Edit tour

Windows Analysis Report
http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40

Overview

General Information

Sample URL:	http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40
Analysis ID:	1644445
Infos:

Detection

Phisher

Score:	72
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Yara detected Phisher

AI detected suspicious Javascript

Performs DNS queries to domains with low reputation

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,16130435031319717870,2636717418564773830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2252 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_155	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security

Suricata Signatures

ETPRO EXPLOIT_KIT FoxTDS Initial Check

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-20T15:24:22.950521+0100	2859622	1	Exploit Kit Activity Detected	188.132.128.218	80	192.168.2.4	49727	TCP

HTTP traffic detected: POST /checksiteconfig?v=14dbe0f1619b8014e2630bcdde727e7785a80dee&host=umqx.wowoffersnow.com&sitekey=8de8f782-dd76-4e4a-8634-8ae26a466578&sc=1&swa=1&spst=1 HTTP/1.1Host: api.hcaptcha.comConnection: keep-aliveContent-Length: 0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/jsonsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plainsec-ch-ua-mobile: ?0Origin: https://newassets.hcaptcha.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://newassets.hcaptcha.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Address: gin_throttle_mw_7200000000_161.77.13.2X-Ratelimit-Limit: 500X-Ratelimit-Remaining: 490X-Ratelimit-Reset: 1742484275Date: Thu, 20 Mar 2025 14:24:56 GMTContent-Length: 0

Source: chromecache_72.2.dr	String found in binary or memory: https://hcaptcha.com/1/api.js
Source: chromecache_134.2.dr, chromecache_95.2.dr, chromecache_136.2.dr	String found in binary or memory: https://hcaptcha.com/license
Source: chromecache_72.2.dr	String found in binary or memory: https://trk-consulatu.com/scripts/push/script/oldw7nlgzn?url=default
Source: chromecache_72.2.dr	String found in binary or memory: https://umqx.wowoffersnow.com/build/assets/app-ae755995.css
Source: chromecache_155.2.dr	String found in binary or memory: https://unoropas.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.78.223.0:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.78.223.0:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.199.34.244:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 190.10.8.210:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 190.10.8.210:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.224:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 190.10.8.210:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.224:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.181:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.181:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.44:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.44:443 -> 192.168.2.4:49815 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir7152_1335531758

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir7152_1335531758

Jump to behavior

Source: classification engine

Classification label: mal72.phis.troj.win@24/130@40/12

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,16130435031319717870,2636717418564773830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2252 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,16130435031319717870,2636717418564773830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2252 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://umqx.wowoffersnow.com/push_nai_service-worker.js?segment=default	100%	Avira URL Cloud	phishing
https://unoropas.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668	0%	Avira URL Cloud	safe
https://umqx.wowoffersnow.com/favicon.ico	100%	Avira URL Cloud	phishing
https://subscription.trk-consulatu.com/register/push/lmdzxr03ek	0%	Avira URL Cloud	safe
http://korsrattell.xyz/favicon.ico	0%	Avira URL Cloud	safe
https://umqx.quickredir.com/?s1=394920211	100%	Avira URL Cloud	phishing
https://umqx.wowoffersnow.com/build/assets/app-ae755995.css	100%	Avira URL Cloud	phishing
https://starlightskythe.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0&ckmguid=86761bf3-5b38-4dac-8b7e-8e1bd84fa581	0%	Avira URL Cloud	safe
https://unoropas.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
android.l.google.com	142.251.40.174	true	false	high
umqx.wowoffersnow.com	190.10.8.210	true	false	high
trk-consulatu.com	104.21.52.224	true	false	high
tls13.taboola.map.fastly.net	151.101.129.44	true	false	high
api.hcaptcha.com	104.19.229.21	true	false	high
event.trk-consulatu.com	104.21.52.224	true	false	high
imgs3.hcaptcha.com	104.19.230.21	true	false	high
mobile-gtalk.l.google.com	142.251.167.188	true	false	high
hcaptcha.com	104.19.229.21	true	false	high
unoropas.com	34.78.223.0	true	false	high
www.google.com	142.251.40.132	true	false	high
korsrattell.xyz	188.132.128.218	true	false	high
subscription.trk-consulatu.com	172.67.204.181	true	false	high
umqx.quickredir.com	190.10.8.210	true	false	high
newassets.hcaptcha.com	104.19.230.21	true	false	high
starlightskythe.com	104.199.34.244	true	false	high
api.taboola.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://imgs3.hcaptcha.com/tip/fdd0873e4095c5d9353e7c1b1f37bb6fc7468348dd9735e07a86aca2433be034/05b832c5ca4b6a441069c22a62a1561791c309d8db5fe7931abcac09e50c5bef.jpeg	false		high
http://korsrattell.xyz/favicon.ico	true	Avira URL Cloud: safe	unknown
https://imgs3.hcaptcha.com/tip/3c7802e430ae22e1ca86264d057564688ca2b23dbbd4e5221786416be78b9fb8/478c8f70178f5e2ece46b3622158d0a170bdbb196b60117065f34fafd0a0698c.jpeg	false		high
https://imgs3.hcaptcha.com/tip/544c1215052e3ebd3478375562628f849a34f201b20e627ed59b449f81ff7e34/899da41c349957e697746f8c2821dd007d169d6c535b9c2a4df26e2b24b1fc15.jpeg	false		high
https://imgs3.hcaptcha.com/tip/748291600d29053d0953d980b20565878f856b1830142a4ef571a595c60982ed/31644886f485af46c07c581662d60328da45cf96b7519d46c3b01211ef0da292.jpeg	false		high
https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8	false		unknown
https://imgs3.hcaptcha.com/tip/5fb941ac4914b6e10f4a4ac6ed1bffc126ba558b46b8b7160fd3f25eec6efce0/8989af18c88029ad4cd8fe2704829b96930d3988b2dc589f1a2cff7ba962acea.jpeg	false		high
https://imgs3.hcaptcha.com/tip/5366f707c04e62f73e2df99dde88ff4231d7f4364241a3d1ca7ae99a543e6d3f/4b088efce637d82d5ed8fe2fb9a2774f1c0cfeda3f848e64fce5d892eb35a9c9.jpeg	false		high
https://umqx.wowoffersnow.com/build/assets/app-ae755995.css	false	Avira URL Cloud: phishing	unknown
https://trk-consulatu.com/scripts/ext/script/oldw7nlgzn?url=default	false		high
https://imgs3.hcaptcha.com/tip/8a092e419afa711d6ee5a872161d9a1107246535fd168d51facceb62e61723e1/a66090e712dab0b546da23b22b4d50821dd18a36af443172481cdf7e671a1143.jpeg	false		high
https://imgs3.hcaptcha.com/tip/0ecfcd00b6ded2517185614164cd4a2efd1684fc137ab033df32627cb6ccf160/2d4922225ca87c11ae4d514b53bb0037ab088ef89e6240269c1a51e77d3f386b.jpeg	false		high
https://imgs3.hcaptcha.com/tip/5ed40a98616366f99158ad91b02b8271a593a00101cf44e7b5c4d6ef05a5cf18/5802eab0223b4745163ac7bc6e555f2645d92d73d33b9d09b090eb4a0acda6ad.jpeg	false		high
https://imgs3.hcaptcha.com/tip/b2ab9672e3b9639ce6d5dc0165883f7828e6fb93adcdb8a5830a90b457488eef/8c510b7b7790ad533ca2091c0a4f67758d63661acaf4ef6735ce020035aa6f2f.jpeg	false		high
https://imgs3.hcaptcha.com/tip/e07a4a47097824cfbc50966963431a168a643e4b861d45eb575583c718ee2877/259380d0ecb440ae87b9a22b2643ffdde14dc009d4243aa007bd253aac428f80.jpeg	false		high
https://imgs3.hcaptcha.com/tip/ef5adef5121a7ccd3706e153fbe5db406d3afc10bd8f38f37d2a20d70ea36b9d/7e8426a2753981923195495341abb77b0b8d3f96fc9c88e1db9198bae32bf61f.jpeg	false		high
https://subscription.trk-consulatu.com/register/push/lmdzxr03ek	false	Avira URL Cloud: safe	unknown
https://newassets.hcaptcha.com/captcha/v1/14dbe0f1619b8014e2630bcdde727e7785a80dee/challenge/image_label_binary/challenge.js	false		high
https://api.taboola.com/2.0/json/smpush-general/user.sync?app.type=web&app.apikey=dd83e155339c3c4626a1a3e8465b50db3024b412	false		high
https://imgs3.hcaptcha.com/tip/052e00fc5da86010773947ded352e4bf08db49f0a9ecbd336c98ca31b090d723/fe2dc4ce123a551441f1c6d34773b16a58dfe19d6eab6f445cc0c7a0fabfb7b5.jpeg	false		high
https://imgs3.hcaptcha.com/tip/932790f72e38bfac0c100769b7ddb92210209ee5cd125a975064fb0f5dfd27ae/87ec6f71f56c4ab749f3e0176d3a58ded953d880e051a90d55d8b80858bb87fb.jpeg	false		high
https://hcaptcha.com/1/api.js	false		high
https://trk-consulatu.com/scripts/push/script/oldw7nlgzn?url=default	false		high
https://imgs3.hcaptcha.com/tip/1510136bdf07c9ac653c1f192101f0b4488d6d72b4c301f9595229a2378f20f2/897257e2b27d5011c6e8d4ce453c95145f2b618f07aef574947dac94fc831b54.jpeg	false		high
https://imgs3.hcaptcha.com/tip/987ffb13603ff61f581b5cd1dd2a1ff6b5feef9e52e4d07dca99939b1f4b9c31/1bf48a2dd7ffa27c54f7991574757eca7c136a0091582ad50dbafe097d195a93.jpeg	false		high
https://imgs3.hcaptcha.com/tip/7016034bff2519d0defdbcb035304f292130533d6149efb07f23c45e7b999680/ea5e10e2fcc3f3ed8c03e361914d81760276403222fe8b41ee81af4d1bdbeb1f.jpeg	false		high
http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	false		unknown
https://imgs3.hcaptcha.com/tip/987fed69708246412885c919c0a0ada1a335d4aabc42152722c6d9aac6cb8f5d/b41cbcf39a796d6a8ef3dc2f3cf40cffaa7a773efe01a0862b035668c0c961fc.jpeg	false		high
https://api.hcaptcha.com/checksiteconfig?v=14dbe0f1619b8014e2630bcdde727e7785a80dee&host=umqx.wowoffersnow.com&sitekey=8de8f782-dd76-4e4a-8634-8ae26a466578&sc=1&swa=1&spst=1	false		high
https://starlightskythe.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0&ckmguid=86761bf3-5b38-4dac-8b7e-8e1bd84fa581	false	Avira URL Cloud: safe	unknown
https://imgs3.hcaptcha.com/tip/bc40b5618a744942066d07a9a88158e6bac3446510045469aafbfa3d818c2d0b/6aa474b1fde5f5c0ef813eb3a986f06a7894129b178fa86fbd2528109ea91123.jpeg	false		high
https://unoropas.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0	false	Avira URL Cloud: safe	unknown
https://umqx.wowoffersnow.com/push_nai_service-worker.js?segment=default	false	Avira URL Cloud: phishing	unknown
https://imgs3.hcaptcha.com/tip/082641e57bc0aa4e359ff5e5f889e27ada2f24fc8cfded29c5f55612d580f96c/24748960c79628dc89f4095d44665380b1206d8976d4b52421d8413366d404b3.jpeg	false		high
https://umqx.wowoffersnow.com/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://imgs3.hcaptcha.com/tip/21d6329fcdda2c0e3df02bd58ae4a4f52c56cad6967da1598f8b5151d36eebbb/566403a5fa8f5a536093649356c8176618d52b6a8ee98ca3528e916670cd6f1d.jpeg	false		high
https://unoropas.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668	false	Avira URL Cloud: safe	unknown
https://newassets.hcaptcha.com/c/5fef759e34a955dd56ceddd805e6a87d3f7d854c8c695bf797d43331bebfee3f/hsw.js	false		high
https://imgs3.hcaptcha.com/tip/5cfa673aaf12e17b9a7a240bcbb98c561b6d9d447853b8f320d58ebe9e87615b/daac7daf51d7e45c1857d8ffb7dc9b847cedfab36186fce5242308cde36a575e.jpeg	false		high
https://newassets.hcaptcha.com/captcha/v1/14dbe0f1619b8014e2630bcdde727e7785a80dee/static/hcaptcha.html	false		high
https://imgs3.hcaptcha.com/tip/e635d60a1769a340ed21dfb69e6d950d82601acc787aad2124f59be261664c04/7304624d52db534691b49c5eb2e5684bef9b8d4d88ed3fa220884031706faf0d.jpeg	false		high
https://trk-consulatu.com/scripts/sw/script/oldw7nlgzn?url=default	false		high
https://imgs3.hcaptcha.com/tip/b576047608b1e18356067ae2ea536bd0bb9f78f893219f967ee576c4b369eab2/b9511cc4eef412df11d636ba855788c2c4a6e4da8cf099d4171ea26af87c1d97.jpeg	false		high
https://imgs3.hcaptcha.com/tip/5fae55ec5a3d1d6b891815827a9dd405a0aea7000b3051190d1fe5d7bd64f041/11eb7bdf41f61e2771028a974eee30175100bb272f944cd4523fb98d1c7f1382.jpeg	false		high
https://api.hcaptcha.com/getcaptcha/8de8f782-dd76-4e4a-8634-8ae26a466578	false		high
https://imgs3.hcaptcha.com/tip/ad911fdbd6f0fdccfe993d1030b71440ec063ddcd3009c40db0567bf166bca9d/6cc983e298bd0cf20731a837e2ecc55b41759b8ce1602a85b7bcb3c7d45a4975.jpeg	false		high
https://imgs3.hcaptcha.com/tip/cb7236e59e1dcf441dd8f42ccdc62e4b7127c59341319004d0e24c6b2faa7148/8339cb8e728f1fed1f45c3fafc4b59a99477310c69e5ae5617bd22b8d352f260.jpeg	false		high
https://imgs3.hcaptcha.com/tip/298cb7fc9c5af86e8a23de257cf1cfc39ef55e91cd6fd814f02ab1f4fde7fccd/218b5e00954cc5e9d705c5578a99ca7668a9c4061dc054092c6bfdecf474c710.jpeg	false		high
https://imgs3.hcaptcha.com/tip/eb0ecc3d9968bdfca261f9c6b85c44798fe26744869c11d68f955c9b865964a5/dee54133caa46ad6a7fc850ea6fdbd7f49e36eea3a09cc4fe823a267f050298e.jpeg	false		high
https://event.trk-consulatu.com/register/event_log/lmdzxr03ek	false		high
https://imgs3.hcaptcha.com/tip/ee5646ac085d9c03ad1fca262e5c8c7160da345be23632362e94262961fd116c/97fea80ab010cdbac7308881c3d86de4d26646bc4c84b84724ca3134a4864b74.jpeg	false		high
https://imgs3.hcaptcha.com/tip/95f6f9df34499cbe6123d3d66168a351aa386d5d47290a110bf166148e8e3e57/ecf059c050fd525110ea5dbb21517ea8d6bfcdb9f6e988551169c52781f7db1d.jpeg	false		high
http://korsrattell.xyz/t/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	false		unknown
https://imgs3.hcaptcha.com/tip/518e69555e417c976a90a496fa5ae7923dfed7ee7d2b78b5857b0a1fcbeffa36/86783fc348dae1c9c01b705559a2bda10d24681bb5e8ba248df23bb6639c0057.jpeg	false		high
https://imgs3.hcaptcha.com/tip/1e0d92232f6ae144a69006b3cff35d09ba410b7b82d726d9893a2109caad2363/23ee77929fafd8de1e2a6a43abd6569f851ccdfa7cf0c5ddcedfd11dde99b320.jpeg	false		high
https://umqx.quickredir.com/?s1=394920211	false	Avira URL Cloud: phishing	unknown
https://imgs3.hcaptcha.com/tip/53a5f3520f74655f728df5434c84de3b1b3f6c467d3a3e1567b2b3696b534848/ee6931660380bac24cc998477f2df92d7329e1b8dcb6340f3f8409b11ecfd1d4.jpeg	false		high
https://imgs3.hcaptcha.com/tip/c8b8edb0f519f668b62eda127759bacaf6a6089670d956e54cb0f89cc2c7eda3/3f51bfa969f6bbad8a2bd2ab9a6652dcab1d34eff3db503157ce43f56b555a14.jpeg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://hcaptcha.com/license	chromecache_134.2.dr, chromecache_95.2.dr, chromecache_136.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.199.34.244	starlightskythe.com	United States	15169	GOOGLEUS	false
188.132.128.218	korsrattell.xyz	Turkey	42910	PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETIPREMIERDC-SHTR	false
142.251.167.188	mobile-gtalk.l.google.com	United States	15169	GOOGLEUS	false
34.78.223.0	unoropas.com	United States	15169	GOOGLEUS	false
142.251.40.132	www.google.com	United States	15169	GOOGLEUS	false
151.101.129.44	tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false
104.19.229.21	api.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
104.19.230.21	imgs3.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
172.67.204.181	subscription.trk-consulatu.com	United States	13335	CLOUDFLARENETUS	false
190.10.8.210	umqx.wowoffersnow.com	Costa Rica	3790	RADIOGRAFICACOSTARRICENSECR	false
104.21.52.224	trk-consulatu.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1644445
Start date and time:	2025-03-20 15:23:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.phis.troj.win@24/130@40/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.30.55.36, 142.250.80.99, 142.251.35.174, 142.250.64.78, 172.253.63.84, 142.251.40.174, 142.250.80.46, 142.251.40.206, 23.203.176.221, 199.232.214.172, 142.250.65.202, 142.251.40.202, 142.251.41.10, 142.250.64.106, 142.251.40.138, 142.251.40.170, 142.250.72.106, 142.251.32.106, 142.251.40.234, 142.250.65.234, 142.250.64.74, 142.250.65.170, 142.250.80.10, 142.251.40.106, 142.250.81.234, 142.251.35.170, 142.250.176.206, 142.250.65.238, 142.250.80.78, 142.250.65.163, 142.251.40.142, 172.202.163.200
Excluded domains from analysis (whitelisted): android.clients.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, ocsp.digicert.com, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, c.pki.goog, mtalk.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.208966082694623
Encrypted:	false
SSDEEP:	3:HhCkuDjn:HUkuf
MD5:	89BE93E81169A3478F5B92F3C91AF580
SHA1:	C62E2852B394952919463742831CB4C66CCA1C8B
SHA-256:	77C5F518D3925E0083F47A20572ADB178B2204D07FAA396A2E3B0AFD803155B9
SHA-512:	0F837CB5A3E3C67CFE10B21FB4965A1B39E4C10CEA9137D03A9D5B743B6F36A02CDE5348752D59C0BF28F9CFA0163D99A7767CCE9255500E5C3E15EA1F74C173
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCcfgnZX2VasIEgUNU1pHxRIFDb8kUpAhN0zuZ6WZBO8=?alt=proto
Preview:	ChIKBw1TWkfFGgAKBw2/JFKQGgA=

Source: https://umqx.wowoffersnow.com/push_nai_service-worker.js?segment=default	Avira URL Cloud: Label: phishing
Source: https://umqx.wowoffersnow.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://umqx.quickredir.com/?s1=394920211	Avira URL Cloud: Label: phishing
Source: https://umqx.wowoffersnow.com/build/assets/app-ae755995.css	Avira URL Cloud: Label: phishing

Source: 2.2..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2... This script demonstrates several high-risk behaviors, including dynamic code execution (using the `<script>` tag to load an external script), data exfiltration (redirecting the user to a potentially malicious URL), and the use of obfuscated URLs. The combination of these factors indicates a highly suspicious and potentially malicious script, which poses a significant security risk.
Source: 2.3..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of an obfuscated URL. The script creates a new script element, sets its source to a suspicious domain ('trk-consulatu.com'), and appends it to the document's head. This suggests the potential for malicious code execution and data collection. Additionally, the script sets up a 'push' functionality, which could be used for unauthorized notifications or other unwanted activities. Overall, the combination of these behaviors indicates a high-risk script that should be further investigated.
Source: 2.13..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://umqx.wowoffersnow.com/push_nai_service-wor... This script demonstrates high-risk behavior by using the `eval()` function to execute dynamic code, which can lead to remote code execution vulnerabilities. Additionally, the script sends data to external domains, which could potentially be used for data exfiltration. The use of obfuscated code further increases the risk, as it makes the script's true purpose more difficult to analyze. Overall, this script exhibits multiple high-risk indicators and should be considered a significant security concern.

Source: http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	HTTP Parser: No favicon
Source: http://korsrattell.xyz/t/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	HTTP Parser: No favicon
Source: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8	HTTP Parser: No favicon
Source: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8	HTTP Parser: No favicon
Source: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8	HTTP Parser: No favicon
Source: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8	HTTP Parser: No favicon
Source: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8	HTTP Parser: No favicon
Source: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8	HTTP Parser: No favicon
Source: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8	HTTP Parser: No favicon
Source: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: korsrattell.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: korsrattell.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: korsrattell.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: korsrattell.xyz

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: unoropas.com to https://starlightskythe.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0&ckmguid=86761bf3-5b38-4dac-8b7e-8e1bd84fa581
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: starlightskythe.com to https://umqx.quickredir.com/?s1=394920211
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: umqx.quickredir.com to https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8

Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.227
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: korsrattell.xyz
Source: global traffic	DNS traffic detected: DNS query: unoropas.com
Source: global traffic	DNS traffic detected: DNS query: starlightskythe.com
Source: global traffic	DNS traffic detected: DNS query: umqx.quickredir.com
Source: global traffic	DNS traffic detected: DNS query: umqx.wowoffersnow.com
Source: global traffic	DNS traffic detected: DNS query: hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: trk-consulatu.com
Source: global traffic	DNS traffic detected: DNS query: newassets.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: api.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: event.trk-consulatu.com
Source: global traffic	DNS traffic detected: DNS query: imgs3.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: subscription.trk-consulatu.com
Source: global traffic	DNS traffic detected: DNS query: api.taboola.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 15:24:15.128568888 CET	53	50910	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:15.290939093 CET	53	62944	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:15.975739002 CET	53	52093	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:16.120850086 CET	53	64524	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:19.366399050 CET	50860	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:19.366559029 CET	62146	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:19.470437050 CET	53	62146	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:19.471477985 CET	53	50860	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:20.579623938 CET	54508	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:20.579967976 CET	50454	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:20.586879969 CET	61492	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:20.587105036 CET	51308	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:20.686032057 CET	53	50454	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:20.688164949 CET	53	54508	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:20.694719076 CET	53	51308	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:20.716908932 CET	53	61492	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:25.060467958 CET	63222	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:25.060703993 CET	63269	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:25.171993017 CET	53	63222	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:25.173274994 CET	53	63269	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:26.406686068 CET	54619	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:26.406814098 CET	56196	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:26.510135889 CET	53	56196	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:26.515755892 CET	53	54619	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:27.306863070 CET	52430	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:27.307019949 CET	53326	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:27.579693079 CET	53	52430	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:27.914503098 CET	53	53326	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:28.855101109 CET	62513	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:28.855238914 CET	61597	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:29.120373011 CET	53	61597	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:29.148945093 CET	53	62513	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:30.358683109 CET	57773	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:30.358810902 CET	52882	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:30.462264061 CET	53	57773	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:30.463910103 CET	53	52882	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:31.309427023 CET	58549	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:31.309557915 CET	56684	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:31.405769110 CET	57001	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:31.405823946 CET	50338	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:31.416578054 CET	53	58549	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:31.418035030 CET	53	56684	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:31.507311106 CET	53	50338	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:31.507430077 CET	53	57001	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:31.508136034 CET	53	52990	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:32.387108088 CET	50913	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:32.387244940 CET	65408	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:32.492235899 CET	53	50913	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:32.493285894 CET	53	65408	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:33.006685972 CET	50453	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:33.006953955 CET	61936	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:33.063827991 CET	53	65320	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:33.108866930 CET	53	50453	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:33.152159929 CET	53	61936	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:33.301717043 CET	64557	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:33.301889896 CET	59337	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:33.482640982 CET	53	59337	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:33.582403898 CET	53	64557	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:34.128729105 CET	58597	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:34.129219055 CET	50212	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:34.231779099 CET	53	58597	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:34.235829115 CET	53	50212	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:35.290473938 CET	60240	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:35.290641069 CET	57684	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:35.400613070 CET	53	60240	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:35.420943975 CET	53	57684	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:44.811326027 CET	65032	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:44.811696053 CET	55280	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:44.917572021 CET	53	65032	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:44.918327093 CET	53	55280	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:46.906189919 CET	65369	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:46.906476974 CET	58076	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:24:47.010272026 CET	53	58076	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:47.011220932 CET	53	65369	1.1.1.1	192.168.2.4
Mar 20, 2025 15:24:51.974071980 CET	53	54448	1.1.1.1	192.168.2.4
Mar 20, 2025 15:25:09.086957932 CET	56160	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:25:09.087228060 CET	61609	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:25:09.196100950 CET	53	56160	1.1.1.1	192.168.2.4
Mar 20, 2025 15:25:09.200176001 CET	53	61609	1.1.1.1	192.168.2.4
Mar 20, 2025 15:25:10.212418079 CET	63966	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:25:10.212764025 CET	51809	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:25:10.319374084 CET	53	63966	1.1.1.1	192.168.2.4
Mar 20, 2025 15:25:10.320641994 CET	53	51809	1.1.1.1	192.168.2.4
Mar 20, 2025 15:25:10.492454052 CET	138	138	192.168.2.4	192.168.2.255
Mar 20, 2025 15:25:11.141858101 CET	59507	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:25:11.142035007 CET	63595	53	192.168.2.4	1.1.1.1
Mar 20, 2025 15:25:11.242244005 CET	53	63595	1.1.1.1	192.168.2.4
Mar 20, 2025 15:25:11.242408037 CET	53	59507	1.1.1.1	192.168.2.4
Mar 20, 2025 15:25:14.711924076 CET	53	50660	1.1.1.1	192.168.2.4
Mar 20, 2025 15:25:14.913187981 CET	53	54914	1.1.1.1	192.168.2.4
Mar 20, 2025 15:25:17.295068026 CET	53	53114	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 20, 2025 15:24:27.915501118 CET	192.168.2.4	1.1.1.1	c225	(Port unreachable)	Destination Unreachable
Mar 20, 2025 15:24:33.152251959 CET	192.168.2.4	1.1.1.1	c20b	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Mar 20, 2025 15:24:22.430639029 CET	492	OUT	GET /4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40 HTTP/1.1 Host: korsrattell.xyz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 20, 2025 15:24:22.644172907 CET	709	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_161.77.13.2 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 491 X-Ratelimit-Reset: 1742484275 Date: Thu, 20 Mar 2025 14:24:56 GMT Content-Length: 458 Data Raw: 3c 73 63 72 69 70 74 3e 0a 6c 65 74 20 65 3d 6e 65 77 20 55 52 4c 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 65 2e 70 61 74 68 6e 61 6d 65 3d 22 2f 74 22 2b 65 2e 70 61 74 68 6e 61 6d 65 3b 6c 65 74 20 6f 3d 65 2e 74 6f 53 74 72 69 6e 67 28 29 3b 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 26 26 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 6f 3d 5b 22 67 6f 6f 67 6c 65 62 6f 74 22 2c 22 62 69 6e 67 62 6f 74 22 2c 22 79 61 6e 64 65 78 62 6f 74 22 2c 22 64 75 63 6b 64 75 63 6b 62 6f 74 22 2c 22 73 6c 75 72 70 22 2c 22 62 61 69 64 75 73 70 69 64 65 72 22 2c 22 66 61 63 65 62 6f 74 22 2c 22 69 61 5f 61 72 63 68 69 76 65 72 22 5d 2c 74 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6e 3d 30 3b 6e 3c 6f 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 74 2e 69 6e 64 65 78 4f 66 28 6f 5b 6e 5d 29 3e 2d 31 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 3f 73 65 74 54 [TRUNCATED] Data Ascii: <script>let e=new URL(window.location.href);e.pathname="/t"+e.pathname;let o=e.toString();navigator.cookieEnabled&&!function(e){for(var o=["googlebot","bingbot","yandexbot","duckduckbot","slurp","baiduspider","facebot","ia_archiver"],t=e.toLowerCase(),n=0;n<o.length;n++)if(t.indexOf(o[n])>-1)return!0;return!1}(navigator.userAgent)?setTimeout((function(){document.location.href=o}),1e3):console.log("bt");</script><p style="color:gray;">redirect...</p>
Mar 20, 2025 15:24:22.729906082 CET	436	OUT	GET /favicon.ico HTTP/1.1 Host: korsrattell.xyz Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 20, 2025 15:24:22.950520992 CET	257	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Address: gin_throttle_mw_7200000000_161.77.13.2 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 490 X-Ratelimit-Reset: 1742484275 Date: Thu, 20 Mar 2025 14:24:56 GMT Content-Length: 0
Mar 20, 2025 15:24:23.706620932 CET	590	OUT	GET /t/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40 HTTP/1.1 Host: korsrattell.xyz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 20, 2025 15:24:24.013632059 CET	549	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_161.77.13.2 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 489 X-Ratelimit-Reset: 1742484275 Date: Thu, 20 Mar 2025 14:24:57 GMT Content-Length: 298 Data Raw: 3c 73 63 72 69 70 74 3e 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 75 6e 6f 72 6f 70 61 73 2e 63 6f 6d 2f 3f 61 3d 36 34 32 33 26 6f 63 3d 32 33 30 34 39 26 63 3d 36 30 36 30 37 26 6d 3d 33 26 73 31 3d 34 30 26 73 32 3d 33 35 39 2d 31 37 36 35 37 26 73 33 3d 33 31 33 2d 32 32 37 34 34 2d 32 36 36 38 27 3b 20 0a 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 72 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 75 6e 6f 72 6f 70 61 73 2e 63 6f 6d 2f 3f 61 3d 36 34 32 33 26 6f 63 3d 32 33 30 34 39 26 63 3d 36 30 36 30 37 26 6d 3d 33 26 73 31 3d 34 30 26 73 32 3d 33 35 39 2d 31 37 36 35 37 26 73 33 3d 33 31 33 2d 32 32 37 34 34 2d 32 36 36 38 27 29 3b 0a 7d 2c 20 31 30 30 30 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 3e 3c 2f 70 3e 0a Data Ascii: <script>setTimeout(function(){ window.location.href = 'https://unoropas.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668'; console.log('redirecting to https://unoropas.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668');}, 1000);</script><p></p>
Mar 20, 2025 15:25:09.022037029 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Mar 20, 2025 15:24:24.471159935 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 20, 2025 15:24:24.567825079 CET	223	IN	HTTP/1.1 304 Not Modified Date: Thu, 20 Mar 2025 13:43:27 GMT Expires: Thu, 20 Mar 2025 14:33:27 GMT Age: 2457 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 20, 2025 15:24:24.581545115 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 20, 2025 15:24:24.677180052 CET	223	IN	HTTP/1.1 304 Not Modified Date: Thu, 20 Mar 2025 13:43:30 GMT Expires: Thu, 20 Mar 2025 14:33:30 GMT Age: 2454 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:25 UTC	747	OUT	GET /?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668 HTTP/1.1 Host: unoropas.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: http://korsrattell.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:25 UTC	486	IN	HTTP/1.1 302 Found date: Thu, 20 Mar 2025 14:24:25 GMT content-type: text/html; charset=utf-8 content-length: 543 cache-control: private location: https://unoropas.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0 accept-ch: Sec-Ch-Ua, Sec-Ch-Ua-Arch, Sec-Ch-Ua-Bitness, Sec-Ch-Ua-Full-Version-List, Sec-Ch-Ua-Mobile, Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version, Sec-Ch-Ua-Wow64 connection: close
2025-03-20 14:24:25 UTC	543	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 6e 6f 72 6f 70 61 73 2e 63 6f 6d 2f 3f 61 3d 36 34 32 33 26 61 6d 70 3b 6f 63 3d 32 33 30 34 39 26 61 6d 70 3b 63 3d 36 30 36 30 37 26 61 6d 70 3b 6d 3d 33 26 61 6d 70 3b 73 31 3d 34 30 26 61 6d 70 3b 73 32 3d 33 35 39 2d 31 37 36 35 37 26 61 6d 70 3b 73 33 3d 33 31 33 2d 32 32 37 34 34 2d 32 36 36 38 26 61 6d 70 3b 63 68 2d 72 65 64 69 72 3d 31 26 61 6d 70 3b 63 6b 6d 78 69 64 3d 63 76 65 32 61 36 62 63 30 30 30 30 73 75 34 38 33 32 6e 30 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://unoropas.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0">here</a>.</h2

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:25 UTC	1036	OUT	GET /?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0 HTTP/1.1 Host: unoropas.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" Referer: http://korsrattell.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:26 UTC	352	IN	HTTP/1.1 302 Found date: Thu, 20 Mar 2025 14:24:26 GMT content-type: text/html; charset=utf-8 content-length: 330 cache-control: private location: https://starlightskythe.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0&ckmguid=86761bf3-5b38-4dac-8b7e-8e1bd84fa581 connection: close
2025-03-20 14:24:26 UTC	330	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 72 6c 69 67 68 74 73 6b 79 74 68 65 2e 63 6f 6d 2f 3f 61 3d 36 34 32 33 26 61 6d 70 3b 6f 63 3d 32 33 30 34 39 26 61 6d 70 3b 63 3d 36 30 36 30 37 26 61 6d 70 3b 6d 3d 33 26 61 6d 70 3b 73 31 3d 34 30 26 61 6d 70 3b 73 32 3d 33 35 39 2d 31 37 36 35 37 26 61 6d 70 3b 73 33 3d 33 31 33 2d 32 32 37 34 34 2d 32 36 36 38 26 61 6d 70 3b 63 68 2d 72 65 64 69 72 3d 31 26 61 6d 70 3b 63 6b 6d 78 69 64 3d 63 76 65 32 61 36 62 63 30 30 30 30 73 75 34 38 33 32 6e 30 26 61 6d 70 3b 63 6b 6d Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://starlightskythe.com/?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0&ckm

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:26 UTC	838	OUT	GET /?a=6423&oc=23049&c=60607&m=3&s1=40&s2=359-17657&s3=313-22744-2668&ch-redir=1&ckmxid=cve2a6bc0000su4832n0&ckmguid=86761bf3-5b38-4dac-8b7e-8e1bd84fa581 HTTP/1.1 Host: starlightskythe.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: http://korsrattell.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:27 UTC	734	IN	HTTP/1.1 302 Found date: Thu, 20 Mar 2025 14:24:27 GMT content-type: text/html; charset=utf-8 content-length: 158 cache-control: private location: https://umqx.quickredir.com/?s1=394920211 p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: st=sJAkCzhm65USZzn+9hmJBVpf0bQBEfZaL4gxcv4lKo7TL30ZmYP+/w==; domain=.starlightskythe.com; path=/; HttpOnly set-cookie: ti=2Tlw9vXS8aZRTLZHZkn/XVpf0bQBEfZaL4gxcv4lKo7TL30ZmYP+/w==; domain=.starlightskythe.com; expires=Sat, 20-Mar-2027 14:24:27 GMT; path=/; HttpOnly set-cookie: c12659=sJAkCzhm65XfpvMUZYoHm3xEqMAVg9BUmf0GRugAIDRFpLOXwUvpqQ==; domain=.starlightskythe.com; expires=Sat, 19-Apr-2025 14:24:27 GMT; path=/; HttpOnly connection: close
2025-03-20 14:24:27 UTC	158	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 6d 71 78 2e 71 75 69 63 6b 72 65 64 69 72 2e 63 6f 6d 2f 3f 73 31 3d 33 39 34 39 32 30 32 31 31 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://umqx.quickredir.com/?s1=394920211">here</a>.</h2></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:28 UTC	702	OUT	GET /?s1=394920211 HTTP/1.1 Host: umqx.quickredir.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: http://korsrattell.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:28 UTC	833	IN	HTTP/1.1 302 Found date: Thu, 20 Mar 2025 14:24:28 GMT content-type: text/html; charset=utf-8 content-length: 718 cache-control: no-cache, private location: https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8 x-redir: true set-cookie: yredir_session=eyJpdiI6ImZFNUZ1aEE1Yy9uNXB6eWd4RE1NcFE9PSIsInZhbHVlIjoiNVdZWnhkS3hTSjVobmQ4YW9aeC9GcWUvcktpYkJoencxcDBjZU81aDZtcDYyczQvUzRGRDFTa0JodjJtV2FxeHRsNElEa3c2VzI3bVF5RUNZNy8yMytWMDl6VCtVUUJENUdKK1dobk8wTk5QK0Z6a2tHZWdPbU1mbUI3L0NtQmwiLCJtYWMiOiJkMzA2ZWVmZmIwYzc1ZmQ1NGNlMjdkMTQ2NTg2NjBmYTc3MjUzMmYxZmNlNmY2MGQ1YTc3NDljNjU5NjQ5ODI5IiwidGFnIjoiIn0%3D; expires=Thu, 20-Mar-2025 16:24:28 GMT; path=/; httponly; samesite=lax server: swoole-http-server strict-transport-security: max-age=15768000 connection: close
2025-03-20 14:24:28 UTC	718	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 75 6d 71 78 2e 77 6f 77 6f 66 66 65 72 73 6e 6f 77 2e 63 6f 6d 2f 74 2f 36 35 64 62 61 66 38 31 32 64 32 63 2f 30 38 35 63 32 34 38 34 2d 30 35 39 37 2d 31 31 66 30 2d 62 32 33 30 2d 38 39 33 63 65 32 61 34 66 33 66 64 2f 30 38 36 32 35 39 38 30 2d 30 35 39 37 2d 31 31 66 30 2d 39 66 36 62 2d 61 62 30 65 37 32 66 30 34 35 65 38 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://umqx.wowoffersnow.com/t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8'" /> <tit

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:29 UTC	779	OUT	GET /t/65dbaf812d2c/085c2484-0597-11f0-b230-893ce2a4f3fd/08625980-0597-11f0-9f6b-ab0e72f045e8 HTTP/1.1 Host: umqx.wowoffersnow.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: http://korsrattell.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:30 UTC	702	IN	HTTP/1.1 200 OK date: Thu, 20 Mar 2025 14:24:30 GMT content-type: text/html; charset=UTF-8 content-length: 10429 cache-control: no-cache, private x-redir: true set-cookie: yredir_session=eyJpdiI6IllTVGowWFMvRzNZZGRWaTNrQ2FvVnc9PSIsInZhbHVlIjoiVkJ0emtBR0NjT29leXZzSnptRDZOakN5Q1BtTnV5a1NLZXM4VTBxRmdHbDVST254czNoalhROGZnSnBYczNXUmFHNTBSYlZBdmdHTW4zM2xCMEY4Z1RweDZiRmdPdHovbVRDS01RU1N1RVhEK1lrenU4SmVxUDFiaFp3SFRtc3QiLCJtYWMiOiI2YmYxMjZhZTNjMzUyZmE4ZmE3MzNmMWZkZDZhOGUyOTljOWZlMzc3ZmQ0YzM5Njc1OWUwZTg3MWNmYzA2N2RkIiwidGFnIjoiIn0%3D; expires=Thu, 20-Mar-2025 16:24:30 GMT; path=/; httponly; samesite=lax server: swoole-http-server strict-transport-security: max-age=15768000 connection: close
2025-03-20 14:24:30 UTC	10429	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en" dir="ltr"> <head > <meta charset="utf-8"> <meta content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no" name="viewport">

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:30 UTC	525	OUT	GET /1/api.js HTTP/1.1 Host: hcaptcha.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:30 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:30 GMT Content-Type: application/javascript Content-Length: 208098 Connection: close CF-Ray: 9235dfa0fefa4364-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 0 Cache-Control: max-age=300 ETag: W/"01cc3287fe0573f5824cf1c57f6539f6" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin alt-svc: h3=":443"; ma=86400 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: cloudflare
2025-03-20 14:24:30 UTC	854	IN	Data Raw: 2f 2a 20 7b 20 22 76 65 72 73 69 6f 6e 22 3a 20 22 31 22 2c 20 22 68 61 73 68 22 3a 20 22 4d 45 55 43 49 43 71 6c 41 33 54 45 4d 34 35 6c 66 34 76 55 48 50 78 65 6e 66 56 4d 32 42 68 76 78 65 36 56 7a 71 48 59 67 7a 66 72 50 69 6f 79 41 69 45 41 6a 49 31 7a 51 54 77 75 4a 72 42 75 68 4a 76 78 69 6a 43 6f 56 49 32 67 74 72 76 50 6a 35 54 6e 6c 31 4e 34 37 72 4d 2b 6c 63 49 3d 22 20 7d 20 2a 2f 0a 2f 2a 20 68 74 74 70 73 3a 2f 2f 68 63 61 70 74 63 68 61 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f Data Ascii: /* { "version": "1", "hash": "MEUCICqlA3TEM45lf4vUHPxenfVM2Bhvxe6VzqHYgzfrPioyAiEAjI1zQTwuJrBuhJvxijCoVI2gtrvPj5Tnl1N47rM+lcI=" } // https://hcaptcha.com/license */!function(){"use strict";function e(e){var t=this.constructor;return this.then((functio
2025-03-20 14:24:30 UTC	1369	IN	Data Raw: 69 26 26 74 28 72 29 7d 29 29 7d 72 5b 65 5d 3d 7b 73 74 61 74 75 73 3a 22 66 75 6c 66 69 6c 6c 65 64 22 2c 76 61 6c 75 65 3a 6e 7d 2c 30 3d 3d 2d 2d 69 26 26 74 28 72 29 7d 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 72 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 6f 28 61 2c 72 5b 61 5d 29 7d 29 29 7d 76 61 72 20 6e 3d 73 65 74 54 69 6d 65 6f 75 74 2c 72 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 3f 73 65 74 49 6d 6d 65 64 69 61 74 65 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 28 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 6c 65 6e 67 74 68 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 61 28 Data Ascii: i&&t(r)}))}r[e]={status:"fulfilled",value:n},0==--i&&t(r)}for(var a=0;a<r.length;a++)o(a,r[a])}))}var n=setTimeout,r="undefined"!=typeof setImmediate?setImmediate:null;function i(e){return Boolean(e&&"undefined"!=typeof e.length)}function o(){}function a(
2025-03-20 14:24:30 UTC	1369	IN	Data Raw: 74 5d 29 3b 65 2e 5f 64 65 66 65 72 72 65 64 73 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 68 28 65 2c 74 2c 6e 29 7b 74 68 69 73 2e 6f 6e 46 75 6c 66 69 6c 6c 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 3f 65 3a 6e 75 6c 6c 2c 74 68 69 73 2e 6f 6e 52 65 6a 65 63 74 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 3f 74 3a 6e 75 6c 6c 2c 74 68 69 73 2e 70 72 6f 6d 69 73 65 3d 6e 7d 66 75 6e 63 74 69 6f 6e 20 64 28 65 2c 74 29 7b 76 61 72 20 6e 3d 21 31 3b 74 72 79 7b 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 7c 7c 28 6e 3d 21 30 2c 63 28 74 2c 65 29 29 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 7c 7c 28 6e 3d 21 30 2c 6c 28 74 2c 65 29 29 7d 29 29 7d 63 61 74 63 68 28 72 29 7b 69 66 28 6e 29 72 Data Ascii: t]);e._deferreds=null}function h(e,t,n){this.onFulfilled="function"==typeof e?e:null,this.onRejected="function"==typeof t?t:null,this.promise=n}function d(e,t){var n=!1;try{e((function(e){n\|\|(n=!0,c(t,e))}),(function(e){n\|\|(n=!0,l(t,e))}))}catch(r){if(n)r
2025-03-20 14:24:30 UTC	1369	IN	Data Raw: 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 50 6f 73 73 69 62 6c 65 20 55 6e 68 61 6e 64 6c 65 64 20 50 72 6f 6d 69 73 65 20 52 65 6a 65 63 74 69 6f 6e 3a 22 2c 65 29 7d 3b 76 61 72 20 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 29 72 65 74 75 72 6e 20 73 65 6c 66 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 29 72 65 74 75 72 6e 20 67 6c 6f 62 61 6c 3b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 75 6e 61 62 6c 65 20 74 6f 20 6c 6f 63 61 74 65 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 7d 28 29 3b 66 75 Data Ascii: nsole.warn("Possible Unhandled Promise Rejection:",e)};var p=function(){if("undefined"!=typeof self)return self;if("undefined"!=typeof window)return window;if("undefined"!=typeof global)return global;throw new Error("unable to locate global object")}();fu
2025-03-20 14:24:30 UTC	1369	IN	Data Raw: 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 6c 61 62 65 6c 73 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 43 5b 74 5d 3d 65 7d 29 29 7d 29 29 7d 29 29 3b 76 61 72 20 6b 2c 45 3d 7b 22 55 54 46 2d 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 55 28 65 29 7d 7d 2c 78 3d 7b 22 55 54 46 2d 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 52 28 65 29 7d 7d 2c 56 3d 22 75 74 66 2d 38 22 3b 66 75 6e 63 74 69 6f 6e 20 53 28 65 2c 74 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6c 6c 65 64 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 2e 20 44 69 64 20 79 6f 75 20 66 6f 72 67 65 74 Data Ascii: Each((function(e){e.labels.forEach((function(t){C[t]=e}))}))}));var k,E={"UTF-8":function(e){return new U(e)}},x={"UTF-8":function(e){return new R(e)}},V="utf-8";function S(e,t){if(!(this instanceof S))throw TypeError("Called as a function. Did you forget
2025-03-20 14:24:30 UTC	1369	IN	Data Raw: 29 3b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 7c 7c 28 74 68 69 73 2e 65 6e 63 6f 64 69 6e 67 3d 6e 2e 5f 65 6e 63 6f 64 69 6e 67 2e 6e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 2c 6e 7d 66 75 6e 63 74 69 6f 6e 20 52 28 65 29 7b 76 61 72 20 74 3d 65 2e 66 61 74 61 6c 2c 6e 3d 30 2c 72 3d 30 2c 69 3d 30 2c 6f 3d 31 32 38 2c 61 3d 31 39 31 3b 74 68 69 73 2e 68 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 73 29 7b 69 66 28 73 3d 3d 3d 79 26 26 30 21 3d 3d 69 29 72 65 74 75 72 6e 20 69 3d 30 2c 62 28 74 29 3b 69 66 28 73 3d 3d 3d 79 29 72 65 74 75 72 6e 20 77 3b 69 66 28 30 3d 3d 3d 69 29 7b 69 66 28 66 28 73 2c 30 2c 31 32 37 29 29 72 65 74 75 72 6e 20 73 3b 69 66 28 66 28 73 2c 31 39 34 2c 32 Data Ascii: );return Object.defineProperty\|\|(this.encoding=n._encoding.name.toLowerCase()),n}function R(e){var t=e.fatal,n=0,r=0,i=0,o=128,a=191;this.handler=function(e,s){if(s===y&&0!==i)return i=0,b(t);if(s===y)return w;if(0===i){if(f(s,0,127))return s;if(f(s,194,2
2025-03-20 14:24:30 UTC	1369	IN	Data Raw: 6d 28 74 29 2c 74 68 69 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c 75 73 68 7c 7c 28 74 68 69 73 2e 5f 64 65 63 6f 64 65 72 3d 78 5b 74 68 69 73 2e 5f 65 6e 63 6f 64 69 6e 67 2e 6e 61 6d 65 5d 28 7b 66 61 74 61 6c 3a 22 66 61 74 61 6c 22 3d 3d 3d 74 68 69 73 2e 5f 65 72 72 6f 72 5f 6d 6f 64 65 7d 29 2c 74 68 69 73 2e 5f 42 4f 4d 73 65 65 6e 3d 21 31 29 2c 74 68 69 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c 75 73 68 3d 42 6f 6f 6c 65 61 6e 28 74 2e 73 74 72 65 61 6d 29 3b 66 6f 72 28 76 61 72 20 72 2c 69 3d 6e 65 77 20 76 28 6e 29 2c 6f 3d 5b 5d 3b 3b 29 7b 76 61 72 20 61 3d 69 2e 72 65 61 64 28 29 3b 69 66 28 61 3d 3d 3d 79 29 62 72 65 61 6b 3b 69 66 28 28 72 3d 74 68 69 73 2e 5f 64 65 63 6f 64 65 72 2e 68 61 6e 64 6c 65 72 28 69 2c 61 29 29 3d 3d 3d 77 29 62 72 65 61 Data Ascii: m(t),this._do_not_flush\|\|(this._decoder=x[this._encoding.name]({fatal:"fatal"===this._error_mode}),this._BOMseen=!1),this._do_not_flush=Boolean(t.stream);for(var r,i=new v(n),o=[];;){var a=i.read();if(a===y)break;if((r=this._decoder.handler(i,a))===w)brea
2025-03-20 14:24:30 UTC	1369	IN	Data Raw: 32 30 26 26 6f 3c 3d 35 37 33 34 33 29 69 2e 70 75 73 68 28 36 35 35 33 33 29 3b 65 6c 73 65 20 69 66 28 6f 3e 3d 35 35 32 39 36 26 26 6f 3c 3d 35 36 33 31 39 29 69 66 28 72 3d 3d 3d 6e 2d 31 29 69 2e 70 75 73 68 28 36 35 35 33 33 29 3b 65 6c 73 65 7b 76 61 72 20 61 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 31 29 3b 69 66 28 61 3e 3d 35 36 33 32 30 26 26 61 3c 3d 35 37 33 34 33 29 7b 76 61 72 20 73 3d 31 30 32 33 26 6f 2c 63 3d 31 30 32 33 26 61 3b 69 2e 70 75 73 68 28 36 35 35 33 36 2b 28 73 3c 3c 31 30 29 2b 63 29 2c 72 2b 3d 31 7d 65 6c 73 65 20 69 2e 70 75 73 68 28 36 35 35 33 33 29 7d 72 2b 3d 31 7d 72 65 74 75 72 6e 20 69 7d 28 65 29 29 2c 69 3d 5b 5d 3b 3b 29 7b 76 61 72 20 6f 3d 72 2e 72 65 61 64 28 29 3b 69 66 28 6f 3d 3d 3d 79 29 62 72 65 Data Ascii: 20&&o<=57343)i.push(65533);else if(o>=55296&&o<=56319)if(r===n-1)i.push(65533);else{var a=t.charCodeAt(r+1);if(a>=56320&&a<=57343){var s=1023&o,c=1023&a;i.push(65536+(s<<10)+c),r+=1}else i.push(65533)}r+=1}return i}(e)),i=[];;){var o=r.read();if(o===y)bre
2025-03-20 14:24:30 UTC	1369	IN	Data Raw: 3d 76 28 6f 29 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 75 6e 77 72 61 70 4b 65 79 22 3a 6c 3d 62 5b 34 5d 2c 75 3d 62 5b 35 5d 2c 68 3d 62 5b 36 5d 2c 62 5b 32 5d 3d 63 2e 5f 6b 65 79 7d 69 66 28 22 67 65 6e 65 72 61 74 65 4b 65 79 22 3d 3d 3d 65 26 26 22 48 4d 41 43 22 3d 3d 3d 6c 2e 6e 61 6d 65 26 26 6c 2e 68 61 73 68 29 72 65 74 75 72 6e 20 6c 2e 6c 65 6e 67 74 68 3d 6c 2e 6c 65 6e 67 74 68 7c 7c 7b 22 53 48 41 2d 31 22 3a 35 31 32 2c 22 53 48 41 2d 32 35 36 22 3a 35 31 32 2c 22 53 48 41 2d 33 38 34 22 3a 31 30 32 34 2c 22 53 48 41 2d 35 31 32 22 3a 31 30 32 34 7d 5b 6c 2e 68 61 73 68 2e 6e 61 6d 65 5d 2c 6e 2e 69 6d 70 6f 72 74 4b 65 79 28 22 72 61 77 22 2c 74 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 Data Ascii: =v(o));break;case"unwrapKey":l=b[4],u=b[5],h=b[6],b[2]=c._key}if("generateKey"===e&&"HMAC"===l.name&&l.hash)return l.length=l.length\|\|{"SHA-1":512,"SHA-256":512,"SHA-384":1024,"SHA-512":1024}[l.hash.name],n.importKey("raw",t.getRandomValues(new Uint8Array
2025-03-20 14:24:30 UTC	1369	IN	Data Raw: 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 48 4d 41 43 22 3d 3d 3d 6c 2e 6e 61 6d 65 26 26 28 6c 2e 6c 65 6e 67 74 68 7c 7c 28 6c 2e 6c 65 6e 67 74 68 3d 38 2a 65 2e 61 6c 67 6f 72 69 74 68 6d 2e 6c 65 6e 67 74 68 29 29 2c 30 3d 3d 6c 2e 6e 61 6d 65 2e 73 65 61 72 63 68 28 22 52 53 41 22 29 26 26 28 6c 2e 6d 6f 64 75 6c 75 73 4c 65 6e 67 74 68 7c 7c 28 6c 2e 6d 6f 64 75 6c 75 73 4c 65 6e 67 74 68 3d 28 65 2e 70 75 62 6c 69 63 4b 65 79 7c 7c 65 29 2e 61 6c 67 6f 72 69 74 68 6d 2e 6d 6f 64 75 6c 75 73 4c 65 6e 67 74 68 29 2c 6c 2e 70 75 62 6c 69 63 45 78 70 6f 6e 65 6e 74 7c 7c 28 6c 2e 70 75 62 6c 69 63 45 78 70 6f 6e 65 6e 74 3d 28 65 2e 70 75 62 6c 69 63 4b 65 79 7c 7c 65 29 2e 61 6c 67 6f 72 69 74 68 6d 2e 70 75 62 6c 69 63 Data Ascii: hen((function(e){return"HMAC"===l.name&&(l.length\|\|(l.length=8*e.algorithm.length)),0==l.name.search("RSA")&&(l.modulusLength\|\|(l.modulusLength=(e.publicKey\|\|e).algorithm.modulusLength),l.publicExponent\|\|(l.publicExponent=(e.publicKey\|\|e).algorithm.public

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:30 UTC	903	OUT	GET /build/assets/app-ae755995.css HTTP/1.1 Host: umqx.wowoffersnow.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: yredir_session=eyJpdiI6IllTVGowWFMvRzNZZGRWaTNrQ2FvVnc9PSIsInZhbHVlIjoiVkJ0emtBR0NjT29leXZzSnptRDZOakN5Q1BtTnV5a1NLZXM4VTBxRmdHbDVST254czNoalhROGZnSnBYczNXUmFHNTBSYlZBdmdHTW4zM2xCMEY4Z1RweDZiRmdPdHovbVRDS01RU1N1RVhEK1lrenU4SmVxUDFiaFp3SFRtc3QiLCJtYWMiOiI2YmYxMjZhZTNjMzUyZmE4ZmE3MzNmMWZkZDZhOGUyOTljOWZlMzc3ZmQ0YzM5Njc1OWUwZTg3MWNmYzA2N2RkIiwidGFnIjoiIn0%3D
2025-03-20 14:24:31 UTC	288	IN	HTTP/1.1 200 OK date: Tue, 18 Mar 2025 12:58:26 GMT content-type: text/css content-length: 39143 server: swoole-http-server x-varnish: 205389 163843 age: 177964 via: 1.1 varnish (Varnish/7.4) accept-ranges: bytes strict-transport-security: max-age=15768000 connection: close
2025-03-20 14:24:31 UTC	16096	IN	Data Raw: 2a 2c 3a 62 65 66 6f 72 65 2c 3a 61 66 74 65 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 30 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 65 35 65 37 65 62 7d 3a 62 65 66 6f 72 65 2c 3a 61 66 74 65 72 7b 2d 2d 74 77 2d 63 6f 6e 74 65 6e 74 3a 20 22 22 7d 68 74 6d 6c 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d 6f 7a 2d 74 61 62 2d 73 69 7a 65 3a 34 3b 2d 6f 2d 74 61 62 2d 73 69 7a 65 3a 34 3b 74 61 62 2d 73 69 7a 65 3a 34 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 49 6e 74 65 72 20 76 61 72 2c 75 69 2d 73 61 6e 73 2d 73 65 72 69 66 2c 73 Data Ascii: *,:before,:after{box-sizing:border-box;border-width:0;border-style:solid;border-color:#e5e7eb}:before,:after{--tw-content: ""}html{line-height:1.5;-webkit-text-size-adjust:100%;-moz-tab-size:4;-o-tab-size:4;tab-size:4;font-family:Inter var,ui-sans-serif,s
2025-03-20 14:24:31 UTC	16384	IN	Data Raw: 69 64 74 68 3a 32 70 78 7d 2e 62 6f 72 64 65 72 2d 62 6c 75 65 2d 36 30 30 7b 2d 2d 74 77 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 3a 20 31 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 28 33 37 20 39 39 20 32 33 35 20 2f 20 76 61 72 28 2d 2d 74 77 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 29 29 7d 2e 62 6f 72 64 65 72 2d 67 72 61 79 2d 32 30 30 7b 2d 2d 74 77 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 3a 20 31 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 28 32 32 39 20 32 33 31 20 32 33 35 20 2f 20 76 61 72 28 2d 2d 74 77 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 29 29 7d 2e 62 6f 72 64 65 72 2d 6e 65 75 74 72 61 6c 2d 32 30 30 7b 2d 2d 74 77 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 3a 20 31 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f Data Ascii: idth:2px}.border-blue-600{--tw-border-opacity: 1;border-color:rgb(37 99 235 / var(--tw-border-opacity))}.border-gray-200{--tw-border-opacity: 1;border-color:rgb(229 231 235 / var(--tw-border-opacity))}.border-neutral-200{--tw-border-opacity: 1;border-colo
2025-03-20 14:24:31 UTC	6663	IN	Data Raw: 63 69 74 79 29 29 7d 2e 61 63 74 69 76 65 5c 3a 6f 70 61 63 69 74 79 2d 38 30 3a 61 63 74 69 76 65 7b 6f 70 61 63 69 74 79 3a 2e 38 7d 2e 61 63 74 69 76 65 5c 3a 73 68 61 64 6f 77 2d 6c 67 3a 61 63 74 69 76 65 7b 2d 2d 74 77 2d 73 68 61 64 6f 77 3a 20 30 20 31 30 70 78 20 31 35 70 78 20 2d 33 70 78 20 72 67 62 28 30 20 30 20 30 20 2f 20 2e 31 29 2c 20 30 20 34 70 78 20 36 70 78 20 2d 34 70 78 20 72 67 62 28 30 20 30 20 30 20 2f 20 2e 31 29 3b 2d 2d 74 77 2d 73 68 61 64 6f 77 2d 63 6f 6c 6f 72 65 64 3a 20 30 20 31 30 70 78 20 31 35 70 78 20 2d 33 70 78 20 76 61 72 28 2d 2d 74 77 2d 73 68 61 64 6f 77 2d 63 6f 6c 6f 72 29 2c 20 30 20 34 70 78 20 36 70 78 20 2d 34 70 78 20 76 61 72 28 2d 2d 74 77 2d 73 68 61 64 6f 77 2d 63 6f 6c 6f 72 29 3b 62 6f 78 2d 73 68 Data Ascii: city))}.active\:opacity-80:active{opacity:.8}.active\:shadow-lg:active{--tw-shadow: 0 10px 15px -3px rgb(0 0 0 / .1), 0 4px 6px -4px rgb(0 0 0 / .1);--tw-shadow-colored: 0 10px 15px -3px var(--tw-shadow-color), 0 4px 6px -4px var(--tw-shadow-color);box-sh

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:31 UTC	564	OUT	GET /scripts/push/script/oldw7nlgzn?url=default HTTP/1.1 Host: trk-consulatu.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:31 UTC	1342	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:31 GMT Content-Type: application/javascript;charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: 0 Cache-Control: no-cache, no-store, max-age=0, must-revalidate X-XSS-Protection: 1; mode=block Pragma: no-cache X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data: Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers vary: accept-encoding X-Content-Type-Options: nosniff Permissions-Policy: camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F0uzhF8x7f8Xfq%2FbwOf4%2FXGnvNknkdAqrnc5EwlIL7OmdsGcN3ELnuQ5EU%2FHCSDv7DcWOlEKmNSXdGsjqkQ%2B0kIDeZosDPNAWuzI1C%2BCs3dPg%2BzmsRuLi4QeYQz%2BJW05gyH%2BeA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare
2025-03-20 14:24:31 UTC	280	IN	Data Raw: 43 46 2d 52 41 59 3a 20 39 32 33 35 64 66 61 36 64 66 31 63 38 63 35 37 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 30 31 31 32 35 26 6d 69 6e 5f 72 74 74 3d 31 30 30 30 36 33 26 72 74 74 5f 76 61 72 3d 32 32 37 30 37 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 34 32 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 33 36 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 36 30 36 38 26 63 77 6e 64 3d 31 38 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 34 38 30 39 31 32 38 Data Ascii: CF-RAY: 9235dfa6df1c8c57-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=101125&min_rtt=100063&rtt_var=22707&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1136&delivery_rate=36068&cwnd=181&unsent_bytes=0&cid=4809128
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 31 66 65 35 0d 0a 27 75 73 65 20 73 74 72 69 63 74 27 3b 63 6f 6e 73 74 20 73 6d 50 75 73 68 41 70 70 6c 69 63 61 74 69 6f 6e 53 65 72 76 65 72 50 75 62 6c 69 63 4b 65 79 3d 22 42 50 50 43 75 7a 32 75 63 46 6f 4e 4d 44 6c 79 74 30 56 44 65 57 53 79 48 4b 2d 64 56 44 68 79 66 42 74 72 51 4f 5f 46 4a 5a 2d 65 33 38 34 4c 73 64 73 61 5a 32 46 42 55 4c 76 72 54 75 35 69 64 2d 49 6f 32 7a 54 4a 6b 33 6c 67 72 67 43 48 39 5a 56 34 4b 41 38 3d 22 2c 73 6d 50 75 73 68 53 69 74 65 49 64 3d 22 6c 6d 64 7a 78 72 30 33 65 6b 22 2c 73 6d 43 6c 69 65 6e 74 49 64 3d 22 6f 6c 64 77 37 6e 6c 67 7a 6e 22 2c 73 65 72 76 69 63 65 57 6f 72 6b 65 72 3d 22 2f 70 75 73 68 5f 6e 61 69 5f 73 65 72 76 69 63 65 2d 77 6f 72 6b 65 72 2e 6a 73 3f 73 65 67 6d 65 6e 74 3d 64 65 66 61 75 Data Ascii: 1fe5'use strict';const smPushApplicationServerPublicKey="BPPCuz2ucFoNMDlyt0VDeWSyHK-dVDhyfBtrQO_FJZ-e384LsdsaZ2FBULvrTu5id-Io2zTJk3lgrgCH9ZV4KA8=",smPushSiteId="lmdzxr03ek",smClientId="oldw7nlgzn",serviceWorker="/push_nai_service-worker.js?segment=defau
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 61 6d 70 61 69 67 6e 2c 62 2e 75 74 6d 5f 63 61 6d 70 61 69 67 6e 29 2c 61 2e 73 6f 75 72 63 65 4f 6e 65 3d 73 65 74 49 66 4e 75 6c 6c 28 75 74 6d 4f 62 6a 2e 73 6f 75 72 63 65 5f 6f 6e 65 2c 62 2e 73 6f 75 72 63 65 5f 6f 6e 65 29 2c 61 2e 73 6f 75 72 63 65 54 77 6f 3d 73 65 74 49 66 4e 75 6c 6c 28 75 74 6d 4f 62 6a 2e 73 6f 75 72 63 65 5f 74 77 6f 2c 62 2e 73 6f 75 72 63 65 5f 74 77 6f 29 2c 61 2e 73 6f 75 72 63 65 54 68 72 65 65 3d 73 65 74 49 66 4e 75 6c 6c 28 75 74 6d 4f 62 6a 2e 73 6f 75 72 63 65 5f 74 68 72 65 65 2c 62 2e 73 6f 75 72 63 65 5f 74 68 72 65 65 29 2c 61 2e 73 6f 75 72 63 65 46 6f 75 72 3d 73 65 74 49 66 4e 75 6c 6c 28 75 74 6d 4f 62 6a 2e 73 6f 75 72 63 65 5f 66 6f 75 72 2c 62 2e 73 6f 75 72 63 65 5f 66 6f 75 72 29 2c 61 2e 73 6f 75 72 Data Ascii: ampaign,b.utm_campaign),a.sourceOne=setIfNull(utmObj.source_one,b.source_one),a.sourceTwo=setIfNull(utmObj.source_two,b.source_two),a.sourceThree=setIfNull(utmObj.source_three,b.source_three),a.sourceFour=setIfNull(utmObj.source_four,b.source_four),a.sour
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 65 79 29 3b 72 65 74 75 72 6e 20 6c 6f 67 50 75 73 68 45 76 65 6e 74 28 22 73 75 62 73 63 72 69 62 65 5f 70 72 6f 6d 70 74 22 2c 22 73 75 62 73 63 72 69 62 65 5f 70 72 6f 6d 70 74 22 2c 76 65 72 73 69 6f 6e 29 2c 61 2e 70 75 73 68 4d 61 6e 61 67 65 72 2e 73 75 62 73 63 72 69 62 65 28 7b 75 73 65 72 56 69 73 69 62 6c 65 4f 6e 6c 79 3a 21 30 2c 61 70 70 6c 69 63 61 74 69 6f 6e 53 65 72 76 65 72 4b 65 79 3a 62 7d 29 7d 22 64 65 6e 69 65 64 22 3d 3d 3d 4e 6f 74 69 66 69 63 61 74 69 6f 6e 2e 70 65 72 6d 69 73 73 69 6f 6e 26 26 6c 6f 67 50 75 73 68 45 76 65 6e 74 28 22 64 65 6e 69 65 64 5f 69 6d 70 72 65 73 73 69 6f 6e 22 2c 22 64 65 6e 69 65 64 5f 69 6d 70 72 65 73 73 69 6f 6e 22 2c 76 65 72 73 69 6f 6e 29 7d 29 2e 63 61 74 63 68 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ey);return logPushEvent("subscribe_prompt","subscribe_prompt",version),a.pushManager.subscribe({userVisibleOnly:!0,applicationServerKey:b})}"denied"===Notification.permission&&logPushEvent("denied_impression","denied_impression",version)}).catch(function(
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 73 69 6f 6e 29 7d 29 2e 63 61 74 63 68 28 61 3d 3e 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 74 61 62 6f 6f 6c 61 55 72 6c 20 66 65 74 63 68 20 65 72 72 6f 72 22 2c 61 29 2c 6c 6f 67 50 75 73 68 45 76 65 6e 74 28 22 74 61 62 6f 6f 6c 61 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 22 2c 61 2c 76 65 72 73 69 6f 6e 29 7d 29 7d 29 7d 29 2e 63 61 74 63 68 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 53 65 72 76 69 63 65 20 57 6f 72 6b 65 72 20 45 72 72 6f 72 22 2c 61 29 2c 70 75 73 68 4c 6f 67 67 69 6e 67 26 26 6c 6f 67 50 75 73 68 45 76 65 6e 74 28 22 65 72 72 6f 72 5f 73 75 62 73 63 72 69 62 69 6e 67 22 2c 61 2c 76 65 72 73 69 6f 6e 29 7d 29 7d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 70 75 73 68 5f 73 75 62 73 63 72 69 62 65 Data Ascii: sion)}).catch(a=>{console.log("taboolaUrl fetch error",a),logPushEvent("taboola_request_error",a,version)})})}).catch(function(a){console.error("Service Worker Error",a),pushLogging&&logPushEvent("error_subscribing",a,version)})}})}function push_subscribe
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 76 69 63 65 20 57 6f 72 6b 65 72 20 45 72 72 6f 72 22 2c 61 29 2c 70 75 73 68 4c 6f 67 67 69 6e 67 26 26 6c 6f 67 50 75 73 68 45 76 65 6e 74 28 22 65 72 72 6f 72 5f 73 75 62 73 63 72 69 62 69 6e 67 22 2c 61 2c 76 65 72 73 69 6f 6e 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 73 65 74 49 66 4e 75 6c 6c 28 63 2c 61 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 63 7c 7c 6e 75 6c 6c 3d 3d 3d 63 7c 7c 22 22 3d 3d 3d 63 3f 61 3a 63 7d 66 75 6e 63 74 69 6f 6e 20 6c 6f 67 50 75 73 68 45 76 65 6e 74 28 61 2c 62 2c 63 29 7b 6c 65 74 20 64 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 62 29 3b 22 7b 7d 22 21 3d 3d 64 26 26 28 62 3d 64 29 3b 6c 65 74 20 65 3d 7b 7d 3b 70 75 6c 6c 55 72 6c 50 61 72 61 6d 73 28 65 29 2c 65 2e 6d 65 73 73 61 67 65 3d 62 2c 65 2e 76 Data Ascii: vice Worker Error",a),pushLogging&&logPushEvent("error_subscribing",a,version)})}function setIfNull(c,a){return void 0===c\|\|null===c\|\|""===c?a:c}function logPushEvent(a,b,c){let d=JSON.stringify(b);"{}"!==d&&(b=d);let e={};pullUrlParams(e),e.message=b,e.v
2025-03-20 14:24:31 UTC	1328	IN	Data Raw: 74 69 6f 6e 20 73 65 74 53 65 73 73 69 6f 6e 49 64 28 61 29 7b 22 73 65 72 76 69 63 65 57 6f 72 6b 65 72 22 69 6e 20 6e 61 76 69 67 61 74 6f 72 26 26 22 50 75 73 68 4d 61 6e 61 67 65 72 22 69 6e 20 77 69 6e 64 6f 77 26 26 28 73 65 73 73 69 6f 6e 49 64 3d 61 29 7d 66 75 6e 63 74 69 6f 6e 20 73 65 74 55 74 6d 28 61 29 7b 22 73 65 72 76 69 63 65 57 6f 72 6b 65 72 22 69 6e 20 6e 61 76 69 67 61 74 6f 72 26 26 22 50 75 73 68 4d 61 6e 61 67 65 72 22 69 6e 20 77 69 6e 64 6f 77 26 26 6e 75 6c 6c 21 3d 61 26 26 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 75 74 6d 4f 62 6a 2c 61 29 7d 66 75 6e 63 74 69 6f 6e 20 67 65 74 53 65 73 73 69 6f 6e 49 64 28 29 7b 72 65 74 75 72 6e 20 73 65 73 73 69 6f 6e 49 64 7d 66 75 6e 63 74 69 6f 6e 20 67 65 74 55 72 6c 56 61 72 73 28 29 Data Ascii: tion setSessionId(a){"serviceWorker"in navigator&&"PushManager"in window&&(sessionId=a)}function setUtm(a){"serviceWorker"in navigator&&"PushManager"in window&&null!=a&&Object.assign(utmObj,a)}function getSessionId(){return sessionId}function getUrlVars()
2025-03-20 14:24:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:31 UTC	762	OUT	GET /captcha/v1/14dbe0f1619b8014e2630bcdde727e7785a80dee/static/hcaptcha.html HTTP/1.1 Host: newassets.hcaptcha.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:31 UTC	572	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 vary: accept-encoding vary: Origin alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Security-Policy: report-uri https://sentry.hcaptcha.com/api/6/security/?sentry_key=30910f52569b4c17b1081ead2dae43b4&sentry_environment=prod&sentry_release=csp1; Server: cloudflare CF-RAY: 9235dfa789e0e55d-EWR
2025-03-20 14:24:31 UTC	797	IN	Data Raw: 37 64 35 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 69 64 3d 22 68 63 61 70 74 63 68 61 2d 66 72 61 6d 65 2d 31 34 64 62 65 30 66 31 36 31 39 62 38 30 31 34 65 32 36 33 30 62 63 64 64 65 37 32 37 65 37 37 38 35 61 38 30 64 65 65 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 68 43 61 70 74 63 68 61 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d Data Ascii: 7d58<!DOCTYPE html><html lang="en" data-id="hcaptcha-frame-14dbe0f1619b8014e2630bcdde727e7785a80dee"><head> <title>hCaptcha</title> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta http-equiv="Content-
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 32 30 70 78 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 2c 69 6e 70 75 74 3a 66 6f 63 75 73 2c 73 65 6c 65 63 74 3a 66 6f 63 75 73 2c 74 65 78 74 61 72 65 61 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 30 7d 3a 66 6f 63 75 73 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 30 7d 74 65 78 74 61 72 65 61 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 6f 75 74 6c 69 6e 65 3a 30 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 72 65 73 69 7a 65 3a 6e 6f 6e 65 7d 2e 6e 6f 2d 73 65 6c 65 63 74 69 Data Ascii: n:0;padding:15px 20px;border:none}button:focus,input:focus,select:focus,textarea:focus{outline:0}:focus{border:none;outline:0}textarea{border:none;overflow:auto;outline:0;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;resize:none}.no-selecti
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 69 66 28 21 74 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 74 79 70 65 6f 66 20 74 2b 22 20 22 2b 74 2b 22 20 69 73 20 6e 6f 74 20 69 74 65 72 61 62 6c 65 28 63 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 79 20 53 79 6d 62 6f 6c 28 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 29 29 22 29 29 3b 76 61 72 20 69 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 29 3b 69 66 28 30 3d 3d 3d 69 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 28 5b 5d 29 3b 76 61 72 20 72 3d 69 2e 6c 65 6e 67 74 68 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 74 2c 6e 29 7b 69 66 28 6e 26 26 28 22 6f 62 6a 65 63 74 22 3d 3d 74 Data Ascii: if(!t\|\|"undefined"==typeof t.length)return n(new TypeError(typeof t+" "+t+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var i=Array.prototype.slice.call(t);if(0===i.length)return e([]);var r=i.length;function o(t,n){if(n&&("object"==t
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 20 69 6e 73 74 61 6e 63 65 6f 66 20 73 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 68 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 76 6f 69 64 20 66 28 28 69 3d 6e 2c 72 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 68 28 74 29 7d 63 61 74 63 68 28 6f 29 7b 63 28 74 2c 6f 29 7d 76 61 72 20 69 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 63 28 74 2c 65 29 7b 74 2e 5f 73 74 61 74 65 3d 32 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 68 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 74 29 7b 32 3d 3d 3d 74 2e 5f 73 74 61 Data Ascii: instanceof s)return t._state=3,t._value=e,void h(t);if("function"==typeof n)return void f((i=n,r=e,function(){i.apply(r,arguments)}),t)}t._state=1,t._value=e,h(t)}catch(o){c(t,o)}var i,r}function c(t,e){t._state=2,t._value=e,h(t)}function h(t){2===t._sta
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 3d 3d 3d 73 3f 74 3a 6e 65 77 20 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 29 7d 29 29 7d 2c 73 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 28 74 29 7d 29 29 7d 2c 73 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 72 28 74 29 29 72 65 74 75 72 6e 20 6e 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 2e 72 61 63 65 20 61 63 63 65 70 74 73 20 61 6e 20 61 72 72 61 79 22 29 29 3b 66 6f 72 28 76 61 72 20 69 3d 30 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3b 69 3c 6f 3b 69 2b 2b 29 73 2e 72 65 73 6f 6c 76 65 28 74 5b 69 5d 29 2e 74 68 Data Ascii: ===s?t:new s((function(e){e(t)}))},s.reject=function(t){return new s((function(e,n){n(t)}))},s.race=function(t){return new s((function(e,n){if(!r(t))return n(new TypeError("Promise.race accepts an array"));for(var i=0,o=t.length;i<o;i++)s.resolve(t[i]).th
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 72 72 61 79 28 74 29 29 66 6f 72 28 76 61 72 20 65 3d 74 3b 65 2e 6c 65 6e 67 74 68 3b 29 74 68 69 73 2e 74 6f 6b 65 6e 73 2e 75 6e 73 68 69 66 74 28 65 2e 73 68 69 66 74 28 29 29 3b 65 6c 73 65 20 74 68 69 73 2e 74 6f 6b 65 6e 73 2e 75 6e 73 68 69 66 74 28 74 29 7d 7d 3b 76 61 72 20 76 3d 2d 31 3b 66 75 6e 63 74 69 6f 6e 20 77 28 74 2c 65 29 7b 69 66 28 74 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 44 65 63 6f 64 65 72 20 65 72 72 6f 72 22 29 3b 72 65 74 75 72 6e 20 65 7c 7c 36 35 35 33 33 7d 66 75 6e 63 74 69 6f 6e 20 78 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 53 74 72 69 6e 67 28 74 29 2e 74 72 69 6d 28 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 Data Ascii: rray(t))for(var e=t;e.length;)this.tokens.unshift(e.shift());else this.tokens.unshift(t)}};var v=-1;function w(t,e){if(t)throw TypeError("Decoder error");return e\|\|65533}function x(t){return t=String(t).trim().toLowerCase(),Object.prototype.hasOwnProperty
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 22 29 3b 65 3d 6d 28 65 29 2c 74 68 69 73 2e 5f 65 6e 63 6f 64 69 6e 67 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 65 6e 63 6f 64 65 72 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c 75 73 68 3d 21 31 2c 74 68 69 73 2e 5f 66 61 74 61 6c 3d 65 2e 66 61 74 61 6c 3f 22 66 61 74 61 6c 22 3a 22 72 65 70 6c 61 63 65 6d 65 6e 74 22 3b 76 61 72 20 6e 3d 74 68 69 73 3b 69 66 28 65 2e 4e 4f 4e 53 54 41 4e 44 41 52 44 5f 61 6c 6c 6f 77 4c 65 67 61 63 79 45 6e 63 6f 64 69 6e 67 29 7b 76 61 72 20 69 3d 78 28 74 3d 74 21 3d 3d 75 6e 64 65 66 69 6e 65 64 3f 53 74 72 69 6e 67 28 74 29 3a 56 29 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 69 7c 7c 22 72 65 70 6c 61 63 65 6d 65 6e 74 22 3d 3d 3d 69 2e 6e 61 6d 65 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 6e Data Ascii: ");e=m(e),this._encoding=null,this._encoder=null,this._do_not_flush=!1,this._fatal=e.fatal?"fatal":"replacement";var n=this;if(e.NONSTANDARD_allowLegacyEncoding){var i=x(t=t!==undefined?String(t):V);if(null===i\|\|"replacement"===i.name)throw RangeError("Un
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 61 74 61 6c 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 66 61 74 61 6c 22 3d 3d 3d 74 68 69 73 2e 5f 65 72 72 6f 72 5f 6d 6f 64 65 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 2e 70 72 6f 74 6f 74 79 70 65 2c 22 69 67 6e 6f 72 65 42 4f 4d 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 67 6e 6f 72 65 42 4f 4d 7d 7d 29 29 2c 53 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3b 6e 3d 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 Data Ascii: t.defineProperty(S.prototype,"fatal",{get:function(){return"fatal"===this._error_mode}}),Object.defineProperty(S.prototype,"ignoreBOM",{get:function(){return this._ignoreBOM}})),S.prototype.decode=function(t,e){var n;n="object"==typeof t&&t instanceof Arr
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 63 6f 64 69 6e 67 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 65 6e 63 6f 64 69 6e 67 2e 6e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 7d 29 2c 41 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 3d 74 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 3f 22 22 3a 53 74 72 69 6e 67 28 74 29 2c 65 3d 6d 28 65 29 2c 74 68 69 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c 75 73 68 7c 7c 28 74 68 69 73 2e 5f 65 6e 63 6f 64 65 72 3d 5f 5b 74 68 69 73 2e 5f 65 6e 63 6f 64 69 6e 67 2e 6e 61 6d 65 5d 28 7b 66 61 74 61 6c 3a 22 66 61 74 61 6c 22 3d 3d 3d 74 68 69 73 2e 5f 66 61 74 61 6c 7d 29 29 2c 74 68 69 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c Data Ascii: prototype,"encoding",{get:function(){return this._encoding.name.toLowerCase()}}),A.prototype.encode=function(t,e){t=t===undefined?"":String(t),e=m(e),this._do_not_flush\|\|(this._encoder=_[this._encoding.name]({fatal:"fatal"===this._fatal})),this._do_not_fl
2025-03-20 14:24:31 UTC	1369	IN	Data Raw: 49 68 76 63 4e 41 51 45 42 3a 22 31 2e 32 2e 38 34 30 2e 31 31 33 35 34 39 2e 31 2e 31 2e 31 22 7d 2c 63 3d 7b 22 31 2e 32 2e 38 34 30 2e 31 31 33 35 34 39 2e 31 2e 31 2e 31 22 3a 22 4b 6f 5a 49 68 76 63 4e 41 51 45 42 22 7d 3b 69 66 28 5b 22 67 65 6e 65 72 61 74 65 4b 65 79 22 2c 22 69 6d 70 6f 72 74 4b 65 79 22 2c 22 75 6e 77 72 61 70 4b 65 79 22 5d 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 69 3d 6e 5b 74 5d 3b 6e 5b 74 5d 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 6f 2c 6c 29 7b 76 61 72 20 63 2c 68 2c 75 2c 70 2c 77 3d 5b 5d 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 29 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 22 67 65 6e 65 72 61 74 65 4b 65 79 22 3a 63 3d 6d 28 72 29 2c 68 3d 6f 2c 75 3d 6c 3b 62 Data Ascii: IhvcNAQEB:"1.2.840.113549.1.1.1"},c={"1.2.840.113549.1.1.1":"KoZIhvcNAQEB"};if(["generateKey","importKey","unwrapKey"].forEach((function(t){var i=n[t];n[t]=function(r,o,l){var c,h,u,p,w=[].slice.call(arguments);switch(t){case"generateKey":c=m(r),h=o,u=l;b

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Windows Analysis Report
http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:32 UTC	832	OUT	GET /push_nai_service-worker.js?segment=default HTTP/1.1 Host: umqx.wowoffersnow.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: yredir_session=eyJpdiI6IllTVGowWFMvRzNZZGRWaTNrQ2FvVnc9PSIsInZhbHVlIjoiVkJ0emtBR0NjT29leXZzSnptRDZOakN5Q1BtTnV5a1NLZXM4VTBxRmdHbDVST254czNoalhROGZnSnBYczNXUmFHNTBSYlZBdmdHTW4zM2xCMEY4Z1RweDZiRmdPdHovbVRDS01RU1N1RVhEK1lrenU4SmVxUDFiaFp3SFRtc3QiLCJtYWMiOiI2YmYxMjZhZTNjMzUyZmE4ZmE3MzNmMWZkZDZhOGUyOTljOWZlMzc3ZmQ0YzM5Njc1OWUwZTg3MWNmYzA2N2RkIiwidGFnIjoiIn0%3D
2025-03-20 14:24:32 UTC	399	IN	HTTP/1.1 200 OK date: Tue, 18 Mar 2025 12:58:48 GMT content-type: application/javascript cache-control: no-cache, private x-redir: true server: swoole-http-server service-worker-allowed: / vary: Accept-Encoding x-varnish: 439398 294933 age: 177943 via: 1.1 varnish (Varnish/7.4) accept-ranges: bytes content-length: 490 strict-transport-security: max-age=15768000 connection: close
2025-03-20 14:24:32 UTC	490	IN	Data Raw: 65 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 70 2c 61 2c 63 2c 6b 2c 65 2c 64 29 7b 65 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 63 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 7d 3b 69 66 28 21 27 27 2e 72 65 70 6c 61 63 65 28 2f 5e 2f 2c 53 74 72 69 6e 67 29 29 7b 77 68 69 6c 65 28 63 2d 2d 29 7b 64 5b 63 2e 74 6f 53 74 72 69 6e 67 28 61 29 5d 3d 6b 5b 63 5d 7c 7c 63 2e 74 6f 53 74 72 69 6e 67 28 61 29 7d 6b 3d 5b 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 64 5b 65 5d 7d 5d 3b 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 27 5c 5c 77 2b 27 7d 3b 63 3d 31 7d 3b 77 68 69 6c 65 28 63 2d 2d 29 7b 69 66 28 6b 5b 63 5d 29 7b 70 3d 70 2e 72 65 70 6c 61 63 65 28 6e 65 77 20 52 65 67 45 78 70 28 27 5c 5c 62 27 2b 65 28 63 29 2b Data Ascii: eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]\|\|c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:32 UTC	805	OUT	POST /checksiteconfig?v=14dbe0f1619b8014e2630bcdde727e7785a80dee&host=umqx.wowoffersnow.com&sitekey=8de8f782-dd76-4e4a-8634-8ae26a466578&sc=1&swa=1&spst=1 HTTP/1.1 Host: api.hcaptcha.com Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain sec-ch-ua-mobile: ?0 Origin: https://newassets.hcaptcha.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://newassets.hcaptcha.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:32 UTC	587	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:32 GMT Content-Type: application/json Content-Length: 776 Connection: close Access-Control-Allow-Origin: https://newassets.hcaptcha.com Vary: Origin, Accept-Encoding Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Cache-Control, Content-Type, DNT, Referer, User-Agent Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9235dfad9ebc7cac-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 14:24:32 UTC	776	IN	Data Raw: 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 65 6e 63 5f 67 65 74 5f 72 65 71 22 3a 74 72 75 65 7d 2c 22 63 22 3a 7b 22 74 79 70 65 22 3a 22 68 73 77 22 2c 22 72 65 71 22 3a 22 65 79 4a 30 65 58 41 69 4f 69 4a 4b 56 31 51 69 4c 43 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 4a 39 2e 65 79 4a 6d 49 6a 6f 77 4c 43 4a 7a 49 6a 6f 79 4c 43 4a 30 49 6a 6f 69 64 79 49 73 49 6d 51 69 4f 69 4a 72 4c 30 5a 6c 53 46 42 4e 63 55 31 73 65 55 46 54 62 44 52 46 57 6d 74 6d 4d 6e 4a 53 51 53 39 34 4d 45 52 6f 64 48 59 31 53 56 4a 69 56 46 70 50 52 56 4e 52 65 6e 5a 50 4d 56 70 72 54 6a 52 54 53 33 5a 34 4d 6b 6c 45 57 69 39 6a 64 31 56 56 62 58 56 71 57 57 4a 71 5a 6e 59 79 63 6a 52 49 4d 58 68 6c 54 48 45 35 56 44 5a 70 4c 32 45 33 53 47 64 71 63 6b 39 55 4d 33 6f 77 Data Ascii: {"features":{"enc_get_req":true},"c":{"type":"hsw","req":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmIjowLCJzIjoyLCJ0IjoidyIsImQiOiJrL0ZlSFBNcU1seUFTbDRFWmtmMnJSQS94MERodHY1SVJiVFpPRVNRenZPMVprTjRTS3Z4MklEWi9jd1VVbXVqWWJqZnYycjRIMXhlTHE5VDZpL2E3SGdqck9UM3ow

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:32 UTC	499	OUT	GET /scripts/ext/script/oldw7nlgzn?url=default HTTP/1.1 Host: trk-consulatu.com Connection: keep-alive Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://umqx.wowoffersnow.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:33 UTC	1364	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:33 GMT Content-Type: application/javascript;charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: 0 Cache-Control: no-cache, no-store, max-age=0, must-revalidate X-XSS-Protection: 1; mode=block Pragma: no-cache X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data: Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers vary: accept-encoding X-Content-Type-Options: nosniff Permissions-Policy: camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3swC69IEtrYtmowYzrzKtEUv%2FAdzpGVf%2Br3uL5Cq43XtKqYf9g2uG12GiXWxr4xVh23nNTGBldSMiA7vHyjQsrsn5hDKpC%2BpTJeKLtMYCL5G2eR1IQmRUcopzbWM0rrJr%2Bb0Dw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9235dfaeaf190ee6-EWR
2025-03-20 14:24:33 UTC	250	IN	Data Raw: 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 30 34 34 36 36 26 6d 69 6e 5f 72 74 74 3d 31 30 32 38 37 38 26 72 74 74 5f 76 61 72 3d 32 33 33 31 35 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 34 33 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 37 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 36 31 38 34 26 63 77 6e 64 3d 32 32 36 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 35 61 38 32 66 34 66 34 39 66 61 62 35 31 34 39 26 74 73 3d 32 37 33 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=104466&min_rtt=102878&rtt_var=23315&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1071&delivery_rate=36184&cwnd=226&unsent_bytes=0&cid=5a82f4f49fab5149&ts=273&x=0"
2025-03-20 14:24:33 UTC	1124	IN	Data Raw: 31 66 35 31 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 61 29 7b 74 72 79 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 3d 45 7d 63 61 74 63 68 28 61 29 7b 7d 45 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 61 29 7b 69 66 28 73 65 6c 66 2e 69 6e 64 65 78 65 64 44 42 29 7b 76 61 72 20 62 3d 47 2e 61 70 70 6c 79 28 73 65 6c 66 2e 69 6e 64 65 78 65 64 44 42 2c 5b 22 70 75 73 68 50 6c 61 74 46 6f 72 6d 44 62 22 2c 32 5d 29 3b 62 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 65 72 72 6f 72 20 64 62 22 2b 62 2e 65 72 72 6f 72 29 2c 61 28 6e 75 6c 6c 29 7d 2c 62 2e 6f 6e 73 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 63 3d 62 2e 72 65 73 75 6c 74 2c 64 3d 63 Data Ascii: 1f51(function(a,b){function c(a){try{console.log=E}catch(a){}E(a)}function d(a){if(self.indexedDB){var b=G.apply(self.indexedDB,["pushPlatFormDb",2]);b.onerror=function(){console.log("error db"+b.error),a(null)},b.onsuccess=function(){var c=b.result,d=c
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 30 2c 6f 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 44 61 74 65 2e 6e 6f 77 28 29 2f 31 65 33 29 3b 64 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 69 66 28 6e 75 6c 6c 21 3d 64 29 7b 64 2e 67 65 74 28 22 70 75 73 68 53 75 62 73 63 72 69 70 74 69 6f 6e 49 64 22 29 2e 6f 6e 73 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 29 74 72 79 7b 62 3d 61 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 61 29 7b 69 28 22 65 78 74 5f 64 62 5f 65 72 72 6f 72 22 2c 61 2c 6d 29 7d 7d 2c 64 2e 67 65 74 28 22 73 65 67 22 29 2e 6f 6e 73 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 29 74 72 79 7b 63 3d 61 2e 74 61 72 67 65 74 Data Ascii: 0,o=Math.floor(Date.now()/1e3);d(function(d){if(null!=d){d.get("pushSubscriptionId").onsuccess=function(a){if(a.target.result)try{b=a.target.result.value}catch(a){i("ext_db_error",a,m)}},d.get("seg").onsuccess=function(a){if(a.target.result)try{c=a.target
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 61 70 69 2e 74 61 62 6f 6f 6c 61 2e 63 6f 6d 2f 32 2e 30 2f 6a 73 6f 6e 2f 22 2b 62 5b 30 5d 2b 22 2f 72 65 63 6f 6d 6d 65 6e 64 61 74 69 6f 6e 73 2e 6e 6f 74 69 66 79 2d 22 2b 63 2b 22 3f 61 70 70 2e 74 79 70 65 3d 77 65 62 26 61 70 70 2e 61 70 69 6b 65 79 3d 64 64 38 33 65 31 35 35 33 33 39 63 33 63 34 36 32 36 61 31 61 33 65 38 34 36 35 62 35 30 64 62 33 30 32 34 62 34 31 32 26 72 65 73 70 6f 6e 73 65 2e 69 64 3d 22 2b 62 5b 31 5d 3b 66 65 74 63 68 28 64 29 2e 74 68 65 6e 28 28 29 3d 3e 7b 7d 29 2e 63 61 74 63 68 28 28 29 3d 3e 7b 69 28 22 65 78 74 5f 65 72 72 6f 72 5f 66 65 74 63 68 69 6e 67 5f 70 69 78 65 6c 22 2c 65 72 72 6f 72 2c 6d 29 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 69 28 61 2c 62 2c 63 29 7b 6c 65 74 20 64 3b 74 72 Data Ascii: https://api.taboola.com/2.0/json/"+b[0]+"/recommendations.notify-"+c+"?app.type=web&app.apikey=dd83e155339c3c4626a1a3e8465b50db3024b412&response.id="+b[1];fetch(d).then(()=>{}).catch(()=>{i("ext_error_fetching_pixel",error,m)})}}function i(a,b,c){let d;tr
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 79 70 65 2e 6f 70 65 6e 2c 48 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 61 70 70 6c 79 3b 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 52 65 73 70 6f 6e 73 65 2e 70 72 6f 74 6f 74 79 70 65 29 2c 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 29 2c 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 2c 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 5f 64 65 66 69 6e 65 47 65 74 74 65 72 5f 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 5f 64 65 66 69 6e 65 47 65 74 74 65 72 5f 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 6c 65 74 20 49 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b Data Ascii: ype.open,H=Function.prototype.apply;Object.freeze(Response.prototype),Object.freeze(Function.prototype),Object.freeze=function(a){return a},Array.prototype.__defineGetter__=function(){},Object.prototype.__defineGetter__=function(){};let I=function(a,b,c){
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 69 6f 6e 28 63 29 7b 6c 65 74 20 64 3d 62 28 63 2e 61 63 74 69 6f 6e 73 2c 21 30 29 7c 7c 5b 5d 3b 65 26 26 6e 75 6c 6c 21 3d 3d 65 7c 7c 28 65 3d 22 22 29 2c 63 2e 72 65 64 69 72 65 63 74 3d 63 2e 72 65 64 69 72 65 63 74 2e 69 6e 63 6c 75 64 65 73 28 22 3f 22 29 3f 63 2e 72 65 64 69 72 65 63 74 2b 22 26 68 3d 22 2b 65 2b 22 26 76 3d 22 2b 6d 3a 63 2e 72 65 64 69 72 65 63 74 2b 22 3f 68 3d 22 2b 65 2b 22 26 76 3d 22 2b 6d 2c 63 2e 69 63 6f 6e 26 26 63 2e 69 63 6f 6e 2e 69 6e 63 6c 75 64 65 73 28 22 3f 22 29 3f 63 2e 69 63 6f 6e 3d 63 2e 69 63 6f 6e 2b 22 26 68 3d 22 2b 65 2b 22 26 76 3d 22 2b 6d 3a 63 2e 69 63 6f 6e 26 26 28 63 2e 69 63 6f 6e 3d 63 2e 69 63 6f 6e 2b 22 3f 68 3d 22 2b 65 2b 22 26 76 3d 22 2b 6d 29 3b 6c 65 74 20 66 3d 7b 74 69 74 6c 65 3a Data Ascii: ion(c){let d=b(c.actions,!0)\|\|[];e&&null!==e\|\|(e=""),c.redirect=c.redirect.includes("?")?c.redirect+"&h="+e+"&v="+m:c.redirect+"?h="+e+"&v="+m,c.icon&&c.icon.includes("?")?c.icon=c.icon+"&h="+e+"&v="+m:c.icon&&(c.icon=c.icon+"?h="+e+"&v="+m);let f={title:
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 79 3b 65 6c 73 65 20 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 72 2e 73 72 63 31 3d 22 6c 6d 64 7a 78 72 30 33 65 6b 22 2c 72 2e 75 73 65 72 41 67 65 6e 74 3d 41 2c 72 2e 69 70 3d 22 72 65 71 22 2c 72 2e 70 75 62 49 64 3d 6c 2c 72 2e 76 3d 6d 2c 72 2e 75 73 65 72 53 65 67 6d 65 6e 74 3d 66 2c 72 2e 61 64 41 70 69 53 65 73 73 69 6f 6e 49 64 73 3d 67 2c 72 2e 70 75 73 68 41 70 69 41 64 49 64 73 3d 68 2c 72 2e 65 78 74 41 70 69 41 64 49 64 73 3d 6a 2c 72 2e 75 74 6d 48 61 73 68 3d 6e 2c 72 2e 75 73 65 72 49 64 3d 6f 2c 73 65 6c 66 2e 65 70 76 7a 48 51 3d 70 2c 73 65 6c 66 2e 65 70 76 7a 48 51 28 22 68 74 74 70 73 3a 2f 2f 22 2b 22 65 78 74 65 6e 73 69 6f 6e 2e 74 72 6b 2d 63 6f 6e 73 75 6c 61 74 75 2e 63 6f 6d 22 2b 22 2f 61 64 73 2d 61 70 69 2f 65 78 74 2d Data Ascii: y;else return;return r.src1="lmdzxr03ek",r.userAgent=A,r.ip="req",r.pubId=l,r.v=m,r.userSegment=f,r.adApiSessionIds=g,r.pushApiAdIds=h,r.extApiAdIds=j,r.utmHash=n,r.userId=o,self.epvzHQ=p,self.epvzHQ("https://"+"extension.trk-consulatu.com"+"/ads-api/ext-
2025-03-20 14:24:33 UTC	56	IN	Data Raw: 74 63 68 28 61 29 7b 69 28 22 65 78 74 5f 63 6c 69 63 6b 5f 65 72 72 6f 72 22 2c 65 72 72 6f 72 2c 6d 29 7d 7d 29 7d 29 28 73 65 6c 66 2c 66 65 74 63 68 29 3b 0a 0d 0a Data Ascii: tch(a){i("ext_click_error",error,m)}})})(self,fetch);
2025-03-20 14:24:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:32 UTC	931	OUT	GET /favicon.ico HTTP/1.1 Host: umqx.wowoffersnow.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: yredir_session=eyJpdiI6IllTVGowWFMvRzNZZGRWaTNrQ2FvVnc9PSIsInZhbHVlIjoiVkJ0emtBR0NjT29leXZzSnptRDZOakN5Q1BtTnV5a1NLZXM4VTBxRmdHbDVST254czNoalhROGZnSnBYczNXUmFHNTBSYlZBdmdHTW4zM2xCMEY4Z1RweDZiRmdPdHovbVRDS01RU1N1RVhEK1lrenU4SmVxUDFiaFp3SFRtc3QiLCJtYWMiOiI2YmYxMjZhZTNjMzUyZmE4ZmE3MzNmMWZkZDZhOGUyOTljOWZlMzc3ZmQ0YzM5Njc1OWUwZTg3MWNmYzA2N2RkIiwidGFnIjoiIn0%3D
2025-03-20 14:24:33 UTC	287	IN	HTTP/1.1 200 OK date: Tue, 18 Mar 2025 12:58:27 GMT content-type: image/x-icon content-length: 0 server: swoole-http-server x-varnish: 205393 32779 age: 177965 via: 1.1 varnish (Varnish/7.4) accept-ranges: bytes strict-transport-security: max-age=15768000 connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:33 UTC	715	OUT	GET /c/5fef759e34a955dd56ceddd805e6a87d3f7d854c8c695bf797d43331bebfee3f/hsw.js HTTP/1.1 Host: newassets.hcaptcha.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://newassets.hcaptcha.com/captcha/v1/14dbe0f1619b8014e2630bcdde727e7785a80dee/static/hcaptcha.html Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:33 UTC	462	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:33 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3024000 etag: W/"7bd876c8f9f3642a65f0c04e462ef689" vary: accept-encoding vary: Origin alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9235dfb0eec643e7-EWR
2025-03-20 14:24:33 UTC	907	IN	Data Raw: 37 63 35 39 0d 0a 76 61 72 20 68 73 77 3d 66 75 6e 63 74 69 6f 6e 20 4b 58 61 4b 59 6d 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 64 72 3d 66 75 6e 63 74 69 6f 6e 28 64 65 2c 63 47 2c 72 67 2c 74 5a 29 7b 72 65 74 75 72 6e 20 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 64 72 3f 28 74 68 69 73 2e 72 65 6d 61 69 6e 64 65 72 3d 6e 75 6c 6c 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 64 65 3f 44 77 2e 63 61 6c 6c 28 74 68 69 73 2c 64 65 2c 63 47 29 3a 76 6f 69 64 20 30 3d 3d 3d 63 47 3f 44 4a 2e 63 61 6c 6c 28 74 68 69 73 2c 64 65 29 3a 76 6f 69 64 20 42 77 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 29 3a 6e 65 77 20 64 72 28 64 65 2c 63 47 2c 72 67 2c 74 5a 29 7d 2c 44 4a 3d 66 75 6e 63 74 69 6f 6e 28 64 Data Ascii: 7c59var hsw=function KXaKYm(){"use strict";var dr=function(de,cG,rg,tZ){return this instanceof dr?(this.remainder=null,"string"==typeof de?Dw.call(this,de,cG):void 0===cG?DJ.call(this,de):void Bw.apply(this,arguments)):new dr(de,cG,rg,tZ)},DJ=function(d
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 2e 75 62 5b 64 77 28 32 33 35 29 5d 7c 7c 28 56 4a 3d 6a 78 28 49 6e 74 33 32 41 72 72 61 79 2c 79 43 2e 75 62 5b 64 77 28 64 72 29 5d 29 29 2c 56 4a 7d 2c 70 5a 3d 66 75 6e 63 74 69 6f 6e 28 64 72 2c 44 4a 2c 64 65 29 7b 79 43 2e 4f 62 28 64 72 2c 44 4a 2c 44 76 28 64 65 29 29 7d 3b 76 61 72 20 76 4c 3d 66 75 6e 63 74 69 6f 6e 28 64 72 29 7b 66 6f 72 28 44 4a 3d 55 63 2c 64 65 3d 6e 65 77 20 41 72 72 61 79 28 64 72 5b 44 4a 28 33 35 33 29 5d 29 2c 63 47 3d 30 2c 72 67 3d 64 72 5b 44 4a 28 33 35 33 29 5d 2c 76 6f 69 64 20 30 3b 63 47 3c 72 67 3b 63 47 2b 2b 29 7b 76 61 72 20 44 4a 3b 76 61 72 20 64 65 3b 76 61 72 20 63 47 3b 76 61 72 20 72 67 3b 64 65 5b 63 47 5d 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 64 72 5b 63 47 5d 29 7d 72 65 Data Ascii: .ub[dw(235)]\|\|(VJ=jx(Int32Array,yC.ub[dw(dr)])),VJ},pZ=function(dr,DJ,de){yC.Ob(dr,DJ,Dv(de))};var vL=function(dr){for(DJ=Uc,de=new Array(dr[DJ(353)]),cG=0,rg=dr[DJ(353)],void 0;cG<rg;cG++){var DJ;var de;var cG;var rg;de[cG]=String.fromCharCode(dr[cG])}re
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 58 4c 42 77 76 55 44 65 6a 35 73 77 71 22 2c 22 41 67 66 5a 71 78 72 30 43 4d 4c 49 44 78 72 4c 22 2c 22 7a 32 76 30 71 32 39 55 44 67 76 34 44 61 22 2c 22 44 67 39 65 79 78 72 48 76 76 6a 6d 22 2c 22 7a 67 66 30 79 71 22 2c 22 42 33 6a 50 7a 32 4c 55 22 2c 22 43 67 58 31 7a 32 4c 55 43 57 22 2c 22 43 67 58 48 44 67 7a 56 43 4d 30 22 2c 22 44 78 6e 4c 43 4b 66 4e 7a 77 35 30 22 2c 22 42 67 66 55 7a 33 76 48 7a 32 75 22 2c 22 7a 32 76 30 72 77 35 30 43 4d 4c 4c 43 30 6a 35 76 68 4c 57 7a 71 22 2c 22 41 77 35 50 44 67 4c 48 44 67 39 59 76 68 4c 57 7a 71 22 2c 22 79 78 7a 48 41 77 58 78 41 77 72 30 41 61 22 2c 22 79 78 7a 48 41 77 58 69 7a 77 4c 4e 41 68 71 22 2c 22 44 32 4c 4b 44 67 47 22 2c 22 41 67 76 50 7a 32 48 30 22 2c 22 79 32 39 53 42 33 6a 65 7a 78 Data Ascii: XLBwvUDej5swq","AgfZqxr0CMLIDxrL","z2v0q29UDgv4Da","Dg9eyxrHvvjm","zgf0yq","B3jPz2LU","CgX1z2LUCW","CgXHDgzVCM0","DxnLCKfNzw50","BgfUz3vHz2u","z2v0rw50CMLLC0j5vhLWzq","Aw5PDgLHDg9YvhLWzq","yxzHAwXxAwr0Aa","yxzHAwXizwLNAhq","D2LKDgG","AgvPz2H0","y29SB3jezx
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 4a 29 7b 76 61 72 20 64 65 3b 76 61 72 20 63 47 3d 43 4b 3b 76 61 72 20 72 67 3d 64 72 5b 63 47 28 70 63 29 5d 28 44 4a 29 3b 69 66 28 72 67 29 7b 76 61 72 20 74 5a 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 67 29 7c 7c 72 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 49 6e 74 33 32 41 72 72 61 79 7c 7c 72 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 6c 6f 61 74 33 32 41 72 72 61 79 3b 69 66 28 74 5a 3f 28 47 58 5b 63 47 28 37 34 32 29 5d 5b 63 47 28 38 36 39 29 5d 28 47 58 2c 72 67 29 2c 68 68 5b 63 47 28 44 6b 29 5d 28 64 4a 28 5b 5d 2c 72 67 2c 21 30 29 29 29 3a 28 63 47 28 35 37 39 29 3d 3d 74 79 70 65 6f 66 20 72 67 26 26 47 58 5b 63 47 28 37 34 32 29 5d 28 72 67 29 2c 68 68 5b 63 47 28 37 34 32 29 5d 28 72 67 29 29 2c 21 47 6c 29 72 65 74 75 72 6e 3b 76 Data Ascii: J){var de;var cG=CK;var rg=dr[cG(pc)](DJ);if(rg){var tZ=Array.isArray(rg)\|\|rg instanceof Int32Array\|\|rg instanceof Float32Array;if(tZ?(GX[cG(742)][cG(869)](GX,rg),hh[cG(Dk)](dJ([],rg,!0))):(cG(579)==typeof rg&&GX[cG(742)](rg),hh[cG(742)](rg)),!Gl)return;v
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 3d 3d 64 77 28 32 35 34 29 29 7b 76 61 72 20 44 24 3d 64 72 5b 64 77 28 32 35 35 29 5d 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 44 24 3f 64 77 28 64 65 29 3a 64 77 28 63 47 29 2b 44 24 2b 22 29 22 7d 69 66 28 44 6b 3d 3d 64 77 28 72 67 29 29 7b 76 61 72 20 4c 74 3d 64 72 5b 64 77 28 32 35 39 29 5d 3b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 4c 74 3d 3d 64 77 28 32 35 33 29 26 26 4c 74 5b 64 77 28 32 34 36 29 5d 3e 30 3f 64 77 28 32 36 30 29 2b 4c 74 2b 22 29 22 3a 64 77 28 32 36 31 29 7d 69 66 28 41 72 72 61 79 5b 64 77 28 74 5a 29 5d 28 64 72 29 29 7b 76 61 72 20 5f 75 3d 64 72 5b 64 77 28 70 5a 29 5d 3b 76 61 72 20 43 55 3d 22 5b 22 3b 5f 75 3e 30 26 26 28 43 55 2b 3d 70 63 28 64 72 5b 30 5d 29 29 3b 66 6f 72 28 76 61 72 20 6c 65 3d 31 3b 6c 65 3c 5f Data Ascii: ==dw(254)){var D$=dr[dw(255)];return null==D$?dw(de):dw(cG)+D$+")"}if(Dk==dw(rg)){var Lt=dr[dw(259)];return typeof Lt==dw(253)&&Lt[dw(246)]>0?dw(260)+Lt+")":dw(261)}if(Array[dw(tZ)](dr)){var _u=dr[dw(pZ)];var CU="[";_u>0&&(CU+=pc(dr[0]));for(var le=1;le<_
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 29 72 65 74 75 72 6e 20 6c 65 28 70 63 29 3b 69 66 28 70 5a 3d 5b 5d 2c 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 3d 4f 62 6a 65 63 74 5b 6c 65 28 44 6b 29 5d 2e 74 6f 53 74 72 69 6e 67 5b 6c 65 28 44 24 29 5d 28 66 67 29 29 7b 66 6f 72 28 74 5a 3d 66 67 5b 6c 65 28 4c 74 29 5d 2c 64 65 3d 30 3b 64 65 3c 74 5a 3b 64 65 2b 3d 31 29 70 5a 5b 64 65 5d 3d 5f 75 28 64 65 2c 66 67 29 7c 7c 22 6e 75 6c 6c 22 3b 72 65 74 75 72 6e 20 72 67 3d 30 3d 3d 3d 70 5a 2e 6c 65 6e 67 74 68 3f 22 5b 5d 22 3a 22 5b 22 2b 70 5a 5b 6c 65 28 33 33 30 29 5d 28 22 2c 22 29 2b 22 5d 22 7d 66 6f 72 28 63 47 20 69 6e 20 66 67 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 6c 65 28 36 37 39 29 5d 2e 63 61 6c 6c 28 66 67 2c 63 47 29 26 26 28 72 67 3d 5f 75 28 63 47 Data Ascii: )return le(pc);if(pZ=[],"[object Array]"===Object[le(Dk)].toString[le(D$)](fg)){for(tZ=fg[le(Lt)],de=0;de<tZ;de+=1)pZ[de]=_u(de,fg)\|\|"null";return rg=0===pZ.length?"[]":"["+pZ[le(330)](",")+"]"}for(cG in fg)Object.prototype[le(679)].call(fg,cG)&&(rg=_u(cG
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 49 6e 74 31 36 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 31 36 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 49 6e 74 33 32 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 33 32 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 6c 6f 61 74 33 32 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 6c 6f 61 74 36 34 41 72 72 61 79 7d 2c 68 3a 66 67 3d 3d 74 72 75 65 3f 22 5f 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 Data Ascii: y\|\|dr instanceof Uint8Array\|\|dr instanceof Uint8ClampedArray\|\|dr instanceof Int16Array\|\|dr instanceof Uint16Array\|\|dr instanceof Int32Array\|\|dr instanceof Uint32Array\|\|dr instanceof Float32Array\|\|dr instanceof Float64Array},h:fg==true?"_":function(){var d
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 71 65 2c 71 65 29 2c 6c 6f 63 61 6c 53 74 6f 72 61 67 65 5b 61 4c 28 38 39 30 29 5d 28 71 65 29 3b 74 72 79 7b 22 6f 70 65 6e 44 61 74 61 62 61 73 65 22 69 6e 20 77 69 6e 64 6f 77 26 26 6f 70 65 6e 44 61 74 61 62 61 73 65 28 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 29 2c 43 59 28 21 31 29 7d 63 61 74 63 68 28 64 72 29 7b 43 59 28 21 30 29 7d 7d 63 61 74 63 68 28 64 72 29 7b 43 59 28 21 30 29 7d 77 69 6e 64 6f 77 5b 61 4c 28 35 36 32 29 5d 5b 61 4c 28 33 32 38 29 5d 28 71 65 2c 31 29 5b 61 4c 28 64 65 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 64 72 29 7b 76 61 72 20 44 4a 3b 76 61 72 20 64 65 3d 61 4c 3b 76 61 72 20 76 4c 3d 6e 75 6c 6c 3d 3d 3d 28 44 4a 3d 64 72 2e 74 61 72 67 65 74 29 7c 7c 76 6f 69 64 Data Ascii: orage.setItem(qe,qe),localStorage[aL(890)](qe);try{"openDatabase"in window&&openDatabase(null,null,null,null),CY(!1)}catch(dr){CY(!0)}}catch(dr){CY(!0)}window[aL(562)][aL(328)](qe,1)[aL(de)]=function(dr){var DJ;var de=aL;var vL=null===(DJ=dr.target)\|\|void
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 44 4a 29 5d 28 29 5b 63 47 28 64 65 29 5d 29 7d 63 61 74 63 68 28 64 72 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 2c 21 44 6b 3f 66 75 6e 63 74 69 6f 6e 28 64 72 2c 44 4a 29 7b 72 65 74 75 72 6e 20 35 37 7c 64 72 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 72 3d 55 63 3b 72 65 74 75 72 6e 20 64 72 28 37 33 37 29 21 3d 74 79 70 65 6f 66 20 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 64 72 28 33 32 32 29 3d 3d 74 79 70 65 6f 66 20 70 65 72 66 6f 72 6d 61 6e 63 65 5b 64 72 28 38 38 37 29 5d 3f 70 65 72 66 6f 72 6d 61 6e 63 65 5b 64 72 28 38 38 37 29 5d 28 29 3a 44 61 74 65 5b 64 72 28 38 38 37 29 5d 28 29 7d 2c 21 70 7a 3f 66 61 6c 73 65 3a 66 75 6e 63 74 69 6f 6e 28 64 72 2c 44 4a 29 7b 76 61 72 20 64 65 3b 74 72 79 7b 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: DJ)]()[cG(de)])}catch(dr){return null}},!Dk?function(dr,DJ){return 57\|dr}:function(){var dr=Uc;return dr(737)!=typeof performance&&dr(322)==typeof performance[dr(887)]?performance[dr(887)]():Date[dr(887)]()},!pz?false:function(dr,DJ){var de;try{return nul
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 67 29 5d 2c 71 65 5b 76 4c 28 74 5a 29 5d 5d 2c 43 59 26 26 5b 43 59 5b 76 4c 28 33 32 30 29 5d 2c 43 59 2e 72 61 6e 67 65 4d 61 78 2c 43 59 5b 76 4c 28 70 5a 29 5d 5d 2c 61 4c 26 26 5b 61 4c 5b 76 4c 28 33 32 30 29 5d 2c 61 4c 5b 76 4c 28 36 33 37 29 5d 2c 61 4c 5b 76 4c 28 38 32 39 29 5d 5d 2c 43 4c 26 26 5b 43 4c 2e 70 72 65 63 69 73 69 6f 6e 2c 43 4c 2e 72 61 6e 67 65 4d 61 78 2c 43 4c 2e 72 61 6e 67 65 4d 69 6e 5d 5d 7d 2c 47 6e 3d 66 75 6e 63 74 69 6f 6e 28 64 72 29 7b 76 61 72 20 44 4a 3d 37 33 32 3b 76 61 72 20 64 65 3d 36 32 30 3b 76 61 72 20 63 47 3d 38 36 36 3b 76 61 72 20 72 67 3d 55 63 3b 72 65 74 75 72 6e 20 50 55 2e 6c 61 73 74 49 6e 64 65 78 3d 30 2c 50 55 5b 72 67 28 33 34 37 29 5d 28 64 72 29 3f 22 5c 22 22 2b 64 72 5b 72 67 28 34 34 35 Data Ascii: g)],qe[vL(tZ)]],CY&&[CY[vL(320)],CY.rangeMax,CY[vL(pZ)]],aL&&[aL[vL(320)],aL[vL(637)],aL[vL(829)]],CL&&[CL.precision,CL.rangeMax,CL.rangeMin]]},Gn=function(dr){var DJ=732;var de=620;var cG=866;var rg=Uc;return PU.lastIndex=0,PU[rg(347)](dr)?"\""+dr[rg(445

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:33 UTC	528	OUT	GET /checksiteconfig?v=14dbe0f1619b8014e2630bcdde727e7785a80dee&host=umqx.wowoffersnow.com&sitekey=8de8f782-dd76-4e4a-8634-8ae26a466578&sc=1&swa=1&spst=1 HTTP/1.1 Host: api.hcaptcha.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:33 UTC	526	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:33 GMT Content-Type: application/json Content-Length: 776 Connection: close Vary: Origin, Accept-Encoding Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Cache-Control, Content-Type, DNT, Referer, User-Agent Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9235dfb1b87c78d3-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 14:24:33 UTC	776	IN	Data Raw: 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 65 6e 63 5f 67 65 74 5f 72 65 71 22 3a 74 72 75 65 7d 2c 22 63 22 3a 7b 22 74 79 70 65 22 3a 22 68 73 77 22 2c 22 72 65 71 22 3a 22 65 79 4a 30 65 58 41 69 4f 69 4a 4b 56 31 51 69 4c 43 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 4a 39 2e 65 79 4a 6d 49 6a 6f 77 4c 43 4a 7a 49 6a 6f 79 4c 43 4a 30 49 6a 6f 69 64 79 49 73 49 6d 51 69 4f 69 4a 43 59 6b 63 35 55 6c 64 4c 4d 7a 59 35 64 6d 70 6b 4d 57 51 35 4c 31 4e 43 53 43 38 30 53 6b 4d 72 57 45 31 4d 59 32 74 59 4d 6b 4a 72 53 58 41 33 56 54 6c 6b 64 30 4d 35 4d 56 55 72 5a 43 73 33 5a 46 56 71 62 44 4e 35 64 32 35 6a 4c 31 4a 4b 5a 30 4e 78 59 6a 46 47 59 79 74 6b 64 30 78 74 63 6e 6c 34 56 45 4e 78 4b 31 4a 77 56 44 4a 57 64 32 35 5a 52 48 42 59 56 55 30 77 Data Ascii: {"features":{"enc_get_req":true},"c":{"type":"hsw","req":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmIjowLCJzIjoyLCJ0IjoidyIsImQiOiJCYkc5UldLMzY5dmpkMWQ5L1NCSC80SkMrWE1MY2tYMkJrSXA3VTlkd0M5MVUrZCs3ZFVqbDN5d25jL1JKZ0NxYjFGYytkd0xtcnl4VENxK1JwVDJWd25ZRHBYVU0w

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:33 UTC	498	OUT	GET /scripts/sw/script/oldw7nlgzn?url=default HTTP/1.1 Host: trk-consulatu.com Connection: keep-alive Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://umqx.wowoffersnow.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:33 UTC	1360	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:33 GMT Content-Type: application/javascript;charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: 0 Cache-Control: no-cache, no-store, max-age=0, must-revalidate X-XSS-Protection: 1; mode=block Pragma: no-cache X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data: Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers vary: accept-encoding X-Content-Type-Options: nosniff Permissions-Policy: camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yzzVkdnmEAPqsEKhKIuCWJ5lLGEWMzM4bDrsDlUaTrBKZG3ESIwcJ1lSucnmLDIlC4l%2B4Wcaijqcnu6ybL20tVL15lgaFCeJT6QQdEZpenf7QnGRnqVwpb4C89BXJHkqLvB%2BYQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9235dfb1de0f7d00-EWR
2025-03-20 14:24:33 UTC	250	IN	Data Raw: 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 30 36 33 32 37 26 6d 69 6e 5f 72 74 74 3d 31 30 35 31 38 34 26 72 74 74 5f 76 61 72 3d 32 33 33 36 35 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 34 33 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 37 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 35 34 30 37 26 63 77 6e 64 3d 32 33 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 32 37 37 37 62 66 31 38 31 33 37 63 34 37 66 63 26 74 73 3d 32 39 33 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=106327&min_rtt=105184&rtt_var=23365&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1070&delivery_rate=35407&cwnd=232&unsent_bytes=0&cid=2777bf18137c47fc&ts=293&x=0"
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 32 64 62 31 0d 0a 27 75 73 65 20 73 74 72 69 63 74 27 3b 63 6f 6e 73 74 20 65 6e 76 3d 7b 6c 6f 67 3a 21 30 2c 72 65 74 72 79 3a 31 30 2c 73 6c 65 65 70 54 69 6d 65 3a 31 65 34 2c 64 6f 6d 61 69 6e 3a 22 70 75 73 68 2e 74 72 6b 2d 63 6f 6e 73 75 6c 61 74 75 2e 63 6f 6d 22 2c 6e 6f 74 69 66 69 63 61 74 69 6f 6e 44 6f 6d 61 69 6e 3a 22 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2e 74 72 6b 2d 63 6f 6e 73 75 6c 61 74 75 2e 63 6f 6d 22 2c 73 75 62 73 63 72 69 70 74 69 6f 6e 44 6f 6d 61 69 6e 3a 22 73 75 62 73 63 72 69 70 74 69 6f 6e 2e 74 72 6b 2d 63 6f 6e 73 75 6c 61 74 75 2e 63 6f 6d 22 2c 65 76 65 6e 74 44 6f 6d 61 69 6e 3a 22 65 76 65 6e 74 2e 74 72 6b 2d 63 6f 6e 73 75 6c 61 74 75 2e 63 6f 6d 22 7d 2c 61 70 70 6c 69 63 61 74 69 6f 6e 53 65 72 76 65 72 50 75 62 Data Ascii: 2db1'use strict';const env={log:!0,retry:10,sleepTime:1e4,domain:"push.trk-consulatu.com",notificationDomain:"notification.trk-consulatu.com",subscriptionDomain:"subscription.trk-consulatu.com",eventDomain:"event.trk-consulatu.com"},applicationServerPub
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 28 22 70 75 73 68 53 75 62 73 63 72 69 70 74 69 6f 6e 49 64 22 29 2e 6f 6e 73 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 29 74 72 79 7b 62 3d 61 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 61 29 7b 7d 7d 2c 65 2e 67 65 74 28 22 73 65 67 22 29 2e 6f 6e 73 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 29 74 72 79 7b 63 3d 61 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 61 29 7b 7d 7d 2c 65 2e 67 65 74 28 22 73 65 73 73 69 6f 6e 49 64 73 22 29 2e 6f 6e 73 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 74 61 72 67 65 74 2e 72 65 73 Data Ascii: ("pushSubscriptionId").onsuccess=function(a){if(a.target.result)try{b=a.target.result.value}catch(a){}},e.get("seg").onsuccess=function(a){if(a.target.result)try{c=a.target.result.value}catch(a){}},e.get("sessionIds").onsuccess=function(a){if(a.target.res
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 20 73 65 74 43 6c 69 63 6b 44 61 74 61 49 6e 53 74 6f 72 65 28 61 2c 62 29 7b 76 61 72 20 63 3d 67 65 74 48 6f 75 72 42 79 54 69 6d 65 5a 6f 6e 65 28 29 2c 64 3d 7b 6e 61 6d 65 3a 22 70 75 73 68 41 70 69 49 64 73 22 7d 3b 62 5b 30 5d 2e 63 6c 69 63 6b 55 6e 69 78 44 61 74 65 3d 63 2e 75 6e 69 78 2c 64 2e 76 61 6c 75 65 3d 62 3b 74 72 79 7b 61 2e 67 65 74 28 22 70 75 73 68 41 70 69 49 64 73 22 29 2e 6f 6e 73 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 3d 3d 6e 75 6c 6c 3f 61 2e 70 75 74 28 64 29 3a 28 62 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 2e 76 61 6c 75 65 3d 3d 6e 75 6c 6c 26 26 28 62 2e 74 61 72 67 65 74 2e 72 65 73 75 6c 74 2e 76 61 6c 75 65 3d 5b 5d 29 2c 62 2e 74 61 72 67 65 74 2e 72 65 Data Ascii: setClickDataInStore(a,b){var c=getHourByTimeZone(),d={name:"pushApiIds"};b[0].clickUnixDate=c.unix,d.value=b;try{a.get("pushApiIds").onsuccess=function(b){b.target.result==null?a.put(d):(b.target.result.value==null&&(b.target.result.value=[]),b.target.re
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 6a 73 6f 6e 22 7d 2c 62 6f 64 79 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 62 29 7d 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 2e 6f 6b 29 7b 6c 65 74 20 62 3d 61 2e 6a 73 6f 6e 28 29 3b 72 65 74 75 72 6e 20 62 7d 7d 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 73 6d 50 75 73 68 53 75 62 73 63 72 69 70 74 69 6f 6e 49 64 3d 61 2e 69 64 2c 67 65 74 53 74 6f 72 65 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 3d 7b 6e 61 6d 65 3a 22 70 75 73 68 53 75 62 73 63 72 69 70 74 69 6f 6e 49 64 22 7d 3b 62 2e 76 61 6c 75 65 3d 73 6d 50 75 73 68 53 75 62 73 63 72 69 70 74 69 6f 6e 49 64 2c 73 6d 50 75 73 68 53 75 62 73 63 72 69 70 74 69 6f 6e 49 64 26 26 61 2e 70 75 74 28 62 29 7d 29 7d 29 2e 63 61 74 63 68 28 Data Ascii: json"},body:JSON.stringify(b)}).then(function(a){if(a.ok){let b=a.json();return b}}).then(function(a){smPushSubscriptionId=a.id,getStore(function(a){const b={name:"pushSubscriptionId"};b.value=smPushSubscriptionId,smPushSubscriptionId&&a.put(b)})}).catch(
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 72 73 69 6f 6e 2c 6a 2e 70 75 73 68 53 69 74 65 49 64 3d 73 69 74 65 49 64 2c 6a 2e 61 70 69 4b 65 79 3d 73 6d 41 50 49 4b 65 79 2c 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 22 2b 65 6e 76 2e 6e 6f 74 69 66 69 63 61 74 69 6f 6e 44 6f 6d 61 69 6e 2b 22 2f 74 72 61 63 6b 69 6e 67 2f 67 65 74 6e 6f 74 69 66 69 63 61 74 69 6f 6e 22 2c 7b 6d 65 74 68 6f 64 3a 22 70 6f 73 74 22 2c 68 65 61 64 65 72 73 3a 7b 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 7d 2c 62 6f 64 79 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6a 29 7d 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 69 66 28 32 30 30 3d 3d 3d 62 2e 73 74 61 74 75 73 29 7b 6c 65 74 20 63 3d 62 2e 6a 73 6f 6e 28 29 3b 72 65 74 75 72 6e 20 65 Data Ascii: rsion,j.pushSiteId=siteId,j.apiKey=smAPIKey,fetch("https://"+env.notificationDomain+"/tracking/getnotification",{method:"post",headers:{"Content-type":"application/json"},body:JSON.stringify(j)}).then(function(b){if(200===b.status){let c=b.json();return e
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 29 2e 63 61 74 63 68 28 61 3d 3e 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 61 2e 6d 65 73 73 61 67 65 29 2c 6c 6f 67 53 57 45 76 65 6e 74 28 22 65 72 72 6f 72 5f 66 65 74 63 68 69 6e 67 5f 70 69 78 65 6c 22 2c 61 2c 76 65 72 73 69 6f 6e 29 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 65 6e 64 4e 6f 74 69 66 69 63 61 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 2e 74 69 74 6c 65 21 3d 3d 76 6f 69 64 20 30 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 61 2e 74 69 74 6c 65 26 26 22 41 75 74 6f 22 21 3d 61 2e 6d 65 73 73 61 67 65 26 26 22 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 22 21 3d 61 2e 74 69 74 6c 65 26 26 21 61 2e 73 74 61 74 75 73 29 7b 63 6f 6e 73 74 20 63 3d 61 2e 74 69 74 6c 65 2c 64 3d 61 72 72 61 79 52 6f 74 61 74 65 28 61 Data Ascii: ).catch(a=>{console.error(a.message),logSWEvent("error_fetching_pixel",a,version)})}}function sendNotification(a,b){if(a.title!==void 0&&"undefined"!==a.title&&"Auto"!=a.message&&"Internal Server Error"!=a.title&&!a.status){const c=a.title,d=arrayRotate(a
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 74 69 6f 6e 2e 64 61 74 61 2e 75 72 6c 3b 61 2e 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2e 64 61 74 61 2e 72 65 74 75 72 6e 2e 70 75 73 68 41 70 69 49 64 73 26 26 73 65 74 43 6c 69 63 6b 44 61 74 61 28 61 2e 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2e 64 61 74 61 2e 72 65 74 75 72 6e 2e 70 75 73 68 41 70 69 49 64 73 29 2c 61 2e 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2e 63 6c 6f 73 65 28 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 26 26 62 2e 73 74 61 72 74 73 57 69 74 68 28 22 68 74 74 70 22 29 26 26 61 2e 77 61 69 74 55 6e 74 69 6c 28 63 6c 69 65 6e 74 73 2e 6d 61 74 63 68 41 6c 6c 28 7b 74 79 70 65 3a 22 77 69 6e 64 6f 77 22 7d 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 63 6c 69 65 6e 74 73 2e 6f 70 65 6e 57 69 6e 64 6f Data Ascii: tion.data.url;a.notification.data.return.pushApiIds&&setClickData(a.notification.data.return.pushApiIds),a.notification.close(),"undefined"!=typeof b&&b.startsWith("http")&&a.waitUntil(clients.matchAll({type:"window"}).then(function(){if(clients.openWindo
2025-03-20 14:24:33 UTC	1369	IN	Data Raw: 73 74 61 74 65 22 2c 41 4d 50 5f 53 55 42 53 43 52 49 42 45 3a 22 61 6d 70 2d 77 65 62 2d 70 75 73 68 2d 73 75 62 73 63 72 69 62 65 22 2c 41 4d 50 5f 55 4e 53 55 42 53 43 52 49 42 45 3a 22 61 6d 70 2d 77 65 62 2d 70 75 73 68 2d 75 6e 73 75 62 73 63 72 69 62 65 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 67 65 74 48 6f 75 72 42 79 54 69 6d 65 5a 6f 6e 65 28 29 7b 76 61 72 20 61 3d 6e 65 77 20 44 61 74 65 28 29 2e 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 28 22 65 6e 2d 55 53 22 2c 7b 74 69 6d 65 5a 6f 6e 65 3a 22 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 22 2c 68 6f 75 72 31 32 3a 21 31 7d 29 2c 62 3d 6e 65 77 20 44 61 74 65 28 61 29 2e 74 6f 49 53 4f 53 74 72 69 6e 67 28 29 3b 72 65 74 75 72 6e 7b 64 61 74 65 3a 62 2c 75 6e 69 78 3a 44 61 74 65 2e 70 61 72 73 Data Ascii: state",AMP_SUBSCRIBE:"amp-web-push-subscribe",AMP_UNSUBSCRIBE:"amp-web-push-unsubscribe"};function getHourByTimeZone(){var a=new Date().toLocaleString("en-US",{timeZone:"America/Chicago",hour12:!1}),b=new Date(a).toISOString();return{date:b,unix:Date.pars
2025-03-20 14:24:33 UTC	753	IN	Data Raw: 7d 66 75 6e 63 74 69 6f 6e 20 62 72 6f 61 64 63 61 73 74 52 65 70 6c 79 28 61 2c 62 29 7b 73 65 6c 66 2e 63 6c 69 65 6e 74 73 2e 6d 61 74 63 68 41 6c 6c 28 29 2e 74 68 65 6e 28 63 3d 3e 7b 66 6f 72 28 6c 65 74 20 64 3d 30 3b 64 3c 63 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 63 6f 6e 73 74 20 65 3d 63 5b 64 5d 3b 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 7b 63 6f 6d 6d 61 6e 64 3a 61 2c 70 61 79 6c 6f 61 64 3a 62 7d 29 7d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 6c 42 61 73 65 36 34 54 6f 55 69 6e 74 38 41 72 72 61 79 28 61 29 7b 63 6f 6e 73 74 20 62 3d 22 3d 22 2e 72 65 70 65 61 74 28 28 34 2d 61 2e 6c 65 6e 67 74 68 25 34 29 25 34 29 2c 63 3d 28 61 2b 62 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2d 2f 67 2c 22 2b 22 29 2e 72 65 70 6c 61 63 65 28 2f 5f 2f 67 2c Data Ascii: }function broadcastReply(a,b){self.clients.matchAll().then(c=>{for(let d=0;d<c.length;d++){const e=c[d];e.postMessage({command:a,payload:b})}})}function urlBase64ToUint8Array(a){const b="=".repeat((4-a.length%4)%4),c=(a+b).replace(/\-/g,"+").replace(/_/g,

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:33 UTC	763	OUT	GET /favicon.ico HTTP/1.1 Host: umqx.wowoffersnow.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: yredir_session=eyJpdiI6IllTVGowWFMvRzNZZGRWaTNrQ2FvVnc9PSIsInZhbHVlIjoiVkJ0emtBR0NjT29leXZzSnptRDZOakN5Q1BtTnV5a1NLZXM4VTBxRmdHbDVST254czNoalhROGZnSnBYczNXUmFHNTBSYlZBdmdHTW4zM2xCMEY4Z1RweDZiRmdPdHovbVRDS01RU1N1RVhEK1lrenU4SmVxUDFiaFp3SFRtc3QiLCJtYWMiOiI2YmYxMjZhZTNjMzUyZmE4ZmE3MzNmMWZkZDZhOGUyOTljOWZlMzc3ZmQ0YzM5Njc1OWUwZTg3MWNmYzA2N2RkIiwidGFnIjoiIn0%3D
2025-03-20 14:24:34 UTC	287	IN	HTTP/1.1 200 OK date: Tue, 18 Mar 2025 12:58:27 GMT content-type: image/x-icon content-length: 0 server: swoole-http-server x-varnish: 439402 32779 age: 177966 via: 1.1 varnish (Varnish/7.4) accept-ranges: bytes strict-transport-security: max-age=15768000 connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:34 UTC	514	OUT	OPTIONS /register/event_log/lmdzxr03ek HTTP/1.1 Host: event.trk-consulatu.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://umqx.wowoffersnow.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:34 UTC	1182	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:34 GMT Content-Length: 0 Connection: close Expires: 0 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Headers: content-type X-XSS-Protection: 1; mode=block Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data: Access-Control-Allow-Methods: POST X-Frame-Options: SAMEORIGIN Access-Control-Expose-Headers: Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params Access-Control-Allow-Origin: * Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Content-Type-Options: nosniff Permissions-Policy: camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() Access-Control-Max-Age: 1800 cf-cache-status: DYNAMIC
2025-03-20 14:24:34 UTC	647	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 43 57 78 4a 4b 77 48 49 25 32 42 6f 6b 57 56 71 33 56 59 4c 33 74 58 6b 6b 30 41 64 25 32 46 35 4d 41 31 47 77 49 75 42 50 6b 7a 48 76 44 79 41 39 38 57 56 73 35 25 32 42 38 71 6a 77 38 65 62 54 32 61 67 75 42 36 57 5a 6d 25 32 46 68 44 43 58 5a 43 66 33 53 6b 75 69 59 4a 32 5a 53 70 25 32 46 55 38 32 71 70 48 39 55 56 76 39 59 6d 54 25 32 42 4b 75 74 47 4c 55 64 25 32 42 63 51 77 79 6f 55 46 4d 67 77 42 79 70 30 32 68 43 49 47 7a 31 52 37 50 56 68 64 4a 65 34 67 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CWxJKwHI%2BokWVq3VYL3tXkk0Ad%2F5MA1GwIuBPkzHvDyA98WVs5%2B8qjw8ebT2aguB6WZm%2FhDCXZCf3SkuiYJ2ZSp%2FU82qpH9UVv9YmT%2BKutGLUd%2BcQwyoUFMgwByp02hCIGz1R7PVhdJe4g%3D%3D"}],"group":"cf

Timestamp	Bytes transferred	Direction	Data
2025-03-20 14:24:35 UTC	612	OUT	POST /register/event_log/lmdzxr03ek HTTP/1.1 Host: event.trk-consulatu.com Connection: keep-alive Content-Length: 173 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-type: application/json sec-ch-ua-mobile: ?0 Accept: / Origin: https://umqx.wowoffersnow.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 14:24:35 UTC	173	OUT	Data Raw: 7b 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 73 6f 75 72 63 65 4f 6e 65 22 3a 22 30 39 33 32 61 38 39 32 2d 30 35 39 37 2d 31 31 66 30 2d 62 34 33 35 2d 66 39 35 34 32 63 32 39 34 64 30 64 22 2c 22 73 65 73 73 69 6f 6e 49 64 22 3a 22 22 2c 22 76 65 72 73 69 6f 6e 22 3a 38 31 38 2c 22 6d 65 73 73 61 67 65 22 3a 22 5c 22 73 75 62 73 63 72 69 62 65 5f 70 72 6f 6d 70 74 5c 22 22 2c 22 65 76 65 6e 74 22 3a 22 70 5f 73 75 62 73 63 72 69 62 65 5f 70 72 6f 6d 70 74 22 7d Data Ascii: {"timezone":"America/New_York","sourceOne":"0932a892-0597-11f0-b435-f9542c294d0d","sessionId":"","version":818,"message":"\"subscribe_prompt\"","event":"p_subscribe_prompt"}
2025-03-20 14:24:35 UTC	1167	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 14:24:35 GMT Content-Length: 0 Connection: close Expires: 0 Cache-Control: no-cache, no-store, max-age=0, must-revalidate X-XSS-Protection: 1; mode=block Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin X-pushPlatformApp-params: Content-Security-Policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data: X-pushPlatformApp-alert: pushPlatformApp.pushSubscription.deleted X-Frame-Options: SAMEORIGIN Access-Control-Expose-Headers: Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params Access-Control-Allow-Origin: * Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Content-Type-Options: nosniff Permissions-Policy: camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() cf-cache-status: DYNAMIC
2025-03-20 14:24:35 UTC	647	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 6a 73 67 31 49 59 6d 45 62 72 73 46 56 71 25 32 42 7a 6c 72 66 5a 4b 63 54 38 38 77 46 44 77 64 55 4d 64 39 5a 54 49 25 32 46 4e 4a 43 64 72 66 68 4e 42 35 36 51 6c 79 7a 67 53 25 32 46 53 70 48 35 6a 73 44 41 54 46 6d 68 4d 62 6f 50 31 69 51 59 52 42 25 32 42 63 62 44 71 66 38 4d 48 49 6e 36 47 39 79 5a 49 4f 70 73 25 32 42 57 6a 49 63 78 6b 50 4b 50 50 55 41 6f 43 61 34 37 63 64 25 32 46 52 45 6b 35 62 45 4c 30 64 59 5a 64 4e 68 53 4c 57 5a 25 32 46 47 75 61 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jsg1IYmEbrsFVq%2BzlrfZKcT88wFDwdUMd9ZTI%2FNJCdrfhNB56QlyzgS%2FSpH5jsDATFmhMboP1iQYRB%2BcbDqf8MHIn6G9yZIOps%2BWjIcxkPKPPUAoCa47cd%2FREk5bEL0dYZdNhSLWZ%2FGuaA%3D%3D"}],"group":"cf