Edit tour

Windows Analysis Report
https://qdjtq.com/modify/

Overview

General Information

Sample URL:	https://qdjtq.com/modify/
Analysis ID:	1519928
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

HTML page contains obfuscated javascript

Found iframes

HTML body contains low number of good links

HTML page contains hidden javascript code

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2000,i,5091690585223991164,14165352931940017661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qdjtq.com/modify/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /api/MC42MTg2MTE1MDg1Nzk2NjAy HTTP/1.1Host: qdjtq.comConnection: keep-aliveContent-Length: 308sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/encryptAccept: */*Origin: https://qdjtq.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://qdjtq.com/modify/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8munRy&sid=jnmURHTecJrkHRFxAHuG	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/assets/d1a234c2ajMSD.js	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/assets/c27b6911ajMSD.js	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muaSX	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mum-H&sid=jnmURHTecJrkHRFxAHuG	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/assets/297557e4tE5dP.css	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mudzw&sid=RcIlUwyZYMmWAnsPAHt1	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/layout/images/68.svg	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mukbh&sid=EAVYAwv8c3Wq9ksAAHuA	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=_2bdYdjJ6QcQscIJAHty	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muq3U&sid=yXWikhQOZczjci5kAHuJ	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/layout/images/56.svg	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mujOQ&sid=cG417RpQ48wOMxxtAHt7	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mufNo&sid=N4xB_A2KRU780xSdAHt4	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mubv1&sid=_2bdYdjJ6QcQscIJAHty	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=cjtByYZSYtIZzkm5AHts	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mum-M&sid=jnmURHTecJrkHRFxAHuG	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=RcIlUwyZYMmWAnsPAHt1	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/layout/images/53.svg	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=3E0SqkwJomtmg_wKAHtv	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=yXWikhQOZczjci5kAHuJ	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muoqp	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/api/MC4yMTY3NjQ0NTM3Mjk2OTA5	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/layout/images/64.svg	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mukbn&sid=EAVYAwv8c3Wq9ksAAHuA	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mucF3&sid=_2bdYdjJ6QcQscIJAHty	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=jnmURHTecJrkHRFxAHuG	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/layout/images/57.svg	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/assets/beb21690tE5dP.css	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/layout/images/67.svg	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muiHw&sid=cG417RpQ48wOMxxtAHt7	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mur3m&sid=VLhOORCLSY2MXW0LAHuP	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mulcg&sid=UFk3GnhaSs1mLKgMAHuD	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/assets/7f8692c3ajMSD.js	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muYmb&sid=cjtByYZSYtIZzkm5AHts	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/assets/e4b62962ajMSD.js	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mubYv	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muf1I	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/modify/assets/ee4b0686tE5dP.css	Avira URL Cloud: Label: phishing
Source: https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muehQ&sid=RcIlUwyZYMmWAnsPAHt1	Avira URL Cloud: Label: phishing

Source: https://qdjtq.com/modify/assets/7ae8a4f5ajMSD.js	HTTP Parser: const a19_0x5b7454=a19_0x4fa0;(function(_0x23dfe7,_0x52eff6){const _0x15ff47=a19_0x4fa0,_0x55c0f4=_0
Source: https://qdjtq.com/modify/assets/00b63b5cajMSD.js	HTTP Parser: (function(_0x87ecb3,_0x295b21){const _0x5402eb=a0_0x1f67,_0xcef53a=_0x87ecb3();while(!![]){try{const

Source: https://uzer.co/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-W4NBD3
Source: https://uzer.co/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-94GBDVKM3R&gacid=228618068.1727397051&gtm=45je49p0v867598331za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&_ng=1&aip=1&fledge=1&frm=0&tag_exp=101671035~101747727&z=1522954775
Source: https://uzer.co/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/10981864615?random=1727397050580&cv=11&fst=1727397050580&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je49p0v867598331za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1280&u_h=1024&url=https%3A%2F%2Fuzer.co%2F&hn=www.googleadservices.com&frm=0&tiba=UZER%20-%20Agencia%20de%20Consultor%C3%ADa%20y%20Dise%C3%B1o%20UX%20%2F%20UI&npa=0&pscdl=noapi&auid=1494440894.1727397051&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://uzer.co/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/10981864615?random=1727397050638&cv=11&fst=1727397050638&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je49p0v867598331za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1280&u_h=1024&url=https%3A%2F%2Fuzer.co%2F&label=V20XCPG92OMDEKfpx_Qo&hn=www.googleadservices.com&frm=0&tiba=UZER%20-%20Agencia%20de%20Consultor%C3%ADa%20y%20Dise%C3%B1o%20UX%20%2F%20UI&gtm_ee=1&npa=0&pscdl=noapi&auid=1494440894.1727397051&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&ct_cookie_present=0
Source: https://uzer.co/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-W4NBD3
Source: https://uzer.co/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-94GBDVKM3R&gacid=228618068.1727397051&gtm=45je49p0v867598331za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&_ng=1&aip=1&fledge=1&frm=0&tag_exp=101671035~101747727&z=1522954775
Source: https://uzer.co/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/10981864615?random=1727397050580&cv=11&fst=1727397050580&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je49p0v867598331za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1280&u_h=1024&url=https%3A%2F%2Fuzer.co%2F&hn=www.googleadservices.com&frm=0&tiba=UZER%20-%20Agencia%20de%20Consultor%C3%ADa%20y%20Dise%C3%B1o%20UX%20%2F%20UI&npa=0&pscdl=noapi&auid=1494440894.1727397051&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://uzer.co/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/10981864615?random=1727397050638&cv=11&fst=1727397050638&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je49p0v867598331za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1280&u_h=1024&url=https%3A%2F%2Fuzer.co%2F&label=V20XCPG92OMDEKfpx_Qo&hn=www.googleadservices.com&frm=0&tiba=UZER%20-%20Agencia%20de%20Consultor%C3%ADa%20y%20Dise%C3%B1o%20UX%20%2F%20UI&gtm_ee=1&npa=0&pscdl=noapi&auid=1494440894.1727397051&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=event%3Dconversion&ct_cookie_present=0

Source: https://qdjtq.com/modify/	HTTP Parser: No favicon
Source: https://qdjtq.com/modify/	HTTP Parser: No favicon
Source: https://qdjtq.com/modify/	HTTP Parser: No favicon
Source: https://qdjtq.com/modify/	HTTP Parser: No favicon
Source: https://www.servientrega.com/wps/portal/rastreo-envio/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziTS08TTwMTAz93f1cTAwCg5yMfP0MHT2NPQ30w8EKDHAARwP9KGL041EQhd_4cP0oPFYYOfoaQRXgMaMgNzTCINNREQC2ok6g/	HTTP Parser: No favicon

Source: https://qdjtq.com/modify/	HTTP Parser: No <meta name="author".. found
Source: https://uzer.co/	HTTP Parser: No <meta name="author".. found
Source: https://uzer.co/	HTTP Parser: No <meta name="author".. found

Source: https://qdjtq.com/modify/	HTTP Parser: No <meta name="copyright".. found
Source: https://uzer.co/	HTTP Parser: No <meta name="copyright".. found
Source: https://uzer.co/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50215 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64

Source: chromecache_443.2.dr, chromecache_175.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id equals www.youtube.com (Youtube)
Source: chromecache_443.2.dr, chromecache_175.2.dr	String found in binary or memory: html.attr( 'src', '//www.youtube.com/embed/' + video.id + '?autoplay=1&rel=0&v=' + video.id ); equals www.youtube.com (Youtube)
Source: chromecache_509.2.dr, chromecache_184.2.dr	String found in binary or memory: url = 'http://www.linkedin.com/shareArticle?url='+url; equals www.linkedin.com (Linkedin)
Source: chromecache_509.2.dr, chromecache_184.2.dr	String found in binary or memory: url = 'https://www.facebook.com/sharer/sharer.php?u='+url+'&t='+title; equals www.facebook.com (Facebook)
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: "https://www.facebook.com/UZER.co/", equals www.facebook.com (Facebook)
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: "https://www.linkedin.com/company/xtrategy.co/about/" equals www.linkedin.com (Linkedin)
Source: chromecache_429.2.dr	String found in binary or memory: <a href="https://www.facebook.com/UZER.co" target="_blank" class="footer_link"><img equals www.facebook.com (Facebook)
Source: chromecache_512.2.dr	String found in binary or memory: src="https://www.facebook.com/tr?id=303367017008635&ev=PageView equals www.facebook.com (Facebook)
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: src="https://www.facebook.com/tr?id=524515998044999&ev=PageView&noscript=1" /></noscript> equals www.facebook.com (Facebook)
Source: chromecache_510.2.dr, chromecache_428.2.dr, chromecache_325.2.dr, chromecache_520.2.dr	String found in binary or memory: Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Yj:function(){e=zb()},nd:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: chromecache_510.2.dr, chromecache_428.2.dr, chromecache_325.2.dr, chromecache_520.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={eh:e,ah:f,bh:g,Ph:k,Qh:m,Ge:n,Bb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(QC(w,"iframe_api")\|\|QC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!HC&&OC(x[A],p.Ge))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_488.2.dr, chromecache_205.2.dr	String found in binary or memory: return b}DC.H="internal.enableAutoEventOnTimer";var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: chromecache_181.2.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_181.2.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_181.2.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: qdjtq.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.servientrega.com
Source: global traffic	DNS traffic detected: DNS query: s.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: mobile.servientrega.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: c.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: sth0d7m9clo4y72mjm8vh3.s.decidata.tv
Source: global traffic	DNS traffic detected: DNS query: tracker.metricool.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: uzer.co
Source: global traffic	DNS traffic detected: DNS query: owlcarousel2.github.io
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: js.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: js.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: forms.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: forms.hsforms.com
Source: global traffic	DNS traffic detected: DNS query: track.hubspot.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Fri, 27 Sep 2024 00:29:40 GMTTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Fri, 27 Sep 2024 00:29:47 GMTTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Fri, 27 Sep 2024 00:29:50 GMTTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Fri, 27 Sep 2024 00:30:04 GMTTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2000,i,5091690585223991164,14165352931940017661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qdjtq.com/modify/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2000,i,5091690585223991164,14165352931940017661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Link
scontent.xx.fbcdn.net	0%	Virustotal	Browse
forms.hsforms.com	0%	Virustotal	Browse
qdjtq.com	0%	Virustotal	Browse
stats.g.doubleclick.net	0%	Virustotal	Browse
code.jquery.com	1%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
js.hs-analytics.net	0%	Virustotal	Browse
script.hotjar.com	0%	Virustotal	Browse
owlcarousel2.github.io	0%	Virustotal	Browse
track.hubspot.com	0%	Virustotal	Browse
cdnjs.cloudflare.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
mobile.servientrega.com	0%	Virustotal	Browse
star-mini.c10r.facebook.com	0%	Virustotal	Browse
static-cdn.hotjar.com	0%	Virustotal	Browse
js.hs-banner.com	0%	Virustotal	Browse
js.hs-scripts.com	0%	Virustotal	Browse
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
forms.hscollectedforms.net	0%	Virustotal	Browse
td.doubleclick.net	0%	Virustotal	Browse
uzer.co	0%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	1%	Virustotal	Browse
googleads.g.doubleclick.net	0%	Virustotal	Browse
maxcdn.bootstrapcdn.com	0%	Virustotal	Browse
analytics.google.com	0%	Virustotal	Browse
s.go-mpulse.net	0%	Virustotal	Browse
www.linkedin.com	0%	Virustotal	Browse
cdn.jsdelivr.net	0%	Virustotal	Browse
unpkg.com	0%	Virustotal	Browse
connect.facebook.net	0%	Virustotal	Browse
px.ads.linkedin.com	0%	Virustotal	Browse
static.hotjar.com	0%	Virustotal	Browse
www.facebook.com	0%	Virustotal	Browse
js.hscollectedforms.net	0%	Virustotal	Browse
c.go-mpulse.net	0%	Virustotal	Browse
snap.licdn.com	0%	Virustotal	Browse
use.fontawesome.com	0%	Virustotal	Browse

Source: chromecache_492.2.dr	String found in binary or memory: http://daneden.me/animate
Source: chromecache_410.2.dr, chromecache_448.2.dr	String found in binary or memory: http://github.com/kenwheeler/slick
Source: chromecache_410.2.dr, chromecache_448.2.dr	String found in binary or memory: http://github.com/kenwheeler/slick/issues
Source: chromecache_185.2.dr	String found in binary or memory: http://hubs.ly/H0702_H0
Source: chromecache_286.2.dr, chromecache_456.2.dr	String found in binary or memory: http://jqueryvalidation.org/
Source: chromecache_410.2.dr, chromecache_448.2.dr	String found in binary or memory: http://kenwheeler.github.io
Source: chromecache_410.2.dr, chromecache_448.2.dr	String found in binary or memory: http://kenwheeler.github.io/slick
Source: chromecache_279.2.dr, chromecache_503.2.dr	String found in binary or memory: http://modernizr.com/download/#-csstransforms-csstransforms3d-shiv-cssclasses-prefixed-teststyles-te
Source: chromecache_279.2.dr, chromecache_492.2.dr, chromecache_503.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_334.2.dr, chromecache_516.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_266.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_227.2.dr, chromecache_529.2.dr, chromecache_295.2.dr, chromecache_343.2.dr	String found in binary or memory: http://www.hubspot.com
Source: chromecache_509.2.dr, chromecache_184.2.dr	String found in binary or memory: http://www.linkedin.com/shareArticle?url=
Source: chromecache_520.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_512.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Source: chromecache_383.2.dr, chromecache_366.2.dr, chromecache_330.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_443.2.dr, chromecache_175.2.dr	String found in binary or memory: https://app.vzaar.com/videos/:id
Source: chromecache_510.2.dr, chromecache_488.2.dr, chromecache_205.2.dr, chromecache_428.2.dr, chromecache_325.2.dr, chromecache_520.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_429.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/gh/Wruczek/Bootstrap-Cookie-Alert
Source: chromecache_429.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/jquery.validation/1.16.0/jquery.validate.min.js
Source: chromecache_429.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/intl-tel-input
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/vanilla-lazyload
Source: chromecache_429.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/Sly/1.6.1/sly.min.js
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/animate.min.css
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/js/bootstrap.min.js
Source: chromecache_429.2.dr	String found in binary or memory: https://clutch.co/profile/uzer-0#review-1925941
Source: chromecache_429.2.dr	String found in binary or memory: https://clutch.co/profile/uzer-0#review-1950744
Source: chromecache_429.2.dr	String found in binary or memory: https://clutch.co/profile/uzer-0#review-1955220
Source: chromecache_429.2.dr	String found in binary or memory: https://clutch.co/profile/uzer-0#review-1956301
Source: chromecache_429.2.dr	String found in binary or memory: https://clutch.co/profile/uzer-0#review-1998374
Source: chromecache_429.2.dr	String found in binary or memory: https://clutch.co/profile/uzer-0#review-2035646
Source: chromecache_429.2.dr	String found in binary or memory: https://clutch.co/profile/uzer-0#review-2165259
Source: chromecache_429.2.dr	String found in binary or memory: https://clutch.co/profile/uzer-0#review-2191089
Source: chromecache_429.2.dr	String found in binary or memory: https://clutch.co/profile/uzer-0?page=1#review-1966987
Source: chromecache_429.2.dr	String found in binary or memory: https://co.linkedin.com/company/xtrategy.co
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.6.0.min.js
Source: chromecache_396.2.dr, chromecache_490.2.dr, chromecache_181.2.dr	String found in binary or memory: https://connect.facebook.net/
Source: chromecache_429.2.dr, chromecache_512.2.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: chromecache_396.2.dr, chromecache_490.2.dr, chromecache_181.2.dr	String found in binary or memory: https://connect.facebook.net/log/fbevents_telemetry/
Source: chromecache_241.2.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_241.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Lexend:wght
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Noto
Source: chromecache_528.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Urbanist:wght
Source: chromecache_429.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: chromecache_474.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lexend/v19/wlpwgwvFAVdoq2_v-6QU.woff2)
Source: chromecache_474.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lexend/v19/wlpwgwvFAVdoq2_v9KQU4Wc.woff2)
Source: chromecache_474.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lexend/v19/wlpwgwvFAVdoq2_v9aQU4Wc.woff2)
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.0.wo
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.1.wo
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.10.w
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.11.w
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.2.wo
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.3.wo
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.4.wo
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.5.wo
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.6.wo
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.7.wo
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.8.wo
Source: chromecache_299.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.9.wo
Source: chromecache_522.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/urbanist/v15/L0x-DF02iFML4hGCyMqlbS0.woff2)
Source: chromecache_522.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/urbanist/v15/L0x-DF02iFML4hGCyMqrbS10ig.woff2)
Source: chromecache_249.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/urbanist/v15/L0xjDF02iFML4hGCyOCpRdycFsGxSrqDFRkvEZmq.woff2)
Source: chromecache_249.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/urbanist/v15/L0xjDF02iFML4hGCyOCpRdycFsGxSrqDFRkvH5mqe8Q.woff2)
Source: chromecache_303.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_257.2.dr, chromecache_362.2.dr, chromecache_481.2.dr, chromecache_451.2.dr, chromecache_427.2.dr, chromecache_438.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_443.2.dr, chromecache_175.2.dr, chromecache_378.2.dr	String found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: chromecache_493.2.dr, chromecache_489.2.dr, chromecache_195.2.dr	String found in binary or memory: https://github.com/Wruczek/Bootstrap-Cookie-Alert
Source: chromecache_387.2.dr, chromecache_446.2.dr, chromecache_279.2.dr, chromecache_503.2.dr	String found in binary or memory: https://github.com/darsain/sly
Source: chromecache_280.2.dr, chromecache_430.2.dr	String found in binary or memory: https://github.com/jackocnr/intl-tel-input.git
Source: chromecache_362.2.dr, chromecache_481.2.dr, chromecache_451.2.dr, chromecache_427.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_303.2.dr, chromecache_257.2.dr, chromecache_438.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_257.2.dr, chromecache_481.2.dr, chromecache_427.2.dr, chromecache_438.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_325.2.dr	String found in binary or memory: https://google.com
Source: chromecache_325.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_227.2.dr, chromecache_343.2.dr	String found in binary or memory: https://js-na1.hs-scripts.com/22144436.js
Source: chromecache_185.2.dr, chromecache_258.2.dr	String found in binary or memory: https://js.hs-analytics.net/analytics/1727397000000/22144436.js
Source: chromecache_529.2.dr, chromecache_295.2.dr	String found in binary or memory: https://js.hs-banner.com/v2
Source: chromecache_185.2.dr, chromecache_258.2.dr	String found in binary or memory: https://js.hs-banner.com/v2/22144436/banner.js
Source: chromecache_185.2.dr, chromecache_258.2.dr	String found in binary or memory: https://js.hscollectedforms.net/collectedforms.js
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: chromecache_429.2.dr	String found in binary or memory: https://noticias.UZER.co/
Source: chromecache_429.2.dr	String found in binary or memory: https://noticias.UZER.co/category/innovacion/
Source: chromecache_429.2.dr	String found in binary or memory: https://noticias.UZER.co/category/ui/
Source: chromecache_429.2.dr	String found in binary or memory: https://noticias.UZER.co/cuanto-aumenta-el-exito-de-un-producto-o-negocio-digital-con-user-experienc
Source: chromecache_429.2.dr	String found in binary or memory: https://noticias.UZER.co/la-apariencia-y-estetica-de-los-productos-digitales-es-determinante-en-la-g
Source: chromecache_429.2.dr	String found in binary or memory: https://noticias.uzer.co/en/uzer-secures-best-ux-consulting-and-design-agency-in-latin-america-for-t
Source: chromecache_429.2.dr	String found in binary or memory: https://noticias.uzer.co/uzer-premiada-como-mejor-agencia-de-consultoria-y-diseno-ux-de-latinoameric
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://owlcarousel2.github.io/OwlCarousel2/assets/owlcarousel/assets/owl.carousel.min.css
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://owlcarousel2.github.io/OwlCarousel2/assets/owlcarousel/owl.carousel.js
Source: chromecache_520.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_510.2.dr, chromecache_488.2.dr, chromecache_205.2.dr, chromecache_428.2.dr, chromecache_325.2.dr, chromecache_520.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_443.2.dr, chromecache_175.2.dr	String found in binary or memory: https://regexper.com/#(http%3A%7Chttps%3A%7C)%5C%2F%5C%2F(player.%7Cwww.%7Capp.)%3F(vimeo%5C.com%7Cy
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://schema.org
Source: chromecache_489.2.dr, chromecache_195.2.dr	String found in binary or memory: https://stackoverflow.com/a/39451131)
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: chromecache_510.2.dr, chromecache_428.2.dr, chromecache_325.2.dr, chromecache_520.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_330.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_383.2.dr, chromecache_366.2.dr, chromecache_330.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_510.2.dr, chromecache_488.2.dr, chromecache_205.2.dr, chromecache_428.2.dr, chromecache_325.2.dr, chromecache_520.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_509.2.dr, chromecache_184.2.dr	String found in binary or memory: https://twitter.com/intent/tweet?text=
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://twitter.com/xtrategyco
Source: chromecache_429.2.dr	String found in binary or memory: https://unpkg.com/aos
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://unpkg.com/popper.js
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://use.fontawesome.com/releases/v5.5.0/css/all.css
Source: chromecache_429.2.dr	String found in binary or memory: https://uzer.co/
Source: chromecache_429.2.dr	String found in binary or memory: https://uzer.co/MPPTD_XTRATEGY.CO.pdf
Source: chromecache_440.2.dr	String found in binary or memory: https://uzer.co/en
Source: chromecache_429.2.dr	String found in binary or memory: https://uzer.co/en/
Source: chromecache_440.2.dr	String found in binary or memory: https://uzer.co/error.html
Source: chromecache_429.2.dr	String found in binary or memory: https://uzer.co/uzer-logo-white.png
Source: chromecache_443.2.dr, chromecache_175.2.dr	String found in binary or memory: https://vimeo.com/:id
Source: chromecache_443.2.dr, chromecache_175.2.dr	String found in binary or memory: https://vimeo.com/channels/:channel/:id
Source: chromecache_443.2.dr, chromecache_175.2.dr	String found in binary or memory: https://vimeo.com/groups/:group/videos/:id
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://wa.me/573115564271?text=Hola
Source: chromecache_488.2.dr, chromecache_205.2.dr, chromecache_440.2.dr, chromecache_429.2.dr, chromecache_512.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_383.2.dr, chromecache_366.2.dr, chromecache_330.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_383.2.dr, chromecache_366.2.dr, chromecache_330.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_383.2.dr, chromecache_366.2.dr, chromecache_330.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_520.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_383.2.dr, chromecache_366.2.dr, chromecache_330.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_402.2.dr, chromecache_459.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/10981864615/?random
Source: chromecache_512.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chromecache_325.2.dr, chromecache_520.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_520.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_510.2.dr, chromecache_488.2.dr, chromecache_205.2.dr, chromecache_325.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_383.2.dr, chromecache_366.2.dr, chromecache_330.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-94GBDVKM3R
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-W4NBD3
Source: chromecache_510.2.dr, chromecache_488.2.dr, chromecache_205.2.dr, chromecache_325.2.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_429.2.dr	String found in binary or memory: https://www.instagram.com/UZER_co/
Source: chromecache_440.2.dr, chromecache_429.2.dr	String found in binary or memory: https://www.linkedin.com/company/xtrategy.co/about/
Source: chromecache_510.2.dr, chromecache_428.2.dr, chromecache_325.2.dr, chromecache_520.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_429.2.dr	String found in binary or memory: https://www.uzer.co/
Source: chromecache_510.2.dr, chromecache_428.2.dr, chromecache_325.2.dr, chromecache_520.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_443.2.dr, chromecache_175.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id
Source: chromecache_443.2.dr, chromecache_175.2.dr	String found in binary or memory: https://youtu.be/:id

Source	Detection	Scanner	Label	Link
https://qdjtq.com/modify/	100%	Avira URL Cloud	phishing
https://qdjtq.com/modify/	18%	Virustotal		Browse

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://fontawesome.com	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
https://connect.facebook.net/	0%	URL Reputation	safe
https://fontawesome.com/license/free	0%	URL Reputation	safe
http://daneden.me/animate	0%	URL Reputation	safe
https://uzer.co/error.html	0%	Avira URL Cloud	safe
https://clutch.co/profile/uzer-0#review-1956301	0%	Avira URL Cloud	safe
https://vimeo.com/groups/:group/videos/:id	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8munRy&sid=jnmURHTecJrkHRFxAHuG	100%	Avira URL Cloud	phishing
https://www.instagram.com/UZER_co/	0%	Avira URL Cloud	safe
https://qdjtq.com/modify/assets/d1a234c2ajMSD.js	100%	Avira URL Cloud	phishing
https://qdjtq.com/modify/assets/c27b6911ajMSD.js	100%	Avira URL Cloud	phishing
https://uzer.co/images/port5-m.png	0%	Avira URL Cloud	safe
https://youtu.be/:id	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muaSX	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mum-H&sid=jnmURHTecJrkHRFxAHuG	100%	Avira URL Cloud	phishing
https://uzer.co/images/port7.png	0%	Avira URL Cloud	safe
http://modernizr.com/download/#-csstransforms-csstransforms3d-shiv-cssclasses-prefixed-teststyles-te	0%	Avira URL Cloud	safe
https://www.facebook.com/tr/?id=303367017008635&ev=PageView&dl=https%3A%2F%2Fmobile.servientrega.com%2FWebSitePortal%2FRastreoEnvio.html&rl=https%3A%2F%2Fwww.servientrega.com%2F&if=true&ts=1727397023311&sw=1280&sh=1024&v=2.9.168&r=stable&ec=0&o=4126&fbp=fb.1.1727397023305.409210438132465739&cs_est=true&ler=other&cdl=API_unavailable&it=1727397021957&coo=false&rqm=GET	0%	Avira URL Cloud	safe
https://qdjtq.com/modify/assets/297557e4tE5dP.css	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mudzw&sid=RcIlUwyZYMmWAnsPAHt1	100%	Avira URL Cloud	phishing
https://www.uzer.co/	0%	Avira URL Cloud	safe
https://qdjtq.com/modify/layout/images/68.svg	100%	Avira URL Cloud	phishing
https://github.com/twbs/bootstrap/graphs/contributors)	0%	Avira URL Cloud	safe
https://mobile.servientrega.com/WebSitePortal/assets/css/plug.min.css	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mukbh&sid=EAVYAwv8c3Wq9ksAAHuA	100%	Avira URL Cloud	phishing
https://clutch.co/profile/uzer-0#review-1955220	0%	Avira URL Cloud	safe
https://uzer.co/css/style.css	0%	Avira URL Cloud	safe
https://uzer.co/images/ico-procesos-03.svg	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=_2bdYdjJ6QcQscIJAHty	100%	Avira URL Cloud	phishing
https://cdn.jsdelivr.net/npm/vanilla-lazyload	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muq3U&sid=yXWikhQOZczjci5kAHuJ	100%	Avira URL Cloud	phishing
https://qdjtq.com/modify/layout/images/56.svg	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mujOQ&sid=cG417RpQ48wOMxxtAHt7	100%	Avira URL Cloud	phishing
https://uzer.co/images/uzer-heading-bg-2024.jpg	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	0%	Avira URL Cloud	safe
https://uzer.co/images/ico-procesos-cta.svg	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mufNo&sid=N4xB_A2KRU780xSdAHt4	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mubv1&sid=_2bdYdjJ6QcQscIJAHty	100%	Avira URL Cloud	phishing
https://uzer.co/js/modernizr.js	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=cjtByYZSYtIZzkm5AHts	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mum-M&sid=jnmURHTecJrkHRFxAHuG	100%	Avira URL Cloud	phishing
https://cdnjs.cloudflare.com/ajax/libs/Sly/1.6.1/sly.min.js	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=RcIlUwyZYMmWAnsPAHt1	100%	Avira URL Cloud	phishing
https://qdjtq.com/modify/layout/images/53.svg	100%	Avira URL Cloud	phishing
https://clutch.co/profile/uzer-0#review-1925941	0%	Avira URL Cloud	safe
https://uzer.co/images/port6-m.png	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=3E0SqkwJomtmg_wKAHtv	100%	Avira URL Cloud	phishing
https://uzer.co/images/design-thinking-home.png	0%	Avira URL Cloud	safe
https://uzer.co/images/imagen-blog-01.png	0%	Avira URL Cloud	safe
https://uzer.co/images/port3.png	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=yXWikhQOZczjci5kAHuJ	100%	Avira URL Cloud	phishing
https://app.vzaar.com/videos/:id	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/gh/Wruczek/Bootstrap-Cookie-Alert	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muoqp	100%	Avira URL Cloud	phishing
https://qdjtq.com/favicon.ico	100%	Avira URL Cloud	phishing
https://qdjtq.com/api/MC4yMTY3NjQ0NTM3Mjk2OTA5	100%	Avira URL Cloud	phishing
https://noticias.uzer.co/uzer-premiada-como-mejor-agencia-de-consultoria-y-diseno-ux-de-latinoameric	0%	Avira URL Cloud	safe
https://twitter.com/xtrategyco	0%	Avira URL Cloud	safe
https://github.com/twbs/bootstrap/blob/master/LICENSE)	0%	Avira URL Cloud	safe
https://qdjtq.com/modify/layout/images/64.svg	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mukbn&sid=EAVYAwv8c3Wq9ksAAHuA	100%	Avira URL Cloud	phishing
https://js-na1.hs-scripts.com/22144436.js	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mucF3&sid=_2bdYdjJ6QcQscIJAHty	100%	Avira URL Cloud	phishing
https://js.hs-analytics.net/analytics/1727397000000/22144436.js	0%	Avira URL Cloud	safe
http://www.hubspot.com	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=jnmURHTecJrkHRFxAHuG	100%	Avira URL Cloud	phishing
https://twitter.com/intent/tweet?text=	0%	Avira URL Cloud	safe
https://uzer.co/images/port1-m.png	0%	Avira URL Cloud	safe
https://connect.facebook.net/signals/config/524515998044999?v=2.9.168&r=stable&domain=uzer.co&hme=3ba426d944c98eb3ce406a0f93fc097d0320a486b65b445a33b2eda3a5aa3429&ex_m=70%2C119%2C105%2C109%2C61%2C4%2C98%2C69%2C16%2C95%2C87%2C51%2C54%2C170%2C173%2C185%2C181%2C182%2C184%2C29%2C99%2C53%2C76%2C183%2C165%2C168%2C178%2C179%2C186%2C129%2C41%2C34%2C141%2C15%2C50%2C192%2C191%2C131%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C91%2C17%2C14%2C94%2C90%2C89%2C106%2C52%2C108%2C39%2C107%2C30%2C92%2C26%2C166%2C169%2C138%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C74%2C100%2C27%2C75%2C9%2C8%2C79%2C48%2C21%2C102%2C101%2C103%2C96%2C10%2C20%2C3%2C38%2C19%2C84%2C56%2C82%2C33%2C73%2C0%2C93%2C32%2C81%2C86%2C47%2C46%2C85%2C37%2C5%2C88%2C80%2C44%2C35%2C83%2C2%2C36%2C63%2C42%2C104%2C45%2C78%2C68%2C110%2C60%2C59%2C31%2C97%2C58%2C55%2C49%2C77%2C72%2C24%2C111	0%	Avira URL Cloud	safe
https://qdjtq.com/modify/layout/images/57.svg	100%	Avira URL Cloud	phishing
https://wa.me/573115564271?text=Hola	0%	Avira URL Cloud	safe
https://vimeo.com/channels/:channel/:id	0%	Avira URL Cloud	safe
https://js.hs-banner.com/v2	0%	Avira URL Cloud	safe
https://qdjtq.com/modify/assets/beb21690tE5dP.css	100%	Avira URL Cloud	phishing
https://qdjtq.com/modify/layout/images/67.svg	100%	Avira URL Cloud	phishing
https://cdn.jsdelivr.net/jquery.validation/1.16.0/jquery.validate.min.js	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muiHw&sid=cG417RpQ48wOMxxtAHt7	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mur3m&sid=VLhOORCLSY2MXW0LAHuP	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mulcg&sid=UFk3GnhaSs1mLKgMAHuD	100%	Avira URL Cloud	phishing
https://qdjtq.com/modify/assets/7f8692c3ajMSD.js	100%	Avira URL Cloud	phishing
https://uzer.co/images/design-sprints-home.png	0%	Avira URL Cloud	safe
https://mobile.servientrega.com/WebSitePortal/assets/css/app.css	0%	Avira URL Cloud	safe
https://js.hscollectedforms.net/collectedforms.js	0%	Avira URL Cloud	safe
https://uzer.co/js/forms.js	0%	Avira URL Cloud	safe
https://www.google.com/recaptcha/api.js	0%	Avira URL Cloud	safe
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muYmb&sid=cjtByYZSYtIZzkm5AHts	100%	Avira URL Cloud	phishing
https://qdjtq.com/modify/assets/e4b62962ajMSD.js	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mubYv	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muf1I	100%	Avira URL Cloud	phishing
https://uzer.co/en	0%	Avira URL Cloud	safe
https://uzer.co/images/port6.png	0%	Avira URL Cloud	safe
http://www.linkedin.com/shareArticle?url=	0%	Avira URL Cloud	safe
https://qdjtq.com/modify/assets/ee4b0686tE5dP.css	100%	Avira URL Cloud	phishing
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muehQ&sid=RcIlUwyZYMmWAnsPAHt1	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Antivirus Detection	Reputation
forms.hsforms.com	104.18.80.204	true	false	0%, Virustotal, Browse	unknown
qdjtq.com	129.226.167.139	true	false	0%, Virustotal, Browse	unknown
js.hs-analytics.net	104.17.175.201	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
stats.g.doubleclick.net	66.102.1.155	true	false	0%, Virustotal, Browse	unknown
owlcarousel2.github.io	185.199.108.153	true	false	0%, Virustotal, Browse	unknown
scontent.xx.fbcdn.net	157.240.253.1	true	false	0%, Virustotal, Browse	unknown
track.hubspot.com	104.16.118.116	true	false	0%, Virustotal, Browse	unknown
code.jquery.com	151.101.66.137	true	false	1%, Virustotal, Browse	unknown
script.hotjar.com	13.33.187.74	true	false	0%, Virustotal, Browse	unknown
forms.hscollectedforms.net	104.16.111.254	true	false	0%, Virustotal, Browse	unknown
mobile.servientrega.com	190.131.194.151	true	false	0%, Virustotal, Browse	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	0%, Virustotal, Browse	unknown
js.hs-scripts.com	104.16.140.209	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.181.228	true	false	0%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	87.248.204.0	true	false	1%, Virustotal, Browse	unknown
static-cdn.hotjar.com	18.66.102.106	true	false	0%, Virustotal, Browse	unknown
star-mini.c10r.facebook.com	157.240.0.35	true	false	0%, Virustotal, Browse	unknown
js.hs-banner.com	104.18.40.240	true	false	0%, Virustotal, Browse	unknown
uzer.co	84.32.84.113	true	false	0%, Virustotal, Browse	unknown
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	0%, Virustotal, Browse	unknown
sth0d7m9clo4y72mjm8vh3.s.decidata.tv	18.173.205.50	true	false		unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
googleads.g.doubleclick.net	142.250.186.34	true	false	0%, Virustotal, Browse	unknown
analytics.google.com	172.217.18.14	true	false	0%, Virustotal, Browse	unknown
td.doubleclick.net	142.250.184.194	true	false	0%, Virustotal, Browse	unknown
unpkg.com	104.17.248.203	true	false	0%, Virustotal, Browse	unknown
js.hscollectedforms.net	104.16.111.254	true	false	0%, Virustotal, Browse	unknown
s.go-mpulse.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
cdn.jsdelivr.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
use.fontawesome.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
static.hotjar.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.facebook.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.linkedin.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
connect.facebook.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
px.ads.linkedin.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
tracker.metricool.com	unknown	unknown	false		unknown
snap.licdn.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.servientrega.com	unknown	unknown	false		unknown
c.go-mpulse.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
https://uzer.co/error.html	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/modify/	true		unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8munRy&sid=jnmURHTecJrkHRFxAHuG	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/assets/d1a234c2ajMSD.js	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/assets/c27b6911ajMSD.js	true	Avira URL Cloud: phishing	unknown
https://uzer.co/images/port5-m.png	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muaSX	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mum-H&sid=jnmURHTecJrkHRFxAHuG	false	Avira URL Cloud: phishing	unknown
https://uzer.co/images/port7.png	false	Avira URL Cloud: safe	unknown
https://www.facebook.com/tr/?id=303367017008635&ev=PageView&dl=https%3A%2F%2Fmobile.servientrega.com%2FWebSitePortal%2FRastreoEnvio.html&rl=https%3A%2F%2Fwww.servientrega.com%2F&if=true&ts=1727397023311&sw=1280&sh=1024&v=2.9.168&r=stable&ec=0&o=4126&fbp=fb.1.1727397023305.409210438132465739&cs_est=true&ler=other&cdl=API_unavailable&it=1727397021957&coo=false&rqm=GET	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/modify/assets/297557e4tE5dP.css	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/layout/images/68.svg	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mudzw&sid=RcIlUwyZYMmWAnsPAHt1	false	Avira URL Cloud: phishing	unknown
https://mobile.servientrega.com/WebSitePortal/assets/css/plug.min.css	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mukbh&sid=EAVYAwv8c3Wq9ksAAHuA	false	Avira URL Cloud: phishing	unknown
https://uzer.co/css/style.css	false	Avira URL Cloud: safe	unknown
https://uzer.co/images/ico-procesos-03.svg	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=_2bdYdjJ6QcQscIJAHty	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muq3U&sid=yXWikhQOZczjci5kAHuJ	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/layout/images/56.svg	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mujOQ&sid=cG417RpQ48wOMxxtAHt7	false	Avira URL Cloud: phishing	unknown
https://uzer.co/images/uzer-heading-bg-2024.jpg	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	false	Avira URL Cloud: safe	unknown
https://uzer.co/images/ico-procesos-cta.svg	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mubv1&sid=_2bdYdjJ6QcQscIJAHty	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mufNo&sid=N4xB_A2KRU780xSdAHt4	false	Avira URL Cloud: phishing	unknown
https://uzer.co/js/modernizr.js	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=cjtByYZSYtIZzkm5AHts	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mum-M&sid=jnmURHTecJrkHRFxAHuG	false	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/Sly/1.6.1/sly.min.js	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=RcIlUwyZYMmWAnsPAHt1	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/layout/images/53.svg	true	Avira URL Cloud: phishing	unknown
https://uzer.co/images/port6-m.png	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=3E0SqkwJomtmg_wKAHtv	false	Avira URL Cloud: phishing	unknown
https://uzer.co/images/design-thinking-home.png	false	Avira URL Cloud: safe	unknown
https://uzer.co/images/imagen-blog-01.png	false	Avira URL Cloud: safe	unknown
https://uzer.co/images/port3.png	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=yXWikhQOZczjci5kAHuJ	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muoqp	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/api/MC4yMTY3NjQ0NTM3Mjk2OTA5	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/layout/images/64.svg	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mukbn&sid=EAVYAwv8c3Wq9ksAAHuA	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mucF3&sid=_2bdYdjJ6QcQscIJAHty	false	Avira URL Cloud: phishing	unknown
https://js.hs-analytics.net/analytics/1727397000000/22144436.js	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=websocket&sid=jnmURHTecJrkHRFxAHuG	false	Avira URL Cloud: phishing	unknown
https://uzer.co/images/port1-m.png	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/signals/config/524515998044999?v=2.9.168&r=stable&domain=uzer.co&hme=3ba426d944c98eb3ce406a0f93fc097d0320a486b65b445a33b2eda3a5aa3429&ex_m=70%2C119%2C105%2C109%2C61%2C4%2C98%2C69%2C16%2C95%2C87%2C51%2C54%2C170%2C173%2C185%2C181%2C182%2C184%2C29%2C99%2C53%2C76%2C183%2C165%2C168%2C178%2C179%2C186%2C129%2C41%2C34%2C141%2C15%2C50%2C192%2C191%2C131%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C91%2C17%2C14%2C94%2C90%2C89%2C106%2C52%2C108%2C39%2C107%2C30%2C92%2C26%2C166%2C169%2C138%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C74%2C100%2C27%2C75%2C9%2C8%2C79%2C48%2C21%2C102%2C101%2C103%2C96%2C10%2C20%2C3%2C38%2C19%2C84%2C56%2C82%2C33%2C73%2C0%2C93%2C32%2C81%2C86%2C47%2C46%2C85%2C37%2C5%2C88%2C80%2C44%2C35%2C83%2C2%2C36%2C63%2C42%2C104%2C45%2C78%2C68%2C110%2C60%2C59%2C31%2C97%2C58%2C55%2C49%2C77%2C72%2C24%2C111	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/modify/layout/images/57.svg	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/assets/beb21690tE5dP.css	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/layout/images/67.svg	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muiHw&sid=cG417RpQ48wOMxxtAHt7	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mur3m&sid=VLhOORCLSY2MXW0LAHuP	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mulcg&sid=UFk3GnhaSs1mLKgMAHuD	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/assets/7f8692c3ajMSD.js	true	Avira URL Cloud: phishing	unknown
https://uzer.co/images/design-sprints-home.png	false	Avira URL Cloud: safe	unknown
https://mobile.servientrega.com/WebSitePortal/assets/css/app.css	false	Avira URL Cloud: safe	unknown
https://js.hscollectedforms.net/collectedforms.js	false	Avira URL Cloud: safe	unknown
https://uzer.co/js/forms.js	false	Avira URL Cloud: safe	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muYmb&sid=cjtByYZSYtIZzkm5AHts	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/modify/assets/e4b62962ajMSD.js	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8mubYv	false	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muf1I	false	Avira URL Cloud: phishing	unknown
https://uzer.co/images/port6.png	false	Avira URL Cloud: safe	unknown
https://uzer.co/	false		unknown
https://qdjtq.com/modify/assets/ee4b0686tE5dP.css	true	Avira URL Cloud: phishing	unknown
https://qdjtq.com/socket.io/?EIO=4&transport=polling&t=P8muehQ&sid=RcIlUwyZYMmWAnsPAHt1	false	Avira URL Cloud: phishing	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://clutch.co/profile/uzer-0#review-1956301	chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/g/collect	chromecache_510.2.dr, chromecache_428.2.dr, chromecache_325.2.dr, chromecache_520.2.dr	false	URL Reputation: safe	unknown
https://vimeo.com/groups/:group/videos/:id	chromecache_443.2.dr, chromecache_175.2.dr	false	Avira URL Cloud: safe	unknown
https://www.instagram.com/UZER_co/	chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_383.2.dr, chromecache_366.2.dr, chromecache_330.2.dr	false	URL Reputation: safe	unknown
https://youtu.be/:id	chromecache_443.2.dr, chromecache_175.2.dr	false	Avira URL Cloud: safe	unknown
http://modernizr.com/download/#-csstransforms-csstransforms3d-shiv-cssclasses-prefixed-teststyles-te	chromecache_279.2.dr, chromecache_503.2.dr	false	Avira URL Cloud: safe	unknown
https://fontawesome.com	chromecache_241.2.dr	false	URL Reputation: safe	unknown
https://www.uzer.co/	chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_257.2.dr, chromecache_481.2.dr, chromecache_427.2.dr, chromecache_438.2.dr	false	Avira URL Cloud: safe	unknown
https://clutch.co/profile/uzer-0#review-1955220	chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/vanilla-lazyload	chromecache_440.2.dr, chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_330.2.dr	false	URL Reputation: safe	unknown
https://clutch.co/profile/uzer-0#review-1925941	chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://schema.org	chromecache_440.2.dr, chromecache_429.2.dr	false	URL Reputation: safe	unknown
https://app.vzaar.com/videos/:id	chromecache_443.2.dr, chromecache_175.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/gh/Wruczek/Bootstrap-Cookie-Alert	chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/	chromecache_396.2.dr, chromecache_490.2.dr, chromecache_181.2.dr	false	URL Reputation: safe	unknown
https://noticias.uzer.co/uzer-premiada-como-mejor-agencia-de-consultoria-y-diseno-ux-de-latinoameric	chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/xtrategyco	chromecache_440.2.dr, chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_303.2.dr, chromecache_257.2.dr, chromecache_438.2.dr	false	Avira URL Cloud: safe	unknown
https://js-na1.hs-scripts.com/22144436.js	chromecache_227.2.dr, chromecache_343.2.dr	false	Avira URL Cloud: safe	unknown
http://www.hubspot.com	chromecache_227.2.dr, chromecache_529.2.dr, chromecache_295.2.dr, chromecache_343.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/intent/tweet?text=	chromecache_509.2.dr, chromecache_184.2.dr	false	Avira URL Cloud: safe	unknown
https://wa.me/573115564271?text=Hola	chromecache_440.2.dr, chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://vimeo.com/channels/:channel/:id	chromecache_443.2.dr, chromecache_175.2.dr	false	Avira URL Cloud: safe	unknown
https://js.hs-banner.com/v2	chromecache_529.2.dr, chromecache_295.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/jquery.validation/1.16.0/jquery.validate.min.js	chromecache_429.2.dr	false	Avira URL Cloud: safe	unknown
https://fontawesome.com/license/free	chromecache_241.2.dr	false	URL Reputation: safe	unknown
http://daneden.me/animate	chromecache_492.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/api.js	chromecache_512.2.dr	false	Avira URL Cloud: safe	unknown
https://uzer.co/en	chromecache_440.2.dr	false	Avira URL Cloud: safe	unknown
http://www.linkedin.com/shareArticle?url=	chromecache_509.2.dr, chromecache_184.2.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
18.66.102.11	unknown	United States	3	MIT-GATEWAYSUS	false
104.17.248.203	unpkg.com	United States	13335	CLOUDFLARENETUS	false
18.173.205.50	sth0d7m9clo4y72mjm8vh3.s.decidata.tv	United States	3	MIT-GATEWAYSUS	false
151.101.130.137	unknown	United States	54113	FASTLYUS	false
104.16.118.116	track.hubspot.com	United States	13335	CLOUDFLARENETUS	false
66.102.1.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.40.240	js.hs-banner.com	United States	13335	CLOUDFLARENETUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
104.17.249.203	unknown	United States	13335	CLOUDFLARENETUS	false
77.37.53.40	unknown	Germany	31400	ACCELERATED-ITDE	false
84.32.84.113	uzer.co	Lithuania	33922	NTT-LT-ASLT	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
104.18.80.204	forms.hsforms.com	United States	13335	CLOUDFLARENETUS	false
104.16.140.209	js.hs-scripts.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.194	td.doubleclick.net	United States	15169	GOOGLEUS	false
157.240.0.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
104.16.137.209	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.175.201	js.hs-analytics.net	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.173.205.56	unknown	United States	3	MIT-GATEWAYSUS	false
185.199.108.153	owlcarousel2.github.io	Netherlands	54113	FASTLYUS	false
157.240.253.35	unknown	United States	32934	FACEBOOKUS	false
190.131.194.151	mobile.servientrega.com	Colombia	262191	COLUMBUSNETWORKSCOLOMBIACO	false
172.217.16.196	unknown	United States	15169	GOOGLEUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
104.19.175.188	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.18.14	analytics.google.com	United States	15169	GOOGLEUS	false
129.226.167.139	qdjtq.com	Singapore	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
18.66.102.106	static-cdn.hotjar.com	United States	3	MIT-GATEWAYSUS	false
104.16.110.254	unknown	United States	13335	CLOUDFLARENETUS	false
74.125.206.154	unknown	United States	15169	GOOGLEUS	false
142.250.74.194	unknown	United States	15169	GOOGLEUS	false
104.16.111.254	forms.hscollectedforms.net	United States	13335	CLOUDFLARENETUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.162	unknown	United States	15169	GOOGLEUS	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
157.240.253.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
13.33.187.74	script.hotjar.com	United States	16509	AMAZON-02US	false
157.240.251.35	unknown	United States	32934	FACEBOOKUS	false
104.16.117.116	unknown	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519928
Start date and time:	2024-09-27 02:28:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://qdjtq.com/modify/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@20/554@151/43
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: http://www.servientrega.com/wps/portal/rastreo-envio/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziTS08TTwMTAz93f1cTAwCg5yMfP0MHT2NPQ30w8EKDHAARwP9KGL041EQhd_4cP0oPFYYOfoaQRXgMaMgNzTCINNREQC2ok6g/# Browse: https://uzer.co/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2828
Entropy (8bit):	4.702208915781906
Encrypted:	false
SSDEEP:	48:cxnxGnsAP/3fUn5XULwkDrtk6UvpUhkzUV2emGcKU8hE:q+/e5XUkkftLMpUhkzUVSGJU8m
MD5:	6F4A7A49589ED8AF694003220991F244
SHA1:	2CBE51B914ED62236DFBF5C4E6D77ED765BE2699
SHA-256:	276101F05F88FC3394CB7515C626053A624413ABC4607AF869E0288AB6E637D5
SHA-512:	339C969ACEB361674FD0B362719021E4197C51B0C461AA4701BEFF9B6B5C6A6F8133CF4216EC9FC6E5F9E4C1219C1559871AF5ECDA32D5627EEF3937013DCF8B
Malicious:	false
Reputation:	low
URL:	https://www.servientrega.com/wps/contenthandler/!ut/p/digest!dWYvvbhKekcZQKtCvzyVng/dav/fs-type1/themes/New-Theme-Servientrega/images/svg/ico-empresas.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="43px" height="30px" viewBox="0 0 43 30" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>Group 29</title>. <g id="Plantilla-1---Menus-desplegados" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="Menu-Soluciones" transform="translate(-1088.000000, -126.000000)">. <g id="Group-29" transform="translate(1088.000000, 126.000000)">. <g id="Group-6" transform="translate(0.000000, 8.893769)">. <g id="Group-3" fill="#009A44">. <path d="M20.1868332,20.1871639 L18.8322719,20.1871639 L18.8322719,3.68059679 C18.8322719,3.45612296 18.6499437,3.27422175 18.4254735,3.27422175 L2.73234361,3.27422175 C2.50787345,3.27422175 2.32597522,3.45612296 2.32597522,3.68059679 L2.32597522,20.1871639 L0.812736767,20.1871639 L0.812736767,0.812750081 L20.1868332,0.812750081 L20.1868332,20.1871639 Z M3.13871199,7.

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 02:29:28.069242001 CEST	192.168.2.6	1.1.1.1	0xec45	Standard query (0)	qdjtq.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:29:28.069463968 CEST	192.168.2.6	1.1.1.1	0xeea5	Standard query (0)	qdjtq.com	65	IN (0x0001)	false
Sep 27, 2024 02:29:28.426184893 CEST	192.168.2.6	1.1.1.1	0x7916	Standard query (0)	qdjtq.com	65	IN (0x0001)	false
Sep 27, 2024 02:29:31.030585051 CEST	192.168.2.6	1.1.1.1	0x6e51	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:29:31.031164885 CEST	192.168.2.6	1.1.1.1	0x56d9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 02:29:33.048044920 CEST	192.168.2.6	1.1.1.1	0x684e	Standard query (0)	qdjtq.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:29:33.048554897 CEST	192.168.2.6	1.1.1.1	0x2c67	Standard query (0)	qdjtq.com	65	IN (0x0001)	false
Sep 27, 2024 02:29:33.474123001 CEST	192.168.2.6	1.1.1.1	0x7e25	Standard query (0)	qdjtq.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:08.901912928 CEST	192.168.2.6	1.1.1.1	0xd3a4	Standard query (0)	www.servientrega.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:08.902249098 CEST	192.168.2.6	1.1.1.1	0x14f4	Standard query (0)	www.servientrega.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:09.969381094 CEST	192.168.2.6	1.1.1.1	0xfd27	Standard query (0)	www.servientrega.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:09.969552040 CEST	192.168.2.6	1.1.1.1	0x295b	Standard query (0)	www.servientrega.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:14.586848974 CEST	192.168.2.6	1.1.1.1	0xab66	Standard query (0)	www.servientrega.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:14.587373972 CEST	192.168.2.6	1.1.1.1	0x1806	Standard query (0)	www.servientrega.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:16.247850895 CEST	192.168.2.6	1.1.1.1	0xa8ea	Standard query (0)	s.go-mpulse.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:16.248243093 CEST	192.168.2.6	1.1.1.1	0xcfb2	Standard query (0)	s.go-mpulse.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:16.260730028 CEST	192.168.2.6	1.1.1.1	0x4946	Standard query (0)	mobile.servientrega.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:16.260870934 CEST	192.168.2.6	1.1.1.1	0x24cb	Standard query (0)	mobile.servientrega.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:16.261699915 CEST	192.168.2.6	1.1.1.1	0x753f	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:16.261939049 CEST	192.168.2.6	1.1.1.1	0xee4	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:17.064554930 CEST	192.168.2.6	1.1.1.1	0xc296	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:17.065062046 CEST	192.168.2.6	1.1.1.1	0xb3f3	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:17.273288965 CEST	192.168.2.6	1.1.1.1	0x23fa	Standard query (0)	mobile.servientrega.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:17.273473978 CEST	192.168.2.6	1.1.1.1	0x7553	Standard query (0)	mobile.servientrega.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:17.536600113 CEST	192.168.2.6	1.1.1.1	0x6e8	Standard query (0)	s.go-mpulse.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:17.536724091 CEST	192.168.2.6	1.1.1.1	0xe0e5	Standard query (0)	s.go-mpulse.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:17.554615974 CEST	192.168.2.6	1.1.1.1	0x6378	Standard query (0)	c.go-mpulse.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:17.554771900 CEST	192.168.2.6	1.1.1.1	0x2cb2	Standard query (0)	c.go-mpulse.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:19.299242020 CEST	192.168.2.6	1.1.1.1	0x407f	Standard query (0)	c.go-mpulse.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:19.299395084 CEST	192.168.2.6	1.1.1.1	0x7969	Standard query (0)	c.go-mpulse.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:19.461185932 CEST	192.168.2.6	1.1.1.1	0xaf1a	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:19.461323977 CEST	192.168.2.6	1.1.1.1	0xdd97	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:20.301067114 CEST	192.168.2.6	1.1.1.1	0xc38e	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:20.301067114 CEST	192.168.2.6	1.1.1.1	0xa1d9	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:21.275738001 CEST	192.168.2.6	1.1.1.1	0x4e78	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:21.276299953 CEST	192.168.2.6	1.1.1.1	0x99e5	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:22.907107115 CEST	192.168.2.6	1.1.1.1	0x7b63	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:22.907449007 CEST	192.168.2.6	1.1.1.1	0x3434	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:22.975119114 CEST	192.168.2.6	1.1.1.1	0x9a95	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:22.975809097 CEST	192.168.2.6	1.1.1.1	0x30c6	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:24.126497030 CEST	192.168.2.6	1.1.1.1	0xa92f	Standard query (0)	mobile.servientrega.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:24.126637936 CEST	192.168.2.6	1.1.1.1	0x19d9	Standard query (0)	mobile.servientrega.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:24.147402048 CEST	192.168.2.6	1.1.1.1	0xb8c2	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:24.147833109 CEST	192.168.2.6	1.1.1.1	0xb180	Standard query (0)	snap.licdn.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:24.440975904 CEST	192.168.2.6	1.1.1.1	0x77cf	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:24.441464901 CEST	192.168.2.6	1.1.1.1	0xe0b2	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:24.819381952 CEST	192.168.2.6	1.1.1.1	0x7603	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:24.819566965 CEST	192.168.2.6	1.1.1.1	0xe439	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:25.137016058 CEST	192.168.2.6	1.1.1.1	0xf05	Standard query (0)	mobile.servientrega.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:25.137433052 CEST	192.168.2.6	1.1.1.1	0x8052	Standard query (0)	mobile.servientrega.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:25.221246958 CEST	192.168.2.6	1.1.1.1	0x5a4	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:25.221774101 CEST	192.168.2.6	1.1.1.1	0x486	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:25.690673113 CEST	192.168.2.6	1.1.1.1	0xf371	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:25.690988064 CEST	192.168.2.6	1.1.1.1	0x5aa5	Standard query (0)	snap.licdn.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:26.406400919 CEST	192.168.2.6	1.1.1.1	0x9cf6	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:26.406666040 CEST	192.168.2.6	1.1.1.1	0x4e31	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:26.416522980 CEST	192.168.2.6	1.1.1.1	0x91b7	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:26.416646004 CEST	192.168.2.6	1.1.1.1	0x2d5b	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:27.544248104 CEST	192.168.2.6	1.1.1.1	0xca41	Standard query (0)	sth0d7m9clo4y72mjm8vh3.s.decidata.tv	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:27.544663906 CEST	192.168.2.6	1.1.1.1	0x82b2	Standard query (0)	sth0d7m9clo4y72mjm8vh3.s.decidata.tv	65	IN (0x0001)	false
Sep 27, 2024 02:30:27.545741081 CEST	192.168.2.6	1.1.1.1	0xc3a1	Standard query (0)	tracker.metricool.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:27.545968056 CEST	192.168.2.6	1.1.1.1	0x97bd	Standard query (0)	tracker.metricool.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:28.570672989 CEST	192.168.2.6	1.1.1.1	0xba3c	Standard query (0)	tracker.metricool.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:28.570831060 CEST	192.168.2.6	1.1.1.1	0xd76f	Standard query (0)	tracker.metricool.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:28.621731043 CEST	192.168.2.6	1.1.1.1	0xf802	Standard query (0)	sth0d7m9clo4y72mjm8vh3.s.decidata.tv	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:28.621876001 CEST	192.168.2.6	1.1.1.1	0xc760	Standard query (0)	sth0d7m9clo4y72mjm8vh3.s.decidata.tv	65	IN (0x0001)	false
Sep 27, 2024 02:30:29.946686983 CEST	192.168.2.6	1.1.1.1	0x56fc	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:29.947602034 CEST	192.168.2.6	1.1.1.1	0xabdd	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:30.045285940 CEST	192.168.2.6	1.1.1.1	0x4a3c	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:30.045285940 CEST	192.168.2.6	1.1.1.1	0x5c23	Standard query (0)	www.linkedin.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:30.602760077 CEST	192.168.2.6	1.1.1.1	0x9502	Standard query (0)	tracker.metricool.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:31.616914988 CEST	192.168.2.6	1.1.1.1	0x9502	Standard query (0)	tracker.metricool.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:32.629611015 CEST	192.168.2.6	1.1.1.1	0x9502	Standard query (0)	tracker.metricool.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:34.636466980 CEST	192.168.2.6	1.1.1.1	0x9502	Standard query (0)	tracker.metricool.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:38.646491051 CEST	192.168.2.6	1.1.1.1	0x9502	Standard query (0)	tracker.metricool.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:40.902652979 CEST	192.168.2.6	1.1.1.1	0xc869	Standard query (0)	uzer.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:40.902894020 CEST	192.168.2.6	1.1.1.1	0x1c1	Standard query (0)	uzer.co	65	IN (0x0001)	false
Sep 27, 2024 02:30:41.737677097 CEST	192.168.2.6	1.1.1.1	0x6390	Standard query (0)	owlcarousel2.github.io	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:41.738148928 CEST	192.168.2.6	1.1.1.1	0xfdf9	Standard query (0)	owlcarousel2.github.io	65	IN (0x0001)	false
Sep 27, 2024 02:30:41.739624977 CEST	192.168.2.6	1.1.1.1	0xed0a	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:41.739901066 CEST	192.168.2.6	1.1.1.1	0x4df3	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:41.742768049 CEST	192.168.2.6	1.1.1.1	0x3a6b	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:41.743649006 CEST	192.168.2.6	1.1.1.1	0xf973	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:41.753516912 CEST	192.168.2.6	1.1.1.1	0xf282	Standard query (0)	use.fontawesome.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:41.753945112 CEST	192.168.2.6	1.1.1.1	0x4f56	Standard query (0)	use.fontawesome.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:41.754374981 CEST	192.168.2.6	1.1.1.1	0xf42e	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:41.754868984 CEST	192.168.2.6	1.1.1.1	0xc0d3	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:41.756129026 CEST	192.168.2.6	1.1.1.1	0xa07a	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:41.757038116 CEST	192.168.2.6	1.1.1.1	0x3f65	Standard query (0)	maxcdn.bootstrapcdn.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:41.761940002 CEST	192.168.2.6	1.1.1.1	0x9749	Standard query (0)	unpkg.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:41.762593985 CEST	192.168.2.6	1.1.1.1	0xf39f	Standard query (0)	unpkg.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:45.861221075 CEST	192.168.2.6	1.1.1.1	0xb1bc	Standard query (0)	owlcarousel2.github.io	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:45.861887932 CEST	192.168.2.6	1.1.1.1	0x687b	Standard query (0)	owlcarousel2.github.io	65	IN (0x0001)	false
Sep 27, 2024 02:30:47.181878090 CEST	192.168.2.6	1.1.1.1	0xa86c	Standard query (0)	uzer.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:47.182125092 CEST	192.168.2.6	1.1.1.1	0xbcd4	Standard query (0)	uzer.co	65	IN (0x0001)	false
Sep 27, 2024 02:30:47.294504881 CEST	192.168.2.6	1.1.1.1	0x4ee6	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:47.294979095 CEST	192.168.2.6	1.1.1.1	0xc252	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:48.578128099 CEST	192.168.2.6	1.1.1.1	0xc17a	Standard query (0)	unpkg.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:48.578375101 CEST	192.168.2.6	1.1.1.1	0x1d08	Standard query (0)	unpkg.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:49.646802902 CEST	192.168.2.6	1.1.1.1	0x704f	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:49.647051096 CEST	192.168.2.6	1.1.1.1	0xabdd	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:50.913707018 CEST	192.168.2.6	1.1.1.1	0x8c59	Standard query (0)	js.hs-scripts.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:50.913957119 CEST	192.168.2.6	1.1.1.1	0xea37	Standard query (0)	js.hs-scripts.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:51.567945957 CEST	192.168.2.6	1.1.1.1	0x5ff6	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:51.568109989 CEST	192.168.2.6	1.1.1.1	0x52ec	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:51.655875921 CEST	192.168.2.6	1.1.1.1	0xeb6	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:51.656419992 CEST	192.168.2.6	1.1.1.1	0x27c4	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:51.673929930 CEST	192.168.2.6	1.1.1.1	0xc5ff	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:51.674201965 CEST	192.168.2.6	1.1.1.1	0x45b0	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:51.949323893 CEST	192.168.2.6	1.1.1.1	0x50ab	Standard query (0)	js.hs-scripts.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:51.949465036 CEST	192.168.2.6	1.1.1.1	0xaeb4	Standard query (0)	js.hs-scripts.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:52.674385071 CEST	192.168.2.6	1.1.1.1	0xd10b	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:52.674928904 CEST	192.168.2.6	1.1.1.1	0x4a02	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:52.677776098 CEST	192.168.2.6	1.1.1.1	0xcb07	Standard query (0)	static.hotjar.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:52.678081036 CEST	192.168.2.6	1.1.1.1	0x51d9	Standard query (0)	static.hotjar.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:53.954533100 CEST	192.168.2.6	1.1.1.1	0xfa16	Standard query (0)	js.hs-banner.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:53.954785109 CEST	192.168.2.6	1.1.1.1	0x65b9	Standard query (0)	js.hs-banner.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:53.970336914 CEST	192.168.2.6	1.1.1.1	0xe208	Standard query (0)	js.hs-analytics.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:53.970501900 CEST	192.168.2.6	1.1.1.1	0x57a5	Standard query (0)	js.hs-analytics.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:54.003705978 CEST	192.168.2.6	1.1.1.1	0xccb7	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:54.004420042 CEST	192.168.2.6	1.1.1.1	0x919c	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:54.086546898 CEST	192.168.2.6	1.1.1.1	0x57e2	Standard query (0)	js.hscollectedforms.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:54.086738110 CEST	192.168.2.6	1.1.1.1	0x17a8	Standard query (0)	js.hscollectedforms.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:54.108292103 CEST	192.168.2.6	1.1.1.1	0xc07b	Standard query (0)	script.hotjar.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:54.108814001 CEST	192.168.2.6	1.1.1.1	0xf97b	Standard query (0)	script.hotjar.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:54.111921072 CEST	192.168.2.6	1.1.1.1	0xc06	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:54.112051964 CEST	192.168.2.6	1.1.1.1	0xb8f5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:54.114371061 CEST	192.168.2.6	1.1.1.1	0xcf4d	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:54.114581108 CEST	192.168.2.6	1.1.1.1	0x7a1c	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:54.978916883 CEST	192.168.2.6	1.1.1.1	0x5bfc	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:54.979070902 CEST	192.168.2.6	1.1.1.1	0x2544	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:55.055597067 CEST	192.168.2.6	1.1.1.1	0xae5	Standard query (0)	forms.hscollectedforms.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:55.055816889 CEST	192.168.2.6	1.1.1.1	0x7e0a	Standard query (0)	forms.hscollectedforms.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:55.076579094 CEST	192.168.2.6	1.1.1.1	0x5e33	Standard query (0)	js.hs-analytics.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:55.076982021 CEST	192.168.2.6	1.1.1.1	0x1c38	Standard query (0)	js.hs-analytics.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:55.078084946 CEST	192.168.2.6	1.1.1.1	0x9e49	Standard query (0)	js.hs-banner.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:55.078325033 CEST	192.168.2.6	1.1.1.1	0x95f5	Standard query (0)	js.hs-banner.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:55.079567909 CEST	192.168.2.6	1.1.1.1	0x7c2c	Standard query (0)	js.hscollectedforms.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:55.079758883 CEST	192.168.2.6	1.1.1.1	0x9234	Standard query (0)	js.hscollectedforms.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:55.228744984 CEST	192.168.2.6	1.1.1.1	0xd552	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:55.229306936 CEST	192.168.2.6	1.1.1.1	0xc5d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:55.774122953 CEST	192.168.2.6	1.1.1.1	0xb8fb	Standard query (0)	forms.hsforms.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:55.774290085 CEST	192.168.2.6	1.1.1.1	0x9a92	Standard query (0)	forms.hsforms.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:56.360030890 CEST	192.168.2.6	1.1.1.1	0xe17a	Standard query (0)	forms.hscollectedforms.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:56.360141039 CEST	192.168.2.6	1.1.1.1	0x984	Standard query (0)	forms.hscollectedforms.net	65	IN (0x0001)	false
Sep 27, 2024 02:30:56.707313061 CEST	192.168.2.6	1.1.1.1	0x512b	Standard query (0)	forms.hsforms.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:56.707674980 CEST	192.168.2.6	1.1.1.1	0x9488	Standard query (0)	forms.hsforms.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:57.081298113 CEST	192.168.2.6	1.1.1.1	0x5c51	Standard query (0)	track.hubspot.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:57.081432104 CEST	192.168.2.6	1.1.1.1	0x7bb2	Standard query (0)	track.hubspot.com	65	IN (0x0001)	false
Sep 27, 2024 02:30:57.847151995 CEST	192.168.2.6	1.1.1.1	0x80db	Standard query (0)	track.hubspot.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 02:30:57.847465038 CEST	192.168.2.6	1.1.1.1	0xc5a7	Standard query (0)	track.hubspot.com	65	IN (0x0001)	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://qdjtq.com/modify/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Windows Analysis Report
https://qdjtq.com/modify/

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 4c 4c 4f 36 48 41 4f 48 6b 6d 78 6d 32 6f 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 37 37 34 31 62 38 61 34 30 62 61 34 65 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: hLLO6HAOHkmxm2oE.1Context: de7741b8a40ba4e9
2024-09-27 00:29:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 00:29:25 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 68 4c 4c 4f 36 48 41 4f 48 6b 6d 78 6d 32 6f 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 37 37 34 31 62 38 61 34 30 62 61 34 65 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: hLLO6HAOHkmxm2oE.2Context: de7741b8a40ba4e9<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-09-27 00:29:25 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 4c 4c 4f 36 48 41 4f 48 6b 6d 78 6d 32 6f 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 37 37 34 31 62 38 61 34 30 62 61 34 65 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: hLLO6HAOHkmxm2oE.3Context: de7741b8a40ba4e9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 00:29:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 00:29:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6f 62 73 70 69 44 48 54 65 6b 57 45 4e 47 5a 57 4f 39 6e 67 51 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: obspiDHTekWENGZWO9ngQA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:29 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 52 2f 39 53 37 67 38 50 45 4b 38 63 6d 4f 70 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 63 34 65 37 63 63 63 38 34 33 62 32 30 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: kR/9S7g8PEK8cmOp.1Context: d2c4e7ccc843b200
2024-09-27 00:29:29 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 00:29:29 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6b 52 2f 39 53 37 67 38 50 45 4b 38 63 6d 4f 70 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 63 34 65 37 63 63 63 38 34 33 62 32 30 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 2f 46 6d 55 48 49 65 72 35 62 48 42 54 6b 4f 58 4f 45 4f 38 6a 6b 45 63 78 71 77 4f 52 74 6c 2f 6d 6b 59 47 62 66 76 67 6a 42 51 4c 43 52 56 4b 72 41 54 54 4b 2b 76 36 78 71 50 45 32 38 67 47 75 63 36 62 63 58 79 6f 66 77 37 2b 6a 54 64 6f 7a 57 6c 4b 32 5a 54 75 74 64 70 5a 42 38 4b 56 6f 79 64 30 61 75 6a 56 78 50 4e 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: kR/9S7g8PEK8cmOp.2Context: d2c4e7ccc843b200<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe/FmUHIer5bHBTkOXOEO8jkEcxqwORtl/mkYGbfvgjBQLCRVKrATTK+v6xqPE28gGuc6bcXyofw7+jTdozWlK2ZTutdpZB8KVoyd0aujVxPNf
2024-09-27 00:29:29 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6b 52 2f 39 53 37 67 38 50 45 4b 38 63 6d 4f 70 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 63 34 65 37 63 63 63 38 34 33 62 32 30 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: kR/9S7g8PEK8cmOp.3Context: d2c4e7ccc843b200<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 00:29:29 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 00:29:29 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 35 70 4d 6f 76 35 53 76 30 65 61 6c 77 67 73 31 38 4d 52 78 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: f5pMov5Sv0ealwgs18MRxQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:29 UTC	659	OUT	GET /modify/ HTTP/1.1 Host: qdjtq.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 00:29:29 UTC	347	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Fri, 27 Sep 2024 00:29:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1638 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 17 Jun 2024 05:04:28 GMT ETag: W/"666-19024951360"
2024-09-27 00:29:29 UTC	1638	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 0a 20 20 20 20 20 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 0a 20 20 20 20 2f 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 73 72 63 3d 22 2e 2f 61 73 73 65 74 73 2f 69 6e 64 65 78 2d 37 63 31 65 64 65 66 38 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no" /> <script type="module" crossorigin src="./assets/index-7c1edef8.js"></script>

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:30 UTC	565	OUT	GET /modify/assets/index-7c1edef8.js HTTP/1.1 Host: qdjtq.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://qdjtq.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://qdjtq.com/modify/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 00:29:30 UTC	364	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Fri, 27 Sep 2024 00:29:30 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 503862 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 17 Jun 2024 05:04:38 GMT ETag: W/"7b036-19024953a70"
2024-09-27 00:29:30 UTC	16020	IN	Data Raw: 76 61 72 20 61 33 38 5f 30 78 33 39 61 63 66 63 3d 61 33 38 5f 30 78 32 31 36 33 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 66 36 61 32 37 2c 5f 30 78 33 66 33 35 33 30 29 7b 76 61 72 20 5f 30 78 64 66 36 34 62 34 3d 61 33 38 5f 30 78 32 31 36 33 2c 5f 30 78 34 38 30 38 32 31 3d 5f 30 78 33 66 36 61 32 37 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 34 39 37 31 64 38 3d 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 64 66 36 34 62 34 28 30 78 31 62 30 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 64 66 36 34 62 34 28 30 78 36 63 32 29 29 2f 30 78 32 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 64 66 36 34 62 34 28 30 78 34 63 61 29 29 2f 30 78 33 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 64 66 36 34 62 34 28 30 78 32 39 Data Ascii: var a38_0x39acfc=a38_0x2163;(function(_0x3f6a27,_0x3f3530){var _0xdf64b4=a38_0x2163,_0x480821=_0x3f6a27();while(!![]){try{var _0x4971d8=-parseInt(_0xdf64b4(0x1b0))/0x1+parseInt(_0xdf64b4(0x6c2))/0x2+parseInt(_0xdf64b4(0x4ca))/0x3*(-parseInt(_0xdf64b4(0x29
2024-09-27 00:29:30 UTC	16384	IN	Data Raw: 30 3d 5f 30 78 33 66 35 61 30 38 3d 3e 42 65 28 5f 30 78 33 66 35 61 30 38 29 26 26 5f 30 78 33 66 35 61 30 38 21 3d 3d 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 78 33 39 33 29 26 26 5f 30 78 33 66 35 61 30 38 5b 30 78 30 5d 21 3d 3d 27 2d 27 26 26 27 27 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 33 66 35 61 30 38 2c 30 78 61 29 3d 3d 3d 5f 30 78 33 66 35 61 30 38 2c 54 72 3d 54 30 28 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 78 34 36 33 29 2b 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 78 33 32 32 29 2b 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 78 35 65 31 29 2b 27 64 65 42 65 66 6f 72 65 4d 6f 27 2b 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 78 35 36 34 29 2b 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 78 35 65 32 29 2b 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 Data Ascii: 0=_0x3f5a08=>Be(_0x3f5a08)&&_0x3f5a08!==a38_0x39acfc(0x393)&&_0x3f5a08[0x0]!=='-'&&''+parseInt(_0x3f5a08,0xa)===_0x3f5a08,Tr=T0(a38_0x39acfc(0x463)+a38_0x39acfc(0x322)+a38_0x39acfc(0x5e1)+'deBeforeMo'+a38_0x39acfc(0x564)+a38_0x39acfc(0x5e2)+a38_0x39acfc(0
2024-09-27 00:29:31 UTC	16384	IN	Data Raw: 7d 2c 27 68 61 73 27 28 5f 30 78 33 61 31 37 33 36 29 7b 76 61 72 20 5f 30 78 33 32 35 66 64 61 3d 5f 30 78 64 66 37 30 39 37 3b 72 65 74 75 72 6e 20 62 72 5b 5f 30 78 33 32 35 66 64 61 28 30 78 37 35 30 29 5d 28 74 68 69 73 2c 5f 30 78 33 61 31 37 33 36 2c 21 30 78 30 29 3b 7d 2c 27 61 64 64 27 3a 67 74 28 27 61 64 64 27 29 2c 27 73 65 74 27 3a 67 74 28 5f 30 78 64 66 37 30 39 37 28 30 78 35 30 36 29 29 2c 27 64 65 6c 65 74 65 27 3a 67 74 28 27 64 65 6c 65 74 65 27 29 2c 27 63 6c 65 61 72 27 3a 67 74 28 5f 30 78 64 66 37 30 39 37 28 30 78 36 63 38 29 29 2c 27 66 6f 72 45 61 63 68 27 3a 44 72 28 21 30 78 30 2c 21 30 78 30 29 7d 3b 72 65 74 75 72 6e 5b 5f 30 78 64 66 37 30 39 37 28 30 78 36 32 32 29 2c 5f 30 78 64 66 37 30 39 37 28 30 78 35 34 37 29 2c 5f Data Ascii: },'has'(_0x3a1736){var _0x325fda=_0xdf7097;return br[_0x325fda(0x750)](this,_0x3a1736,!0x0);},'add':gt('add'),'set':gt(_0xdf7097(0x506)),'delete':gt('delete'),'clear':gt(_0xdf7097(0x6c8)),'forEach':Dr(!0x0,!0x0)};return[_0xdf7097(0x622),_0xdf7097(0x547),_
2024-09-27 00:29:31 UTC	16384	IN	Data Raw: 34 61 35 31 38 34 7d 3d 5f 30 78 31 66 37 32 37 65 2c 5f 30 78 32 64 34 33 62 65 3d 5f 30 78 33 32 65 35 37 36 5b 5f 30 78 33 38 39 34 66 39 28 30 78 32 61 32 29 2b 27 6e 73 27 5d 3b 69 66 28 5f 30 78 31 66 37 32 37 65 5b 5f 30 78 33 38 39 34 66 39 28 30 78 31 64 33 29 5d 7c 7c 5f 30 78 31 66 37 32 37 65 5b 5f 30 78 33 38 39 34 66 39 28 30 78 34 37 30 29 5d 29 72 65 74 75 72 6e 21 30 78 30 3b 69 66 28 5f 30 78 34 33 64 66 66 31 26 26 5f 30 78 34 61 35 31 38 34 3e 3d 30 78 30 29 7b 69 66 28 5f 30 78 34 61 35 31 38 34 26 30 78 34 30 30 29 72 65 74 75 72 6e 21 30 78 30 3b 69 66 28 5f 30 78 34 61 35 31 38 34 26 30 78 31 30 29 72 65 74 75 72 6e 20 5f 30 78 33 32 39 63 32 64 3f 52 73 28 5f 30 78 33 32 39 63 32 64 2c 5f 30 78 31 31 36 30 66 62 2c 5f 30 78 32 64 Data Ascii: 4a5184}=_0x1f727e,_0x2d43be=_0x32e576[_0x3894f9(0x2a2)+'ns'];if(_0x1f727e[_0x3894f9(0x1d3)]\|\|_0x1f727e[_0x3894f9(0x470)])return!0x0;if(_0x43dff1&&_0x4a5184>=0x0){if(_0x4a5184&0x400)return!0x0;if(_0x4a5184&0x10)return _0x329c2d?Rs(_0x329c2d,_0x1160fb,_0x2d
2024-09-27 00:29:31 UTC	16384	IN	Data Raw: 30 78 32 36 62 65 31 35 2c 5f 30 78 34 34 32 31 65 35 29 7c 7c 64 65 28 5f 30 78 33 62 34 39 32 31 2c 5f 30 78 34 34 32 31 65 35 29 7c 7c 64 65 28 75 72 2c 5f 30 78 34 34 32 31 65 35 29 7c 7c 64 65 28 5f 30 78 35 31 64 36 62 62 5b 27 63 6f 6e 66 69 67 27 5d 5b 5f 30 78 34 37 36 62 33 64 28 30 78 32 63 39 29 2b 27 65 72 74 69 65 73 27 5d 2c 5f 30 78 34 34 32 31 65 35 29 3b 7d 2c 27 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 27 28 5f 30 78 62 39 65 61 39 39 2c 5f 30 78 32 64 37 61 62 35 2c 5f 30 78 61 36 30 37 64 29 7b 76 61 72 20 5f 30 78 37 66 31 65 33 34 3d 61 33 38 5f 30 78 33 39 61 63 66 63 3b 72 65 74 75 72 6e 20 5f 30 78 61 36 30 37 64 5b 27 67 65 74 27 5d 21 3d 6e 75 6c 6c 3f 5f 30 78 62 39 65 61 39 39 5b 27 5f 27 5d 5b 5f 30 78 37 66 31 65 33 34 28 Data Ascii: 0x26be15,_0x4421e5)\|\|de(_0x3b4921,_0x4421e5)\|\|de(ur,_0x4421e5)\|\|de(_0x51d6bb['config'][_0x476b3d(0x2c9)+'erties'],_0x4421e5);},'defineProperty'(_0xb9ea99,_0x2d7ab5,_0xa607d){var _0x7f1e34=a38_0x39acfc;return _0xa607d['get']!=null?_0xb9ea99['_'][_0x7f1e34(
2024-09-27 00:29:31 UTC	16384	IN	Data Raw: 2c 5f 30 78 34 36 33 39 61 31 29 29 2c 5f 30 78 32 39 62 33 62 39 21 3d 6e 75 6c 6c 26 26 21 79 65 28 5f 30 78 32 39 62 33 62 39 29 26 26 28 5f 30 78 32 39 62 33 62 39 3d 6e 75 6c 6c 29 3b 63 6f 6e 73 74 20 5f 30 78 34 36 36 62 39 62 3d 6a 61 28 29 2c 5f 30 78 33 65 38 30 66 65 3d 6e 65 77 20 53 65 74 28 29 3b 6c 65 74 20 5f 30 78 64 31 65 39 39 3d 21 30 78 31 3b 63 6f 6e 73 74 20 5f 30 78 33 37 33 33 30 30 3d 5f 30 78 34 36 36 62 39 62 5b 27 61 70 70 27 5d 3d 7b 27 5f 75 69 64 27 3a 62 6c 2b 2b 2c 27 5f 63 6f 6d 70 6f 6e 65 6e 74 27 3a 5f 30 78 34 36 33 39 61 31 2c 27 5f 70 72 6f 70 73 27 3a 5f 30 78 32 39 62 33 62 39 2c 27 5f 63 6f 6e 74 61 69 6e 65 72 27 3a 6e 75 6c 6c 2c 27 5f 63 6f 6e 74 65 78 74 27 3a 5f 30 78 34 36 36 62 39 62 2c 27 5f 69 6e 73 74 Data Ascii: ,_0x4639a1)),_0x29b3b9!=null&&!ye(_0x29b3b9)&&(_0x29b3b9=null);const _0x466b9b=ja(),_0x3e80fe=new Set();let _0xd1e99=!0x1;const _0x373300=_0x466b9b['app']={'_uid':bl++,'_component':_0x4639a1,'_props':_0x29b3b9,'_container':null,'_context':_0x466b9b,'_inst
2024-09-27 00:29:31 UTC	16384	IN	Data Raw: 27 73 75 62 54 72 65 65 27 5d 3d 5f 30 78 34 36 34 32 35 65 2c 5f 30 78 32 65 64 39 38 66 28 5f 30 78 32 38 33 38 31 65 2c 5f 30 78 34 36 34 32 35 65 2c 5f 30 78 34 31 62 66 63 32 28 5f 30 78 32 38 33 38 31 65 5b 27 65 6c 27 5d 29 2c 5f 30 78 34 61 37 63 66 37 28 5f 30 78 32 38 33 38 31 65 29 2c 5f 30 78 35 36 35 61 30 39 2c 5f 30 78 61 38 31 34 61 32 2c 5f 30 78 33 35 35 39 31 30 29 2c 5f 30 78 32 31 65 32 64 32 5b 27 65 6c 27 5d 3d 5f 30 78 34 36 34 32 35 65 5b 27 65 6c 27 5d 2c 5f 30 78 33 35 39 37 38 61 3d 3d 3d 6e 75 6c 6c 26 26 47 75 28 5f 30 78 35 36 35 61 30 39 2c 5f 30 78 34 36 34 32 35 65 5b 27 65 6c 27 5d 29 2c 5f 30 78 34 61 66 64 30 34 26 26 4e 65 28 5f 30 78 34 61 66 64 30 34 2c 5f 30 78 61 38 31 34 61 32 29 2c 28 5f 30 78 32 30 65 65 36 64 Data Ascii: 'subTree']=_0x46425e,_0x2ed98f(_0x28381e,_0x46425e,_0x41bfc2(_0x28381e['el']),_0x4a7cf7(_0x28381e),_0x565a09,_0xa814a2,_0x355910),_0x21e2d2['el']=_0x46425e['el'],_0x35978a===null&&Gu(_0x565a09,_0x46425e['el']),_0x4afd04&&Ne(_0x4afd04,_0xa814a2),(_0x20ee6d
2024-09-27 00:29:31 UTC	16384	IN	Data Raw: 6d 69 63 43 68 69 27 2b 5f 30 78 35 33 63 35 37 38 28 30 78 33 62 36 29 5d 2c 5f 30 78 32 61 39 62 33 35 2c 5f 30 78 65 66 35 61 64 2c 5f 30 78 31 37 35 31 30 35 2c 5f 30 78 32 32 32 35 62 64 2c 5f 30 78 31 31 34 39 39 37 2c 5f 30 78 32 37 63 32 66 35 29 2c 51 30 28 5f 30 78 35 33 34 63 37 61 2c 5f 30 78 31 36 65 38 64 62 2c 21 30 78 30 29 29 3a 5f 30 78 66 61 31 61 38 63 7c 7c 5f 30 78 32 31 30 35 31 33 28 5f 30 78 35 33 34 63 37 61 2c 5f 30 78 31 36 65 38 64 62 2c 5f 30 78 65 66 35 61 64 2c 5f 30 78 62 33 37 61 35 65 2c 5f 30 78 31 37 35 31 30 35 2c 5f 30 78 32 32 32 35 62 64 2c 5f 30 78 31 31 34 39 39 37 2c 5f 30 78 32 37 63 32 66 35 2c 21 30 78 31 29 2c 5f 30 78 35 37 61 36 39 32 29 5f 30 78 33 38 62 32 65 63 7c 7c 52 72 28 5f 30 78 31 36 65 38 64 62 Data Ascii: micChi'+_0x53c578(0x3b6)],_0x2a9b35,_0xef5ad,_0x175105,_0x2225bd,_0x114997,_0x27c2f5),Q0(_0x534c7a,_0x16e8db,!0x0)):_0xfa1a8c\|\|_0x210513(_0x534c7a,_0x16e8db,_0xef5ad,_0xb37a5e,_0x175105,_0x2225bd,_0x114997,_0x27c2f5,!0x1),_0x57a692)_0x38b2ec\|\|Rr(_0x16e8db
2024-09-27 00:29:31 UTC	16384	IN	Data Raw: 63 66 63 28 30 78 34 33 63 29 2b 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 78 34 38 62 29 2b 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 78 35 36 63 29 2c 4f 74 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 3c 27 75 27 3f 64 6f 63 75 6d 65 6e 74 3a 6e 75 6c 6c 2c 55 73 3d 4f 74 26 26 4f 74 5b 61 33 38 5f 30 78 33 39 61 63 66 63 28 30 78 35 63 61 29 2b 27 65 6e 74 27 5d 28 27 74 65 6d 70 6c 61 74 65 27 29 2c 4a 6c 3d 7b 27 69 6e 73 65 72 74 27 3a 28 5f 30 78 31 39 37 62 30 39 2c 5f 30 78 31 30 37 62 30 66 2c 5f 30 78 35 62 32 36 31 30 29 3d 3e 7b 76 61 72 20 5f 30 78 34 66 31 33 65 61 3d 61 33 38 5f 30 78 33 39 61 63 66 63 3b 5f 30 78 31 30 37 62 30 66 5b 5f 30 78 34 66 31 33 65 61 28 30 78 34 37 36 29 2b 27 72 65 27 5d 28 5f 30 78 31 39 37 62 30 39 2c 5f Data Ascii: cfc(0x43c)+a38_0x39acfc(0x48b)+a38_0x39acfc(0x56c),Ot=typeof document<'u'?document:null,Us=Ot&&Ot[a38_0x39acfc(0x5ca)+'ent']('template'),Jl={'insert':(_0x197b09,_0x107b0f,_0x5b2610)=>{var _0x4f13ea=a38_0x39acfc;_0x107b0f[_0x4f13ea(0x476)+'re'](_0x197b09,_
2024-09-27 00:29:31 UTC	16384	IN	Data Raw: 36 34 37 66 2c 5f 30 78 35 34 33 37 36 37 29 3a 5f 30 78 35 63 63 35 36 65 5b 5f 30 78 33 32 33 30 39 37 5d 3d 5f 30 78 35 34 33 37 36 37 3b 7d 72 65 74 75 72 6e 20 5f 30 78 35 63 63 35 36 65 3b 7d 63 6f 6e 73 74 20 41 63 3d 53 79 6d 62 6f 6c 28 29 3b 66 75 6e 63 74 69 6f 6e 20 42 63 28 5f 30 78 35 61 63 33 64 37 29 7b 76 61 72 20 5f 30 78 63 36 36 32 66 63 3d 61 33 38 5f 30 78 33 39 61 63 66 63 3b 72 65 74 75 72 6e 21 79 30 28 5f 30 78 35 61 63 33 64 37 29 7c 7c 21 5f 30 78 35 61 63 33 64 37 5b 27 68 61 73 4f 77 6e 50 72 6f 70 27 2b 5f 30 78 63 36 36 32 66 63 28 30 78 36 33 39 29 5d 28 41 63 29 3b 7d 63 6f 6e 73 74 20 7b 61 73 73 69 67 6e 3a 5f 74 7d 3d 4f 62 6a 65 63 74 3b 66 75 6e 63 74 69 6f 6e 20 46 63 28 5f 30 78 66 39 32 36 31 35 29 7b 76 61 72 20 Data Ascii: 647f,_0x543767):_0x5cc56e[_0x323097]=_0x543767;}return _0x5cc56e;}const Ac=Symbol();function Bc(_0x5ac3d7){var _0xc662fc=a38_0x39acfc;return!y0(_0x5ac3d7)\|\|!_0x5ac3d7['hasOwnProp'+_0xc662fc(0x639)](Ac);}const {assign:_t}=Object;function Fc(_0xf92615){var

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:31 UTC	555	OUT	GET /modify/assets/f6170fbbtE5dP.css HTTP/1.1 Host: qdjtq.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://qdjtq.com/modify/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 00:29:31 UTC	322	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Fri, 27 Sep 2024 00:29:31 GMT Content-Type: text/css; charset=utf-8 Content-Length: 952 Connection: close Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 17 Jun 2024 05:04:28 GMT ETag: W/"3b8-19024951360"
2024-09-27 00:29:31 UTC	952	IN	Data Raw: 40 6b 65 79 66 72 61 6d 65 73 20 67 2d 6c 6f 61 64 69 6e 67 2d 62 67 41 6e 69 6d 7b 30 25 2c 74 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 2e 36 33 35 29 7d 35 30 25 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 29 7d 7d 2e 67 2d 6c 6f 61 64 69 6e 67 2d 6d 61 73 6b 7b 77 69 64 74 68 3a 31 30 30 76 77 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 3b 61 6e 69 6d 61 74 69 6f 6e 3a 67 2d 6c 6f 61 Data Ascii: @keyframes g-loading-bgAnim{0%,to{background-color:rgba(255,255,255,.635)}50%{background-color:rgba(255,255,255,0)}}.g-loading-mask{width:100vw;height:100vh;display:flex;justify-content:center;align-items:center;position:fixed;left:0;top:0;animation:g-loa

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 00:29:33 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=58601 Date: Fri, 27 Sep 2024 00:29:33 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:33 UTC	528	OUT	GET /modify/assets/7f8692c3ajMSD.js HTTP/1.1 Host: qdjtq.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://qdjtq.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 00:29:34 UTC	361	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Fri, 27 Sep 2024 00:29:34 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 4610 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 17 Jun 2024 05:04:30 GMT ETag: W/"1202-19024951b30"
2024-09-27 00:29:34 UTC	4610	IN	Data Raw: 63 6f 6e 73 74 20 61 32 30 5f 30 78 32 33 38 38 31 34 3d 61 32 30 5f 30 78 39 37 34 33 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 32 62 31 37 37 2c 5f 30 78 35 36 62 35 64 65 29 7b 63 6f 6e 73 74 20 5f 30 78 36 33 65 66 37 36 3d 61 32 30 5f 30 78 39 37 34 33 2c 5f 30 78 33 61 36 64 66 37 3d 5f 30 78 31 32 62 31 37 37 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 63 6f 6e 73 74 20 5f 30 78 33 32 37 39 61 30 3d 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 33 65 66 37 36 28 30 78 31 37 30 29 29 2f 30 78 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 33 65 66 37 36 28 30 78 31 37 61 29 29 2f 30 78 32 29 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 33 65 66 37 36 28 30 78 31 38 61 29 29 2f 30 78 33 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 Data Ascii: const a20_0x238814=a20_0x9743;(function(_0x12b177,_0x56b5de){const _0x63ef76=a20_0x9743,_0x3a6df7=_0x12b177();while(!![]){try{const _0x3279a0=-parseInt(_0x63ef76(0x170))/0x1(-parseInt(_0x63ef76(0x17a))/0x2)+-parseInt(_0x63ef76(0x18a))/0x3(-parseInt(_0x6

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:33 UTC	528	OUT	GET /modify/assets/7ae8a4f5ajMSD.js HTTP/1.1 Host: qdjtq.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://qdjtq.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 00:29:34 UTC	362	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Fri, 27 Sep 2024 00:29:34 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 53555 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 17 Jun 2024 05:04:30 GMT ETag: W/"d133-19024951b30"
2024-09-27 00:29:34 UTC	16022	IN	Data Raw: 63 6f 6e 73 74 20 61 31 39 5f 30 78 35 62 37 34 35 34 3d 61 31 39 5f 30 78 34 66 61 30 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 33 64 66 65 37 2c 5f 30 78 35 32 65 66 66 36 29 7b 63 6f 6e 73 74 20 5f 30 78 31 35 66 66 34 37 3d 61 31 39 5f 30 78 34 66 61 30 2c 5f 30 78 35 35 63 30 66 34 3d 5f 30 78 32 33 64 66 65 37 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 63 6f 6e 73 74 20 5f 30 78 32 36 39 62 39 63 3d 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 31 35 66 66 34 37 28 30 78 32 33 62 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 31 35 66 66 34 37 28 30 78 32 34 65 29 29 2f 30 78 32 2a 28 70 61 72 73 65 49 6e 74 28 5f 30 78 31 35 66 66 34 37 28 30 78 32 32 30 29 29 2f 30 78 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 31 35 66 66 Data Ascii: const a19_0x5b7454=a19_0x4fa0;(function(_0x23dfe7,_0x52eff6){const _0x15ff47=a19_0x4fa0,_0x55c0f4=_0x23dfe7();while(!![]){try{const _0x269b9c=-parseInt(_0x15ff47(0x23b))/0x1+parseInt(_0x15ff47(0x24e))/0x2*(parseInt(_0x15ff47(0x220))/0x3)+-parseInt(_0x15ff
2024-09-27 00:29:34 UTC	16384	IN	Data Raw: 5f 30 78 35 36 39 39 36 31 3b 5f 30 78 31 39 36 65 37 30 26 26 28 5f 30 78 33 32 62 33 39 31 3d 3d 3d 30 78 30 3f 5f 30 78 66 34 64 33 63 38 5b 5f 30 78 33 62 65 36 38 32 28 30 78 32 35 64 29 5d 28 7b 27 74 79 70 65 27 3a 30 78 30 2c 27 76 61 6c 75 65 27 3a 5f 30 78 31 39 36 65 37 30 7d 29 3a 5f 30 78 33 32 62 33 39 31 3d 3d 3d 30 78 31 7c 7c 5f 30 78 33 32 62 33 39 31 3d 3d 3d 30 78 32 7c 7c 5f 30 78 33 32 62 33 39 31 3d 3d 3d 30 78 33 3f 28 5f 30 78 66 34 64 33 63 38 5b 5f 30 78 33 62 65 36 38 32 28 30 78 32 35 61 29 5d 3e 30 78 31 26 26 28 5f 30 78 66 66 34 34 62 36 3d 3d 3d 27 2a 27 7c 7c 5f 30 78 66 66 34 34 62 36 3d 3d 3d 27 2b 27 29 26 26 5f 30 78 35 65 31 61 32 32 28 27 41 5c 78 32 30 72 65 70 65 61 74 61 62 27 2b 27 6c 65 5c 78 32 30 70 61 72 61 Data Ascii: _0x569961;_0x196e70&&(_0x32b391===0x0?_0xf4d3c8[_0x3be682(0x25d)]({'type':0x0,'value':_0x196e70}):_0x32b391===0x1\|\|_0x32b391===0x2\|\|_0x32b391===0x3?(_0xf4d3c8[_0x3be682(0x25a)]>0x1&&(_0xff44b6==='*'\|\|_0xff44b6==='+')&&_0x5e1a22('A\x20repeatab'+'le\x20para
2024-09-27 00:29:34 UTC	16384	IN	Data Raw: 78 31 36 37 31 33 31 5b 5f 30 78 33 36 32 62 64 37 28 30 78 31 63 65 29 5d 28 5f 30 78 34 37 66 33 39 30 3d 3e 7b 63 6f 6e 73 74 20 5f 30 78 62 65 38 66 31 30 3d 5f 30 78 33 36 32 62 64 37 3b 69 66 28 21 5f 30 78 34 37 66 33 39 30 29 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 5b 5f 30 78 62 65 38 66 31 30 28 30 78 32 30 33 29 5d 28 6e 65 77 20 45 72 72 6f 72 28 27 43 6f 75 6c 64 6e 5c 78 32 37 74 5c 78 32 30 72 27 2b 5f 30 78 62 65 38 66 31 30 28 30 78 31 66 36 29 2b 5f 30 78 62 65 38 66 31 30 28 30 78 32 39 33 29 2b 5f 30 78 33 66 36 30 65 64 2b 5f 30 78 62 65 38 66 31 30 28 30 78 32 36 64 29 2b 5f 30 78 63 37 34 31 34 61 5b 5f 30 78 62 65 38 66 31 30 28 30 78 31 66 39 29 5d 2b 27 5c 78 32 32 27 29 29 3b 63 6f 6e 73 74 20 5f 30 78 34 62 65 38 35 30 3d 6e Data Ascii: x167131[_0x362bd7(0x1ce)](_0x47f390=>{const _0xbe8f10=_0x362bd7;if(!_0x47f390)return Promise[_0xbe8f10(0x203)](new Error('Couldn\x27t\x20r'+_0xbe8f10(0x1f6)+_0xbe8f10(0x293)+_0x3f60ed+_0xbe8f10(0x26d)+_0xc7414a[_0xbe8f10(0x1f9)]+'\x22'));const _0x4be850=n
2024-09-27 00:29:34 UTC	4765	IN	Data Raw: 62 64 28 5f 30 78 37 33 39 65 63 35 5b 27 74 6f 27 5d 2c 5f 30 78 33 31 31 39 31 36 29 5b 5f 30 78 34 31 66 30 32 65 28 30 78 31 63 65 29 5d 28 5f 30 78 34 37 38 35 30 36 3d 3e 7b 63 6f 6e 73 74 20 5f 30 78 35 34 64 31 35 34 3d 5f 30 78 34 31 66 30 32 65 3b 49 28 5f 30 78 34 37 38 35 30 36 2c 30 78 31 34 29 26 26 21 5f 30 78 31 34 34 33 38 38 5b 5f 30 78 35 34 64 31 35 34 28 30 78 31 65 36 29 5d 26 26 5f 30 78 31 34 34 33 38 38 5b 5f 30 78 35 34 64 31 35 34 28 30 78 32 35 36 29 5d 3d 3d 3d 59 5b 27 70 6f 70 27 5d 26 26 5f 30 78 35 39 37 36 38 39 5b 27 67 6f 27 5d 28 2d 30 78 31 2c 21 30 78 31 29 3b 7d 29 5b 5f 30 78 34 31 66 30 32 65 28 30 78 31 65 37 29 5d 28 57 29 2c 50 72 6f 6d 69 73 65 5b 5f 30 78 34 31 66 30 32 65 28 30 78 32 30 33 29 5d 28 29 29 3a Data Ascii: bd(_0x739ec5['to'],_0x311916)[_0x41f02e(0x1ce)](_0x478506=>{const _0x54d154=_0x41f02e;I(_0x478506,0x14)&&!_0x144388[_0x54d154(0x1e6)]&&_0x144388[_0x54d154(0x256)]===Y['pop']&&_0x597689['go'](-0x1,!0x1);})[_0x41f02e(0x1e7)](W),Promise[_0x41f02e(0x203)]()):

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:33 UTC	581	OUT	GET /favicon.ico HTTP/1.1 Host: qdjtq.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://qdjtq.com/modify/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 00:29:34 UTC	326	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Fri, 27 Sep 2024 00:29:34 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 38078 Connection: close Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 17 Jun 2024 05:04:20 GMT ETag: W/"94be-1902494f420"
2024-09-27 00:29:34 UTC	16058	IN	Data Raw: 00 00 01 00 01 00 60 60 00 00 01 00 20 00 a8 94 00 00 16 00 00 00 28 00 00 00 60 00 00 00 c0 00 00 00 01 00 20 00 00 00 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: `` (`
2024-09-27 00:29:34 UTC	16384	IN	Data Raw: 57 ab 25 ff 57 ab 25 ff 57 ac 25 ff 57 ac 25 ff 57 ac 25 ff 57 ac 25 ff 58 ac 25 ff 50 a9 1a ff a0 c3 8b ff db d6 de ff d1 d1 d1 ff d0 d0 d0 ff ce ce ce ff cc cc cd ff c7 c7 c8 ff c6 c9 c4 ff f1 f3 f0 ff ff ff ff ff d8 ec cc ff 55 ab 22 ff 57 ac 25 ff 58 ac 26 ff 58 ac 26 ff 58 ac 26 ff 58 ac 27 ff 58 ac 27 ff 58 ac 27 ff 58 ac 27 ff 58 ac 27 ff 4f a7 1a ff 9d ce 80 ff ff ff ff ff bd bd bd 87 ff ff ff ff f9 fc f7 ff 6f b7 44 ff 52 a9 1f ff 57 ab 25 ff 57 ab 25 ff 57 ab 25 ff 57 ab 25 ff 57 ab 25 ff 57 ab 25 ff 57 ab 25 ff 57 ab 25 ff 57 ab 25 ff 58 ab 25 ff 58 ab 25 ff 58 ab 25 ff 58 ab 26 ff 57 ab 24 ff 51 a8 1d ff 4e a7 19 ff 52 a9 1e ff 53 a9 20 ff 53 a9 20 ff 53 a9 20 ff 53 a9 20 ff 53 a9 20 ff 53 a9 20 ff 53 a9 20 ff 53 a9 20 ff 53 a9 20 ff 53 a9 20 Data Ascii: W%W%W%W%W%W%X%PU"W%X&X&X&X'X'X'X'X'OoDRW%W%W%W%W%W%W%W%W%X%X%X%X&W$QNRS S S S S S S S S S
2024-09-27 00:29:34 UTC	5636	IN	Data Raw: 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6b bd 4b ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c bd 4c ff 6c be 4c ff 6c be 4c ff 6c be 4c ff 6c be 4c ff 6c be 4c ff 6c be 4c ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 6c be 4d ff 65 bb 45 ff 92 cf 7c ff ff ff ff Data Ascii: kKkKkKkKkKkKkKkKkKkKkKkKlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlLlMlMlMlMlMlMlMlMlMlMlMlMeE\|

Timestamp	Bytes transferred	Direction	Data
2024-09-27 00:29:34 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 00:29:34 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=58546 Date: Fri, 27 Sep 2024 00:29:34 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-27 00:29:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}