75 2c 69 6e 76 6f 6b 65 57 65 62 56 69 65 77 43 75 73 74 6f 6d 4d 65 74 68 6f 64 3a 28 29 3d 3e 73 70 2c 6a 6f 69 6e 43 68 61 6e 6e 65 6c 3a 28 29 3d 3e 4f 6f 2c 6a 6f 69 6e 43 68 61 74 6c 69 73 74 49 6e 76 69 74 65 3a 28 29 3d 3e 4e 72 2c 6a 6f 69 6e 47 72 6f 75 70 43 61 6c 6c 3a 28 29 3d 3e 67 70 2c 6a 6f 69 6e 47 72 6f 75 70 43 61 6c 6c 50 72 65 73 65 6e 74 61 74 69 6f 6e 3a 28 29 3d 3e 6d 70 2c 6c 61 75 6e 63 68 50 72 65 70 61 69 64 47 69 76 65 61 77 61 79 3a 28 29 3d 3e 73 67 2c 6c 65 61 76 65 43 68 61 6e 6e 65 6c 3a 28 29 3d 3e Data Ascii: ()=>Pu,importChatInvite:()=>Pr,importContact:()=>nd,installStickerSet:()=>iu,invokeWebViewCustomMethod:()=>sp,joinChannel:()=>Oo,joinChatlistInvite:()=>Nr,joinGroupCall:()=>gp,joinGroupCallPresentation:()=>mp,launchPrepaidGiveaway:()=>sg,leaveChannel:()=>
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 28 29 3d 3e 71 6c 2c 72 65 73 63 68 65 64 75 6c 65 4d 65 73 73 61 67 65 3a 28 29 3d 3e 6e 63 2c 72 65 73 6f 6c 76 65 42 75 73 69 6e 65 73 73 43 68 61 74 4c 69 6e 6b 3a 28 29 3d 3e 4e 64 2c 72 65 73 74 61 72 74 41 75 74 68 3a 28 29 3d 3e 66 6f 2c 72 65 73 74 61 72 74 41 75 74 68 57 69 74 68 51 72 3a 28 29 3d 3e 67 6f 2c 73 61 76 65 43 6c 6f 73 65 46 72 69 65 6e 64 73 3a 28 29 3d 3e 64 64 2c 73 61 76 65 44 65 66 61 75 6c 74 53 65 6e 64 41 73 3a 28 29 3d 3e 78 63 2c 73 61 76 65 44 72 61 66 74 3a 28 29 3d 3e 46 6f 2c 73 61 76 65 47 69 66 3a 28 29 3d 3e 61 75 2c 73 61 76 65 53 74 61 72 47 69 66 74 3a 28 29 3d 3e 65 67 2c 73 65 61 72 63 68 43 68 61 74 73 3a 28 29 3d 3e 78 6f 2c 73 65 61 72 63 68 47 69 66 73 3a 28 29 3d 3e 63 75 2c 73 65 61 72 63 68 48 61 73 68 Data Ascii: ()=>ql,rescheduleMessage:()=>nc,resolveBusinessChatLink:()=>Nd,restartAuth:()=>fo,restartAuthWithQr:()=>go,saveCloseFriends:()=>dd,saveDefaultSendAs:()=>xc,saveDraft:()=>Fo,saveGif:()=>au,saveStarGift:()=>eg,searchChats:()=>xo,searchGifs:()=>cu,searchHash
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 3d 3e 4d 72 2c 74 6f 67 67 6c 65 4a 6f 69 6e 52 65 71 75 65 73 74 3a 28 29 3d 3e 49 72 2c 74 6f 67 67 6c 65 4a 6f 69 6e 54 6f 53 65 6e 64 3a 28 29 3d 3e 53 72 2c 74 6f 67 67 6c 65 50 61 72 74 69 63 69 70 61 6e 74 73 48 69 64 64 65 6e 3a 28 29 3d 3e 52 72 2c 74 6f 67 67 6c 65 50 65 65 72 54 72 61 6e 73 6c 61 74 69 6f 6e 73 3a 28 29 3d 3e 6a 72 2c 74 6f 67 67 6c 65 50 69 6e 6e 65 64 54 6f 70 69 63 3a 28 29 3d 3e 55 72 2c 74 6f 67 67 6c 65 50 72 65 48 69 73 74 6f 72 79 48 69 64 64 65 6e 3a 28 29 3d 3e 72 72 2c 74 6f 67 67 6c 65 53 61 76 65 64 44 69 61 6c 6f 67 50 69 6e 6e 65 64 3a 28 29 3d 3e 51 6f 2c 74 6f 67 67 6c 65 53 69 67 6e 61 74 75 72 65 73 3a 28 29 3d 3e 66 72 2c 74 6f 67 67 6c 65 53 70 6f 6e 73 6f 72 65 64 4d 65 73 73 61 67 65 73 3a 28 29 3d 3e 46 Data Ascii: =>Mr,toggleJoinRequest:()=>Ir,toggleJoinToSend:()=>Sr,toggleParticipantsHidden:()=>Rr,togglePeerTranslations:()=>jr,togglePinnedTopic:()=>Ur,togglePreHistoryHidden:()=>rr,toggleSavedDialogPinned:()=>Qo,toggleSignatures:()=>fr,toggleSponsoredMessages:()=>F
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 48 65 69 67 68 74 2c 32 30 29 2c 6d 3d 32 30 30 2c 79 3d 35 30 2c 5f 3d 31 30 30 2c 62 3d 31 30 30 2c 77 3d 31 30 30 2c 76 3d 31 30 30 2c 53 3d 35 30 2c 49 3d 31 30 30 2c 41 3d 35 30 2c 50 3d 31 30 30 2c 43 3d 31 30 30 2c 4d 3d 31 30 30 2c 52 3d 32 30 2c 6b 3d 33 65 35 2c 54 3d 22 58 54 52 22 2c 45 3d 32 2a 2a 33 31 2d 31 2c 42 3d 4d 61 74 68 2e 72 6f 75 6e 64 28 34 35 30 29 2c 44 3d 6e 65 77 20 53 65 74 28 5b 22 6e 65 77 4d 65 73 73 61 67 65 22 2c 22 6e 65 77 53 63 68 65 64 75 6c 65 64 4d 65 73 73 61 67 65 22 2c 22 64 65 6c 65 74 65 4d 65 73 73 61 67 65 73 22 2c 22 64 65 6c 65 74 65 53 63 68 65 64 75 6c 65 64 4d 65 73 73 61 67 65 73 22 2c 22 64 65 6c 65 74 65 48 69 73 74 6f 72 79 22 5d 29 2c 55 3d 32 Data Ascii: ndow&&window.innerHeight,20),m=200,y=50,_=100,b=100,w=100,v=100,S=50,I=100,A=50,P=100,C=100,M=100,R=20,k=3e5,T="XTR",E=2**31-1,B=Math.round(450),D=new Set(["newMessage","newScheduledMessage","deleteMessages","deleteScheduledMessages","deleteHistory"]),U=2
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 20 73 2c 6e 2c 61 2c 69 3d 21 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7c 7c 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 3d 21 30 3b 66 6f 72 28 76 61 72 20 6f 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 72 3d 6e 65 77 20 41 72 72 61 79 28 6f 29 2c 63 3d 30 3b 63 3c 6f 3b 63 2b 2b 29 72 5b 63 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 63 5d 3b 61 3d 72 2c 73 7c 7c 28 69 26 26 28 6e 3d 21 31 2c 65 28 2e 2e 2e 61 29 29 2c 73 3d 73 65 6c 66 2e 73 65 74 49 6e 74 65 72 76 61 6c 28 28 28 29 3d 3e 7b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 73 65 6c 66 2e 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 73 29 2c 76 6f 69 64 28 73 Data Ascii: s,n,a,i=!(arguments.length>2&&void 0!==arguments[2])\|\|arguments[2];return function(){n=!0;for(var o=arguments.length,r=new Array(o),c=0;c<o;c++)r[c]=arguments[c];a=r,s\|\|(i&&(n=!1,e(...a)),s=self.setInterval((()=>{if(!n)return self.clearInterval(s),void(s

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:43 UTC	553	OUT	GET /notification.mp3 HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: audio Referer: https://wkybcnfuqpgjx.ltd/ Accept-Language: en-US,en;q=0.9 Range: bytes=0-
2025-01-12 00:03:44 UTC	929	IN	HTTP/1.1 206 Partial Content Date: Sun, 12 Jan 2025 00:03:44 GMT Content-Type: audio/mpeg Content-Length: 10880 Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:40 GMT ETag: "674840b0-2a80" Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Content-Range: bytes 0-10879/10880 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0jlaAqsQFvJUOJRnzPvGWueAR7IdbXN7ZZKAKYOMp0hz5YCKVggmtdhiNYiycNQghehA%2F%2B3s6r4DgmCnXSLDWwDwn9ILt3LHXgCTGRyVfOg%2BFl6wa%2FlbCeYXtaYDAop0oW8goA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e2984f734402-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1561&min_rtt=1553&rtt_var=600&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1129&delivery_rate=1798029&cwnd=182&unsent_bytes=0&cid=a4e66b01f6f737a8&ts=637&x=0"
2025-01-12 00:03:44 UTC	440	IN	Data Raw: 49 44 33 03 00 00 00 00 02 38 54 41 4c 42 00 00 00 01 00 00 00 54 43 4f 4e 00 00 00 01 00 00 00 54 49 54 32 00 00 00 01 00 00 00 54 50 45 31 00 00 00 01 00 00 00 54 52 43 4b 00 00 00 01 00 00 00 54 59 45 52 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ID38TALBTCONTIT2TPE1TRCKTYER
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: ba bd c0 c0 c2 c5 c8 c8 ca cd d0 d2 d2 d5 d8 da da dd e0 e2 e5 e5 e8 ea ed ed f0 f2 f5 f8 f8 fa fd ff 00 00 00 32 4c 41 4d 45 33 2e 39 39 72 04 aa 00 00 00 00 2e 10 00 00 35 20 24 04 3c 4d 00 01 c2 00 00 28 be c7 83 d5 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2LAME3.99r.5 $<M(/
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 00 00 00 c3 a4 2c c9 40 4c 1f 0a 8e 11 09 4c 66 99 4c ff 0d cd 8a 2d 21 85 ea 52 de cb f0 13 92 13 ae a1 c8 cf f2 3b da f7 5c 3c 25 36 44 d0 6c bf ff ff ff 70 48 00 00 03 ed 24 40 00 00 70 ef 1f 7c 11 ed 9d 33 f4 b4 30 9b b4 f5 63 e3 56 14 06 e4 c3 4c 26 81 52 54 0b 18 14 ac 0e 87 97 96 27 2f 94 0c 35 71 ab 96 96 02 c2 cf 46 a1 69 94 58 c9 b4 c0 78 d5 20 00 10 27 86 7e 00 00 00 0a 12 ff fb 30 64 fd 81 72 53 1d 4f fb 5d a0 e8 06 40 09 a8 00 00 01 06 98 47 3d ec f1 63 20 0c 80 67 60 00 00 06 4c 46 41 08 48 93 98 92 37 18 71 12 19 56 1d 17 d5 be 02 00 2d 6c 5c 6a f1 65 54 4c 42 9a 19 ae 13 b3 b2 67 f2 c3 23 00 00 3e 82 62 00 00 0b 10 cf f8 01 f7 43 65 85 1d 00 8c 0e 48 4d 42 1b 0c 69 8f 0c ea 0e 8c 63 48 b3 03 14 c9 12 d6 e4 5c 08 0d 92 28 c9 59 7f 62 1d bb Data Ascii: ,@LLfL-!R;\<%6DlpH$@p\|30cVL&RT'/5qFiXx '~0drSO]@G=c g`LFAH7qV-l\jeTLBg#>bCeHMBicH\(Yb
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 00 00 01 45 cc 49 3d ee 3c e6 e0 32 01 e7 f4 13 00 0c d1 47 a0 66 c8 10 c0 db 80 05 fe 84 a0 a5 05 87 b4 56 e1 19 b9 33 73 6e a2 0a a2 e0 74 7d cf a0 6f ed a0 c8 0a d8 89 67 40 2f 44 41 c2 9b 2a f1 43 00 31 49 79 0f c0 00 00 16 58 f1 96 88 55 00 03 a9 ac 84 46 22 93 19 8c 24 5a 17 28 bd b0 db 2e 90 da 09 49 36 96 54 11 fe d5 19 d2 98 70 05 60 00 00 03 80 00 00 e8 18 a0 94 30 35 a2 cb 7f ff e9 75 28 a0 06 29 2f ff fb 20 64 fd 81 71 78 11 d0 7b 98 29 b8 0b 80 1a 7e 04 00 01 45 68 49 3d ae 61 66 60 15 80 29 50 00 00 05 11 c6 01 91 93 0d 89 95 94 1c 09 38 70 10 c4 f4 23 36 04 0c 0e 05 41 f2 dc 38 4d 0a 72 dc 39 2f a4 45 5e 60 21 dc a9 b0 d3 8e fe 8a b0 58 07 02 01 16 87 8a 63 00 30 88 99 8e 00 00 00 16 f2 17 c9 11 d4 2c a4 72 c1 62 4d e5 72 42 c1 ea ae 81 50 Data Ascii: EI=<2GfV3snt}og@/DA*C1IyXUF"$Z(.I6Tp`05u()/ dqx{)~EhI=af`)P8p#6A8Mr9/E^`!Xc0,rbMrBP
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 28 c9 75 06 be 0c 32 80 14 d4 03 49 6e 0c d6 30 3c ed 9d f7 0b 67 78 3d bc 21 60 00 00 00 00 00 b0 98 1f 27 43 51 e0 08 df a8 9c 00 99 25 af 65 29 96 20 a8 13 54 c3 f6 0c e8 08 42 c9 d8 92 29 8a f9 ae 03 70 be ce 8b c3 75 f5 06 ee 19 04 0c 3a 51 15 1c 6e a2 17 84 00 51 99 08 0e 00 00 ff fb 20 64 fe 01 51 5e 0d cf fb 63 03 28 0e e0 5a 9e 25 81 01 04 a4 49 3f ed 6c 44 e0 3f 81 e7 f4 93 04 0c 00 17 62 76 c3 4c c4 86 84 bf 16 58 a6 41 e3 b3 32 a1 a8 9f a7 a5 63 3b 7a 26 c0 6c 00 00 00 00 00 0d 85 cb 6d 54 06 5b 00 18 c3 03 70 96 14 1a e8 f3 89 30 da 70 13 69 68 95 b4 2a 93 84 25 55 14 f7 f7 10 5b c8 0d 86 a8 dd 9b ed 00 db df fe 00 00 00 0f c0 59 a8 82 e7 62 26 0e 14 78 ff fb 30 64 f5 03 71 40 08 50 79 fb c0 98 0d c0 6a 7e 24 62 01 04 9c 21 41 cc 6d e2 60 24 Data Ascii: (u2In0<gx=!`'CQ%e) TB)pu:QnQ dQ^c(Z%I?lD?bvLXA2c;z&lmT[p0pih*%U[Yb&x0dq@Pyj~$b!Am`$
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: ff fb 20 64 f8 01 70 e3 07 d6 71 ef 58 4a 0a e0 1a be 04 00 01 04 70 21 3f e7 e9 81 20 1e 80 6a 38 20 00 05 e7 bb 3d c2 17 9f e0 00 20 28 f2 72 2e 54 2b 0a a8 84 ed 56 26 89 e1 93 81 9a 99 06 00 6f 7a 9d ec 20 a9 e0 00 00 00 00 06 89 0a 2e 03 9c a8 12 ac c6 d1 37 53 8a 62 f0 59 cf 52 0e 00 00 00 00 00 01 86 b4 27 6c 43 20 39 0e 9b 3e 2a 15 44 a0 b4 3f 6f 4b d4 c1 47 d3 01 2d 47 45 ba 03 ff fb 10 64 fd 83 71 29 07 d0 79 f9 78 a8 0c 20 1a 8e 08 00 01 43 78 21 5b c7 bc 21 68 1c 81 69 f8 11 04 05 00 61 49 ae 2a db 20 bb d0 00 00 00 00 0b 90 54 a4 00 aa ac c3 47 24 0c 5c b2 8b b0 b4 ed 64 6c 6e e4 50 1c 80 00 00 00 00 01 c6 24 f4 5d c0 55 00 30 93 45 59 f5 b3 6d 42 45 94 8a 40 bd 2d 56 87 40 89 b9 ff fb 10 64 f5 03 70 f0 08 55 f1 ef 08 58 0a e0 0a be 00 00 01 Data Ascii: dpqXJp!? j8 = (r.T+V&oz .7SbYR'lC 9>D?oKG-GEdq)yx Cx![!hiaI TG$\dlnP$]U0EYmBE@-V@dpUX
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 4c 41 4d 45 33 2e 39 39 2e 35 aa aa aa aa aa aa aa aa aa b9 30 ba 90 00 00 00 00 21 86 aa e8 ab 08 c2 d6 ff fb 10 64 fe 83 70 d6 07 51 f1 f8 78 38 0b 40 1a 6e 04 00 01 02 bc 1b 53 c7 bd 80 e8 15 00 68 f8 10 00 04 0e 16 70 20 0f c1 33 50 c4 d8 80 00 31 93 66 16 e0 8c d0 2c c4 e8 0e 69 d3 6c 1a 04 f0 2f 4b b1 15 4c 41 4d 45 33 2e 39 39 2e 35 55 55 bc 03 da c0 00 00 00 00 0d 9c 4e 08 58 48 70 4c 59 2e 5d a6 43 37 68 ff fb 10 64 fc 83 70 d3 07 d3 f3 0f 60 38 06 00 1a 24 04 00 01 03 04 1b 47 c8 e1 80 e8 15 80 68 b8 00 00 05 90 80 00 32 24 a6 c8 2e 5c 00 00 b0 35 14 60 1e 2a 98 d2 88 45 14 30 8d 53 ac 49 10 e8 01 00 9f 1e 4c 41 4d 45 33 2e 39 39 2e 35 aa aa aa 89 01 95 60 00 00 00 00 2b 0f a4 e8 28 04 1d 3c 90 c4 cc 0e 7a 99 ff fb 10 64 fa 07 70 d4 06 d2 f1 f8 Data Ascii: LAME3.99.50!dpQx8@nShp 3P1f,il/KLAME3.99.5UUNXHpLY.]C7hdp`8$Gh2$.\5`*E0SILAME3.99.5`+(<zdp
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: aa aa aa aa aa aa aa aa aa aa aa aa aa aa 77 20 78 00 ff fb 10 64 f7 03 70 ab 06 d2 71 ef 08 48 04 e0 69 55 04 03 01 02 7c 1b 38 84 e1 60 e0 12 00 26 d0 00 00 04 00 00 00 00 0a 43 12 55 0a b2 81 2c a6 c0 ea 77 80 28 86 00 00 1c d4 6c 38 24 08 66 45 7b f6 41 b5 4c 41 4d 45 33 2e 39 39 2e 35 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 95 ff fb 10 64 f5 03 f0 97 06 ce a1 98 60 98 06 40 19 98 04 00 01 82 60 1b 45 c6 3c 22 e0 08 00 25 c0 00 00 06 0d 40 00 06 84 c8 26 f8 b5 97 32 b4 08 e4 b0 71 35 a8 6e 35 b4 c0 a7 57 09 19 aa 82 d8 3d 02 c7 aa 4c 41 4d 45 33 2e 39 39 2e 35 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 76 ff fb 10 64 f5 07 70 ad 06 cf 71 6f 60 a8 05 80 09 98 00 00 01 02 2c 19 3d c6 3d 82 68 Data Ascii: w xdpqHiU\|8`&CU,w(l8$fE{ALAME3.99.5UUUUUUUUUUUUUUUUUUUUUUUUd`@`E<"%@&2q5n5W=LAME3.99.5vdpqo`,==h
2025-01-12 00:03:44 UTC	857	IN	Data Raw: aa ff fb 10 64 eb 07 f0 78 06 4b 40 78 30 98 00 00 0f f0 00 00 01 01 68 19 36 80 c0 62 60 00 00 3f c0 00 00 04 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa ff fb 10 64 ea 87 f0 6c 06 4d 20 38 30 98 00 00 0f f0 00 00 01 01 8c 19 32 80 c0 c2 a0 00 00 3f c0 00 00 04 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa ff fb 10 64 ea 07 f0 69 04 cb 40 70 08 9a 00 00 0f f0 00 00 01 01 70 19 2b 00 e0 c2 60 00 00 3f c0 00 00 04 aa aa aa aa aa aa aa aa aa aa Data Ascii: dxK@x0h6b`?dlM 802?di@pp+`?

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:43 UTC	547	OUT	GET /5193.75042954cc9da1f6d6ac.js HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://wkybcnfuqpgjx.ltd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:44 UTC	937	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:44 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:39 GMT Vary: Accept-Encoding ETag: W/"674840af-47f6" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6952 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vWD%2BZBPXADeFzd8b3p%2BtRS9lclZodhkPQ8s3ErM%2FHXOHHkPXVcW%2B%2BI6QvXXVtpush%2Fcve7RsyliVGYKUjQFWkRZc3fI%2FSXKWMnkWU1sJgyxzNI%2F%2BpuA%2BFYn283v7VVqF1H0RSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e2984eabefa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1763&rtt_var=685&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1125&delivery_rate=1570736&cwnd=163&unsent_bytes=0&cid=957c3ba8127b1d96&ts=148&x=0"
2025-01-12 00:03:44 UTC	432	IN	Data Raw: 34 37 66 36 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 74 65 6c 65 67 72 61 6d 5f 74 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 74 65 6c 65 67 72 61 6d 5f 74 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 35 31 39 33 5d 2c 7b 35 31 39 33 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 64 65 66 61 75 6c 74 3a 28 29 3d 3e 61 7d 29 3b 63 6f 6e 73 74 20 61 3d 7b 53 65 61 72 63 68 3a 22 53 65 61 72 63 68 22 2c 53 61 76 65 64 4d 65 73 73 61 67 65 73 3a 22 53 61 76 65 64 20 4d 65 73 73 61 67 65 73 22 2c 41 72 63 68 69 76 65 64 43 68 61 74 73 3a 22 41 72 63 68 69 76 65 64 20 43 68 61 74 73 22 2c 43 6f 6e 74 61 63 74 73 3a 22 43 6f 6e 74 61 63 74 73 22 2c 53 65 74 74 69 6e 67 73 Data Ascii: 47f6"use strict";(self.webpackChunktelegram_t=self.webpackChunktelegram_t\|\|[]).push([[5193],{5193:(e,t,n)=>{n.r(t),n.d(t,{default:()=>a});const a={Search:"Search",SavedMessages:"Saved Messages",ArchivedChats:"Archived Chats",Contacts:"Contacts",Settings
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 63 72 4f 70 65 6e 4d 65 6e 75 32 3a 22 4f 70 65 6e 20 6d 65 6e 75 22 2c 4e 65 77 4d 65 73 73 61 67 65 54 69 74 6c 65 3a 22 4e 65 77 20 4d 65 73 73 61 67 65 22 2c 4e 65 77 43 68 61 6e 6e 65 6c 3a 22 4e 65 77 20 43 68 61 6e 6e 65 6c 22 2c 4e 65 77 47 72 6f 75 70 3a 22 4e 65 77 20 47 72 6f 75 70 22 2c 22 43 6f 6d 6d 6f 6e 2e 43 6c 6f 73 65 22 3a 22 43 6c 6f 73 65 22 2c 46 69 6c 74 65 72 41 6c 6c 43 68 61 74 73 3a 22 41 6c 6c 20 43 68 61 74 73 22 2c 4d 61 72 6b 41 73 55 6e 72 65 61 64 3a 22 4d 61 72 6b 20 61 73 20 75 6e 72 65 61 64 22 2c 55 6e 70 69 6e 46 72 6f 6d 54 6f 70 3a 22 55 6e 70 69 6e 20 66 72 6f 6d 20 74 6f 70 22 2c 22 43 68 61 74 4c 69 73 74 2e 4d 75 74 65 22 3a 22 4d 75 74 65 22 2c 41 72 63 68 69 76 65 3a 22 41 72 63 68 69 76 65 22 2c 44 65 6c 65 Data Ascii: crOpenMenu2:"Open menu",NewMessageTitle:"New Message",NewChannel:"New Channel",NewGroup:"New Group","Common.Close":"Close",FilterAllChats:"All Chats",MarkAsUnread:"Mark as unread",UnpinFromTop:"Unpin from top","ChatList.Mute":"Mute",Archive:"Archive",Dele
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 62 65 72 22 3a 22 44 65 63 22 2c 53 65 61 72 63 68 41 6c 6c 43 68 61 74 73 53 68 6f 72 74 3a 22 43 68 61 74 73 22 2c 53 68 61 72 65 64 4d 65 64 69 61 54 61 62 32 3a 22 4d 65 64 69 61 22 2c 53 68 61 72 65 64 4c 69 6e 6b 73 54 61 62 32 3a 22 4c 69 6e 6b 73 22 2c 53 68 61 72 65 64 46 69 6c 65 73 54 61 62 32 3a 22 46 69 6c 65 73 22 2c 53 68 61 72 65 64 4d 75 73 69 63 54 61 62 32 3a 22 4d 75 73 69 63 22 2c 53 68 61 72 65 64 56 6f 69 63 65 54 61 62 32 3a 22 56 6f 69 63 65 22 2c 22 50 72 65 76 69 65 77 53 65 6e 64 65 72 2e 53 65 6e 64 50 68 6f 74 6f 22 3a 7b 6f 6e 65 56 61 6c 75 65 3a 22 53 65 6e 64 20 50 68 6f 74 6f 22 2c 6f 74 68 65 72 56 61 6c 75 65 3a 22 53 65 6e 64 20 25 64 20 50 68 6f 74 6f 73 22 7d 2c 53 65 6e 64 3a 22 53 65 6e 64 22 2c 22 50 72 65 76 69 Data Ascii: ber":"Dec",SearchAllChatsShort:"Chats",SharedMediaTab2:"Media",SharedLinksTab2:"Links",SharedFilesTab2:"Files",SharedMusicTab2:"Music",SharedVoiceTab2:"Voice","PreviewSender.SendPhoto":{oneValue:"Send Photo",otherValue:"Send %d Photos"},Send:"Send","Previ
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 75 72 73 41 67 6f 22 3a 7b 6f 6e 65 56 61 6c 75 65 3a 22 6c 61 73 74 20 73 65 65 6e 20 31 20 68 6f 75 72 20 61 67 6f 22 2c 6f 74 68 65 72 56 61 6c 75 65 3a 22 6c 61 73 74 20 73 65 65 6e 20 25 40 20 68 6f 75 72 73 20 61 67 6f 22 7d 2c 46 6f 72 77 61 72 64 65 64 4d 65 73 73 61 67 65 3a 22 46 6f 72 77 61 72 64 65 64 20 6d 65 73 73 61 67 65 22 2c 22 57 65 65 6b 64 61 79 2e 59 65 73 74 65 72 64 61 79 22 3a 22 59 65 73 74 65 72 64 61 79 22 2c 41 74 74 61 63 68 56 69 64 65 6f 3a 22 56 69 64 65 6f 22 2c 4c 61 74 65 6c 79 3a 22 6c 61 73 74 20 73 65 65 6e 20 72 65 63 65 6e 74 6c 79 22 2c 22 57 65 65 6b 64 61 79 2e 54 75 65 73 64 61 79 22 3a 22 54 75 65 73 64 61 79 22 2c 22 57 65 65 6b 64 61 79 2e 57 65 64 6e 65 73 64 61 79 22 3a 22 57 65 64 6e 65 73 64 61 79 22 2c Data Ascii: ursAgo":{oneValue:"last seen 1 hour ago",otherValue:"last seen %@ hours ago"},ForwardedMessage:"Forwarded message","Weekday.Yesterday":"Yesterday",AttachVideo:"Video",Lately:"last seen recently","Weekday.Tuesday":"Tuesday","Weekday.Wednesday":"Wednesday",
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 6c 6e 67 5f 73 65 6e 64 5f 61 63 74 69 6f 6e 5f 75 70 6c 6f 61 64 5f 76 69 64 65 6f 3a 22 75 70 6c 6f 61 64 69 6e 67 20 76 69 64 65 6f 2e 2e 2e 22 2c 6c 6e 67 5f 73 65 6e 64 5f 61 63 74 69 6f 6e 5f 72 65 63 6f 72 64 5f 61 75 64 69 6f 3a 22 72 65 63 6f 72 64 69 6e 67 20 61 75 64 69 6f 2e 2e 2e 22 2c 6c 6e 67 5f 73 65 6e 64 5f 61 63 74 69 6f 6e 5f 75 70 6c 6f 61 64 5f 61 75 64 69 6f 3a 22 75 70 6c 6f 61 64 69 6e 67 20 61 75 64 69 6f 2e 2e 2e 22 2c 6c 6e 67 5f 73 65 6e 64 5f 61 63 74 69 6f 6e 5f 75 70 6c 6f 61 64 5f 70 68 6f 74 6f 3a 22 75 70 6c 6f 61 64 69 6e 67 20 70 68 6f 74 6f 2e 2e 2e 22 2c 6c 6e 67 5f 73 65 6e 64 5f 61 63 74 69 6f 6e 5f 75 70 6c 6f 61 64 5f 66 69 6c 65 3a 22 75 70 6c 6f 61 64 69 6e 67 20 66 69 6c 65 2e 2e 2e 22 2c 43 72 6f 70 49 6d 61 Data Ascii: lng_send_action_upload_video:"uploading video...",lng_send_action_record_audio:"recording audio...",lng_send_action_upload_audio:"uploading audio...",lng_send_action_upload_photo:"uploading photo...",lng_send_action_upload_file:"uploading file...",CropIma
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 6f 6c 64 65 72 22 2c 4d 65 6d 62 65 72 73 3a 7b 6f 6e 65 56 61 6c 75 65 3a 22 25 31 24 64 20 6d 65 6d 62 65 72 22 2c 6f 74 68 65 72 56 61 6c 75 65 3a 22 25 31 24 64 20 6d 65 6d 62 65 72 73 22 7d 2c 47 65 6e 65 72 61 6c 3a 22 47 65 6e 65 72 61 6c 22 2c 6c 6e 67 5f 73 65 74 74 69 6e 67 73 5f 73 65 6e 64 5f 65 6e 74 65 72 3a 22 53 65 6e 64 20 77 69 74 68 20 45 6e 74 65 72 22 2c 6c 6e 67 5f 73 65 74 74 69 6e 67 73 5f 73 65 6e 64 5f 63 6d 64 65 6e 74 65 72 3a 22 53 65 6e 64 20 77 69 74 68 20 43 6d 64 2b 45 6e 74 65 72 22 2c 54 65 78 74 53 69 7a 65 3a 22 4d 65 73 73 61 67 65 20 54 65 78 74 20 53 69 7a 65 22 2c 43 68 61 74 42 61 63 6b 67 72 6f 75 6e 64 3a 22 43 68 61 74 20 42 61 63 6b 67 72 6f 75 6e 64 22 2c 22 56 6f 69 63 65 4f 76 65 72 2e 4b 65 79 62 6f 61 72 Data Ascii: older",Members:{oneValue:"%1$d member",otherValue:"%1$d members"},General:"General",lng_settings_send_enter:"Send with Enter",lng_settings_send_cmdenter:"Send with Cmd+Enter",TextSize:"Message Text Size",ChatBackground:"Chat Background","VoiceOver.Keyboar
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 20 74 69 6d 65 3f 22 2c 50 72 69 76 61 63 79 50 72 6f 66 69 6c 65 50 68 6f 74 6f 54 69 74 6c 65 3a 22 57 68 6f 20 63 61 6e 20 73 65 65 20 6d 79 20 70 72 6f 66 69 6c 65 20 70 68 6f 74 6f 73 20 26 20 76 69 64 65 6f 73 3f 22 2c 50 72 69 76 61 63 79 46 6f 72 77 61 72 64 73 54 69 74 6c 65 3a 22 57 68 6f 20 63 61 6e 20 61 64 64 20 61 20 6c 69 6e 6b 20 74 6f 20 6d 79 20 61 63 63 6f 75 6e 74 20 77 68 65 6e 20 66 6f 72 77 61 72 64 69 6e 67 20 6d 79 20 6d 65 73 73 61 67 65 73 3f 22 2c 57 68 6f 43 61 6e 41 64 64 4d 65 3a 22 57 68 6f 20 63 61 6e 20 61 64 64 20 6d 65 20 74 6f 20 67 72 6f 75 70 20 63 68 61 74 73 3f 22 2c 6c 6e 67 5f 73 65 74 74 69 6e 67 73 5f 73 65 6e 73 69 74 69 76 65 5f 74 69 74 6c 65 3a 22 53 65 6e 73 69 74 69 76 65 20 63 6f 6e 74 65 6e 74 22 2c 6c Data Ascii: time?",PrivacyProfilePhotoTitle:"Who can see my profile photos & videos?",PrivacyForwardsTitle:"Who can add a link to my account when forwarding my messages?",WhoCanAddMe:"Who can add me to group chats?",lng_settings_sensitive_title:"Sensitive content",l
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 2e 2e 2e 22 2c 4e 65 76 65 72 53 68 61 72 65 57 69 74 68 54 69 74 6c 65 3a 22 4e 65 76 65 72 20 53 68 61 72 65 22 2c 22 50 72 69 76 61 63 79 2e 50 72 6f 66 69 6c 65 50 68 6f 74 6f 22 3a 22 50 72 6f 66 69 6c 65 20 50 68 6f 74 6f 22 2c 46 69 6c 74 65 72 4e 6f 43 68 61 74 73 54 6f 44 69 73 70 6c 61 79 3a 22 46 6f 6c 64 65 72 20 69 73 20 65 6d 70 74 79 22 2c 41 74 74 61 63 68 53 74 69 63 6b 65 72 3a 22 53 74 69 63 6b 65 72 22 2c 22 43 68 61 74 4c 69 73 74 2e 53 65 61 72 63 68 2e 53 68 6f 77 4d 6f 72 65 22 3a 22 53 68 6f 77 20 6d 6f 72 65 22 2c 22 44 69 61 6c 6f 67 4c 69 73 74 2e 53 65 61 72 63 68 53 65 63 74 69 6f 6e 44 69 61 6c 6f 67 73 22 3a 22 43 68 61 74 73 20 61 6e 64 20 43 6f 6e 74 61 63 74 73 22 2c 53 65 61 72 63 68 4d 65 73 73 61 67 65 73 3a 22 4d 65 Data Ascii: ...",NeverShareWithTitle:"Never Share","Privacy.ProfilePhoto":"Profile Photo",FilterNoChatsToDisplay:"Folder is empty",AttachSticker:"Sticker","ChatList.Search.ShowMore":"Show more","DialogList.SearchSectionDialogs":"Chats and Contacts",SearchMessages:"Me
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 50 69 6e 3a 22 50 69 6e 22 2c 46 6f 72 77 61 72 64 3a 22 46 6f 72 77 61 72 64 22 2c 22 43 6f 6d 6d 6f 6e 2e 53 65 6c 65 63 74 22 3a 22 53 65 6c 65 63 74 22 2c 44 65 6c 65 74 65 53 69 6e 67 6c 65 4d 65 73 73 61 67 65 73 54 69 74 6c 65 3a 22 44 65 6c 65 74 65 20 6d 65 73 73 61 67 65 22 2c 41 72 65 59 6f 75 53 75 72 65 44 65 6c 65 74 65 53 69 6e 67 6c 65 4d 65 73 73 61 67 65 3a 22 41 72 65 20 79 6f 75 20 73 75 72 65 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 64 65 6c 65 74 65 20 74 68 69 73 20 6d 65 73 73 61 67 65 3f 22 2c 50 69 6e 4d 65 73 73 61 67 65 41 6c 65 72 74 54 69 74 6c 65 3a 22 50 69 6e 20 6d 65 73 73 61 67 65 22 2c 50 69 6e 4d 65 73 73 61 67 65 41 6c 65 72 74 43 68 61 74 3a 22 44 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 70 69 6e 20 74 68 69 73 20 6d Data Ascii: Pin:"Pin",Forward:"Forward","Common.Select":"Select",DeleteSingleMessagesTitle:"Delete message",AreYouSureDeleteSingleMessage:"Are you sure you want to delete this message?",PinMessageAlertTitle:"Pin message",PinMessageAlertChat:"Do you want to pin this m
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 73 69 63 20 66 69 6c 65 73 20 66 6f 75 6e 64 22 2c 45 6e 74 65 72 43 68 61 6e 6e 65 6c 4e 61 6d 65 3a 22 43 68 61 6e 6e 65 6c 20 6e 61 6d 65 22 2c 44 65 73 63 72 69 70 74 69 6f 6e 50 6c 61 63 65 68 6f 6c 64 65 72 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 43 68 61 6e 6e 65 6c 54 79 70 65 3a 22 43 68 61 6e 6e 65 6c 20 54 79 70 65 22 2c 54 79 70 65 50 75 62 6c 69 63 3a 22 50 75 62 6c 69 63 22 2c 44 69 73 63 75 73 73 69 6f 6e 3a 22 44 69 73 63 75 73 73 69 6f 6e 22 2c 44 69 73 63 75 73 73 69 6f 6e 55 6e 6c 69 6e 6b 3a 22 55 6e 6c 69 6e 6b 22 2c 43 68 61 6e 6e 65 6c 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 3a 22 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 2c 43 68 61 6e 6e 65 6c 53 69 67 6e 4d 65 73 73 61 67 65 73 3a 22 53 69 67 6e 20 4d 65 73 73 61 67 65 Data Ascii: sic files found",EnterChannelName:"Channel name",DescriptionPlaceholder:"Description",ChannelType:"Channel Type",TypePublic:"Public",Discussion:"Discussion",DiscussionUnlink:"Unlink",ChannelAdministrators:"Administrators",ChannelSignMessages:"Sign Message

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:03:44 UTC	643	OUT	GET /chat-bg-br.f34cc96fbfb048812820.png HTTP/1.1 Host: wkybcnfuqpgjx.ltd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://wkybcnfuqpgjx.ltd/main.949acaf34f3882f511ff.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:03:44 UTC	904	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:03:44 GMT Content-Type: image/png Content-Length: 1920 Connection: close Last-Modified: Thu, 28 Nov 2024 10:06:39 GMT ETag: "674840af-780" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6952 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BLpiaWv%2FkAfQdwAHkUDEYbYBT%2BAof8PyBpjjIDAn%2Fsx9ZlqqTWZdqgS0qfrT2AHrQQgZuLFuj2K0V5W2%2B2DX1B3CGR8lLM8rfoUaVwHlar5p9JEpO%2FgxoF7sQk3guChFRfTf6A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008e2989b7c43ab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2015&min_rtt=2009&rtt_var=766&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1221&delivery_rate=1416100&cwnd=224&unsent_bytes=0&cid=29f5a17f163e250c&ts=143&x=0"
2025-01-12 00:03:44 UTC	465	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 02 00 00 00 91 5d 1f e6 00 00 07 47 49 44 41 54 78 01 8d d6 09 4f 1b c7 1b c7 f1 79 c5 ff b3 f7 7d 9a 31 2c b0 98 0d 72 23 b7 da 48 39 36 91 43 1d 6a c0 98 c5 d9 a4 16 b5 12 73 e7 4e 5e 4c 7f 33 3f fb e1 d9 0b 2a 7d 35 1a 13 49 f3 e9 33 83 a9 79 fd 61 1f bd a9 09 ff f4 ea fd 90 bd 78 b7 f7 e2 cd e0 d4 37 7d bd 3b 79 d1 1f bf e8 65 a7 bd f4 b4 37 98 76 fb 93 a4 37 49 92 f1 ed db 59 1c 67 71 27 8b db 69 27 4a db e1 a0 1d 0c da 76 70 a3 d1 8f 7e ea 47 df 6d ad 7d d7 0b bf e9 85 5f f5 c2 2f 36 57 3f db 5c f9 ec e1 ca 27 dd 00 7d 84 1e b8 fe ff 60 c9 bc 7e 3f ac 63 39 b1 32 a1 f3 b7 ce 74 fc 66 67 fa a2 ef 58 67 bf 67 34 4d bb 30 75 61 1a df aa 30 f5 23 9a 7e d8 6a 89 09 69 93 80 fe 77 Data Ascii: PNGIHDR22]GIDATxOy}1,r#H96CjsN^L3?*}5I3yax7};ye7v7IYgq'i'Jvp~Gm}_/6W?\'}`~?c92tfgXgg4M0ua0#~jiw
2025-01-12 00:03:44 UTC	1369	IN	Data Raw: 44 13 40 da c4 aa 4c 64 61 12 94 91 c2 64 48 ca 84 1e c1 34 ff fe 4c ea 47 55 6d 82 86 11 a4 4c ac 99 63 1d bf e9 e3 78 24 14 e6 40 6f fa 30 f1 ee 0e 5f 3c 1a 9f 73 54 dd c2 a8 c0 92 2f 2a 3d aa cf 37 03 b0 f4 c5 31 80 98 36 15 59 38 9b 32 86 3d 22 a8 d2 54 fe f3 d7 ce 3a 72 83 ea 55 f1 49 d5 b2 18 4d e5 0c ce 06 42 d2 20 5e 1c de 93 32 a1 a4 30 aa f6 41 3b 77 83 5b 6b c2 12 19 34 d5 b2 c4 6a 8d 7c 34 38 18 02 38 94 e6 11 3b bc 34 6d c2 84 60 f2 a3 82 89 7f 95 39 2a b2 22 b2 64 5a fe 12 c1 42 4b 7e 66 a8 c9 88 23 0b 1f a9 c1 c6 d5 b5 c8 1c 12 c1 2a 40 73 d3 b1 37 4d 9d 29 37 aa ac ad 59 7a 5a 64 21 b0 18 ce 13 99 46 60 f3 69 d7 22 ec b9 31 f8 1e 82 40 47 90 ff 7e ea a2 4a 93 1f 15 58 bf e0 06 1d 6b 2f f2 ac 90 2c ff e4 03 34 97 2d 12 27 e1 27 dc 40 80 3d Data Ascii: D@LdadH4LGUmLcx$@o0_<sT/=716Y82="T:rUIMB ^20A;w[k4j\|488;4m`9"dZBK~f#*@s7M)7YzZd!F`i"1@G~JXk/,4-''@=
2025-01-12 00:03:44 UTC	86	IN	Data Raw: 06 56 21 43 7a 6c e8 ba 99 19 ce 86 20 57 bf e1 b3 f3 bd c5 aa 59 4b 7d 99 16 64 79 56 46 96 c8 78 9b 82 a3 0c 5d 2b 23 6b 9b 2c 31 31 cb 95 d5 c9 c0 42 71 49 b6 45 19 52 32 3d b3 ba db 44 90 fd 0d 46 e2 25 ab 51 73 31 15 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: V!Czl WYK}dyVFx]+#k,11BqIER2=DF%Qs1IENDB`