Edit tour

Windows Analysis Report
https://qr.me-qr.com/pt/E9k76ew

Overview

General Information

Sample URL:	https://qr.me-qr.com/pt/E9k76ew
Analysis ID:	1586454
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected suspicious URL

Drops files with a non-matching file extension (content does not match file extension)

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,9900625001011427299,17192751964070924098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qr.me-qr.com/pt/E9k76ew" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /statistic/collect/37808944 HTTP/1.1Host: qr.me-qr.comConnection: keep-aliveContent-Length: 150sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, */*Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXMNoTLti2IOaIOCfsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://qr.me-qr.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://qr.me-qr.com/E9k76ewAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: user_local=en; adsStatData=%7B%22url%22%3Anull%2C%22campaignId%22%3Anull%2C%22adgroupId%22%3Anull%2C%22gClId%22%3Anull%2C%22bannerId%22%3Anull%2C%22device%22%3Anull%2C%22adPosition%22%3Anull%2C%22targetId%22%3Anull%2C%22locInterestMC%22%3Anull%2C%22locPhysicalMs%22%3Anull%2C%22keyword%22%3Anull%2C%22audience%22%3Anull%2C%22deviceModel%22%3Anull%2C%22creative%22%3Anull%2C%22firstVisitDate%22%3A%222025-01-09%2008%3A23%3A51%22%7D; cookieId=37b957cd-11ce-4e0a-9b28-551f490dd856

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 06:24:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=0, must-revalidate, no-cache, no-store, privatex-frame-options: SAMEORIGINexpires: Thu, 09 Jan 2025 06:24:01 GMTvary: User-Agentvary: accept-encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BCZCZxemt8zcwflWRiSI2apbhR2vkpvrZgM1NR0m2o1vAEM0lXqhSWoQX70LAs0mASbL8OyeEdcVC90i19psBMHWJ9s%2BHdukcjKMHOChKL3o9%2FI2linF6CScCjTu5ZM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffServer: cloudflareCF-RAY: 8ff257843ebfc461-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1525&min_rtt=1498&rtt_var=581&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1839&delivery_rate=1949265&cwnd=228&unsent_bytes=0&cid=2473c5dd2b4ab948&ts=597&x=0"

Source: https://qr.me-qr.com/E9k76ew	Joe Sandbox AI: Page contains button: 'Download' Source: '1.2.pages.csv'
Source: https://qr.me-qr.com/E9k76ew	Joe Sandbox AI: Page contains button: 'Download' Source: '1.4.pages.csv'
Source: https://qr.me-qr.com/E9k76ew	Joe Sandbox AI: Page contains button: 'View PDF' Source: '1.6.pages.csv'
Source: https://qr.me-qr.com/E9k76ew	Joe Sandbox AI: Page contains button: 'Download' Source: '1.8.pages.csv'
Source: https://qr.me-qr.com/E9k76ew	Joe Sandbox AI: Page contains button: 'Download' Source: '1.9.pages.csv'
Source: https://qr.me-qr.com/E9k76ew#google_vignette	Joe Sandbox AI: Page contains button: 'Open' Source: '2.31.pages.csv'
Source: https://qr.me-qr.com/E9k76ew#google_vignette	Joe Sandbox AI: Page contains button: 'Download' Source: '2.35.pages.csv'

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://qr.me-qr.com
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://qr.me-qr.com

Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No favicon
Source: https://drive.google.com/drive/folders/1XVWKHXdkIlGE0gsXUu3A8IogHdtBSCRs	HTTP Parser: No favicon
Source: https://drive.google.com/drive/folders/1XVWKHXdkIlGE0gsXUu3A8IogHdtBSCRs	HTTP Parser: No favicon
Source: https://drive.google.com/drive/folders/1XVWKHXdkIlGE0gsXUu3A8IogHdtBSCRs	HTTP Parser: No favicon
Source: https://drive.google.com/drive/folders/1XVWKHXdkIlGE0gsXUu3A8IogHdtBSCRs	HTTP Parser: No favicon
Source: https://drive.google.com/drive/folders/1XVWKHXdkIlGE0gsXUu3A8IogHdtBSCRs	HTTP Parser: No favicon
Source: https://drive.google.com/drive/folders/1XVWKHXdkIlGE0gsXUu3A8IogHdtBSCRs	HTTP Parser: No favicon
Source: https://drive.google.com/drive/folders/1XVWKHXdkIlGE0gsXUu3A8IogHdtBSCRs	HTTP Parser: No favicon
Source: https://drive.google.com/drive/folders/1XVWKHXdkIlGE0gsXUu3A8IogHdtBSCRs	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/ORIENTA%C3%87%C3%95ES%20GERAIS%20QUIMICOS%20E%20EMERGENCIA%20AMBIENTAL.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/ORIENTA%C3%87%C3%95ES%20GERAIS%20QUIMICOS%20E%20EMERGENCIA%20AMBIENTAL.pdf	HTTP Parser: No favicon

Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="author".. found
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="author".. found
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="author".. found
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="author".. found
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="author".. found

Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="copyright".. found
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="copyright".. found
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="copyright".. found
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="copyright".. found
Source: https://qr.me-qr.com/E9k76ew	HTTP Parser: No <meta name="copyright".. found

Source:	Binary string: 6,d);_.hh(d,7,f);e>0&&_.hh(q,8,e);_.J(q,9,c);_.hh(_.hh(_.hh(_.hh(_.hh(_.hh(_.hh(_.hh(_.hh(_.hh(_.Kk(_.Kk(_.Kk(_.Kk(_.hh(_.hh(_.hh(_.hh(_.hh(_.hh(_.hh(_.hh(_.hh(q,10,_.Dg.NBIOYd),19,_.Dg.ohdHoe),11,_.Dg.ibaGGe),22,_.Dg.rWdzAb),12,_.Dg.GgyFOe),13,_.Dg.Nqgfyd),14,_.Dg.bi0onf),15,_.Dg.oLqGMb),16,_.Dg.zT9Qed),24,_.Dg.WzYtHe),26,_.Dg.hhHvAb),27,_.aEb.q2DVqf),25,_.Dg.SIFjLe),17,_.Dg.yYfRDe),18,_.Dg.hOuh3e),28,_.Dg.L4PTxf),29,_.Dg.gKxFy),30,_.Dg.vcz2Gf),31,_.Dg.aoTe7b),32,_.PDb),33,_.QDb),34,_.iDb),35,_.jDb); source: chromecache_356.1.dr, chromecache_566.1.dr
Source:	Binary string: var SY=function(a,b,c){a.kfa===b\|\|a.isDisposed()\|\|(a.kfa=b,a.dispatchEvent(new B$g(c)))},C$g=function(a,b){b!==a.pb.uCb()&&a.pb.y3b(b)},D$g=function(a,b){b!==a.pb.vCb()&&a.pb.z3b(b)},E$g=function(a){a.Oa.Yd(_.xjf[a.state]);_.gh(a.Oa,13,_.xjf[a.U]);_.J(a.Oa,17,a.Ta);return a.Oa.clone()},F$g=function(a){a=a.pb.pDb();return!_.yj(_.zl(a))},G$g=function(a,b,c,d){this.url=a;this.rect=b;this.ZW=c;this.page=d===void 0?-1:d};G$g.prototype.getUrl=function(){return this.url};G$g.prototype.Nt=function(){return this.rect}; source: chromecache_358.1.dr, chromecache_492.1.dr
Source:	Binary string: var jge=function(a,b,c,d,e){_.jB.call(this,c);var f=this;this.Fb=a;this.U=d;this.request=e;this.H={};this.items={};this.status=6;this.O=_.js(new _.is,[1]);this.addOnDisposeCallback(function(){f.H={}});_.PDb++};_.P(jge,_.jB);_.h=jge.prototype;_.h.ega=function(){_.oc(this.items)&&this.status===6\|\|kge(this)};_.h.DJ=function(){return"sync.IdViewCacheLiveMap"};_.h.Zd=function(){return this.request}; source: chromecache_583.1.dr, chromecache_309.1.dr
Source:	Binary string: var xlh=function(a){if(a.item.getFeature().gQb()){var b=a.Xb(),c=Flh;b=a.Ca?_.ro(a.Ca,b):a.Ca;a.Mc=c(a,_.Ad(Ykh,b,Dlh(a)),(0,_.mg)(a.HQc,a),(0,_.mg)(a.zg,a),(0,_.mg)(a.we,a,19))}else ylh(a)},Jlh=function(a){a.Ka=!0;a.tb=!0;Klh(a);a.Fa={};a.Ha={};var b=a.item.Mb;if(b)_.HW(a.item,2),b(1).then((0,_.mg)(a.jQc,a),(0,_.mg)(a.uc,a));else if(F$g(a.item)\|\|!_.RW(a.item)){b=a.upload;var c=a.item;var d=c.pb.pDb();c=F$g(c)?d:c.pb.w2();b.call(a,c)}else zlh(a)};_.h=qZ.prototype; source: chromecache_358.1.dr, chromecache_492.1.dr
Source:	Binary string: e.height=b.height;return{rect:e,status:g}};_.$1b=function(a,b){return(b&8&&_.Dy(a)?b^4:b)&-9};_.b2b=function(a,b){this.U=a;this.qa=!!b;this.V={0:this.U+"-Ve",1:this.U+"-Ud",2:this.U+"-Md",3:this.U+"-Ue"}};_.P(_.b2b,_.Y1b);_.b2b.prototype.rs=function(a){this.O=a};_.b2b.prototype.setPosition=function(a,b,c,d){a!=null&&(this.Z0a=a);b!=null&&(this.w0a=b);typeof c==="number"&&(this.hvb=Math.max(c,15));typeof d==="number"&&(this.pdb=d)};_.c2b=function(a,b,c){a.H=b;a.W=c}; source: chromecache_416.1.dr, chromecache_418.1.dr
Source:	Binary string: "https://support.google.com/docs/answer/2494893?co=GENIE.Platform%3DDesktop#zippy=%2Cprevent-people-from-downloading-printing-or-copying-your-file")])}},Rhh=function(a){var b=Zhh(a);if(b)return $hh(a,b),!0;a.H&&_.Vf(a.ob(),_.JVf,a.H);a.H=null;_.Vf(a.ob(),_.DVf);return!1},Qhh=async function(a){if(!a.TC())return Whh(a);if(!Rhh(a))return a.tDa(2)},Xhh=async function(a){if((await a.V).service.o8.H()&&!a.Ji.PDb()\|\|a.O.TG()\|\|!a.Xi.dh()\|\|a.TC()\|\|await aih(a))return!1;var b=await bih(a);return Yhh(a)\|\|b}; source: chromecache_358.1.dr, chromecache_492.1.dr
Source:	Binary string: _.h.w0a=2;_.h.hvb=20;_.h.Z0a=3;_.h.pdb=-5;_.h.JHa=!1;var j2b=function(a){_.Wd.call(this);this.dom=a\|\|_.ce()};_.P(j2b,_.Wd);j2b.prototype.V=function(){_.dB(this.Da(),"tooltip");_.eB(this.Da(),"live","polite")};_.k2b=function(a){j2b.call(this,a);this.U=this.dom.Va("DIV","g-Ca-pt");this.H=this.dom.Va("DIV","g-Ca-aa",this.dom.Va("DIV","g-Ca-Fd"),this.dom.Va("DIV","g-Ca-Jd"));this.O=this.dom.Va("DIV",{"class":"g-Ca",role:"tooltip"},this.U,this.H);this.V()};_.P(_.k2b,j2b);_.k2b.prototype.Da=function(){return this.O};_.k2b.prototype.Tc=function(){return this.U};_.k2b.prototype.rb=function(){j2b.prototype.rb.call(this);this.O&&_.xp(this.O)};_.l2b=function(a){_.k2b.call(this,a)};_.P(_.l2b,_.k2b);_.l2b.prototype.V=function(){_.dB(this.Da(),"tooltip")};var o2b=function(a){return _.aj(_.Of(a.replace(m2b,function(b,c){return n2b.test(c)?"":" "}).replace(/[\t\n ]+/g," ")))},n2b=/^(?:abbr\|acronym\|address\|b\|em\|i\|small\|strong\|su[bp]\|u)$/i,m2b=/<[!\/]?([a-z0-9]+)([\/ ][^>]*)?>/gi;var q2b;_.r2b=function(a){a=a\|\|_.ce();var b=_.wg(a.Ec());_.p2b[b]\|\|(_.p2b[b]=new q2b(a))};_.FD=function(a,b,c){c\|\|(c=b instanceof _.Ec?o2b(_.Ic(b).toString()):b);a.removeAttribute("title");a.removeAttribute("data-tooltip-contained");a.removeAttribute("data-tooltip");b?(b instanceof _.Ec?a.Cya=b:(a.setAttribute("data-tooltip",b),a.Cya=null),a.setAttribute("aria-label",c)):(a.Cya=null,a.removeAttribute("aria-label"));_.r2b(_.ce(a))}; source: chromecache_416.1.dr, chromecache_418.1.dr
Source:	Binary string: ODb=function(a,b){b=b\|\|null;for(var c=0;c<_.sB.length;++c)a.call(b,_.sB[c].manifest,c)};MDb=function(a){_.aa.call(this);this.manifest=a;this.message="Extension registered after application initialization adding these services: "+(a.services?_.Bj(a.services,function(b){return b.id}).join(", "):"none")};_.P(MDb,_.aa);_.PDb=0;_.QDb=0;_.Ira=function(a,b){return"https://drive-thirdparty.googleusercontent.com/"+b+"/type/"+(a\|\|"application/unknown")};var RDb,TDb;RDb=function(){};_.SDb=function(){return _.ba.cvox!=null};_.uB=function(){TDb\|\|(TDb=new RDb);return TDb};var UDb=function(){_.WCb.apply(this,arguments)};_.P(UDb,_.WCb);UDb.prototype.W_a=function(){return!0};UDb.prototype.uxb=function(a,b){return UCb(a,b,!0)};_.VDb=function(a,b){b=b===void 0?"":b;_.aa.call(this);this.jx=a;this.message=b?b+" for operation "+this.jx.getType():"Error executing operation "+this.jx.getType()};_.P(_.VDb,_.aa);_.WDb=function(a,b){b=b===void 0?0:b;_.aa.call(this,a===void 0?"network unavailable":a);this.jKa=b};_.P(_.WDb,_.aa);_.XDb=new _.Hd("wQm6q","wQm6q",[]);_.YDb=new _.Av(new _.Bv("DriveRegionNavigateNext"),"aA5FPe",91291);_.ZDb=new _.Av(new _.Bv("DriveRegionNavigatePrevious"),"QpE3P",91292);_.$Db=!1;_.aoa=new Map;var wB=function(a,b){_.Wd.call(this);var c=this;this.H=null;this.O=!1;this.obj=a;this.subscription=b;this.addOnDisposeCallback(function(){c.obj!==null&&c.subscription!==null&&(c.obj=null,c.subscription.dispose(),c.subscription=null,c.H&&(_.vB(c.H),c.H=null))});_.$Db&&boa("Ex5INe",this)};_.P(wB,_.Wd);wB.prototype.rv=function(){if(this.obj!==null&&this.subscription!==null){if(this.O)throw Error("wd");this.H=null;this.O=!0}return this};_.Dg={};_.aEb={};var bEb=function(a){this.reference=a};bEb.prototype.deref=function(){return this.reference};var cEb=_.ba.performance?function(){return performance.now()}:function(){return Date.now()},xB=function(){this.O=0;this.H=new Set;_.Eg("oLqGMb");_.$Db&&boa("j1Tf6b",this)};xB.prototype.add=function(a,b){var c=this;a&&(_.Eg("bi0onf"),this.H.add(new dEb(a,b)),b instanceof _.Wd&&b.addOnDisposeCallback(function(){eEb(c,b)}))};xB.prototype.subscribe=function(a){var b=new fEb(new bEb(a));this.H.add(b);return new gEb(this.H,b,a)}; source: chromecache_416.1.dr, chromecache_418.1.dr
Source:	Binary string: k),c=a.Bxb(c?k:void 0,e),a.BHa(k,c),g.gOb=c}var l;if(c=(l=_.Fe(b,_.lib))==null?void 0:l.H())g.bEa=c;if(l=(l=_.Fe(b,_.hib))&&l.Rvc())g.Qe=l;if(l=(l=_.Fe(b,fib))?l:_.Fe(b,_.Sz))g.FE=l.fvc()\|\|void 0;b=_.Fe(b,_.Qe);b!=null&&(b=b.lO.get(),b=i_b.get(b.id),l=new wKb,b=_.gh(l,1,b),g.ZPa=b);if(f.viewType\|\|f.hpa)g.Pdb=f.viewType,g.hTc=f.hpa;return g};_.h=_.k_b.prototype;_.h.Og=function(a){var b=a.H.W2;this.O.IWa.bja(a.H,a.H.QZ()\|\|void 0);m_b(this,1,b);return a}; source: chromecache_416.1.dr, chromecache_418.1.dr
Source:	Binary string: var d2b=function(a,b,c,d,e,f){if(a.O){var g=f2b(b,c);var k=a.O;var l=_.yy(k);l=(e2b(b)?l.height/2:l.width/2)-d;var n=_.$1b(k,g),q;if(q=_.ry(k))k=_.Ngb(_.zy(k)),e2b(b)?k.top<q.top&&!(n&1)?l-=q.top-k.top:k.bottom>q.bottom&&n&1&&(l-=k.bottom-q.bottom):k.left<q.left&&!(n&4)?l-=q.left-k.left:k.right>q.right&&n&4&&(l-=k.right-q.right);k=l;k=e2b(b)?new _.lp(a.pdb,k):new _.lp(k,a.pdb);l=e2b(b)?6:9;a.JHa&&e==2&&(l=e2b(b)?4:1);n=b^3;e2b(b)&&a.O.dir=="rtl"&&(n=b);g=_.ED(a.O,f2b(n,c),a.H,g,k,f,a.JNa?l:0,void 0, source: chromecache_416.1.dr, chromecache_418.1.dr
Source:	Binary string: H_g=function(a,b){return _.J(a,50,b)};I_g=function(a,b){_.J(a,53,b)};_.J_g=function(a){this.Ba=_.p(a)};_.P(_.J_g,_.y);_.h=_.J_g.prototype;_.h.qfc=function(){return _.A(this,2)};_.h.rfc=function(){return _.A(this,3)};_.h.Yrb=function(){return _.Ui(this,4,0)};_.h.HDb=function(){return _.A(this,7)};_.h.nfc=function(){return _.M(this,10)};_.h.ofc=function(){return _.M(this,11)};_.h.pfc=function(){return _.M(this,12)};_.h.PDb=function(){return _.M(this,15,!1)};_.h.Uhb=function(a){return _.J(this,15,a)}; source: chromecache_358.1.dr, chromecache_492.1.dr
Source:	Binary string: _.h.z3b=function(a){_.J(this,57,a)};_.h.ALa=function(){return _.M(this,23,!1)};_.h.A3b=function(a){_.J(this,23,a)};_.h.uFc=function(){return _.Wk(this,23)};_.h.UXa=function(){return _.A(this,25,"")};_.h.Ar=function(){return _.K(this,_.sY,26)};_.h.pDb=function(){return _.A(this,28,"")};_.h.oDb=function(){return _.K(this,w_g,29)};_.h.getFileExtension=function(){return _.A(this,33,"")};_.h.Ev=function(){return _.K(this,_.ojf,35)};_.h.jhb=function(a){_.R(this,_.ojf,35,a)}; source: chromecache_358.1.dr, chromecache_492.1.dr
Source:	Binary string: Roa=function(a){switch(a.toLowerCase()){case "navigation":return 2;case "resource":return 3;case "paint":return 4;case "longtask":return 5;case "largest-contentful-paint":return 6;default:return 0}};Uoa=function(a){switch(a.toLowerCase()){case "blocking":return 1;case "non-blocking":return 2;default:return 0}};Toa=function(a){return typeof a==="string"};Soa=function(a){return typeof a==="number"};Xoa=function(a){if(a)return a==null?void 0:a.Pdb}; source: chromecache_416.1.dr, chromecache_418.1.dr
Source:	Binary string: _.m(e.values());for(var f=e.next();!f.done;f=e.next()){f=f.value;if(a.getViewType()\|\|a.getViewInfo())f.Pdb=a.getViewType(),f.hTc=a.getViewInfo();b.yb.ls(f)}}).catch(function(e){var f=null;typeof e==="string"?f=e:e instanceof Error&&(f=JSON.stringify({fileName:e.fileName,lineNumber:e.lineNumber,message:e.message,name:e.name,stack:e.stack}));f&&_.vd("TickerReporter failed to send report: "+f,Error("Xu"),"warning")})}; source: chromecache_382.1.dr, chromecache_620.1.dr

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_493.1.dr, chromecache_504.1.dr	String found in binary or memory: Gf=y(["https://sandbox.google.com/tools/feedback/"]),Hf=y(["https://www.google.cn/tools/feedback/"]),If=y(["https://help.youtube.com/tools/feedback/"]),Jf=y(["https://asx-frontend-staging.corp.google.com/inapp/"]),Kf=y(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),Lf=y(["https://localhost.corp.google.com/inapp/"]),Mf=y(["https://localhost.proxy.googlers.com/inapp/"]),Nf=U(pf),Of=[U(qf),U(rf)],Pf=[U(sf),U(tf),U(uf),U(vf),U(wf),U(xf),U(yf),U(zf),U(Af),U(Bf)],Qf=[U(Cf),U(Df)],Vf= equals www.youtube.com (Youtube)
Source: chromecache_384.1.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Mk:function(){e=nb()},Kd:function(){d()}}};var Vb=wa(["data-gtm-yt-inspected-"]),LE=["www.youtube.com","www.youtube-nocookie.com"],ME,NE=!1; equals www.youtube.com (Youtube)
Source: chromecache_358.1.dr, chromecache_492.1.dr	String found in binary or memory: _.h.seb=function(){};_.h.NQa=function(){};_.h.Ggb=function(){};_.h.Dhb=function(){};_.h.Thb=function(){};_.h.z8a=function(){return 0};_.h.a6a=function(){return 0};_.h.cab=function(){return!1};var wY=function(a,b,c){a=uY.call(this,a,b,c)\|\|this;a.Ra=!1;a.ready=!1;a.Fa=0;a.volume=0;a.Ta=!1;a.Aa=null;a.qa=null;a.O=null;a.playerState=-1;a.Ka=c.Ma().CS()\|\|new _.y_g;a.host=_.A(a.Ka,1,"https://www.youtube.com");a.Ha={onError:a.Fdb.bind(a),onKeyPress:a.onKeyPress.bind(a),onReady:a.onReady.bind(a),onStateChange:a.onStateChange.bind(a),onTabOrderChange:a.Cb.bind(a),onVideoProgress:a.onVideoProgress.bind(a),onVolumeChange:a.onVolumeChange.bind(a)};a.Ya().listen(a.Qa().getWindow(),"message",a.tb); equals www.youtube.com (Youtube)
Source: chromecache_384.1.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=qC(a,c,e);T(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return T(122),!0;if(d&&f){for(var m=yb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},tC=function(){var a=[],b=function(c){return bb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_385.1.dr, chromecache_398.1.dr	String found in binary or memory: function X(a,b){this.v={};this.playerInfo={};this.videoTitle="";this.j=this.g=null;this.h=0;this.m=!1;this.l=[];this.i=null;this.A={};this.options=null;if(!a)throw Error("YouTube player element ID required.");this.id=qa(this);b=Object.assign({title:"video player",videoId:"",width:640,height:360},b\|\|{});var c=document;if(a=typeof a==="string"?c.getElementById(a):a){W.yt_embedsEnableRsaforFromIframeApi&&tb();c=a.tagName.toLowerCase()==="iframe";b.host\|\|(b.host=c?mb(a.src):"https://www.youtube.com");this.options= equals www.youtube.com (Youtube)
Source: chromecache_385.1.dr, chromecache_398.1.dr	String found in binary or memory: function tb(){var a=new rb,b=["https://www.youtube.com"];b=b===void 0?qb:b;oa(function(c){switch(c.g){case 1:return C(c,sb(),2);case 2:if(!c.m){c.g=3;break}return C(c,Promise.all(b.map(function(d){var g;return oa(function(k){if(k.g==1)return k.l=2,C(k,navigator.permissions.query({name:"top-level-storage-access",requestedOrigin:d}),4);k.g!=2?(g=k.m,g.state==="prompt"&&a.g.push(d),k.g=0,k.l=0):(k.l=0,k.i=null,k.g=0)})})),4); equals www.youtube.com (Youtube)
Source: chromecache_384.1.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Lh:e,Jh:f,Kh:g,si:k,ui:m,af:n,Kb:b},q=A.YT;if(q)return q.ready&&q.ready(d),b;var r=A.onYouTubeIframeAPIReady;A.onYouTubeIframeAPIReady=function(){r&&r();d()};H(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(WE(w,"iframe_api")\|\|WE(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!NE&&UE(x[B],p.af))return lc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_443.1.dr, chromecache_331.1.dr	String found in binary or memory: inline:{css:1},disableRealtimeCallback:!1,drive_share:{skipInitCommand:!0},csi:{rate:.01},client:{cors:!1},signInDeprecation:{rate:0},include_granted_scopes:!0,llang:"en",iframes:{youtube:{params:{location:["search","hash"]},url:":socialhost:/:session_prefix:_/widget/render/youtube?usegapi=1",methods:["scroll","openwindow"]},ytsubscribe:{url:"https://www.youtube.com/subscribe_embed?usegapi=1"},plus_circle:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/plus/circle?usegapi=1"}, equals www.youtube.com (Youtube)
Source: chromecache_358.1.dr, chromecache_492.1.dr	String found in binary or memory: u;(q=(t=a.sza)==null?void 0:(u=t.EKa)==null?void 0:u.D_a)&&q.length>0&&(c.length_seconds=r$g(q[0]))}}_.M(this.context.Ma(),192,!1)&&a.WDa&&a.WDa.ijb===ugh.AVAILABLE&&(c.videoStoryboard=JSON.stringify(Z8g(a.WDa)));return c};var Ush=function(a){srh.call(this,a.Qa());this.context=a;this.qa=new _.rg};_.P(Ush,srh);Ush.prototype.O=function(){return"onYouTubeIframeAPIReady"};Ush.prototype.V=function(){var a=this.context.Ma().CS()\|\|new _.y_g;return _.jFa(_.A(a,1,"https://www.youtube.com"),"iframe_api")};Ush.prototype.H=function(){return _.rj("YT.Player",this.Qa().getWindow())};Ush.prototype.Mo=function(){return this.qa};var CZ=function(a){_.rg.call(this);var b=this;this.context=a;this.O=null;this.Fa=!1;this.U=0;this.logger=this.V=null;this.Sa(this.context);var c=a.Ma();a=a.Qa();c.wK()\|\|_.Qj(c,83);this.W=new _.g$c;var d=Vsh(c);_.j$c(this.W,d,function(){return _.$8c(d,!0)});_.i$c(this.W,d);this.handler=new _.tg(this);this.Sa(this.handler);this.H=new cph;this.Sa(this.H);Wsh(this,c,a);Xsh(this);var e=c.GK();this.Je&&e&&(this.context.get(_.rT).start(),this.Je.od({Na:1}),_.Rjf(Pgh),(c=c.aF())&&this.context.Sua().setEnabled(!!_.M(c, equals www.youtube.com (Youtube)
Source: chromecache_384.1.dr	String found in binary or memory: var YD=function(a,b,c,d,e){var f=OB("fsl",c?"nv.mwt":"mwt",0),g;g=c?OB("fsl","nv.ids",[]):OB("fsl","ids",[]);if(!g.length)return!0;var k=TB(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);T(121);if(m==="https://www.facebook.com/tr/")return T(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!xA(k,zA(b, equals www.facebook.com (Facebook)
Source: chromecache_437.1.dr	String found in binary or memory: var scriptUrl = 'https:\/\/youtube.googleapis.com\/s\/player\/3ede36f2\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: qr.me-qr.com
Source: global traffic	DNS traffic detected: DNS query: cdn.me-qr.com
Source: global traffic	DNS traffic detected: DNS query: me-ticket.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cms.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: dclk-match.dotomi.com
Source: global traffic	DNS traffic detected: DNS query: tr.blismedia.com
Source: global traffic	DNS traffic detected: DNS query: creativecdn.com
Source: global traffic	DNS traffic detected: DNS query: sync.srv.stackadapt.com
Source: global traffic	DNS traffic detected: DNS query: bh.contextweb.com
Source: global traffic	DNS traffic detected: DNS query: analytics.pangle-ads.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: pm.w55c.net
Source: global traffic	DNS traffic detected: DNS query: ads.travelaudience.com
Source: global traffic	DNS traffic detected: DNS query: match.adsby.bidtheatre.com
Source: global traffic	DNS traffic detected: DNS query: a.c.appier.net
Source: global traffic	DNS traffic detected: DNS query: onetag-sys.com
Source: global traffic	DNS traffic detected: DNS query: sync.teads.tv
Source: global traffic	DNS traffic detected: DNS query: sync.ipredictive.com
Source: global traffic	DNS traffic detected: DNS query: dis.criteo.com
Source: global traffic	DNS traffic detected: DNS query: a.rfihub.com
Source: global traffic	DNS traffic detected: DNS query: t.adx.opera.com
Source: global traffic	DNS traffic detected: DNS query: gtrace.mediago.io
Source: global traffic	DNS traffic detected: DNS query: widget.us.criteo.com
Source: global traffic	DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: ep2.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: drivefrontend-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: peoplestack-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: people-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: contacts.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com

Source: chromecache_377.1.dr	Initial sample: https://www.chemicalrisk.com.br/avaliacao-nr-26-e-implementacao-da-comunicacao-de-perigo-ghs/
Source: chromecache_377.1.dr	Initial sample: https://www.abntcatalogo.com.br/normagrid.aspx
Source: chromecache_377.1.dr	Initial sample: http://www.unece.org/trans/danger/publi/ghs/ghs_rev07/07files_e.html
Source: chromecache_377.1.dr	Initial sample: https://www.chemicalrisk.com.br/mapeamento-para-gestao-do-risco-quimico/
Source: chromecache_377.1.dr	Initial sample: http://trabalho.gov.br/images/documentos/sst/nr/nr26.pdf
Source: chromecache_377.1.dr	Initial sample: https://www.chemicalrisk.com.br/curso-in-company-manuseio-seguro-de-produtos-quimicos/
Source: chromecache_377.1.dr	Initial sample: http://trabalho.gov.br/images/Documentos/SST/NR/NR26.pdf

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,9900625001011427299,17192751964070924098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qr.me-qr.com/pt/E9k76ew"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,9900625001011427299,17192751964070924098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 605
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 553	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 377
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 377	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 605	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Drive-by Compromise	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
static.cloudflareinsights.com	104.16.80.73	true	false	high
tr.blismedia.com	34.96.105.8	true	false	high
global.px.quantserve.com	91.228.74.244	true	false	high
am1-direct-bgp.contextweb.com	208.93.169.131	true	false	high
cdn.w55c.net	35.210.130.15	true	false	high
drivefrontend-pa.clients6.google.com	142.250.185.234	true	false	high
widget.nl3.vip.prod.criteo.com	178.250.1.9	true	false	high
cm.g.doubleclick.net	142.250.186.66	true	false	high
www.google.com	142.250.184.228	true	false	high
drive.google.com	142.250.185.174	true	false	high
sync.srv.stackadapt.com	35.153.85.19	true	false	high
cdn.me-qr.com	78.46.57.143	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
creativecdn.com	185.184.8.90	true	false	high
sync.ipredictive.com	3.211.160.164	true	false	high
plus.l.google.com	172.217.16.206	true	false	high
ep1.adtrafficquality.google	142.250.184.226	true	false	high
drive.usercontent.google.com	142.250.185.161	true	false	high
qr.me-qr.com	188.114.97.3	true	false	high
ep2.adtrafficquality.google	142.250.186.161	true	false	high
gtrace.mediago.io	35.214.168.80	true	false	high
googleads.g.doubleclick.net	142.250.181.226	true	false	high
www3.l.google.com	172.217.23.110	true	false	high
ads.travelaudience.com	35.190.0.66	true	false	high
play.google.com	142.250.185.174	true	false	high
outspot2-ams.adx.opera.com	82.145.213.8	true	false	high
onetag-sys.com	51.89.9.252	true	false	high
match.adsby.bidtheatre.com	134.122.57.34	true	false	high
me-ticket.com	188.114.96.3	true	false	high
peoplestack-pa.clients6.google.com	216.58.212.138	true	false	high
people-pa.clients6.google.com	142.250.181.234	true	false	high
widget.us5.vip.prod.criteo.com	74.119.117.16	true	false	high
sync.teads.tv	unknown	unknown	false	high
t.adx.opera.com	unknown	unknown	false	high
pm.w55c.net	unknown	unknown	false	high
a.rfihub.com	unknown	unknown	false	high
ogs.google.com	unknown	unknown	false	high
fundingchoicesmessages.google.com	unknown	unknown	false	high
a.c.appier.net	unknown	unknown	false	high
contacts.google.com	unknown	unknown	false	high
dis.criteo.com	unknown	unknown	false	high
widget.us.criteo.com	unknown	unknown	false	high
analytics.pangle-ads.com	unknown	unknown	false	high
bh.contextweb.com	unknown	unknown	false	high
cms.quantserve.com	unknown	unknown	false	high
dclk-match.dotomi.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.WkVplHa1ISE.2021.O/am=PKgBT3uPuoHBeAIhAAEAADIBKIA/d=0/br=1/rs=AFB8gsxtN31NwTam2ScuD_-Qfq1agVWa8w/m=FEOFHe?cb=101621422	false	high
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSY_vH_Jn0Wp9bKWHt0Ae8gk7W30fPVm1T0sgsIKFYfmyyFHI37AUGEhgt7R6phJDmbY244yfB6PH7h60RHUJUyoE_kNg	false	high
https://qr.me-qr.com/image/header/arrow-up.svg	false	high
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmS_xiC_SD6udNesqRCcJ9ws5wbFix0idHIiqFdG2HbrTXwbZb3QANXJLnuMudpndIrlBuqbSuhgQJz0A6XT9grgmV8ehpeHYnI&google_hm=zSECM75opQUyGbac0NqguA	false	high
https://googleads.g.doubleclick.net/pagead/interaction/?ai=C_NkXfGt_Z82fNtTT9u8P7_ClkATPzIjGfJHSsc-jE93ZHhABIPCmk48BYMmWy4vEpPwPoAG_xN-yKcgBCakCOUgqbguGqD6oAwHIA8sEqgSOAk_QfspudpzAYYRVB61BbonZDAwqyUaWDzYAeIOygUmFa0h7-6R7RJWZnSYn0xD5YO3qhOTBVeGszGNjHpAwn_VLqz8IyYA85-qvYqLs_7wWFMEkZtM_ELXcVS5UJRkZVXrKPJx3zWIifcu4jt9BCy9Fnhd1X0Zp6qzaFTOlZ7RtRVOTxCbE2JL2DrRM9cAE0cYbqg2xn4cEJsu_mz7y38tdBU5tOBjcuwpaE5_12tjkar24qBhi4xME-Mva5pyPJnm9fuLEEY5cQ2Ka5HV7Rh5gsk_OITSjJyPbzsQeVJBkEGgYmM_7abS2c7EIC40ThMOu_fKhT3YXT8z0GbQZLFYrLu_udTJyHEA0PCl1gcAEiqPe7_wEiAXRrZKBUaAGLoAHv_yvkgSoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB-C9sQKoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB_vCsQLYBwDSCCYIgGEQARgfMgKKAjoLgECAwICAgKCogAJIvf3BOljpsYmvgOiKA7EJ5oWs1iOIpCWACgGYCwHICwGADAHaDBYKCxDw-vbZrJ6NyKgBEgIBA0ABSgElqg0CVVPIDQG4E-QD2BMMiBQD0BUBmBYB-BYBgBcBshcCGAG6FwI4AbIYCRICsV8YLiIBANAYAegYAQ&sigh=LQWEoiNo71A&cid=CAQSTwCa7L7dmYbQbo9NmakYjpf5lwD7B-Xz2fKPzH8dpivaDWYzM9avDUdaIXhGWlk_wwmcqfbBJ4hxUujUY32YX0P6ImAEp1IZ2CHloFhn6vc&label=user_feedback_menu_interaction&cid=CAQSTwCa7L7dmYbQbo9NmakYjpf5lwD7B-Xz2fKPzH8dpivaDWYzM9avDUdaIXhGWlk_wwmcqfbBJ4hxUujUY32YX0P6ImAEp1IZ2CHloFhn6vcYAQ	false	high
https://qr.me-qr.com/pt/E9k76ew	false	high
https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmR2EDCXh93u5PqAOAhsVplVMUL7PaVkVcljJZ7ABohbmAg9GOKaTDx-bJmXsq-e1aD4TKqbCIVEYP9NtteBWR4Sd2tiL8lsMfA&google_gid=CAESEHOdGk_QIuVpvJdQPNWeNmU&google_cver=1	false	high
https://googleads.g.doubleclick.net/btr/view?ai=Chx1ZgGt_Z4XAHvy59u8Pk4HxkAHPzIjGfJHSsc-jE93ZHhABIPCmk48BYMmWy4vEpPwPoAG_xN-yKcgBCakCOUgqbguGqD6oAwHIA8sEqgSLAk_QCIKeSJlJbYExYsEff9OKEqFbZjDammEehq08s0sq7IZpMnZrzwX0kVX2j4x4LG4YO1Gxzk9WKMnGlG2XUKh_h1seP9QtvsMtfifkPIu1L9aCnzRswQwra6CRyNwSzqNS2OlPRmneWT6SBKZ4yaMtmxaciJmty6A9R3cpejm9B6_MqdpwDUaswN7fBnBkfsbg200YKE5XAQfwteSi6kAs8t3w4lEPspB4IdvuSqdOYJgdVV7kNOsX4eCSPoGLWZC_CcMTWNcYI1eH0A0sIbkqycw4B4XHQjFJW7usHtj9ASxD5N9tAcQYM4WSmU5jKyXneC1Zm8KZnnKx7Ck2cWGk2zuIG8Ilujoex8AEiqPe7_wEiAXRrZKBUZIFBAgEGAGSBQQIBRgEoAYugAe__K-SBKgH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQlfwL0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpYyuXlsIDoigOaCTxodHRwczovL3BkZnpvbmVwcm8uY29tL3BkZj9jaWQ9YjlXM0poVzR5dk40SnIxcCZnYWRfc291cmNlPTWACgHICwHaDBEKCxDQ3JWN87D-9IUBEgIBA7gT5APYEwyIFAPQFQGYFgGAFwGyFx4KGggAEhRwdWItNzA1NjEwOTIxMDg3NjIwOBgAGAG6FwI4AbIYCRICsV8YLiIBANAYAegYAQ&sigh=aHWMfHnmHQQ&uach_m=%5BUACH%5D&ase=2&cid=CAQSPACa7L7dMpv7gO1_nHKzjHXEmN4Iw1d8YouhtdfzeRpB9peuuBYQ_4VdezCSOk4CSbDEVbfywDnWruWfzhgB&template_id=484&vis=1&ibtr=1&nis=6	false	high
https://apis.google.com/js/api.js	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0?le=scs	false	high
https://qr.me-qr.com/build/1001.4e6edec0dc.js	false	high
https://qr.me-qr.com/statistic/collect/37808944	false	high
https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.WkVplHa1ISE.2021.O/am=PKgBT3uPuoHBeAIhAAEAADIBKIA/d=0/br=1/rs=AFB8gsxtN31NwTam2ScuD_-Qfq1agVWa8w/m=BpTpKd,sy33h,sy33i,sy34q,sy33n,sy3er,sy3eq,VZyVdb,sy2z4,sy2z3,sy3ig,sy3ik,sy3il,sy3im,sy3ii,sy3ij,Y7JHmc,sy3ih,YG6GGc,sy3yi,sy3yj,qOiTdd,RkHMtd,oBK6Xd,DOffoc,A9Bcub?cb=101621422	false	high
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=wPfmkbtZSYQ2K08fuK0lJw&google_push=AXcoOmSn9QtCQxM04RouTEQs8X5GhT-H7EhwyF0b7he0I0dW5FkKvGLpOBgMoks2SpShpudtm2i6RTKfDe30ExX28ZXXRZ1B8CUJbpnG	false	high
https://fundingchoicesmessages.google.com/f/AGSKWxVfu5Ows4OJfOmwQg_-MeSgPMwoK4EQg91cja2UQDdPUZx9Y-rfgTylvafHo9hqhJDUNjtHhFcxScLBqqt3a2ek4HQ6q8afkA120xaXyyfDE7A9CNi0O05B8ewwlu_8rSFdUwVEaw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM2NDAzODQyLDE1MzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vcXIubWUtcXIuY29tL0U5azc2ZXciLG51bGwsW1s4LCJwRDVJX3BmckxQSSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0	false	high
https://me-ticket.com/media/cache/blur_bg_filter/data/images/vgg/150359675-24.jpg	false	high
https://googleads.g.doubleclick.net/pagead/adview?ai=CliBrfGt_Z8yfNtTT9u8P7_ClkASMw8TJfLmXqpjHE46rxdL5RBABIPCmk48BYMmWy4vEpPwPoAGml8bOKcgBAakCOUgqbguGqD6oAwHIA8sEqgSIAk_Q1226Rtbu4O-8Na9yC7_myQ2oYqrzh-asLeqKu-MI1IxS8kdmswzT2HKC1v0rNMqvWCtG0Dh3TRJ3F4Fqqs8oBztEQD-7uj8YNqbWsYV1WpW5JF62lAWN3aKIoZRcWMIe1E3XSFndj2OLjU09iJ1Ni8HkFTF_6cHkQiP-UWPrSgAbWtXqU2o2f-NYZWD7nUNUij8yeimlT40jVKRzuIr0LlJsX7yqD-ulfLsgTPTMGNazMvc3uwAnUWk2zs2LI2VkwyhMNE3Bs1wPU9wwKaH2m4GrVGXktjwAxSzJZccYZnQRRATtPyZqsic1qVcttfHcgFe_0a9ZkV6953N5Sdg2GqiGN6rg7MAE9fTTsIQFiAXWruClUpIFBAgEGAGSBQQIBRgEgAemz5auBKgH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwHyBwUQ6LWBBdIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WOmxia-A6IoDmgk_aHR0cHM6Ly9wZGZlZGl0b3JwbHVzLmNvbS9wZGY_Y2lkPWJmN2Z6Mk1ERU8yWUZWTkwmZ2FkX3NvdXJjZT01gAoByAsB2gwQCgoQwO2a47n4wpcSEgIBA9gTDdAVAYAXAbIXHgoaCAASFHB1Yi03MDU2MTA5MjEwODc2MjA4GAAYAboXAjgBshgJEgKxXxgBIgEA0BgB6BgB&sigh=5xRcTdmtyRs&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwCa7L7dmYbQbo9NmakYjpf5lwD7B-Xz2fKPzH8dpivaDWYzM9avDUdaIXhGWlk_wwmcqfbBJ4hxUujUY32YX0P6ImAEp1IZ2CHloFhn6vcYAQ&template_id=5001&vis=1&ebtr=1&nis=6	false	high
https://qr.me-qr.com/favicon.gif	false	high
https://www.google.com/images/cleardot.gif	false	high
https://ep2.adtrafficquality.google/sodar/sodar2.js	false	high
https://a.nel.cloudflare.com/report/v4?s=ykvGfGqHFGwg9PaXt6sQ0ykrkGvmEtKH31JA8WJt4q54z%2BOswglNys4MHdpRfT%2F%2BkaTduLkZcX%2F3BD0MOYc9SeGBSdbmDngOIUpNyI9qmi7QXxvmwKF8pdN%2FUOl2QVA%3D	false	high
https://fundingchoicesmessages.google.com/i/ca-pub-7056109210876208?href=https%3A%2F%2Fqr.me-qr.com%2FE9k76ew&ers=2	false	high
https://me-ticket.com/media/cache/blur_bg_filter/data/images/vgg/102774-24.jpg	false	high
https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.WkVplHa1ISE.2021.O/am=PKgBT3uPuoHBeAIhAAEAADIBKIA/d=1/exm=RsR2Mc,b/ed=1/br=1/rs=AFB8gsxtN31NwTam2ScuD_-Qfq1agVWa8w/m=core?cb=101621422	false	high
https://fundingchoicesmessages.google.com/f/AGSKWxWrL1SVX6NXD_lWYD6TXKMCzRNii_OcNbTw20uk_ZULftg716wfGLeGQq8-p8F5h9CqXRWInUrWJNusG7chGgk092sC4_AV7IF5LbRJ-5c62HgYs4xgnJIXI3Is07AxUsJShrMpbA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM2NDAzODQxLDIwNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vcXIubWUtcXIuY29tL0U5azc2ZXciLG51bGwsW1s4LCJwRDVJX3BmckxQSSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0	false	high
https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.WkVplHa1ISE.2021.O/am=PKgBT3uPuoHBeAIhAAEAADIBKIA/d=0/br=1/rs=AFB8gsxtN31NwTam2ScuD_-Qfq1agVWa8w/m=CHaMoc,sy3u0,FUoYUc?cb=101621422	false	high
https://contacts.google.com/_/scs/social-static/_/js/k=boq.SocialPeopleHovercardUi.en_US.QqrmPQn3Ycw.es5.O/ck=boq.SocialPeopleHovercardUi.ZGw-qTPFAfM.L.B1.O/am=GAzwBg/d=1/exm=A7fCU,BVgquf,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,L1AAkb,LEikZe,MI6k7c,MdUzUe,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,P6sQOc,PrPYRd,QIhFr,RMhBfe,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Xg7Hl,Z5uLle,ZDZcre,ZwDk9d,_b,_tp,aW3pY,byfTOb,e5qFLc,gychg,hKSk3e,hc6Ubd,kjKdXe,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,n73qwf,pjICDe,pw70Gc,s39S4,w9hDv,wmnU7d,ws9Tlc,xQtZb,xUdipf,zbML3c,zr1jrb/excm=_b,_tp,hovercardwidget/ed=1/wt=2/ujg=1/rs=AGLTcCMwBQ2BEX6ui0P24ao0mbrbrQ-HuQ/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:GkRiKb/m=Wt6vjf,hhhU8,FCpbqb,WhJNk	false	high
https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.WkVplHa1ISE.2021.O/am=PKgBT3uPuoHBeAIhAAEAADIBKIA/d=0/br=1/rs=AFB8gsxtN31NwTam2ScuD_-Qfq1agVWa8w/m=RyvaUb,E1sPM?cb=101621422	false	high
https://qr.me-qr.com/build/231.bd9bee1dc7.js	false	high
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LnFIPLz4XxIXcDr59v-rymSburS3eufyPMREjSs_oCb9iZ1ZkyiK2nD3Owb64-jizvVsT05qIE5w	false	high
https://qr.me-qr.com/assets/css/tooltipped.css?v=20211115	false	high
https://googleads.g.doubleclick.net/pagead/adview?ai=Ck7RgfGt_Z-6lNr2s9u8Pq4fO6AvPzIjGfJHSsc-jE93ZHhABIPCmk48BYMmWy4vEpPwPoAG_xN-yKcgBAakCOUgqbguGqD6oAwHIA8sEqgSLAk_QVaA1EfmHQpwFFtLozz2P8Mp6yJnOKvMDTVt_sHwbtor6_D4Fds-BzXENkGbD38s1eKTqyGMYiGsaNls6KnXmCH73dUWTr9CTJ5GOrc4VEbkiESMCpaeU8MrIWLhLQRG6zQ-7KHGJWglP7C1LctuM6mWk7nDaE7VSjujSeCkHTf-AsonhKuIvKtcsoE4VSn1Saia5UqX-3RQqIoPf67PRxURKFk4CDvnnuilF35m36xbgHabf6yF_OodyDLykEJIiJxCaeCNUqKU_eUaT7AC-mBA9jzLlDQ6nSVJXgRxa9Osks5GK5f2x3CIQBjk1KfP_h9zoN9gtznu7aooy15H18PHDeRa6Z7gVpcAEiqPe7_wEiAXRrZKBUZIFBAgEGAGSBQQIBRgEgAe__K-SBKgH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwHyBwQQqu8w0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpYrrmJr4DoigOaCTxodHRwczovL3BkZnpvbmVwcm8uY29tL3BkZj9jaWQ9YjlXM0poVzR5dk40SnIxcCZnYWRfc291cmNlPTWACgHICwHaDBAKChCwpO3ajNrF_BISAgED2BMMiBQD0BUBmBYBgBcBshceChoIABIUcHViLTcwNTYxMDkyMTA4NzYyMDgYABgBuhcCOAGyGAkSArFfGAEiAQDQGAHoGAE&sigh=n5_DrKwrXUI&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwCa7L7do3zjkkxOpw_0jJWDhOik7djIuVs0BQeTVz5qLR-uXeSN2DybMgTaS_rQ5a5q86IENt6D545tIRZCZpAXezggPjaNGeRhrpZxnMQYAQ&template_id=5001&vis=1&ebtr=1&nis=6	false	high
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSOOh6qjB4XebE9Lzsf7hdidzSb2sP0KVHsTMVD-jPQQsyl1Hvx9T6YcH81ovjmgk8UljG0Nxka3OItEjrhmDYJR20AAhzZw7dZ	false	high
https://www.google.com/pagead/drt/ui	false	high
https://drive.google.com/_/drive_fe/_/js/k=drive_fe.main.en_US.WkVplHa1ISE.2021.O/am=PKgBT3uPuoHBeAIhAAEAADIBKIA/d=1/exm=b/ed=1/br=1/rs=AFB8gsxtN31NwTam2ScuD_-Qfq1agVWa8w/m=RsR2Mc?cb=101621422	false	high
https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESELX4502hrTBvDZbIo9xtIhI&google_cver=1&google_push=AXcoOmQCz7DcFxl6ZQa6IDYo9LNjkZDwHuBeyHypwLQmLI_kM7PV8xE0GapPuMPLJ_h_PHr-lXVjdEYaTKTWOtUY8BPNJYeJIazRH8gFiA	false	high
https://googleads.g.doubleclick.net/btr/view?ai=Ck7RgfGt_Z-6lNr2s9u8Pq4fO6AvPzIjGfJHSsc-jE93ZHhABIPCmk48BYMmWy4vEpPwPoAG_xN-yKcgBAakCOUgqbguGqD6oAwHIA8sEqgSLAk_QVaA1EfmHQpwFFtLozz2P8Mp6yJnOKvMDTVt_sHwbtor6_D4Fds-BzXENkGbD38s1eKTqyGMYiGsaNls6KnXmCH73dUWTr9CTJ5GOrc4VEbkiESMCpaeU8MrIWLhLQRG6zQ-7KHGJWglP7C1LctuM6mWk7nDaE7VSjujSeCkHTf-AsonhKuIvKtcsoE4VSn1Saia5UqX-3RQqIoPf67PRxURKFk4CDvnnuilF35m36xbgHabf6yF_OodyDLykEJIiJxCaeCNUqKU_eUaT7AC-mBA9jzLlDQ6nSVJXgRxa9Osks5GK5f2x3CIQBjk1KfP_h9zoN9gtznu7aooy15H18PHDeRa6Z7gVpcAEiqPe7_wEiAXRrZKBUZIFBAgEGAGSBQQIBRgEgAe__K-SBKgH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwHyBwQQqu8w0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpYrrmJr4DoigOaCTxodHRwczovL3BkZnpvbmVwcm8uY29tL3BkZj9jaWQ9YjlXM0poVzR5dk40SnIxcCZnYWRfc291cmNlPTWACgHICwHaDBAKChCwpO3ajNrF_BISAgED2BMMiBQD0BUBmBYBgBcBshceChoIABIUcHViLTcwNTYxMDkyMTA4NzYyMDgYABgBuhcCOAGyGAkSArFfGAEiAQDQGAHoGAE&sigh=n5_DrKwrXUI&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwCa7L7do3zjkkxOpw_0jJWDhOik7djIuVs0BQeTVz5qLR-uXeSN2DybMgTaS_rQ5a5q86IENt6D545tIRZCZpAXezggPjaNGeRhrpZxnMQYAQ&template_id=5001&vis=1&ibtr=1&nis=6	false	high
https://googleads.g.doubleclick.net/pagead/interaction/?ai=CuXMDfGt_Z-6lNr2s9u8Pq4fO6AvPzIjGfJHSsc-jE93ZHhABIPCmk48BYMmWy4vEpPwPoAG_xN-yKcgBAakCOUgqbguGqD6oAwHIA8sEqgSOAk_QVaA1EfmHQpwFFtLozz2P8Mp6yJnOKvMDTVt_sHwbtor6_D4Fds-BzXENkGbD38s1eKTqyGMYiGsaNls6KnXmCH73dUWTr9CTJ5GOrc4VEbkiESMCpaeU8MrIWLhLQRG6zQ-7KHGJWglP7C1LctuM6mWk7nDaE7VSjujSeCkHTf-AsonhKuIvKtcsoE4VSn1Saia5UqX-3RQqIoPf67PRxURKFk4CDvnnuilF35m36xbgHabf6yF_OodyDLykEJIiJxCaeCNUqKU_eUaT7AC-mBA9j3DnPJxSyeBhEa5JH2UwVh_xElHSK6Y7KjPAINjnOgdcVC-jEF6Vclj-QYUQXDfmVQ5N0hIjNQ6-rcAEiqPe7_wEiAXRrZKBUYAHv_yvkgSoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB-C9sQKoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB_vCsQLYBwHSCCYIgGEQARgfMgKKAjoLgECAwICAgKCogAJIvf3BOliuuYmvgOiKA7EJ5oWs1iOIpCWACgGYCwHICwHaDBAKChCwpO3ajNrF_BISAgEDqg0CVVPIDQHYEwyIFAPQFQGYFgH4FgGAFwGyFwIYAboXAjgBshgJEgKxXxgBIgEA0BgB6BgB&sigh=UCwDjiz3R8U&cid=CAQSTwCa7L7do3zjkkxOpw_0jJWDhOik7djIuVs0BQeTVz5qLR-uXeSN2DybMgTaS_rQ5a5q86IENt6D545tIRZCZpAXezggPjaNGeRhrpZxnMQ&label=window_focus&gqid=fGt_Z_qDNaLS9u8P96OU8AY&qqid=CO7Tia-A6IoDFT2W_Qcdq4MTvQ&fg=1	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://signaler-staging.sandbox.google.com	chromecache_358.1.dr, chromecache_492.1.dr	false		high
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_493.1.dr, chromecache_504.1.dr	false		high
https://www.googletagservices.com/agrp/	chromecache_441.1.dr, chromecache_250.1.dr	false		high
https://apis.google.com/js/client.js	chromecache_358.1.dr, chromecache_493.1.dr, chromecache_504.1.dr, chromecache_492.1.dr	false		high
https://myactivity.google.com/product/workspace?utm_source=gmail	chromecache_304.1.dr, chromecache_310.1.dr	false		high
https://support.google.com	chromecache_358.1.dr, chromecache_447.1.dr, chromecache_492.1.dr	false		high
https://ep2.adtrafficquality.google	chromecache_334.1.dr	false		high
https://support.google.com/drive/answer/2375102	chromecache_304.1.dr, chromecache_310.1.dr	false		high
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_504.1.dr	false		high
https://cloudsearch.google.com/cloudsearch?	chromecache_304.1.dr, chromecache_310.1.dr	false		high
https://fundingchoicesmessages.google.com/i/$	chromecache_546.1.dr, chromecache_392.1.dr	false		high
https://pay.google.com/gp/v/widget/save	chromecache_331.1.dr	false		high
https://support.google.com/docs/answer/49114	chromecache_492.1.dr	false		high
https://drive-thirdparty.googleusercontent.com/	chromecache_418.1.dr	false		high
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_493.1.dr, chromecache_504.1.dr	false		high
https://drive.google.com/file/d/151B67OWNDBekQnU_8XHNyBa64Vn33WEe/view?usp=drivesdk	chromecache_618.1.dr	false		high
https://support.google.com/a?p=increase_storage	chromecache_304.1.dr, chromecache_310.1.dr	false		high
https://support.google.com/docs?p=cse_guest_access	chromecache_275.1.dr	false		high
https://support.google.com/drive/answer/141702	chromecache_304.1.dr, chromecache_310.1.dr	false		high
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=231	chromecache_296.1.dr	false		high
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=232	chromecache_339.1.dr, chromecache_334.1.dr	false		high
https://sandbox.google.com/inapp/%	chromecache_493.1.dr, chromecache_504.1.dr	false		high
https://tasks.google.com/	chromecache_358.1.dr, chromecache_492.1.dr	false		high
https://www.google.com/recaptcha/api.js?trustedtypes=true	chromecache_358.1.dr, chromecache_492.1.dr	false		high
https://www.youtube.com/subscribe_embed?usegapi=1	chromecache_443.1.dr, chromecache_331.1.dr	false		high
https://github.com/twbs/icons/blob/main/LICENSE)	chromecache_586.1.dr	false		high
https://securepubads.g.doubleclick.net/pagead/js/cocar.js	chromecache_546.1.dr, chromecache_392.1.dr	false		high
http://mathiasbynens.be/	chromecache_546.1.dr, chromecache_392.1.dr	false		high
https://www.youtubeeducation.com	chromecache_358.1.dr, chromecache_492.1.dr	false		high
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_493.1.dr, chromecache_504.1.dr	false		high
http://googleads.g.doubleclick.net	chromecache_460.1.dr, chromecache_546.1.dr, chromecache_509.1.dr, chromecache_392.1.dr	false		high
https://drive.google.com/requestreview?id=	chromecache_358.1.dr, chromecache_492.1.dr	false		high
http://lh4.ggpht.com	chromecache_358.1.dr, chromecache_492.1.dr	false		high
https://calendar.google.com/event	chromecache_595.1.dr, chromecache_519.1.dr	false		high
https://support.google.com/docs/answer/13447609	chromecache_492.1.dr	false		high
https://ep2.adtrafficquality.google/sodar/$	chromecache_546.1.dr, chromecache_392.1.dr	false		high
https://support.google.com/a/users?p=clean_up_sd	chromecache_304.1.dr, chromecache_310.1.dr	false		high
https://play.google.com	chromecache_358.1.dr, chromecache_447.1.dr, chromecache_492.1.dr	false		high
https://support.google.com/inapp/%	chromecache_493.1.dr, chromecache_504.1.dr	false		high
https://support.google.com/docs/answer/15001094	chromecache_358.1.dr, chromecache_492.1.dr	false		high
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_385.1.dr, chromecache_398.1.dr	false		high
https://drive-thirdparty.googleusercontent.com/rtl	chromecache_416.1.dr, chromecache_418.1.dr	false		high
https://www.google.com/shopping/customerreviews/badge?usegapi=1	chromecache_443.1.dr, chromecache_331.1.dr	false		high
https://lh3.googleusercontent.com/a/default-user	chromecache_310.1.dr	false		high
https://support.google.com/inapp/	chromecache_493.1.dr, chromecache_504.1.dr	false		high
https://asx-frontend-autopush.corp.google.co.uk/inapp/	chromecache_493.1.dr, chromecache_504.1.dr	false		high
https://drive.usercontent.google.com	chromecache_358.1.dr, chromecache_492.1.dr	false		high
https://apis.google.com	chromecache_331.1.dr, chromecache_280.1.dr	false		high
https://icons.getbootstrap.com/)	chromecache_586.1.dr	false		high
https://contacts.google.com	chromecache_519.1.dr	false		high
https://domains.google.com/suggest/flow	chromecache_255.1.dr, chromecache_406.1.dr, chromecache_454.1.dr, chromecache_280.1.dr	false		high
https://apps-drive-picker-dev.corp.google.com/picker/minpick/main	chromecache_358.1.dr, chromecache_492.1.dr	false		high
https://feedback2-test.corp.google.com/inapp/%	chromecache_493.1.dr, chromecache_504.1.dr	false		high
https://www.chemicalrisk.com.br/curso-in-company-manuseio-seguro-de-produtos-quimicos/)	chromecache_605.1.dr, 92fae80d-9a62-4d79-85ba-b6b209b5843c.tmp.0.dr, chromecache_377.1.dr	false	Avira URL Cloud: safe	unknown
https://cse.google.com/cse.js	chromecache_546.1.dr, chromecache_392.1.dr	false		high
https://support.google.com/drive?p=spam_view	chromecache_449.1.dr, chromecache_568.1.dr	false		high
https://workspace.google.com/terms/google-workspace-individual-terms/esignature-signer/	chromecache_492.1.dr	false		high
https://cdn.ampproject.org/rtv/$	chromecache_546.1.dr, chromecache_392.1.dr	false		high
http://www.bohemiancoding.com/sketch/ns	chromecache_395.1.dr, chromecache_287.1.dr	false		high
https://cloudsearch.clients6.google.com	chromecache_304.1.dr, chromecache_310.1.dr	false		high
https://mail.google.com/mail/u/	chromecache_595.1.dr, chromecache_519.1.dr	false		high
https://sandbox.google.com/inapp/	chromecache_493.1.dr, chromecache_504.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
35.190.0.66	ads.travelaudience.com	United States	15169	GOOGLEUS	false
91.228.74.244	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
35.210.130.15	cdn.w55c.net	United States	19527	GOOGLE-2US	false
104.16.80.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
51.89.9.252	onetag-sys.com	France	16276	OVHFR	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.33	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
3.211.160.164	sync.ipredictive.com	United States	14618	AMAZON-AESUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
185.184.8.90	creativecdn.com	Poland	204995	RTB-HOUSE-AMSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	qr.me-qr.com	European Union	13335	CLOUDFLARENETUS	false
134.122.57.34	match.adsby.bidtheatre.com	United States	14061	DIGITALOCEAN-ASNUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
82.145.213.8	outspot2-ams.adx.opera.com	United Kingdom	39832	NO-OPERANO	false
35.153.85.19	sync.srv.stackadapt.com	United States	14618	AMAZON-AESUS	false
208.93.169.131	am1-direct-bgp.contextweb.com	United States	26228	SERVEPATHUS	false
216.58.206.36	unknown	United States	15169	GOOGLEUS	false
172.217.23.110	www3.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.161	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.16.79.73	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.97	unknown	United States	15169	GOOGLEUS	false
172.217.18.110	unknown	United States	15169	GOOGLEUS	false
34.96.105.8	tr.blismedia.com	United States	15169	GOOGLEUS	false
178.250.1.9	widget.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
74.119.117.16	widget.us5.vip.prod.criteo.com	United States	19750	AS-CRITEOUS	false
142.250.186.161	ep2.adtrafficquality.google	United States	15169	GOOGLEUS	false
216.58.206.66	unknown	United States	15169	GOOGLEUS	false
35.214.168.80	gtrace.mediago.io	United States	19527	GOOGLE-2US	false
216.58.206.68	unknown	United States	15169	GOOGLEUS	false
142.250.185.174	drive.google.com	United States	15169	GOOGLEUS	false
78.46.57.143	cdn.me-qr.com	Germany	24940	HETZNER-ASDE	false
188.114.96.3	me-ticket.com	European Union	13335	CLOUDFLARENETUS	false
142.250.186.66	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.185.97	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586454
Start date and time:	2025-01-09 07:23:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://qr.me-qr.com/pt/E9k76ew
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@31/586@128/38
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 05:23:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9859027551670256
Encrypted:	false
SSDEEP:	48:86dgTEYoHOidAKZdA1FehwiZUklqehQy+3:8tfZ/y
MD5:	9D3190423997FE609C643D7C729CB721
SHA1:	25D02C95CB1B448ADA7FA925E93CB9D5D72255A0
SHA-256:	9EDF0124F3483FB8CC98580CB5E65F053D359710BE0F786FDB8983C4628356BB
SHA-512:	5DBBF1728379CDBABC42EDF2BEE864F4B48DE3B631945EE4D83A29E2EE69B4E220602A06993801A66B306BB48B285ACAE7B80155BA48C26B6BF44A30D64608E8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......?._b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I)Z.2....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z.2....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)Z.2....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)Z.2..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)Z.2...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............o.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 07:23:50.141326904 CET	192.168.2.16	1.1.1.1	0xd20a	Standard query (0)	qr.me-qr.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:50.141520023 CET	192.168.2.16	1.1.1.1	0x6625	Standard query (0)	qr.me-qr.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:51.985172987 CET	192.168.2.16	1.1.1.1	0x5255	Standard query (0)	cdn.me-qr.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:51.985333920 CET	192.168.2.16	1.1.1.1	0x6596	Standard query (0)	cdn.me-qr.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:52.944545984 CET	192.168.2.16	1.1.1.1	0xdea6	Standard query (0)	me-ticket.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:52.944845915 CET	192.168.2.16	1.1.1.1	0x7d38	Standard query (0)	me-ticket.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:52.945933104 CET	192.168.2.16	1.1.1.1	0xe8f1	Standard query (0)	qr.me-qr.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:52.946082115 CET	192.168.2.16	1.1.1.1	0xf773	Standard query (0)	qr.me-qr.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:53.279769897 CET	192.168.2.16	1.1.1.1	0x6f64	Standard query (0)	static.cloudflareinsights.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:53.279911995 CET	192.168.2.16	1.1.1.1	0x1d5	Standard query (0)	static.cloudflareinsights.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:53.574048996 CET	192.168.2.16	1.1.1.1	0x459	Standard query (0)	me-ticket.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:53.574289083 CET	192.168.2.16	1.1.1.1	0x1103	Standard query (0)	me-ticket.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:53.995565891 CET	192.168.2.16	1.1.1.1	0xa276	Standard query (0)	static.cloudflareinsights.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:53.995723009 CET	192.168.2.16	1.1.1.1	0x916e	Standard query (0)	static.cloudflareinsights.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:54.055845976 CET	192.168.2.16	1.1.1.1	0xdc63	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:54.055999041 CET	192.168.2.16	1.1.1.1	0x1de7	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:54.212186098 CET	192.168.2.16	1.1.1.1	0x27e1	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:54.212337971 CET	192.168.2.16	1.1.1.1	0x1337	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Jan 9, 2025 07:23:55.994920969 CET	192.168.2.16	1.1.1.1	0x5e1	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:55.995310068 CET	192.168.2.16	1.1.1.1	0x8d17	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Jan 9, 2025 07:23:58.137993097 CET	192.168.2.16	1.1.1.1	0xe682	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:58.138153076 CET	192.168.2.16	1.1.1.1	0xd5a0	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:59.567147970 CET	192.168.2.16	1.1.1.1	0x2c82	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:59.567584991 CET	192.168.2.16	1.1.1.1	0x1d41	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:23:59.601110935 CET	192.168.2.16	1.1.1.1	0xa5a4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:23:59.601373911 CET	192.168.2.16	1.1.1.1	0x889e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:01.123802900 CET	192.168.2.16	1.1.1.1	0xfc3d	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:01.123963118 CET	192.168.2.16	1.1.1.1	0xcfc2	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.196650028 CET	192.168.2.16	1.1.1.1	0xb0b3	Standard query (0)	cms.quantserve.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.196650028 CET	192.168.2.16	1.1.1.1	0x5839	Standard query (0)	cms.quantserve.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.197109938 CET	192.168.2.16	1.1.1.1	0x93d3	Standard query (0)	dclk-match.dotomi.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.197366953 CET	192.168.2.16	1.1.1.1	0xdf62	Standard query (0)	dclk-match.dotomi.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.197906017 CET	192.168.2.16	1.1.1.1	0x4289	Standard query (0)	tr.blismedia.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.198600054 CET	192.168.2.16	1.1.1.1	0xe467	Standard query (0)	tr.blismedia.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.198600054 CET	192.168.2.16	1.1.1.1	0xd18	Standard query (0)	creativecdn.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.198820114 CET	192.168.2.16	1.1.1.1	0xbd88	Standard query (0)	creativecdn.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.201204062 CET	192.168.2.16	1.1.1.1	0xd547	Standard query (0)	sync.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.201539040 CET	192.168.2.16	1.1.1.1	0x66dd	Standard query (0)	sync.srv.stackadapt.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.202213049 CET	192.168.2.16	1.1.1.1	0xa111	Standard query (0)	bh.contextweb.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.202347994 CET	192.168.2.16	1.1.1.1	0x60e6	Standard query (0)	bh.contextweb.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.203285933 CET	192.168.2.16	1.1.1.1	0x7e1c	Standard query (0)	analytics.pangle-ads.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.203759909 CET	192.168.2.16	1.1.1.1	0x54b8	Standard query (0)	analytics.pangle-ads.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.207191944 CET	192.168.2.16	1.1.1.1	0xb7a4	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.207341909 CET	192.168.2.16	1.1.1.1	0x883e	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.208489895 CET	192.168.2.16	1.1.1.1	0x8166	Standard query (0)	pm.w55c.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.208867073 CET	192.168.2.16	1.1.1.1	0xc6dc	Standard query (0)	pm.w55c.net	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.209464073 CET	192.168.2.16	1.1.1.1	0x76cf	Standard query (0)	ads.travelaudience.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.209624052 CET	192.168.2.16	1.1.1.1	0xcd98	Standard query (0)	ads.travelaudience.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.209934950 CET	192.168.2.16	1.1.1.1	0xad9a	Standard query (0)	match.adsby.bidtheatre.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.211035013 CET	192.168.2.16	1.1.1.1	0x7992	Standard query (0)	match.adsby.bidtheatre.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.212656975 CET	192.168.2.16	1.1.1.1	0x442b	Standard query (0)	a.c.appier.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.212902069 CET	192.168.2.16	1.1.1.1	0xd877	Standard query (0)	a.c.appier.net	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.215071917 CET	192.168.2.16	1.1.1.1	0xfe77	Standard query (0)	onetag-sys.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.215233088 CET	192.168.2.16	1.1.1.1	0xd454	Standard query (0)	onetag-sys.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.215795040 CET	192.168.2.16	1.1.1.1	0x936a	Standard query (0)	sync.teads.tv	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.215795040 CET	192.168.2.16	1.1.1.1	0x3156	Standard query (0)	sync.teads.tv	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.218079090 CET	192.168.2.16	1.1.1.1	0xdd5c	Standard query (0)	sync.ipredictive.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.218219042 CET	192.168.2.16	1.1.1.1	0xcb9d	Standard query (0)	sync.ipredictive.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.218610048 CET	192.168.2.16	1.1.1.1	0xff75	Standard query (0)	dis.criteo.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.218610048 CET	192.168.2.16	1.1.1.1	0x2d15	Standard query (0)	dis.criteo.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.219237089 CET	192.168.2.16	1.1.1.1	0x8759	Standard query (0)	a.rfihub.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.219350100 CET	192.168.2.16	1.1.1.1	0xe4dc	Standard query (0)	a.rfihub.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.219717026 CET	192.168.2.16	1.1.1.1	0x3394	Standard query (0)	t.adx.opera.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.219717026 CET	192.168.2.16	1.1.1.1	0x7425	Standard query (0)	t.adx.opera.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.220730066 CET	192.168.2.16	1.1.1.1	0xce6e	Standard query (0)	gtrace.mediago.io	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.220925093 CET	192.168.2.16	1.1.1.1	0xc431	Standard query (0)	gtrace.mediago.io	65	IN (0x0001)	false
Jan 9, 2025 07:24:02.717557907 CET	192.168.2.16	1.1.1.1	0x1f1a	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:02.718024969 CET	192.168.2.16	1.1.1.1	0x67c6	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Jan 9, 2025 07:24:03.290333986 CET	192.168.2.16	1.1.1.1	0x266c	Standard query (0)	widget.us.criteo.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:03.290661097 CET	192.168.2.16	1.1.1.1	0x4ee1	Standard query (0)	widget.us.criteo.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:03.933451891 CET	192.168.2.16	1.1.1.1	0x408c	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:03.933538914 CET	192.168.2.16	1.1.1.1	0xaa66	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Jan 9, 2025 07:24:03.935537100 CET	192.168.2.16	1.1.1.1	0x2f4a	Standard query (0)	widget.us.criteo.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:03.935895920 CET	192.168.2.16	1.1.1.1	0x65e6	Standard query (0)	widget.us.criteo.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:05.236193895 CET	192.168.2.16	1.1.1.1	0xf18e	Standard query (0)	ep1.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:05.236509085 CET	192.168.2.16	1.1.1.1	0xce58	Standard query (0)	ep1.adtrafficquality.google	65	IN (0x0001)	false
Jan 9, 2025 07:24:06.259360075 CET	192.168.2.16	1.1.1.1	0xa492	Standard query (0)	sync.teads.tv	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:06.259522915 CET	192.168.2.16	1.1.1.1	0xfe53	Standard query (0)	sync.teads.tv	65	IN (0x0001)	false
Jan 9, 2025 07:24:06.293530941 CET	192.168.2.16	1.1.1.1	0x55b7	Standard query (0)	ep2.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:06.293725967 CET	192.168.2.16	1.1.1.1	0xf7d8	Standard query (0)	ep2.adtrafficquality.google	65	IN (0x0001)	false
Jan 9, 2025 07:24:06.294574976 CET	192.168.2.16	1.1.1.1	0x4ce2	Standard query (0)	ep1.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:06.294723034 CET	192.168.2.16	1.1.1.1	0x9069	Standard query (0)	ep1.adtrafficquality.google	65	IN (0x0001)	false
Jan 9, 2025 07:24:07.313709974 CET	192.168.2.16	1.1.1.1	0x5487	Standard query (0)	ep2.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:07.314091921 CET	192.168.2.16	1.1.1.1	0xb1b0	Standard query (0)	ep2.adtrafficquality.google	65	IN (0x0001)	false
Jan 9, 2025 07:24:07.332710028 CET	192.168.2.16	1.1.1.1	0x8153	Standard query (0)	ep2.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:07.334548950 CET	192.168.2.16	1.1.1.1	0x3077	Standard query (0)	ep2.adtrafficquality.google	65	IN (0x0001)	false
Jan 9, 2025 07:24:35.174372911 CET	192.168.2.16	1.1.1.1	0x9ffd	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:35.174560070 CET	192.168.2.16	1.1.1.1	0xaab7	Standard query (0)	drive.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:36.665877104 CET	192.168.2.16	1.1.1.1	0x1ffa	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:36.666239023 CET	192.168.2.16	1.1.1.1	0xb9c6	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:37.602180958 CET	192.168.2.16	1.1.1.1	0xdef3	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:37.602333069 CET	192.168.2.16	1.1.1.1	0x12ee	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:37.939934015 CET	192.168.2.16	1.1.1.1	0xa274	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:37.940035105 CET	192.168.2.16	1.1.1.1	0x16e	Standard query (0)	drive.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:40.563527107 CET	192.168.2.16	1.1.1.1	0xf349	Standard query (0)	drivefrontend-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:40.563852072 CET	192.168.2.16	1.1.1.1	0x5d3b	Standard query (0)	drivefrontend-pa.clients6.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:41.780435085 CET	192.168.2.16	1.1.1.1	0x8a4d	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:41.780600071 CET	192.168.2.16	1.1.1.1	0xfeba	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:42.192210913 CET	192.168.2.16	1.1.1.1	0xb3d9	Standard query (0)	peoplestack-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:42.192368031 CET	192.168.2.16	1.1.1.1	0x302f	Standard query (0)	peoplestack-pa.clients6.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:42.642011881 CET	192.168.2.16	1.1.1.1	0xaa2a	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:42.642214060 CET	192.168.2.16	1.1.1.1	0x4483	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:42.654561043 CET	192.168.2.16	1.1.1.1	0x4332	Standard query (0)	drivefrontend-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:42.654561043 CET	192.168.2.16	1.1.1.1	0x62c8	Standard query (0)	drivefrontend-pa.clients6.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:44.125750065 CET	192.168.2.16	1.1.1.1	0x29b3	Standard query (0)	people-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:44.125907898 CET	192.168.2.16	1.1.1.1	0xffa7	Standard query (0)	people-pa.clients6.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:45.141592979 CET	192.168.2.16	1.1.1.1	0x77f6	Standard query (0)	people-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:45.141948938 CET	192.168.2.16	1.1.1.1	0x3993	Standard query (0)	people-pa.clients6.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:47.070198059 CET	192.168.2.16	1.1.1.1	0xc9cc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:47.070425034 CET	192.168.2.16	1.1.1.1	0xd672	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:49.602480888 CET	192.168.2.16	1.1.1.1	0xb865	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:49.602756023 CET	192.168.2.16	1.1.1.1	0xb293	Standard query (0)	drive.usercontent.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:52.639585972 CET	192.168.2.16	1.1.1.1	0xa3c5	Standard query (0)	contacts.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:52.639750957 CET	192.168.2.16	1.1.1.1	0xb75f	Standard query (0)	contacts.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:53.441896915 CET	192.168.2.16	1.1.1.1	0xed5f	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:53.442044020 CET	192.168.2.16	1.1.1.1	0xc17	Standard query (0)	drive.usercontent.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:54.202331066 CET	192.168.2.16	1.1.1.1	0x93f6	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:54.202776909 CET	192.168.2.16	1.1.1.1	0xdcb2	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:24:54.982650042 CET	192.168.2.16	1.1.1.1	0xdd60	Standard query (0)	contacts.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:24:54.982789040 CET	192.168.2.16	1.1.1.1	0x1e9f	Standard query (0)	contacts.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:25:41.818312883 CET	192.168.2.16	1.1.1.1	0xed2c	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:25:41.818312883 CET	192.168.2.16	1.1.1.1	0x8c11	Standard query (0)	drive.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:25:42.953516006 CET	192.168.2.16	1.1.1.1	0x9809	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:25:42.953671932 CET	192.168.2.16	1.1.1.1	0x163a	Standard query (0)	drive.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:25:49.818521976 CET	192.168.2.16	1.1.1.1	0xd9f3	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:25:49.818809032 CET	192.168.2.16	1.1.1.1	0xd36d	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jan 9, 2025 07:25:50.655637980 CET	192.168.2.16	1.1.1.1	0xf90a	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 07:25:50.655637980 CET	192.168.2.16	1.1.1.1	0x86ca	Standard query (0)	play.google.com	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:51 UTC	665	OUT	GET /pt/E9k76ew HTTP/1.1 Host: qr.me-qr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 06:23:51 UTC	1179	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 06:23:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://qr.me-qr.com/E9k76ew Cache-Control: max-age=0, must-revalidate, no-cache, no-store, private expires: Thu, 09 Jan 2025 06:23:51 GMT Set-Cookie: user_local=en; expires=Fri, 09 Jan 2026 06:23:51 GMT; Max-Age=31536000; path=/; secure Set-Cookie: adsStatData=%7B%22url%22%3Anull%2C%22campaignId%22%3Anull%2C%22adgroupId%22%3Anull%2C%22gClId%22%3Anull%2C%22bannerId%22%3Anull%2C%22device%22%3Anull%2C%22adPosition%22%3Anull%2C%22targetId%22%3Anull%2C%22locInterestMC%22%3Anull%2C%22locPhysicalMs%22%3Anull%2C%22keyword%22%3Anull%2C%22audience%22%3Anull%2C%22deviceModel%22%3Anull%2C%22creative%22%3Anull%2C%22firstVisitDate%22%3A%222025-01-09%2008%3A23%3A51%22%7D; expires=Fri, 09 Jan 2026 06:23:51 GMT; Max-Age=31536000; path=/; secure; httponly; samesite=lax Set-Cookie: cookieId=37b957cd-11ce-4e0a-9b28-551f490dd856; expires=Fri, 09 Jan 2026 06:23:51 GMT; Max-Age=31536000; path=/; secure; httponly; samesite=lax vary: User-Agent cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC"
2025-01-09 06:23:51 UTC	656	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 53 41 31 25 32 42 66 52 47 44 25 32 46 39 52 49 4c 50 36 70 4b 6a 78 47 46 79 4a 55 33 7a 37 32 56 48 79 70 69 66 32 4e 45 59 73 38 63 47 59 25 32 42 53 25 32 42 74 59 41 32 33 68 6f 6e 42 53 50 37 51 37 4f 4b 67 59 57 73 44 6f 52 44 35 51 37 35 44 5a 6a 49 39 25 32 42 48 59 46 35 39 45 61 42 37 43 4f 62 6b 64 36 30 57 71 43 25 32 46 75 63 39 63 6c 38 76 62 48 4e 72 62 61 4f 47 7a 6c 36 7a 35 69 75 71 53 41 57 51 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SA1%2BfRGD%2F9RILP6pKjxGFyJU3z72VHypif2NEYs8cGY%2BS%2BtYA23honBSP7Q7OKgYWsDoRD5Q75DZjI9%2BHYF59EaB7CObkd60WqC%2Fuc9cl8vbHNrbaOGzl6z5iuqSAWQ%3D"}],"group":"cf-nel","max_age":6048
2025-01-09 06:23:51 UTC	844	IN	Data Raw: 33 34 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 71 72 2e 6d 65 2d 71 72 2e 63 6f 6d 2f 45 39 6b 37 36 65 77 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 71 72 2e 6d 65 2d 71 72 2e 63 6f 6d 2f 45 39 6b 37 36 65 77 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 Data Ascii: 345<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://qr.me-qr.com/E9k76ew'" /> <title>Redirecting to https://qr.me-qr.com/E9k76ew</title> </head> <body>
2025-01-09 06:23:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:51 UTC	1149	OUT	GET /E9k76ew HTTP/1.1 Host: qr.me-qr.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: user_local=en; adsStatData=%7B%22url%22%3Anull%2C%22campaignId%22%3Anull%2C%22adgroupId%22%3Anull%2C%22gClId%22%3Anull%2C%22bannerId%22%3Anull%2C%22device%22%3Anull%2C%22adPosition%22%3Anull%2C%22targetId%22%3Anull%2C%22locInterestMC%22%3Anull%2C%22locPhysicalMs%22%3Anull%2C%22keyword%22%3Anull%2C%22audience%22%3Anull%2C%22deviceModel%22%3Anull%2C%22creative%22%3Anull%2C%22firstVisitDate%22%3A%222025-01-09%2008%3A23%3A51%22%7D; cookieId=37b957cd-11ce-4e0a-9b28-551f490dd856
2025-01-09 06:23:51 UTC	1042	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, must-revalidate, no-cache, no-store, private x-frame-options: SAMEORIGIN expires: Thu, 09 Jan 2025 06:23:51 GMT vary: User-Agent vary: accept-encoding cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uKBaiGyFVG9eV%2BIZWoRkJ7LqjyV2EVVV3nUnNdbDSm8AVLC0gMAbeOJ%2BUBrYoHyhNDfVORDtT3mNCtjXiBHoAcoOPVrnxCaF6RgGx4ezZXYcKARXAAq8I4C44OFkiAA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8ff2574bbd463314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1948&min_rtt=1941&rtt_var=743&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1727&delivery_rate=1457813&cwnd=212&unsent_bytes=0&cid=c4109fdf5d96d625&ts=707&x=0"
2025-01-09 06:23:51 UTC	327	IN	Data Raw: 39 30 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 20 20 20 20 20 20 20 20 20 20 20 47 69 61 6e 74 20 51 52 20 43 6f 64 65 20 47 65 6e 65 72 61 74 6f 72 20 7c 20 56 69 65 77 20 51 52 20 63 6f 64 65 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 62 75 69 6c 64 2f 73 74 61 74 69 63 2d 70 61 67 65 2e 32 38 65 32 65 64 39 65 33 39 2e 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 62 75 69 6c 64 2f 72 75 6e 74 69 6d 65 2e 38 33 31 65 33 66 35 37 62 35 2e 6a 73 22 20 64 65 66 65 72 3e Data Ascii: 907<!DOCTYPE html><html lang="en"><head> <title> Giant QR Code Generator \| View QR code </title> <link rel="stylesheet" href="/build/static-page.28e2ed9e39.css"> <script src="/build/runtime.831e3f57b5.js" defer>
2025-01-09 06:23:51 UTC	1369	IN	Data Raw: 73 72 63 3d 22 2f 62 75 69 6c 64 2f 31 30 30 31 2e 34 65 36 65 64 65 63 30 64 63 2e 6a 73 22 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 62 75 69 6c 64 2f 36 34 36 38 2e 35 36 66 37 64 33 32 35 39 31 2e 6a 73 22 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 62 75 69 6c 64 2f 32 33 31 2e 62 64 39 62 65 65 31 64 63 37 2e 6a 73 22 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 62 75 69 6c 64 2f 39 30 34 31 2e 30 64 65 30 37 64 62 32 37 61 2e 6a 73 22 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 62 75 69 6c 64 2f 73 74 61 74 69 63 2d 70 61 67 65 2e 62 33 33 66 36 62 35 62 61 33 2e 6a Data Ascii: src="/build/1001.4e6edec0dc.js" defer></script><script src="/build/6468.56f7d32591.js" defer></script><script src="/build/231.bd9bee1dc7.js" defer></script><script src="/build/9041.0de07db27a.js" defer></script><script src="/build/static-page.b33f6b5ba3.j
2025-01-09 06:23:51 UTC	622	IN	Data Raw: 20 51 52 20 63 6f 64 65 73 20 6f 6e 6c 69 6e 65 20 77 69 74 68 20 4d 45 2d 51 52 21 0a 20 20 20 20 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 0a 20 20 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 71 72 2e 6d 65 2d 71 72 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 70 61 67 65 73 2f 6c 6f 67 6f 2f 6c 6f 67 6f 2d 76 32 2e 6a 70 67 22 3e 0a 20 20 20 20 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 71 72 2e 6d 65 2d 71 72 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0a 3c 6d 65 Data Ascii: QR codes online with ME-QR! "/> <meta property="og:image" content="https://qr.me-qr.com/static/pages/logo/logo-v2.jpg"> <meta charset="utf-8"/><link rel="apple-touch-icon" sizes="76x76" href="https://qr.me-qr.com/favicon.ico"><me
2025-01-09 06:23:51 UTC	1369	IN	Data Raw: 37 66 66 39 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 49 53 51 50 20 4f 2d 49 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 3a 61 6c 74 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 45 5f 51 52 20 4c 4f 47 4f 22 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 71 72 2e 6d 65 2d 71 72 2e 63 6f 6d 2f 45 39 6b 37 36 65 77 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 71 72 2e 6d 65 2d 71 72 Data Ascii: 7ff9<meta name="twitter:title" content="FISQP O-I"> <meta name="twitter:image:alt" content="ME_QR LOGO" <link rel="alternate" hreflang="en" href="https://qr.me-qr.com/E9k76ew"> <link rel="alternate" hreflang="es" href="https://qr.me-qr
2025-01-09 06:23:51 UTC	1369	IN	Data Raw: 2e 6d 65 2d 71 72 2e 63 6f 6d 2f 73 76 2f 45 39 6b 37 36 65 77 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 75 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 71 72 2e 6d 65 2d 71 72 2e 63 6f 6d 2f 75 6b 2f 45 39 6b 37 36 65 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 7a 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 71 72 2e 6d 65 2d 71 72 2e 63 6f 6d 2f 7a 68 2f 45 39 6b 37 36 65 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: .me-qr.com/sv/E9k76ew"> <link rel="alternate" hreflang="uk" href="https://qr.me-qr.com/uk/E9k76ew"> <link rel="alternate" hreflang="zh" href="https://qr.me-qr.com/zh/E9k76ew">
2025-01-09 06:23:51 UTC	1369	IN	Data Raw: 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 71 72 2e 6d 65 2d 71 72 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 63 73 73 2f 74 6f 6f 6c 74 69 70 70 65 64 2e 63 73 73 3f 76 3d 32 30 32 31 31 31 31 35 22 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 61 6f 53 54 2d 71 44 45 51 5a 70 56 69 5a 6f 51 48 75 64 73 4a 55 4b 5f 71 52 58 31 4f 65 37 6e 6a 35 52 68 77 5f 76 44 65 58 38 22 20 2f 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 64 61 74 61 Data Ascii: </script> <link rel="stylesheet" href="https://qr.me-qr.com/assets/css/tooltipped.css?v=20211115"/> <meta name="google-site-verification" content="aoST-qDEQZpViZoQHudsJUK_qRX1Oe7nj5Rhw_vDeX8" /> </head><body data
2025-01-09 06:23:51 UTC	1369	IN	Data Raw: 75 6f 74 3b 3a 26 71 75 6f 74 3b 5c 2f 71 72 2d 63 6f 64 65 2d 67 65 6e 65 72 61 74 6f 72 5c 2f 6d 61 70 26 71 75 6f 74 3b 7d 2c 26 71 75 6f 74 3b 77 69 66 69 26 71 75 6f 74 3b 3a 7b 26 71 75 6f 74 3b 74 69 74 6c 65 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 57 69 2d 46 69 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 69 6d 67 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 5c 2f 73 74 61 74 69 63 5c 2f 70 61 67 65 73 5c 2f 61 64 6d 69 6e 2d 69 6d 67 5c 2f 73 79 6d 62 6f 6c 2e 73 76 67 3f 76 3d 32 23 69 63 6f 6e 2d 77 69 66 69 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 68 72 65 66 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 5c 2f 71 72 2d 63 6f 64 65 2d 67 65 6e 65 72 61 74 6f 72 5c 2f 77 69 2d 66 69 26 71 75 6f 74 3b 7d 2c 26 71 75 6f 74 3b 61 75 64 69 6f 26 71 75 6f 74 3b 3a 7b 26 Data Ascii: uot;:"\/qr-code-generator\/map"},"wifi":{"title":"Wi-Fi","img":"\/static\/pages\/admin-img\/symbol.svg?v=2#icon-wifi","href":"\/qr-code-generator\/wi-fi"},"audio":{&
2025-01-09 06:23:51 UTC	1369	IN	Data Raw: 3b 3a 26 71 75 6f 74 3b 5c 2f 71 72 2d 63 6f 64 65 2d 67 65 6e 65 72 61 74 6f 72 5c 2f 65 78 63 65 6c 26 71 75 6f 74 3b 7d 2c 26 71 75 6f 74 3b 66 61 63 65 62 6f 6f 6b 26 71 75 6f 74 3b 3a 7b 26 71 75 6f 74 3b 74 69 74 6c 65 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 46 61 63 65 62 6f 6f 6b 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 69 6d 67 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 5c 2f 73 74 61 74 69 63 5c 2f 70 61 67 65 73 5c 2f 61 64 6d 69 6e 2d 69 6d 67 5c 2f 73 79 6d 62 6f 6c 2e 73 76 67 3f 76 3d 32 23 69 63 6f 6e 2d 66 61 63 65 62 6f 6f 6b 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 68 72 65 66 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 5c 2f 71 72 2d 63 6f 64 65 2d 67 65 6e 65 72 61 74 6f 72 5c 2f 66 61 63 65 62 6f 6f 6b 26 71 75 6f 74 3b 7d 2c 26 71 75 6f 74 3b 66 Data Ascii: ;:"\/qr-code-generator\/excel"},"facebook":{"title":"Facebook","img":"\/static\/pages\/admin-img\/symbol.svg?v=2#icon-facebook","href":"\/qr-code-generator\/facebook"},"f
2025-01-09 06:23:51 UTC	1369	IN	Data Raw: 3c 62 75 74 74 6f 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 20 62 6f 72 64 65 72 2d 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 6d 65 6e 75 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 6c 61 62 65 6c 6c 65 64 62 79 3d 22 73 70 61 6e 2d 6d 65 6e 75 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 6f 66 66 63 61 6e 76 61 73 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 61 74 61 2d 62 73 2d 74 61 72 67 65 74 3d 22 23 6f 66 66 63 61 6e 76 61 73 4e 61 76 62 61 72 Data Ascii: <button class="navbar-toggler border-0" aria-label="menu" aria-labelledby="span-menu" type="button" data-bs-toggle="offcanvas" data-bs-target="#offcanvasNavbar
2025-01-09 06:23:51 UTC	1369	IN	Data Raw: 67 2d 66 6c 65 78 20 64 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6d 65 2d 78 6c 2d 34 20 64 72 6f 70 64 6f 77 6e 20 6e 61 76 2d 70 69 6c 6c 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 22 20 72 6f 6c 65 3d 22 62 75 74 74 6f 6e 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 57 68 79 20 4d 65 2d 51 52 3f 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: g-flex d-none"> <li class="nav-item me-xl-4 dropdown nav-pills"> <a href="" class="nav-link" role="button" data-bs-toggle="dropdown" aria-expanded="false"> Why Me-QR?

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://qr.me-qr.com/pt/E9k76ew

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\92fae80d-9a62-4d79-85ba-b6b209b5843c.tmp

C:\Users\user\Downloads\ORIENTA ES GERAIS QUIMICOS E EMERGENCIA AMBIENTAL.pdf.crdownload

C:\Users\user\Downloads\ORIENTA..ES GERAIS QUIMICOS E EMERGENCIA AMBIENTAL.pdf (copy)

C:\Users\user\Downloads\ORIENTA..ES GERAIS QUIMICOS E EMERGENCIA AMBIENTAL.pdf.crdownload (copy)

C:\Users\user\Downloads\e207b9d4-f7e8-4651-a723-8f42b3dece17.tmp

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 252

Chrome Cache Entry: 253

Chrome Cache Entry: 254

Chrome Cache Entry: 255

Chrome Cache Entry: 256

Chrome Cache Entry: 257

Chrome Cache Entry: 258

Chrome Cache Entry: 259

Chrome Cache Entry: 260

Chrome Cache Entry: 261

Chrome Cache Entry: 262

Chrome Cache Entry: 263

Chrome Cache Entry: 264

Windows Analysis Report
https://qr.me-qr.com/pt/E9k76ew

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:52 UTC	1049	OUT	GET /build/static-page.28e2ed9e39.css HTTP/1.1 Host: qr.me-qr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://qr.me-qr.com/E9k76ew Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: user_local=en; adsStatData=%7B%22url%22%3Anull%2C%22campaignId%22%3Anull%2C%22adgroupId%22%3Anull%2C%22gClId%22%3Anull%2C%22bannerId%22%3Anull%2C%22device%22%3Anull%2C%22adPosition%22%3Anull%2C%22targetId%22%3Anull%2C%22locInterestMC%22%3Anull%2C%22locPhysicalMs%22%3Anull%2C%22keyword%22%3Anull%2C%22audience%22%3Anull%2C%22deviceModel%22%3Anull%2C%22creative%22%3Anull%2C%22firstVisitDate%22%3A%222025-01-09%2008%3A23%3A51%22%7D; cookieId=37b957cd-11ce-4e0a-9b28-551f490dd856
2025-01-09 06:23:52 UTC	981	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:52 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close last-modified: Fri, 03 Jan 2025 16:39:51 GMT etag: W/"677812d7-51a69" expires: Mon, 13 Jan 2025 12:34:18 GMT Cache-Control: public, max-age=604800 vary: User-Agent CF-Cache-Status: HIT Age: 236974 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nJZU6afy%2Bf7XPALyS7ThMalaaUgqp%2BYLoeaoss3c6gJyBaMLmuZ0sbHR%2BtYr7vPUwcfOF917Ejt5E5uidOb3ebfQPlACZ5%2FshyyVrfZ667TkyjebFOFRrnYWS2L1Et0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8ff257531d604369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1577&min_rtt=1570&rtt_var=604&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1627&delivery_rate=1789215&cwnd=220&unsent_bytes=0&cid=86e60ec5482b6ba9&ts=155&x=0"
2025-01-09 06:23:52 UTC	388	IN	Data Raw: 37 63 61 32 0d 0a 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2e 63 6f 6e 74 61 69 6e 65 72 7b 63 6f 6c 6f 72 3a 23 33 65 34 38 35 37 7d 2e 74 6f 70 2d 62 67 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 39 30 64 65 67 2c 23 31 64 30 63 35 65 2c 23 34 64 30 37 34 61 20 36 30 2e 38 39 25 2c 23 33 61 30 34 37 64 20 39 39 2e 39 25 29 7d 75 6c 2e 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 6c 69 3a 3a 6d 61 72 6b 65 72 7b 63 6f 6c 6f 72 3a 23 37 61 36 66 66 37 7d 2e 68 65 72 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 39 30 64 65 67 2c 23 30 34 30 30 31 33 2c 23 34 32 30 36 33 66 20 35 34 2e 33 31 25 2c 23 33 61 30 34 37 64 20 39 39 2e 39 25 Data Ascii: 7ca2@charset "UTF-8";.container{color:#3e4857}.top-bg{background-image:linear-gradient(90deg,#1d0c5e,#4d074a 60.89%,#3a047d 99.9%)}ul.instructions li::marker{color:#7a6ff7}.hero{background-image:linear-gradient(90deg,#040013,#42063f 54.31%,#3a047d 99.9%
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 75 73 3a 34 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 30 70 78 20 32 30 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 34 29 2c 30 20 32 70 78 20 36 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 34 29 2c 30 20 30 20 31 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 30 34 29 7d 2e 62 67 2d 66 69 72 73 74 2d 73 65 63 6f 6e 64 2d 63 68 65 63 6b 62 6f 78 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 39 62 32 37 61 66 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 62 67 2d 66 69 72 73 74 2d 73 65 63 6f 6e 64 2d 63 68 65 63 6b 62 6f 78 2c 2e 62 67 2d 74 68 69 72 64 2d 63 68 65 63 6b 62 6f 78 7b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 Data Ascii: us:4px;box-shadow:0 10px 20px rgba(0,0,0,.04),0 2px 6px rgba(0,0,0,.04),0 0 1px rgba(0,0,0,.04)}.bg-first-second-checkbox{background:#9b27af;border-radius:2px;color:#fff}.bg-first-second-checkbox,.bg-third-checkbox{-ms-flex-pack:center;-ms-flex-align:cent
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 65 72 3a 30 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 6d 73 2d 63 6c 65 61 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 6d 73 2d 72 65 76 65 61 6c 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 3b 77 69 64 74 68 3a 30 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 63 61 6e 63 65 6c 2d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 64 65 63 6f 72 61 74 69 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 72 65 73 75 6c 74 73 2d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 Data Ascii: er:0}input[type=search]::-ms-clear,input[type=search]::-ms-reveal{display:none;height:0;width:0}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration,input[type=search]::-webkit-search-results-button,input[type=sea
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 3a 31 30 30 25 20 31 30 30 25 2c 30 20 31 30 30 25 7d 2e 62 67 2d 61 72 74 2c 2e 62 67 2d 74 69 63 6b 65 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 2c 6e 6f 2d 72 65 70 65 61 74 7d 2e 62 67 2d 61 72 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 62 65 39 66 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 6f 72 6e 61 6d 65 6e 74 2d 61 72 74 2e 36 33 35 38 30 36 39 64 2e 70 6e 67 29 2c 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 69 6d 67 2d 61 72 74 2e 38 64 61 31 38 63 37 61 2e 70 6e 67 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 35 30 25 2c 31 30 30 25 20 31 30 30 25 7d 2e 62 67 2d 72 65 76 69 65 77 7b Data Ascii: :100% 100%,0 100%}.bg-art,.bg-ticket{background-repeat:no-repeat,no-repeat}.bg-art{background-color:#ebe9fe;background-image:url(/build/images/ornament-art.6358069d.png),url(/build/images/img-art.8da18c7a.png);background-position:50%,100% 100%}.bg-review{
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 70 78 7d 2e 62 67 2d 6f 72 64 65 72 69 6e 67 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2e 35 36 33 64 32 30 61 64 2e 70 6e 67 29 3b 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 33 31 70 78 29 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2d 6d 2e 64 66 61 62 34 34 30 62 2e 70 6e 67 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 38 31 32 70 78 7d 7d 2e 62 67 2d 71 72 2d 77 65 62 73 69 74 65 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2e 62 35 34 36 62 30 64 37 2e 70 6e 67 29 3b 40 6d 65 64 69 61 20 73 63 72 65 Data Ascii: px}.bg-ordering{background-image:url(/build/images/bg.563d20ad.png);@media screen and (max-width:431px){background-image:url(/build/images/bg-m.dfab440b.png);min-height:812px}}.bg-qr-websites{background-image:url(/build/images/bg.b546b0d7.png);@media scre
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2e 30 38 65 30 66 38 37 31 2e 70 6e 67 29 3b 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 33 31 70 78 29 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2d 6d 2e 31 32 32 39 33 64 36 62 2e 70 6e 67 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 38 31 32 70 78 7d 7d 2e 62 67 2d 71 72 2d 66 6c 79 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2e 31 39 63 31 62 65 64 62 2e 70 6e 67 29 3b 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 33 31 70 78 29 7b 62 61 Data Ascii: nd-image:url(/build/images/bg.08e0f871.png);@media screen and (max-width:431px){background-image:url(/build/images/bg-m.12293d6b.png);min-height:812px}}.bg-qr-flyer{background-image:url(/build/images/bg.19c1bedb.png);@media screen and (max-width:431px){ba
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 29 3b 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 33 31 70 78 29 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2d 6d 2e 39 30 64 38 30 36 38 37 2e 70 6e 67 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 38 31 32 70 78 7d 7d 2e 62 67 2d 71 72 2d 77 69 6e 64 6f 77 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2e 64 62 33 36 36 34 63 31 2e 70 6e 67 29 3b 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 33 31 70 78 29 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2d 6d 2e 34 36 Data Ascii: );@media screen and (max-width:431px){background-image:url(/build/images/bg-m.90d80687.png);min-height:812px}}.bg-qr-windows{background-image:url(/build/images/bg.db3664c1.png);@media screen and (max-width:431px){background-image:url(/build/images/bg-m.46
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 62 67 2d 6d 2e 61 31 61 61 32 33 66 33 2e 70 6e 67 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 31 32 70 78 7d 7d 2e 62 67 2d 77 69 74 68 2d 64 6f 74 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 62 75 69 6c 64 2f 69 6d 61 67 65 73 2f 6d 61 69 6e 2d 69 6d 67 2e 30 66 34 37 38 33 65 38 2e 77 65 62 70 29 7d 2e 62 67 2d 73 68 61 70 65 73 2c 2e 62 67 2d 77 69 74 68 2d 64 6f 74 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 76 65 72 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 34 35 30 70 78 7d 2e 62 67 2d 73 68 61 70 65 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 Data Ascii: nd-image:url(/build/images/bg-m.a1aa23f3.png);min-height:1012px}}.bg-with-dots{background-image:url(/build/images/main-img.0f4783e8.webp)}.bg-shapes,.bg-with-dots{background-repeat:no-repeat;background-size:cover;min-height:450px}.bg-shapes{background-ima
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 78 3b 74 6f 70 3a 31 30 70 78 7d 2e 67 65 6e 65 72 61 74 6f 72 2d 64 72 6f 70 64 6f 77 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 65 6e 65 72 61 74 6f 72 2d 64 72 6f 70 64 6f 77 6e 20 61 2c 2e 67 65 6e 65 72 61 74 6f 72 2d 64 72 6f 70 64 6f 77 6e 20 67 2c 2e 67 65 6e 65 72 61 74 6f 72 2d 64 72 6f 70 64 6f 77 6e 20 70 61 74 68 2c 2e 67 65 6e 65 72 61 74 6f 72 2d 64 72 6f 70 64 6f 77 6e 20 73 76 67 2c 2e 67 65 6e 65 72 61 74 6f 72 2d 64 72 6f 70 64 6f 77 6e 20 75 73 65 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 67 65 6e 65 72 61 74 6f 72 2d 64 72 6f 70 64 6f 77 6e 20 62 75 74 74 6f 6e 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 65 6e 65 72 61 74 6f 72 2d 64 72 Data Ascii: x;top:10px}.generator-dropdown{margin-left:2px!important}.generator-dropdown a,.generator-dropdown g,.generator-dropdown path,.generator-dropdown svg,.generator-dropdown use{cursor:pointer}.generator-dropdown button{box-shadow:none!important}.generator-dr
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 72 2d 6c 69 67 68 74 3a 23 66 66 65 66 65 65 3b 2d 2d 62 73 2d 64 61 72 6b 2d 70 75 72 70 6c 65 3a 23 33 63 30 35 37 65 3b 2d 2d 62 73 2d 64 61 72 6b 2d 67 72 65 65 6e 3a 23 31 37 35 37 34 33 3b 2d 2d 62 73 2d 62 6f 6f 6b 69 6e 67 3a 23 65 62 35 36 34 37 3b 2d 2d 62 73 2d 6d 61 69 6e 2d 62 6f 6f 6b 69 6e 67 3a 23 30 65 30 64 31 37 3b 2d 2d 62 73 2d 77 68 69 74 65 3a 23 66 66 66 3b 2d 2d 62 73 2d 6f 72 61 6e 67 65 3a 23 66 38 61 34 30 66 3b 2d 2d 62 73 2d 62 6f 6f 6b 69 6e 67 2d 79 65 6c 6c 6f 77 3a 23 66 66 65 34 35 39 3b 2d 2d 62 73 2d 61 72 74 2d 67 72 61 79 3a 23 37 36 37 36 37 36 3b 2d 2d 62 73 2d 61 72 74 2d 6c 69 67 68 74 2d 67 72 61 79 3a 23 66 63 66 61 66 36 3b 2d 2d 62 73 2d 74 69 63 6b 65 74 2d 70 72 69 6d 61 72 79 3a 23 31 36 62 30 35 34 3b 2d Data Ascii: r-light:#ffefee;--bs-dark-purple:#3c057e;--bs-dark-green:#175743;--bs-booking:#eb5647;--bs-main-booking:#0e0d17;--bs-white:#fff;--bs-orange:#f8a40f;--bs-booking-yellow:#ffe459;--bs-art-gray:#767676;--bs-art-light-gray:#fcfaf6;--bs-ticket-primary:#16b054;-

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:52 UTC	1053	OUT	GET /assets/css/tooltipped.css?v=20211115 HTTP/1.1 Host: qr.me-qr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://qr.me-qr.com/E9k76ew Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: user_local=en; adsStatData=%7B%22url%22%3Anull%2C%22campaignId%22%3Anull%2C%22adgroupId%22%3Anull%2C%22gClId%22%3Anull%2C%22bannerId%22%3Anull%2C%22device%22%3Anull%2C%22adPosition%22%3Anull%2C%22targetId%22%3Anull%2C%22locInterestMC%22%3Anull%2C%22locPhysicalMs%22%3Anull%2C%22keyword%22%3Anull%2C%22audience%22%3Anull%2C%22deviceModel%22%3Anull%2C%22creative%22%3Anull%2C%22firstVisitDate%22%3A%222025-01-09%2008%3A23%3A51%22%7D; cookieId=37b957cd-11ce-4e0a-9b28-551f490dd856
2025-01-09 06:23:52 UTC	975	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:52 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close last-modified: Fri, 03 Jan 2025 16:34:38 GMT etag: W/"6778119e-eeb" expires: Sat, 11 Jan 2025 12:12:17 GMT Cache-Control: public, max-age=604800 vary: User-Agent CF-Cache-Status: HIT Age: 411095 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ny%2F4hChbY6Hw79OoGJpVZPRWFjWcY2bVR3oQM0nTdzdBL2x2hhxh8SUS8g82%2FeleTcYvpFkcj8a4Cs4wrTkCJOnWwxiDIhaHcbPKtjqf0RcNYHr7nDEwKZ1gJSAvjCk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8ff257536ecd0c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1653&min_rtt=1641&rtt_var=640&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1631&delivery_rate=1678160&cwnd=241&unsent_bytes=0&cid=a5870194421e4779&ts=146&x=0"
2025-01-09 06:23:52 UTC	394	IN	Data Raw: 65 65 62 0d 0a 2e 74 6f 6f 6c 74 69 70 70 65 64 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 74 6f 6f 6c 74 69 70 70 65 64 3a 61 66 74 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 30 30 30 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 35 70 78 20 38 70 78 3b 66 6f 6e 74 3a 6e 6f 72 6d 61 6c 20 6e 6f 72 6d 61 6c 20 31 31 70 78 2f 31 2e 35 20 48 65 6c 76 65 74 69 63 61 2c 61 72 69 61 6c 2c 6e 69 6d 62 75 73 73 61 6e 73 6c 2c 6c 69 62 65 72 61 74 69 6f 6e 73 61 6e 73 2c 66 72 65 65 73 61 6e 73 2c 63 6c 65 61 6e 2c 73 61 6e 73 2d 73 65 72 69 66 2c 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 3b 63 6f 6c 6f 72 3a 23 Data Ascii: eeb.tooltipped{position:relative}.tooltipped:after{position:absolute;z-index:1000000;display:none;padding:5px 8px;font:normal normal 11px/1.5 Helvetica,arial,nimbussansl,liberationsans,freesans,clean,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";color:#
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 63 6f 6e 74 65 6e 74 3a 61 74 74 72 28 61 72 69 61 2d 6c 61 62 65 6c 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 38 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 73 75 62 70 69 78 65 6c 2d 61 6e 74 69 61 6c 69 61 73 65 64 7d 2e 74 6f 6f 6c 74 69 70 70 65 64 3a 62 65 66 6f 72 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 30 30 31 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 77 69 64 74 68 3a 30 3b 68 65 69 67 68 74 3a 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 38 29 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e Data Ascii: pointer-events:none;content:attr(aria-label);background:rgba(0,0,0,.8);border-radius:3px;-webkit-font-smoothing:subpixel-antialiased}.tooltipped:before{position:absolute;z-index:1000001;display:none;width:0;height:0;color:rgba(0,0,0,.8);pointer-events:non
2025-01-09 06:23:52 UTC	1369	IN	Data Raw: 28 35 30 25 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 35 30 25 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 35 30 25 29 7d 2e 74 6f 6f 6c 74 69 70 70 65 64 2d 77 3a 61 66 74 65 72 7b 72 69 67 68 74 3a 31 30 30 25 3b 62 6f 74 74 6f 6d 3a 35 30 25 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 35 30 25 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 35 30 25 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 35 30 25 29 7d 2e 74 6f 6f 6c 74 69 70 70 65 64 2d 77 3a 62 65 66 6f 72 65 7b 74 6f 70 3a 35 30 25 3b 62 6f 74 74 6f 6d 3a 35 30 25 3b 6c 65 66 74 Data Ascii: (50%);-ms-transform:translateX(50%);transform:translateX(50%)}.tooltipped-w:after{right:100%;bottom:50%;margin-right:5px;-webkit-transform:translateY(50%);-ms-transform:translateY(50%);transform:translateY(50%)}.tooltipped-w:before{top:50%;bottom:50%;left
2025-01-09 06:23:52 UTC	694	IN	Data Raw: 6f 6f 6c 74 69 70 70 65 64 20 2e 74 6f 6f 6c 74 69 70 70 65 64 2d 73 3a 62 65 66 6f 72 65 2c 2e 66 75 6c 6c 73 63 72 65 65 6e 2d 6f 76 65 72 6c 61 79 2d 65 6e 61 62 6c 65 64 2e 64 61 72 6b 2d 74 68 65 6d 65 20 2e 74 6f 6f 6c 74 69 70 70 65 64 20 2e 74 6f 6f 6c 74 69 70 70 65 64 2d 73 65 3a 62 65 66 6f 72 65 2c 2e 66 75 6c 6c 73 63 72 65 65 6e 2d 6f 76 65 72 6c 61 79 2d 65 6e 61 62 6c 65 64 2e 64 61 72 6b 2d 74 68 65 6d 65 20 2e 74 6f 6f 6c 74 69 70 70 65 64 20 2e 74 6f 6f 6c 74 69 70 70 65 64 2d 73 77 3a 62 65 66 6f 72 65 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 2e 38 29 7d 2e 66 75 6c 6c 73 63 72 65 65 6e 2d 6f 76 65 72 6c 61 79 2d 65 6e 61 62 6c 65 64 2e 64 61 72 6b 2d 74 68 65 6d Data Ascii: ooltipped .tooltipped-s:before,.fullscreen-overlay-enabled.dark-theme .tooltipped .tooltipped-se:before,.fullscreen-overlay-enabled.dark-theme .tooltipped .tooltipped-sw:before{border-bottom-color:rgba(255,255,255,.8)}.fullscreen-overlay-enabled.dark-them
2025-01-09 06:23:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:52 UTC	1107	OUT	GET /static/pages/icon-img/arrow-down-primary.svg HTTP/1.1 Host: qr.me-qr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://qr.me-qr.com/E9k76ew Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: user_local=en; adsStatData=%7B%22url%22%3Anull%2C%22campaignId%22%3Anull%2C%22adgroupId%22%3Anull%2C%22gClId%22%3Anull%2C%22bannerId%22%3Anull%2C%22device%22%3Anull%2C%22adPosition%22%3Anull%2C%22targetId%22%3Anull%2C%22locInterestMC%22%3Anull%2C%22locPhysicalMs%22%3Anull%2C%22keyword%22%3Anull%2C%22audience%22%3Anull%2C%22deviceModel%22%3Anull%2C%22creative%22%3Anull%2C%22firstVisitDate%22%3A%222025-01-09%2008%3A23%3A51%22%7D; cookieId=37b957cd-11ce-4e0a-9b28-551f490dd856
2025-01-09 06:23:52 UTC	1244	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:52 GMT Content-Type: image/svg+xml Content-Length: 497 Connection: close last-modified: Fri, 03 Jan 2025 16:34:39 GMT etag: "6778119f-1f1" expires: Sun, 12 Jan 2025 12:23:29 GMT Cache-Control: max-age=604800 access-control-allow-origin: * access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range access-control-expose-headers: Content-Length,Content-Range vary: User-Agent CF-Cache-Status: HIT Age: 324023 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5NrLVJPbuuL5hfT1DbRbpwQjziKclbxppASgHO%2FycZCDIVYwbvuOUvgU4LvLP0gwX3X5Vj21ZR0JZKsElOMlACEeJcoe7OZbCxuccTLAqXcNSE0hiabG%2BlTV4wG%2FqTA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8ff257539e549e02-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1976&min_rtt=1964&rtt_var=745&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1685&delivery_rate=1486761&cwnd=244&unsent_bytes=0&cid=bbfcc654b0c9e12d&ts=149&x=0"
2025-01-09 06:23:52 UTC	125	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 39 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 39 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d Data Ascii: <svg width="16" height="9" viewBox="0 0 16 9" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-
2025-01-09 06:23:52 UTC	372	IN	Data Raw: 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 30 2e 38 35 32 32 35 32 20 30 2e 38 35 32 32 35 32 43 31 2e 30 37 31 39 32 20 30 2e 36 33 32 35 38 33 20 31 2e 34 32 38 30 38 20 30 2e 36 33 32 35 38 33 20 31 2e 36 34 37 37 35 20 30 2e 38 35 32 32 35 32 4c 38 20 37 2e 32 30 34 35 4c 31 34 2e 33 35 32 33 20 30 2e 38 35 32 32 35 32 43 31 34 2e 35 37 31 39 20 30 2e 36 33 32 35 38 33 20 31 34 2e 39 32 38 31 20 30 2e 36 33 32 35 38 33 20 31 35 2e 31 34 37 37 20 30 2e 38 35 32 32 35 32 43 31 35 2e 33 36 37 34 20 31 2e 30 37 31 39 32 20 31 35 2e 33 36 37 34 20 31 2e 34 32 38 30 38 20 31 35 2e 31 34 37 37 20 31 2e 36 34 37 37 35 4c 38 2e 33 39 37 37 35 20 38 2e 33 39 37 37 35 43 38 2e 31 37 38 30 38 20 38 2e 36 31 37 34 32 20 37 2e 38 32 31 39 32 20 38 2e Data Ascii: rule="evenodd" d="M0.852252 0.852252C1.07192 0.632583 1.42808 0.632583 1.64775 0.852252L8 7.2045L14.3523 0.852252C14.5719 0.632583 14.9281 0.632583 15.1477 0.852252C15.3674 1.07192 15.3674 1.42808 15.1477 1.64775L8.39775 8.39775C8.17808 8.61742 7.82192 8.

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:52 UTC	1030	OUT	GET /build/runtime.831e3f57b5.js HTTP/1.1 Host: qr.me-qr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qr.me-qr.com/E9k76ew Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: user_local=en; adsStatData=%7B%22url%22%3Anull%2C%22campaignId%22%3Anull%2C%22adgroupId%22%3Anull%2C%22gClId%22%3Anull%2C%22bannerId%22%3Anull%2C%22device%22%3Anull%2C%22adPosition%22%3Anull%2C%22targetId%22%3Anull%2C%22locInterestMC%22%3Anull%2C%22locPhysicalMs%22%3Anull%2C%22keyword%22%3Anull%2C%22audience%22%3Anull%2C%22deviceModel%22%3Anull%2C%22creative%22%3Anull%2C%22firstVisitDate%22%3A%222025-01-09%2008%3A23%3A51%22%7D; cookieId=37b957cd-11ce-4e0a-9b28-551f490dd856
2025-01-09 06:23:53 UTC	993	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:52 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close last-modified: Wed, 08 Jan 2025 15:16:04 GMT etag: W/"677e96b4-215a" expires: Wed, 15 Jan 2025 15:16:15 GMT Cache-Control: public, max-age=604800 vary: User-Agent CF-Cache-Status: HIT Age: 54457 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jTwJcl9gYvQq45AIdMmJn5aWZQRanL9OtAEwD9sh1PsZVJ%2FsSSLW36sFGaUJqTz%2F%2F1AHtsgou8U0OjK1CmFVxbfOW5Y3qswQaVoAA0y9uq08Gm7%2FNHJBYXBVNwWzMYI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8ff257542b574307-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&min_rtt=1553&rtt_var=612&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1608&delivery_rate=1746411&cwnd=239&unsent_bytes=0&cid=9a4ba261eec4a749&ts=145&x=0"
2025-01-09 06:23:53 UTC	376	IN	Data Raw: 32 31 35 61 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 2c 61 2c 66 2c 6e 2c 63 2c 72 3d 7b 7d 2c 64 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 76 61 72 20 74 3d 64 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 74 29 72 65 74 75 72 6e 20 74 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 61 3d 64 5b 65 5d 3d 7b 69 64 3a 65 2c 6c 6f 61 64 65 64 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 72 5b 65 5d 2e 63 61 6c 6c 28 61 2e 65 78 70 6f 72 74 73 2c 61 2c 61 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 61 2e 6c 6f 61 64 65 64 3d 21 30 2c 61 2e 65 78 70 6f 72 74 73 7d 6f 2e 6d 3d 72 2c 65 3d 5b 5d 2c 6f 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 61 2c 66 2c 6e 29 7b 69 66 28 21 61 29 Data Ascii: 215a!function(){"use strict";var e,t,a,f,n,c,r={},d={};function o(e){var t=d[e];if(void 0!==t)return t.exports;var a=d[e]={id:e,loaded:!1,exports:{}};return r[e].call(a.exports,a,a.exports,o),a.loaded=!0,a.exports}o.m=r,e=[],o.O=function(t,a,f,n){if(!a)
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 73 28 6f 2e 4f 29 2e 65 76 65 72 79 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 4f 5b 65 5d 28 61 5b 64 5d 29 7d 29 29 3f 61 2e 73 70 6c 69 63 65 28 64 2d 2d 2c 31 29 3a 28 72 3d 21 31 2c 6e 3c 63 26 26 28 63 3d 6e 29 29 3b 69 66 28 72 29 7b 65 2e 73 70 6c 69 63 65 28 69 2d 2d 2c 31 29 3b 76 61 72 20 62 3d 66 28 29 3b 76 6f 69 64 20 30 21 3d 3d 62 26 26 28 74 3d 62 29 7d 7d 72 65 74 75 72 6e 20 74 7d 6e 3d 6e 7c 7c 30 3b 66 6f 72 28 76 61 72 20 69 3d 65 2e 6c 65 6e 67 74 68 3b 69 3e 30 26 26 65 5b 69 2d 31 5d 5b 32 5d 3e 6e 3b 69 2d 2d 29 65 5b 69 5d 3d 65 5b 69 2d 31 5d 3b 65 5b 69 5d 3d 5b 61 2c 66 2c 6e 5d 7d 2c 6f 2e 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 66 Data Ascii: s(o.O).every((function(e){return o.O[e](a[d])}))?a.splice(d--,1):(r=!1,n<c&&(c=n));if(r){e.splice(i--,1);var b=f();void 0!==b&&(t=b)}}return t}n=n\|\|0;for(var i=e.length;i>0&&e[i-1][2]>n;i--)e[i]=e[i-1];e[i]=[a,f,n]},o.n=function(e){var t=e&&e.__esModule?f
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 30 3a 22 38 65 64 34 31 33 39 32 62 64 22 2c 31 37 30 35 3a 22 63 30 33 37 62 65 62 63 61 64 22 2c 31 37 36 32 3a 22 39 62 30 65 38 61 61 66 37 64 22 2c 31 38 32 34 3a 22 38 63 64 38 64 35 39 64 37 36 22 2c 31 38 35 30 3a 22 63 64 65 30 64 36 33 37 38 30 22 2c 31 38 36 35 3a 22 35 35 32 66 39 30 32 66 38 35 22 2c 32 31 33 39 3a 22 39 37 33 37 64 33 36 66 33 39 22 2c 32 31 37 37 3a 22 63 33 38 37 61 38 38 31 62 62 22 2c 32 32 35 31 3a 22 32 39 35 34 62 36 39 32 38 66 22 2c 32 33 33 37 3a 22 38 66 32 64 38 65 34 34 30 31 22 2c 32 33 39 37 3a 22 33 34 39 61 62 33 31 64 30 66 22 2c 32 35 37 38 3a 22 39 66 61 33 34 65 32 63 61 33 22 2c 32 36 33 39 3a 22 32 39 30 35 66 66 37 38 66 63 22 2c 32 36 38 36 3a 22 31 32 31 62 61 63 61 37 37 63 22 2c 32 37 35 37 3a 22 Data Ascii: 0:"8ed41392bd",1705:"c037bebcad",1762:"9b0e8aaf7d",1824:"8cd8d59d76",1850:"cde0d63780",1865:"552f902f85",2139:"9737d36f39",2177:"c387a881bb",2251:"2954b6928f",2337:"8f2d8e4401",2397:"349ab31d0f",2578:"9fa34e2ca3",2639:"2905ff78fc",2686:"121baca77c",2757:"
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 3a 22 65 39 38 64 62 36 31 39 63 32 22 2c 37 30 31 35 3a 22 37 31 36 37 34 30 39 31 61 31 22 2c 37 30 39 33 3a 22 30 66 35 34 35 39 62 30 61 65 22 2c 37 31 37 31 3a 22 64 37 65 39 38 33 36 30 34 65 22 2c 37 31 38 38 3a 22 34 36 39 63 66 65 39 65 39 65 22 2c 37 32 31 32 3a 22 38 39 33 64 62 65 65 33 37 64 22 2c 37 32 32 34 3a 22 32 34 37 66 37 66 61 64 34 61 22 2c 37 33 31 34 3a 22 35 33 66 62 64 62 66 37 35 32 22 2c 37 35 38 38 3a 22 61 64 39 31 61 61 61 64 66 61 22 2c 37 35 39 30 3a 22 66 61 65 66 30 34 34 38 31 30 22 2c 37 37 30 38 3a 22 61 30 34 35 66 30 31 33 63 36 22 2c 37 37 37 32 3a 22 33 38 61 38 62 65 39 30 61 66 22 2c 37 38 33 34 3a 22 64 36 66 32 63 62 31 34 39 66 22 2c 37 38 34 32 3a 22 62 64 30 35 39 39 30 32 31 61 22 2c 37 38 35 31 3a 22 34 Data Ascii: :"e98db619c2",7015:"71674091a1",7093:"0f5459b0ae",7171:"d7e983604e",7188:"469cfe9e9e",7212:"893dbee37d",7224:"247f7fad4a",7314:"53fbdbf752",7588:"ad91aaadfa",7590:"faef044810",7708:"a045f013c6",7772:"38a8be90af",7834:"d6f2cb149f",7842:"bd0599021a",7851:"4
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 61 22 2c 31 38 35 30 3a 22 30 34 61 32 36 34 65 39 66 33 22 2c 32 31 34 33 3a 22 36 31 37 36 32 38 39 30 38 37 22 2c 32 33 32 38 3a 22 65 66 32 38 63 61 32 35 66 33 22 2c 32 39 33 31 3a 22 66 34 35 31 30 65 34 30 61 38 22 2c 33 31 34 36 3a 22 61 30 31 66 30 35 66 31 62 31 22 2c 33 31 38 36 3a 22 30 38 30 36 36 32 64 30 36 63 22 2c 33 36 36 38 3a 22 39 37 35 33 30 30 39 34 32 65 22 2c 33 37 30 36 3a 22 35 65 65 31 34 66 33 32 37 32 22 2c 33 37 31 35 3a 22 38 66 66 39 39 65 32 38 66 63 22 2c 34 30 33 33 3a 22 30 61 30 61 33 34 31 39 33 38 22 2c 34 33 39 39 3a 22 65 34 64 36 64 31 36 38 33 30 22 2c 34 34 31 33 3a 22 33 33 34 38 65 39 62 33 30 63 22 2c 34 34 36 39 3a 22 38 37 66 36 32 64 36 30 64 63 22 2c 34 39 37 31 3a 22 32 61 31 38 65 37 65 32 32 31 22 2c Data Ascii: a",1850:"04a264e9f3",2143:"6176289087",2328:"ef28ca25f3",2931:"f4510e40a8",3146:"a01f05f1b1",3186:"080662d06c",3668:"975300942e",3706:"5ee14f3272",3715:"8ff99e28fc",4033:"0a0a341938",4399:"e4d6d16830",4413:"3348e9b30c",4469:"87f62d60dc",4971:"2a18e7e221",
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 6c 65 74 65 20 66 5b 65 5d 2c 63 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 63 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 63 29 2c 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 28 61 29 7d 29 29 2c 74 29 72 65 74 75 72 6e 20 74 28 61 29 7d 2c 6c 3d 73 65 74 54 69 6d 65 6f 75 74 28 75 2e 62 69 6e 64 28 6e 75 6c 6c 2c 76 6f 69 64 20 30 2c 7b 74 79 70 65 3a 22 74 69 6d 65 6f 75 74 22 2c 74 61 72 67 65 74 3a 63 7d 29 2c 31 32 65 34 29 3b 63 2e 6f 6e 65 72 72 6f 72 3d 75 2e 62 69 6e 64 28 6e 75 6c 6c 2c 63 2e 6f 6e 65 72 72 6f 72 29 2c 63 2e 6f 6e 6c 6f 61 64 3d 75 2e 62 69 6e 64 28 6e 75 6c 6c 2c 63 2e 6f 6e 6c 6f 61 64 29 2c 72 26 26 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 Data Ascii: lete f[e],c.parentNode&&c.parentNode.removeChild(c),n&&n.forEach((function(e){return e(a)})),t)return t(a)},l=setTimeout(u.bind(null,void 0,{type:"timeout",target:c}),12e4);c.onerror=u.bind(null,c.onerror),c.onload=u.bind(null,c.onload),r&&document.head.a
2025-01-09 06:23:53 UTC	1325	IN	Data Raw: 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 29 7d 28 65 2c 6e 2c 74 2c 61 29 7d 29 29 7d 2c 63 3d 7b 33 36 36 36 3a 30 7d 2c 6f 2e 66 2e 6d 69 6e 69 43 73 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 63 5b 65 5d 3f 74 2e 70 75 73 68 28 63 5b 65 5d 29 3a 30 21 3d 3d 63 5b 65 5d 26 26 7b 33 39 38 3a 31 2c 34 36 32 3a 31 2c 38 36 31 3a 31 2c 31 34 35 30 3a 31 2c 31 38 35 30 3a 31 2c 32 39 33 31 3a 31 2c 33 31 34 36 3a 31 2c 33 31 38 36 3a 31 2c 33 36 36 38 3a 31 2c 33 37 31 35 3a 31 2c 34 34 31 33 3a 31 2c 34 39 37 31 3a 31 2c 36 31 33 35 3a 31 2c 36 31 35 30 3a 31 2c 36 32 34 33 3a 31 2c 36 38 30 39 3a 31 2c 37 30 39 33 3a 31 2c 37 32 31 32 3a 31 2c 37 37 37 32 3a 31 2c 37 39 33 38 3a 31 2c 38 30 33 36 3a 31 2c 38 34 31 30 3a 31 2c 38 35 30 Data Ascii: .head.appendChild(n)}(e,n,t,a)}))},c={3666:0},o.f.miniCss=function(e,t){c[e]?t.push(c[e]):0!==c[e]&&{398:1,462:1,861:1,1450:1,1850:1,2931:1,3146:1,3186:1,3668:1,3715:1,4413:1,4971:1,6135:1,6150:1,6243:1,6809:1,7093:1,7212:1,7772:1,7938:1,8036:1,8410:1,850
2025-01-09 06:23:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:52 UTC	617	OUT	GET /n1ed/files/me-qr/articles/pexels-nappy-936137.jpg HTTP/1.1 Host: cdn.me-qr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://qr.me-qr.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 06:23:53 UTC	529	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 09 Jan 2025 06:23:53 GMT Content-Type: image/jpeg Content-Length: 102451 Last-Modified: Thu, 08 Dec 2022 14:14:13 GMT Connection: close ETag: "6391f135-19033" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range X-Robots-Tag: noindex, nofollow Accept-Ranges: bytes
2025-01-09 06:23:53 UTC	15855	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 Data Ascii: JFIFHHXICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@d
2025-01-09 06:23:53 UTC	16384	IN	Data Raw: 79 eb ad c6 f9 75 97 e9 dc 6b a5 cc fb 01 e5 bd 6b bf 70 bb 3f 32 be 8b 7c f2 f5 ef 57 95 f4 ad cc 77 92 f6 7e 2d f9 d1 f5 8b e4 e7 a9 f3 9e c8 fa 47 f1 fb ec 17 33 50 4c de 57 62 0f 8f 7f 61 fe 5f f5 39 fe 53 fa 9f f2 cf dd dd 5e 27 7a f9 51 f7 5f c8 18 7a be 00 fb 1f f1 63 7a ec f9 af b5 33 79 57 b1 f9 8f 59 d5 6b f9 c7 cc da b0 6f be fa d1 3a 0a db f3 cf 89 7b cf d1 5d 5e 67 81 3d 62 71 8a 5b bb f9 af 63 eb b5 e8 f0 a7 d0 4c 9e 32 ad 78 cd 27 77 c4 e1 ea 66 b4 ae 59 e3 0e 2f 67 a6 f0 6a 58 0e 1f 76 ce 63 98 db d3 9b bc 5c e3 77 30 77 fa c6 27 54 67 37 a3 b4 47 ad e3 22 ad 83 19 af 63 3a 7c ad 86 9e bb d4 2d ca cd 8d 97 f9 1d dc c5 fc 75 ce 67 4b 32 ec 5a 51 a1 30 97 71 12 b8 2c 5d da 9d 6e 5b 72 38 8b 33 9f 3f 9b d2 b2 14 5f de 3a 3f 94 76 3c 0d d9 7c Data Ascii: yukkp?2\|Ww~-G3PLWba_9S^'zQ_zcz3yWYko:{]^g=bq[cL2x'wfY/gjXvc\w0w'Tg7G"c:\|-ugK2ZQ0q,]n[r83?_:?v<\|
2025-01-09 06:23:53 UTC	16384	IN	Data Raw: b1 2e 70 34 68 82 29 41 91 7e 82 7d 46 c3 71 53 b2 69 4c 70 43 9d 56 d9 0f fd 26 56 f3 fc 72 0d 5c 53 97 0c be 5d 53 de 60 53 b7 0c be b0 cd 4d c3 09 46 ad 69 86 9d 42 00 5d d3 da 41 d4 88 a6 ee c5 1a 25 d6 7c 36 93 c8 d7 2a 76 d4 5b 22 cc 6c b5 17 d2 4a 1b 65 14 6a fe d3 25 62 d8 ba b7 74 bb 77 8c c6 b4 d9 d8 d4 84 74 a1 84 b5 45 5c ab 83 ef a1 51 17 79 9c 9e 75 c7 f2 6e 65 d5 88 b4 c6 a5 b1 7b a7 b1 e3 01 66 ab 66 f0 2c 69 df f9 bc 54 14 4d 1a 21 54 83 9b 4f b7 21 e8 6a 37 6e e6 f1 6d e5 d2 eb 4e bd 6f 7b 69 fe 42 85 c2 56 d9 2d 29 d0 9b 54 d1 09 12 36 34 6b 56 30 82 94 22 d1 76 ca 1a 59 e4 1a bb 75 a7 ec 2e 28 d3 ae 25 f6 95 2b 1d 60 02 57 cb 95 71 ea 29 55 cf 90 da 88 35 90 b2 bc d3 ab c7 37 88 b4 c0 b1 6e 1b 16 c2 d7 c7 72 89 6e 93 51 c2 29 eb d7 2e Data Ascii: .p4h)A~}FqSiLpCV&Vr\S]S`SMFiB]A%\|6*v["lJej%btwtE\Qyune{ff,iTM!TO!j7nmNo{iBV-)T64kV0"vYu.(%+`Wq)U57nrnQ).
2025-01-09 06:23:53 UTC	16384	IN	Data Raw: 16 be fc 90 59 29 83 bb 23 25 56 78 71 53 90 6e 75 4f 06 e4 ee 0c 4d 2d 24 0d 38 23 20 ee a9 1d 88 5a ca a8 1b 5d 10 33 dd 60 9c e9 7a 30 56 4a 61 0d fb 76 f0 4e 2d fd 91 21 04 e8 a4 0e 1c d7 de 21 17 39 8d 7f be ec c1 43 75 d1 64 6e 23 92 82 a4 de 69 8b 24 2e 2d d6 d9 1e 5e 4a 78 e9 5c d9 27 12 f2 77 82 81 8d 74 8c a3 e9 1e d7 1b dc d9 50 ed 29 43 64 87 0c 8c cc 03 9a 15 75 50 c0 1c 03 58 6e f2 78 2a 5c 32 32 33 89 b0 b0 68 a2 da 9b 3e a0 36 27 0b 70 55 f0 c4 e8 e5 86 cc 26 e3 3c c2 6d 6e 00 e7 96 86 9e 09 b4 d1 06 07 38 81 cc df 78 43 44 53 6a 29 de c3 c9 39 8f 73 4e a1 07 4a e8 1d dd 94 5b e6 8d 18 0f 73 ee d7 bc c5 23 4f 05 4c 3a 12 f9 1a 4c 6f 74 6e 17 d5 9c d5 1b 70 01 da c0 f3 f3 6a ee e0 84 9c 2f 24 79 72 55 b2 9b b6 07 59 4b 04 98 24 6d 8e be a8 Data Ascii: Y)#%VxqSnuOM-$8# Z]3`z0VJavN-!!9Cudn#i$.-^Jx\'wtP)CduPXnx*\223h>6'pU&<mn8xCDSj)9sNJ[s#OL:Lotnpj/$yrUYK$m
2025-01-09 06:23:53 UTC	16384	IN	Data Raw: f0 9c 4a 77 8b cf 4d 23 1e 7a 52 0c da 1c cb 45 06 0e 21 16 21 b8 74 b4 87 74 b6 0a 6d 2d 82 0a c7 0e 11 95 67 dc 60 92 cc 4b 3c 58 d7 98 f7 16 b9 97 cf 52 cd 46 ea ea 3a 21 7f 1c a7 30 7e 91 59 5d 0a b8 37 18 0d cb f8 5b 66 62 ae 09 2e 5f 4b 65 c1 c7 42 e2 c4 3a f0 c6 d3 88 86 fa 79 7a 84 8d d0 b3 a1 54 5c c3 44 19 be 9d a1 d3 4e 9c ef c4 46 33 1b 58 45 94 45 b6 12 e1 38 43 ad f4 16 ba 1b 8c 45 a8 71 35 8e 30 82 d8 81 cf 4d 27 fa 4d d3 18 c1 6e 5e d8 de 60 dd f4 be 86 1f 81 2f a9 dd 2e dc 7c 1a 96 54 1c ac b4 13 c4 da 5b c4 a6 60 3a 0e a5 9d 16 89 f8 41 bb 97 72 92 d9 6f 7f 82 b6 31 88 c9 d0 e8 38 82 90 ee 42 0d 30 e8 36 41 83 2e 62 5f 99 e2 97 e6 5a 66 2f cc 27 62 e6 a2 7a f2 68 b9 66 e2 d1 59 b4 03 bf 54 b8 15 17 7e e1 af 8d e2 fd 79 94 15 5a 87 2e b8 Data Ascii: JwM#zRE!!ttm-g`K<XRF:!0~Y]7[fb._KeB:yzT\DNF3XEE8CEq50M'Mn^`/.\|T[`:Aro18B06A.b_Zf/'bzhfYT~yZ.

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:53 UTC	594	OUT	GET /assets/img/logo-white.svg HTTP/1.1 Host: me-ticket.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://qr.me-qr.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 06:23:53 UTC	1190	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:53 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close last-modified: Mon, 20 Dec 2021 09:36:14 GMT etag: W/"61c04e8e-9a3" expires: Sun, 26 Jan 2025 08:44:47 GMT Cache-Control: public, max-age=2592000 access-control-allow-origin: * access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range access-control-expose-headers: Content-Length,Content-Range CF-Cache-Status: HIT Age: 1114746 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nvkKGMXYlzQy9mAsc3WiTD6VB3GYBDPPPZiB%2B2lVE4tZ321jXs8mRYVKnfMpNcTWGUYlL%2FudyK4juuGBwRcEeorpf9YzG3GMXXySShIi9MSw%2FShtqCbaawuCFEYv5l%2FR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff257576a9c19b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1969&min_rtt=1967&rtt_var=742&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1172&delivery_rate=1470292&cwnd=149&unsent_bytes=0&cid=2439e0d6a4a6299a&ts=140&x=0"
2025-01-09 06:23:53 UTC	179	IN	Data Raw: 39 61 33 0d 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 31 35 37 22 20 68 65 69 67 68 74 3d 22 35 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 37 20 35 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 31 38 2e 33 39 36 31 20 33 35 2e 33 34 34 38 4c 31 38 2e 33 36 37 32 20 32 33 2e 32 31 35 35 4c 31 32 2e 34 31 38 31 20 33 33 2e 32 30 37 37 48 31 30 2e 33 30 39 39 4c 34 2e 33 38 39 36 36 20 32 33 Data Ascii: 9a3<svg width="157" height="50" viewBox="0 0 157 50" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M18.3961 35.3448L18.3672 23.2155L12.4181 33.2077H10.3099L4.38966 23
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 2e 34 37 35 34 56 33 35 2e 33 34 34 38 48 30 56 31 35 2e 31 32 39 33 48 33 2e 38 36 39 38 33 4c 31 31 2e 34 33 36 32 20 32 37 2e 36 39 31 38 4c 31 38 2e 38 38 37 31 20 31 35 2e 31 32 39 33 48 32 32 2e 37 32 38 4c 32 32 2e 37 38 35 38 20 33 35 2e 33 34 34 38 48 31 38 2e 33 39 36 31 5a 22 20 66 69 6c 6c 3d 22 23 33 45 34 38 35 37 22 2f 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 34 33 2e 32 33 34 36 20 33 31 2e 35 39 30 35 56 33 35 2e 33 34 34 38 48 32 37 2e 35 38 32 56 31 35 2e 31 32 39 33 48 34 32 2e 38 35 39 32 56 31 38 2e 38 38 33 36 48 33 32 2e 32 33 31 36 56 32 33 2e 32 37 33 32 48 34 31 2e 36 31 37 33 56 32 36 2e 39 31 32 48 33 32 2e 32 33 31 36 56 33 31 2e 35 39 30 35 48 34 33 2e 32 33 34 36 5a 22 20 66 69 6c 6c 3d 22 23 33 45 34 38 35 37 22 2f 3e 0a 3c 70 Data Ascii: .4754V35.3448H0V15.1293H3.86983L11.4362 27.6918L18.8871 15.1293H22.728L22.7858 35.3448H18.3961Z" fill="#3E4857"/><path d="M43.2346 31.5905V35.3448H27.582V15.1293H42.8592V18.8836H32.2316V23.2732H41.6173V26.912H32.2316V31.5905H43.2346Z" fill="#3E4857"/><p
2025-01-09 06:23:53 UTC	926	IN	Data Raw: 31 39 2e 35 35 37 35 20 38 37 2e 31 32 39 20 31 38 2e 37 36 38 31 20 38 35 2e 31 30 37 35 20 31 38 2e 37 36 38 31 43 38 33 2e 38 35 36 31 20 31 38 2e 37 36 38 31 20 38 32 2e 37 33 39 34 20 31 39 2e 30 34 37 33 20 38 31 2e 37 35 37 35 20 31 39 2e 36 30 35 36 43 38 30 2e 37 37 35 36 20 32 30 2e 31 34 34 37 20 38 30 2e 30 30 35 35 20 32 30 2e 39 30 35 32 20 37 39 2e 34 34 37 31 20 32 31 2e 38 38 37 31 43 37 38 2e 39 30 38 31 20 32 32 2e 38 36 39 20 37 38 2e 36 33 38 35 20 32 33 2e 39 38 35 36 20 37 38 2e 36 33 38 35 20 32 35 2e 32 33 37 31 43 37 38 2e 36 33 38 35 20 32 36 2e 34 38 38 35 20 37 38 2e 39 30 38 31 20 32 37 2e 36 30 35 32 20 37 39 2e 34 34 37 31 20 32 38 2e 35 38 37 31 43 38 30 2e 30 30 35 35 20 32 39 2e 35 36 39 20 38 30 2e 37 37 35 36 20 33 30 Data Ascii: 19.5575 87.129 18.7681 85.1075 18.7681C83.8561 18.7681 82.7394 19.0473 81.7575 19.6056C80.7756 20.1447 80.0055 20.9052 79.4471 21.8871C78.9081 22.869 78.6385 23.9856 78.6385 25.2371C78.6385 26.4885 78.9081 27.6052 79.4471 28.5871C80.0055 29.569 80.7756 30
2025-01-09 06:23:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:53 UTC	612	OUT	GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1 Host: static.cloudflareinsights.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://qr.me-qr.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://qr.me-qr.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 06:23:53 UTC	373	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:53 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 19948 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 ETag: W/"2024.6.1" Last-Modified: Thu, 06 Jun 2024 15:52:56 GMT Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8ff2575989c94246-EWR
2025-01-09 06:23:53 UTC	996	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 33 34 33 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 32 35 36 3b 2b 2b 6e 29 74 5b 6e 5d 3d 28 6e 2b 32 35 36 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2e 73 75 62 73 74 72 28 31 29 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 7c 7c 30 2c 69 3d 74 3b 72 65 74 75 72 6e 5b 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 22 2d 22 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 22 2d 22 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 22 2d 22 2c 69 5b 65 5b 72 2b Data Ascii: !function(){var e={343:function(e){"use strict";for(var t=[],n=0;n<256;++n)t[n]=(n+256).toString(16).substr(1);e.exports=function(e,n){var r=n\|\|0,i=t;return[i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r+
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 3b 69 66 28 61 5b 36 5d 3d 31 35 26 61 5b 36 5d 7c 36 34 2c 61 5b 38 5d 3d 36 33 26 61 5b 38 5d 7c 31 32 38 2c 74 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 31 36 3b 2b 2b 63 29 74 5b 6f 2b 63 5d 3d 61 5b 63 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 69 28 61 29 7d 7d 2c 31 36 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 Data Ascii: ;if(a[6]=15&a[6]\|64,a[8]=63&a[8]\|128,t)for(var c=0;c<16;++c)t[o+c]=a[c];return t\|\|i(a)}},168:function(e,t,n){"use strict";var r=this&&this.__assign\|\|function(){return r=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var i in t=arg
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 72 63 68 50 61 72 61 6d 73 29 7b 76 61 72 20 79 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 67 2e 72 65 70 6c 61 63 65 28 2f 5e 5b 5e 5c 3f 5d 2b 5c 3f 3f 2f 2c 22 22 29 29 2c 68 3d 79 2e 67 65 74 28 22 74 6f 6b 65 6e 22 29 3b 68 26 26 28 70 2e 74 6f 6b 65 6e 3d 68 29 3b 76 61 72 20 54 3d 79 2e 67 65 74 28 22 73 70 61 22 29 3b 70 2e 73 70 61 3d 6e 75 6c 6c 3d 3d 3d 54 7c 7c 22 74 72 75 65 22 3d 3d 3d 54 7d 7d 70 26 26 22 6d 75 6c 74 69 22 21 3d 3d 70 2e 6c 6f 61 64 26 26 28 70 2e 6c 6f 61 64 3d 22 73 69 6e 67 6c 65 22 29 2c 77 69 6e 64 6f 77 2e 5f 5f 63 66 42 65 61 63 6f 6e 3d 70 7d 69 66 28 73 26 26 70 26 26 70 2e 74 6f 6b 65 6e 29 7b 76 61 72 20 77 2c 53 2c 62 3d 21 31 3b 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 Data Ascii: rchParams){var y=new URLSearchParams(g.replace(/^[^\?]+\??/,"")),h=y.get("token");h&&(p.token=h);var T=y.get("spa");p.spa=null===T\|\|"true"===T}}p&&"multi"!==p.load&&(p.load="single"),window.__cfBeacon=p}if(s&&p&&p.token){var w,S,b=!1;document.addEventList
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 2e 74 69 6d 69 6e 67 73 56 32 3d 7b 7d 2c 64 2e 76 65 72 73 69 6f 6e 73 2e 74 69 6d 69 6e 67 73 3d 32 2c 64 2e 64 74 3d 6d 5b 30 5d 2e 64 65 6c 69 76 65 72 79 54 79 70 65 2c 64 65 6c 65 74 65 20 64 2e 74 69 6d 69 6e 67 73 2c 74 28 6d 5b 30 5d 2c 64 2e 74 69 6d 69 6e 67 73 56 32 29 29 7d 31 3d 3d 3d 64 2e 76 65 72 73 69 6f 6e 73 2e 74 69 6d 69 6e 67 73 26 26 74 28 63 2c 64 2e 74 69 6d 69 6e 67 73 29 2c 74 28 75 2c 64 2e 6d 65 6d 6f 72 79 29 7d 65 6c 73 65 20 4f 28 64 29 3b 72 65 74 75 72 6e 20 64 2e 66 69 72 73 74 50 61 69 6e 74 3d 6b 28 22 66 69 72 73 74 2d 70 61 69 6e 74 22 29 2c 64 2e 66 69 72 73 74 43 6f 6e 74 65 6e 74 66 75 6c 50 61 69 6e 74 3d 6b 28 22 66 69 72 73 74 2d 63 6f 6e 74 65 6e 74 66 75 6c 2d 70 61 69 6e 74 22 29 2c 70 26 26 28 70 2e 69 63 Data Ascii: .timingsV2={},d.versions.timings=2,d.dt=m[0].deliveryType,delete d.timings,t(m[0],d.timingsV2))}1===d.versions.timings&&t(c,d.timings),t(u,d.memory)}else O(d);return d.firstPaint=k("first-paint"),d.firstContentfulPaint=k("first-contentful-paint"),p&&(p.ic
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 65 72 65 64 3a 21 30 7d 7d 3b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 3f 52 28 29 3a 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 52 29 7d 29 29 3b 76 61 72 20 41 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4c 26 26 30 3d 3d 3d 76 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 69 64 3d 3d 3d 6c 7d 29 29 2e 6c 65 6e 67 74 68 7d 2c 5f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 2e 70 75 73 68 28 7b 69 64 3a 6c 2c 75 72 6c 3a 65 2c 74 73 3a 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 Data Ascii: ered:!0}};"complete"===window.document.readyState?R():window.addEventListener("load",(function(){window.setTimeout(R)}));var A=function(){return L&&0===v.filter((function(e){return e.id===l})).length},_=function(e){v.push({id:l,url:e,ts:(new Date).getTime
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 72 63 65 4c 6f 61 64 54 69 6d 65 2c 45 2e 6c 63 70 2e 65 72 64 3d 63 2e 65 6c 65 6d 65 6e 74 52 65 6e 64 65 72 44 65 6c 61 79 2c 45 2e 6c 63 70 2e 69 74 3d 6e 75 6c 6c 3d 3d 3d 28 69 3d 63 2e 6c 63 70 52 65 73 6f 75 72 63 65 45 6e 74 72 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 69 6e 69 74 69 61 74 6f 72 54 79 70 65 2c 45 2e 6c 63 70 2e 66 70 3d 6e 75 6c 6c 3d 3d 3d 28 61 3d 6e 75 6c 6c 3d 3d 3d 28 6f 3d 63 2e 6c 63 70 45 6e 74 72 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6f 2e 65 6c 65 6d 65 6e 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 3f 76 6f 69 64 20 30 3a 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 66 65 74 63 68 70 72 69 6f 72 69 74 79 22 29 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 49 4e 50 22 Data Ascii: rceLoadTime,E.lcp.erd=c.elementRenderDelay,E.lcp.it=null===(i=c.lcpResourceEntry)\|\|void 0===i?void 0:i.initiatorType,E.lcp.fp=null===(a=null===(o=c.lcpEntry)\|\|void 0===o?void 0:o.element)\|\|void 0===a?void 0:a.getAttribute("fetchpriority"));break;case"INP"
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 64 65 64 42 6f 64 79 53 69 7a 65 26 26 28 72 2e 64 65 63 6f 64 65 64 42 6f 64 79 53 69 7a 65 3d 6e 5b 30 5d 2e 64 65 63 6f 64 65 64 42 6f 64 79 53 69 7a 65 29 2c 65 2e 64 74 3d 6e 5b 30 5d 2e 64 65 6c 69 76 65 72 79 54 79 70 65 29 2c 74 28 72 2c 65 2e 74 69 6d 69 6e 67 73 56 32 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 65 29 7b 76 61 72 20 74 3b 69 66 28 22 66 69 72 73 74 2d 63 6f 6e 74 65 6e 74 66 75 6c 2d 70 61 69 6e 74 22 3d 3d 3d 65 26 26 45 2e 66 63 70 26 26 45 2e 66 63 70 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 45 2e 66 63 70 2e 76 61 6c 75 65 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 29 7b 76 61 72 20 6e 3d 6e 75 6c 6c 3d 3d 3d 28 74 3d 73 2e 67 65 74 45 6e 74 72 69 Data Ascii: dedBodySize&&(r.decodedBodySize=n[0].decodedBodySize),e.dt=n[0].deliveryType),t(r,e.timingsV2)}}function k(e){var t;if("first-contentful-paint"===e&&E.fcp&&E.fcp.value)return E.fcp.value;if("function"==typeof s.getEntriesByType){var n=null===(t=s.getEntri
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 76 65 6e 74 54 79 70 65 3d 7b 7d 29 29 5b 72 2e 4c 6f 61 64 3d 31 5d 3d 22 4c 6f 61 64 22 2c 72 5b 72 2e 41 64 64 69 74 69 6f 6e 61 6c 3d 32 5d 3d 22 41 64 64 69 74 69 6f 6e 61 6c 22 2c 72 5b 72 2e 57 65 62 56 69 74 61 6c 73 56 32 3d 33 5d 3d 22 57 65 62 56 69 74 61 6c 73 56 32 22 2c 28 6e 3d 74 2e 46 65 74 63 68 50 72 69 6f 72 69 74 79 7c 7c 28 74 2e 46 65 74 63 68 50 72 69 6f 72 69 74 79 3d 7b 7d 29 29 2e 48 69 67 68 3d 22 68 69 67 68 22 2c 6e 2e 4c 6f 77 3d 22 6c 6f 77 22 2c 6e 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 2c 31 30 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 Data Ascii: ventType={}))[r.Load=1]="Load",r[r.Additional=2]="Additional",r[r.WebVitalsV2=3]="WebVitalsV2",(n=t.FetchPriority\|\|(t.FetchPriority={})).High="high",n.Low="low",n.Auto="auto"},104:function(e,t){!function(e){"use strict";var t,n,r,i,o,a=function(){return w
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 30 3f 72 3d 22 70 72 65 72 65 6e 64 65 72 22 3a 64 6f 63 75 6d 65 6e 74 2e 77 61 73 44 69 73 63 61 72 64 65 64 3f 72 3d 22 72 65 73 74 6f 72 65 22 3a 6e 2e 74 79 70 65 26 26 28 72 3d 6e 2e 74 79 70 65 2e 72 65 70 6c 61 63 65 28 2f 5f 2f 67 2c 22 2d 22 29 29 29 2c 7b 6e 61 6d 65 3a 65 2c 76 61 6c 75 65 3a 76 6f 69 64 20 30 3d 3d 3d 74 3f 2d 31 3a 74 2c 72 61 74 69 6e 67 3a 22 67 6f 6f 64 22 2c 64 65 6c 74 61 3a 30 2c 65 6e 74 72 69 65 73 3a 5b 5d 2c 69 64 3a 22 76 33 2d 22 2e 63 6f 6e 63 61 74 28 44 61 74 65 2e 6e 6f 77 28 29 2c 22 2d 22 29 2e 63 6f 6e 63 61 74 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 38 39 39 39 39 39 39 39 39 39 39 39 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 2b 31 65 31 32 29 2c 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 3a 72 7d 7d 2c Data Ascii: 0?r="prerender":document.wasDiscarded?r="restore":n.type&&(r=n.type.replace(/_/g,"-"))),{name:e,value:void 0===t?-1:t,rating:"good",delta:0,entries:[],id:"v3-".concat(Date.now(),"-").concat(Math.floor(8999999999999*Math.random())+1e12),navigationType:r}},
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 62 2c 21 30 29 2c 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 72 65 72 65 6e 64 65 72 69 6e 67 63 68 61 6e 67 65 22 2c 62 2c 21 30 29 7d 2c 43 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 3c 30 26 26 28 77 3d 53 28 29 2c 45 28 29 2c 6c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 3d 53 28 29 2c 45 28 29 7d 29 2c 30 29 7d 29 29 29 2c 7b 67 65 74 20 66 69 72 73 74 48 69 64 64 65 6e 54 69 6d 65 28 29 7b 72 65 74 75 72 6e 20 77 7d 7d 7d 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 64 6f 63 75 6d 65 6e 74 2e 70 Data Ascii: function(){removeEventListener("visibilitychange",b,!0),removeEventListener("prerenderingchange",b,!0)},C=function(){return w<0&&(w=S(),E(),l((function(){setTimeout((function(){w=S(),E()}),0)}))),{get firstHiddenTime(){return w}}},P=function(e){document.p

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:53 UTC	624	OUT	GET /media/cache/blur_bg_filter/data/images/vgg/10238-24.jpg HTTP/1.1 Host: me-ticket.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://qr.me-qr.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 06:23:53 UTC	1204	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:53 GMT Content-Type: image/jpeg Content-Length: 38170 Connection: close last-modified: Thu, 29 Feb 2024 13:45:21 GMT etag: "65e08a71-951a" expires: Thu, 06 Feb 2025 17:25:48 GMT Cache-Control: public, max-age=2592000 access-control-allow-origin: * access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range access-control-expose-headers: Content-Length,Content-Range CF-Cache-Status: HIT Age: 133085 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BH%2FZisCoRs6Qc3o8OPJUGJ9mrtByWf7kKQt1Alz2kCEZTBkv8JSlnS5pJPh5%2BTed4yQJVUSSZh%2BYl1ZQbJjFSq57l4mxIuE0eqS2s2KEagCalD6%2BN2FldM2MMXO8j23v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff2575a0d61c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1518&min_rtt=1509&rtt_var=584&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1202&delivery_rate=1845764&cwnd=155&unsent_bytes=0&cid=4c124512861d4862&ts=155&x=0"
2025-01-09 06:23:53 UTC	165	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 37 35 0a ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 75C $.' ",#(7),01444'9=82<.342C
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 52 01 a4 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 Data Ascii: 2!!22222222222222222222222222222222222222222222222222R"}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: a0 05 34 d3 4e a6 9a 06 14 51 45 00 14 51 45 00 39 7a d5 fb 51 96 15 41 7e f5 69 5a 0e 45 26 6b 4b e2 37 ec 47 02 b7 6d 7b 56 25 92 f0 2b 72 d5 7a 57 1d 46 7d 1e 11 68 6b db f4 15 a7 6e 3a 56 6d b8 e0 56 8c 27 15 cc d9 eb 5b dd 35 21 c6 2a 49 31 b6 aa c4 fc 54 ac d9 15 27 2c a3 a9 81 ad 2e 63 6a f3 3d 5e 3f df 35 7a 86 ac 33 1b 57 9d ea d1 7c ec 6b a2 83 d4 f3 71 ca e8 e5 dc 60 d3 78 a9 ae 06 1a ab e6 bb 16 a7 87 27 66 3b 8a 31 4c cd 19 a7 62 79 90 a4 51 8a 4c d1 9a 64 dd 0b 45 26 68 a6 21 28 a2 8a 04 14 51 45 00 14 51 4b 8a 2c 02 51 4b 8a 4a 00 28 a2 8a 00 28 a2 8a 06 14 51 45 00 14 ab c3 0a 4a 05 34 06 a5 bc 98 5a 65 c9 dd 55 e2 93 15 29 60 c2 b3 92 b3 b9 e8 53 a9 cd 0e 52 93 0c 1a 4a 92 4e b5 1d 52 38 24 ac c2 8a 28 a6 48 51 45 14 00 51 45 14 00 52 8a Data Ascii: 4NQEQE9zQA~iZE&kK7Gm{V%+rzWF}hkn:VmV'[5!*I1T',.cj=^?5z3W\|kq`x'f;1LbyQLdE&h!(QEQK,QKJ((QEJ4ZeU)`SRJNR8$(HQEQER
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 a6 85 b1 50 d3 d0 e0 d0 ca 8e e5 a9 1f e4 aa 4d c9 a9 9d b8 a8 29 22 e6 ee 14 51 45 33 32 dd 81 c4 eb f5 af 50 f0 e1 cc 6b 5e 59 68 71 30 fa d7 a6 f8 6a 4f 91 6b 97 12 b4 3d 5c be 5a 9d 0d fa 7e e4 d7 9e 6b 63 0e d5 e8 d7 ec 3e ce 7e 95 e7 5a df df 6a e7 c3 ee 7a 18 e6 dc 0e 79 1b 0f 4b 3b e5 69 9f c4 69 92 f4 ae db 6a 78 d7 f7 4a ad d6 9a 69 c7 ad 34 d6 87 2c 84 a2 8a 29 90 14 51 45 00 3e ad 41 cd 51 f3 97 d0 d4 f0 de 46 9d 43 7e 02 98 91 66 65 e2 ab 9a 73 df c2 c3 85 7f c8 7f 8d 40 6e 13 d1 a9 14 ec 49 46 28 dd 98 f7 80 48 a8 fe d0 9e 8d f9 53 16 84 c0 52 e2 af 5a e9 72 dd e9 df 6d 8a 58 4c 41 b6 b0 24 e5 0f bf 15 14 96 73 45 24 88 e0 03 1a ee 63 9e d9 03 f1 eb 51 cc 8d 95 39 76 2a 91 49 8a 27 90 43 33 c4 e1 b7 21 Data Ascii: (((PM)"QE32Pk^Yhq0jOk=\Z~kc>~ZjzyK;iijxJi4,)QE>AQFC~fes@nIF(HSRZrmXLA$sE$cQ9v*I'C3!
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 2e 05 39 54 1e 98 e2 98 5c 8c f6 a9 01 4d b8 20 e6 82 bd ba 53 08 38 e3 9a 00 52 01 6e 07 14 8f f2 f0 06 4d 03 27 8c e2 85 cf 3d b0 33 40 84 50 5b da 83 1e 1b 93 4f 1b 88 dc 5a 9a 5c 93 dc af ae 28 01 e3 6e 3b 51 51 ed 63 c8 c5 14 01 0d 14 94 b4 cc 42 8a 28 a0 02 97 71 1d 09 a4 a9 21 8c 4a e4 33 6d 00 64 d0 31 a3 e6 46 e7 91 cd 6b f8 57 53 b7 d2 f5 e8 5e f9 0c 9a 7c d9 86 ea 31 d5 a3 6e 0e 3d c7 0c 0f 62 01 ad cf 0c e9 5a 24 b0 3b ea 77 06 00 55 be 60 37 30 f4 c0 27 b9 ae 73 52 b6 84 5e 4e 2d 8e 51 58 ec 24 60 b2 fa e3 b5 74 55 c3 3a 70 52 6d 3b f6 33 85 5e 69 38 d9 e8 6d 5c e9 96 f3 5c dc 05 b6 6b 7d 39 47 ee ca 9c 97 75 c9 c6 e2 7e 66 23 23 81 8e 41 c0 15 cd 5f 79 1f 6a 66 b6 52 b0 30 05 03 1c 91 c7 f8 d7 5d a4 4d 71 a8 78 75 a6 b5 b0 8a 6b 8d 34 ab 79 Data Ascii: .9T\M S8RnM'=3@P[OZ\(n;QQcB(q!J3md1FkWS^\|1n=bZ$;wU`70'sR^N-QX$`tU:pRm;3^i8m\\k}9Gu~f##A_yjfR0]Mqxuk4y
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 95 24 e7 2e 66 ee 45 9a 5a 90 40 e7 a6 29 7c 87 e9 95 a6 67 62 2a 28 a2 81 05 14 52 50 31 6b 73 44 91 96 7b 77 52 14 86 20 1c 67 b5 61 56 ef 87 f6 bd f5 b2 37 4d c6 a6 7b 1b 50 f8 d5 8e fa de 59 63 8b cc 73 c8 fb d9 00 71 eb 5a 9a 7e a6 f7 4a 17 ed 3e 64 67 39 31 b7 1c 76 e2 b8 2f 15 ea 92 45 12 59 44 4a ee 1f 31 1d 76 fa 7e 79 ac ef 08 ea 9f 62 d7 21 8a 47 61 05 c1 f2 9f 1d b3 c0 3f 9d 71 3a 2e 50 72 3e 92 9e 65 4e 8d 75 46 4a eb 66 fb 33 d7 96 52 97 4c e1 58 44 ca 36 e3 81 d3 15 e6 5a c4 b3 ad d5 e6 9b 28 76 8a ea 56 91 40 3f 75 84 8e 01 3c 73 d5 b8 f7 af 51 82 c9 9a 24 cb 67 ef 13 5e 61 e2 45 94 eb ee 53 f8 59 c8 3e 9f bd 7a cf 0c ef 26 69 9d a5 c9 0b 77 39 89 ed 24 b5 b8 96 da 61 b6 58 9c a3 a9 ec 45 57 3c 36 2b 63 c4 91 08 bc 41 78 a0 01 97 0d 80 30 Data Ascii: $.fEZ@)\|gb*(RP1ksD{wR gaV7M{PYcsqZ~J>dg91v/EYDJ1v~yb!Ga?q:.Pr>eNuFJf3RLXD6Z(vV@?u<sQ$g^aESY>z&iw9$aXEW<6+cAx0
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 8e 2c 6e 56 20 fa 11 55 e4 1b 1f 0a c0 8e bf 4a 41 23 67 b5 06 84 f1 c6 8e 37 1c 12 0e 0f d3 d6 ac 59 69 73 ea 5a 94 76 56 e1 4c d3 1d a8 0f 00 9f f2 2a 08 24 03 73 7f 10 1d 3d 69 f6 ba 8c d6 7a 85 bd ec 04 2c d6 f2 09 10 fb 83 91 40 68 43 aa e9 b7 3a 75 fc 96 97 31 14 92 32 47 4e 1b 07 19 1e a3 8e b4 d8 a0 df 18 76 2b eb 82 79 15 ea 3e 22 f0 dd ef 8d f4 eb 1f 10 e9 71 c4 1d d3 cb 6b 76 93 04 77 e0 9e 3a ee eb e9 5e 79 ad e8 f7 3e 1f bf 6d 3e ee 4b 79 27 0a 0b ac 32 6f 08 7f ba 48 ef 55 ca f9 79 ad a1 32 e4 8d 47 14 ee 67 1b 85 8f 70 54 18 3d 98 67 1e f5 5c c8 59 f2 7f 2a 97 c9 67 fb a0 31 f4 a8 a4 5d a4 7b 1c 1a 92 25 72 4f 91 c6 08 21 ff 00 87 15 19 52 a7 ad 19 2b cd 26 e2 c6 9d 85 75 d4 8b b5 58 b7 85 ae a1 99 10 65 e2 43 28 19 ea 07 de fd 39 fa 03 55 Data Ascii: ,nV UJA#g7YisZvVL$s=iz,@hC:u12GNv+y>"qkvw:^y>m>Ky'2oHUy2GgpT=g\Yg1]{%rO!R+&uXeC(9U
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 9c 91 ee 33 fd 6b 1f c7 7a 3c 7a 4e be 05 bc 2d 1d b4 d1 24 91 e4 e7 77 18 27 f1 23 3f 8d 61 09 c9 4d c2 5f 23 aa 54 53 a5 ed 22 fd 4e 66 a6 b5 00 b8 19 a8 6a c5 96 d1 20 66 e8 0d 6c ce 78 ee 46 c3 06 a4 88 e1 1f f0 a4 39 39 1b 78 a6 a7 11 b7 3c d0 5e cc eb ac 6e 9a cf c2 71 4c a8 8f b6 e6 50 52 45 0c ac 08 00 82 2b af b0 d4 6c ad 3c 23 14 9a 55 ac b0 db cc b2 0b 94 2f bb 0d 83 9d 8d db 8c f5 f6 eb 5c 5c 70 3b f8 01 1d 4f 3f 6d 28 17 b9 c8 1f e1 5d 6d ae 87 2e 81 e1 d1 13 dd 47 70 f3 3c 86 44 51 f2 c7 85 03 1c fb e7 9a e0 aa e3 67 7e e7 bd 85 7f bd 82 7b 72 a3 cc 89 cb 39 40 db 09 3b 73 c9 aa f2 93 8e 4f 35 3c a1 a3 0c 87 82 a7 06 aa be 48 cd 77 23 c3 98 c3 eb eb 45 0a 09 e0 73 41 e0 e0 d5 18 85 1d 68 a0 75 14 01 24 5c 12 ff 00 dd e9 f5 a0 8f 90 9f 7a 73 Data Ascii: 3kz<zN-$w'#?aM_#TS"Nfj flxF99x<^nqLPRE+l<#U/\\p;O?m(]m.Gp<DQg~{r9@;sO5<Hw#EsAhu$\zs
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: a5 7d 03 a3 5c 98 e2 5b a3 31 60 df bb 46 3f 3e 43 70 01 23 1b 86 71 8e 98 af 0a 9f c1 7a b5 a5 e8 3f 67 fb 45 99 6f dd 5d 20 3e 54 c3 38 00 1f 52 78 c7 5f 6a f5 ed 03 c5 10 e9 da 44 5f 6b 65 88 f1 2c 6d b7 21 88 c6 40 c0 e3 9a c2 b5 39 4a 2e 51 e8 74 c6 71 4d 45 f7 3d 04 eb 9a 7c c2 78 3e d3 71 31 86 22 65 22 3c 8d bd 0e 39 f7 ef 5f 3e 7c 65 3e 7e ad a7 cc 81 9e 34 81 a2 12 ed c0 23 79 65 07 df 0d fa d7 be ae af 35 e5 84 33 c4 b2 ee c0 2e 61 c0 ea 39 07 e5 39 af 24 f8 ab 77 fd a5 0e a5 63 be 3f 30 4b 0c ea b8 fb a5 63 60 dc fa e0 8f ca 92 77 92 b1 d5 2a 69 41 bb 5b fa f4 3c 73 4a b4 b8 bd d4 a0 82 d8 13 2b 38 c1 c7 4e 6b ae f1 1e a5 16 ac 16 d7 50 90 34 d6 91 2c 11 14 1c 06 ee 73 e8 02 e0 f2 73 91 8a e4 f4 dd 52 4d 30 dc 18 87 cf 2c 5b 03 83 82 9f 30 39 Data Ascii: }\[1`F?>Cp#qz?gEo] >T8Rx_jD_ke,m!@9J.QtqME=\|x>q1"e"<9_>\|e>~4#ye53.a99$wc?0Kc`w*iA[<sJ+8NkP4,ssRM0,[09
2025-01-09 06:23:53 UTC	1369	IN	Data Raw: 3b bf 1c e3 f5 aa 7e 26 b2 b7 92 f5 1e da 5d e9 24 7b c8 2c 0f cc 72 4f 3f ad 61 ed 97 37 29 da f0 35 23 4b db 49 68 51 f0 fe a7 f6 42 f6 ef 21 81 49 dc 1c 73 83 50 eb 77 c2 f6 ee 34 89 9a 58 e3 18 df d3 71 ad 2b 5d 0e 39 6d d8 a4 2c 64 41 b8 82 78 02 ad 4f a0 5a 45 04 73 dc 79 8a 49 65 58 f9 53 9e 4e 79 1d 3a 7a 51 cd 1e 6b 89 ce a7 b3 54 fa 19 6b e1 5b 89 22 2f 24 d1 40 fb 43 24 6e 4e 58 1e 9c f4 15 d5 e9 9a 2c 7a 43 db 98 b2 db 90 ac 85 bf 8c 9f e8 30 2b 09 2f 2e 24 b7 7b c9 1b 7e 5c b6 49 e4 80 54 7f 5a 9b 53 f1 49 86 dd 44 6a c5 c8 03 27 90 9f fd 7a 2d 39 35 73 a2 84 f0 f4 e9 c9 c9 5e 4e d6 f2 0f 15 44 c7 54 37 11 e1 96 38 95 64 65 c7 de e7 af e8 3f 0a 8f c0 7a e3 68 1e 23 fb 52 44 b2 86 8d 82 c6 e3 20 b7 b7 be 33 58 57 3a cd c3 da 3c 45 13 f7 9f 7a Data Ascii: ;~&]${,rO?a7)5#KIhQB!IsPw4Xq+]9m,dAxOZEsyIeXSNy:zQkTk["/$@C$nNX,zC0+/.${~\ITZSIDj'z-95s^NDT78de?zh#RD 3XW:<Ez

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:53 UTC	867	OUT	GET /static/pages/icon-img/arrow-down-primary.svg HTTP/1.1 Host: qr.me-qr.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: user_local=en; adsStatData=%7B%22url%22%3Anull%2C%22campaignId%22%3Anull%2C%22adgroupId%22%3Anull%2C%22gClId%22%3Anull%2C%22bannerId%22%3Anull%2C%22device%22%3Anull%2C%22adPosition%22%3Anull%2C%22targetId%22%3Anull%2C%22locInterestMC%22%3Anull%2C%22locPhysicalMs%22%3Anull%2C%22keyword%22%3Anull%2C%22audience%22%3Anull%2C%22deviceModel%22%3Anull%2C%22creative%22%3Anull%2C%22firstVisitDate%22%3A%222025-01-09%2008%3A23%3A51%22%7D; cookieId=37b957cd-11ce-4e0a-9b28-551f490dd856
2025-01-09 06:23:54 UTC	1244	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:53 GMT Content-Type: image/svg+xml Content-Length: 497 Connection: close last-modified: Fri, 03 Jan 2025 16:34:39 GMT etag: "6778119f-1f1" expires: Sun, 12 Jan 2025 12:23:29 GMT Cache-Control: max-age=604800 access-control-allow-origin: * access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range access-control-expose-headers: Content-Length,Content-Range vary: User-Agent CF-Cache-Status: HIT Age: 324024 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eM8R9QWrtnUColjbXCE5YNySEVFxPrA8%2FnzbDvGr8YN0b03Blwxovt0PMoFjFBj7vLL2U1ErH0p3jfgdLMeihzXXpr5%2BcFASCKE55HjXMIc6MJWow0yD%2B7i9qveSBxA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8ff2575a58bc72bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1781&min_rtt=1768&rtt_var=689&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1445&delivery_rate=1558996&cwnd=252&unsent_bytes=0&cid=f474b87617b8a80d&ts=138&x=0"
2025-01-09 06:23:54 UTC	125	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 39 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 39 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d Data Ascii: <svg width="16" height="9" viewBox="0 0 16 9" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-
2025-01-09 06:23:54 UTC	372	IN	Data Raw: 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 30 2e 38 35 32 32 35 32 20 30 2e 38 35 32 32 35 32 43 31 2e 30 37 31 39 32 20 30 2e 36 33 32 35 38 33 20 31 2e 34 32 38 30 38 20 30 2e 36 33 32 35 38 33 20 31 2e 36 34 37 37 35 20 30 2e 38 35 32 32 35 32 4c 38 20 37 2e 32 30 34 35 4c 31 34 2e 33 35 32 33 20 30 2e 38 35 32 32 35 32 43 31 34 2e 35 37 31 39 20 30 2e 36 33 32 35 38 33 20 31 34 2e 39 32 38 31 20 30 2e 36 33 32 35 38 33 20 31 35 2e 31 34 37 37 20 30 2e 38 35 32 32 35 32 43 31 35 2e 33 36 37 34 20 31 2e 30 37 31 39 32 20 31 35 2e 33 36 37 34 20 31 2e 34 32 38 30 38 20 31 35 2e 31 34 37 37 20 31 2e 36 34 37 37 35 4c 38 2e 33 39 37 37 35 20 38 2e 33 39 37 37 35 43 38 2e 31 37 38 30 38 20 38 2e 36 31 37 34 32 20 37 2e 38 32 31 39 32 20 38 2e Data Ascii: rule="evenodd" d="M0.852252 0.852252C1.07192 0.632583 1.42808 0.632583 1.64775 0.852252L8 7.2045L14.3523 0.852252C14.5719 0.632583 14.9281 0.632583 15.1477 0.852252C15.3674 1.07192 15.3674 1.42808 15.1477 1.64775L8.39775 8.39775C8.17808 8.61742 7.82192 8.

Timestamp	Bytes transferred	Direction	Data
2025-01-09 06:23:54 UTC	1095	OUT	GET /build/fonts/bootstrap-icons.b7bcc075.woff2 HTTP/1.1 Host: qr.me-qr.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://qr.me-qr.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://qr.me-qr.com/build/static-page.28e2ed9e39.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: user_local=en; adsStatData=%7B%22url%22%3Anull%2C%22campaignId%22%3Anull%2C%22adgroupId%22%3Anull%2C%22gClId%22%3Anull%2C%22bannerId%22%3Anull%2C%22device%22%3Anull%2C%22adPosition%22%3Anull%2C%22targetId%22%3Anull%2C%22locInterestMC%22%3Anull%2C%22locPhysicalMs%22%3Anull%2C%22keyword%22%3Anull%2C%22audience%22%3Anull%2C%22deviceModel%22%3Anull%2C%22creative%22%3Anull%2C%22firstVisitDate%22%3A%222025-01-09%2008%3A23%3A51%22%7D; cookieId=37b957cd-11ce-4e0a-9b28-551f490dd856
2025-01-09 06:23:54 UTC	959	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 06:23:54 GMT Content-Type: font/woff2 Content-Length: 130396 Connection: close last-modified: Wed, 08 Jan 2025 15:16:04 GMT etag: "677e96b4-1fd5c" vary: User-Agent Cache-Control: max-age=432000 CF-Cache-Status: HIT Age: 1743 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FlCzrgJ%2BQsWPlED3PqfM1oWVyIXu6y%2Bl8aQO%2BEEgW4AVTRy%2FnY%2F%2F%2Bx4e6WCR%2F2tnniukUMvs8y5HgBZ7HvO7FeOZI5TBJTKr35mkj%2FcPfNYWB6UqFdEfxC6CfUQrnIE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8ff2575c599d9e16-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1782&rtt_var=685&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1673&delivery_rate=1579232&cwnd=189&unsent_bytes=0&cid=3ed49ac2e9e7003c&ts=153&x=0"
2025-01-09 06:23:54 UTC	410	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 fd 5c 00 0b 00 00 00 07 4b 54 00 01 fd 06 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 54 06 60 00 81 e3 06 0a 98 b1 60 93 bc 63 01 36 02 24 03 c0 04 0b c0 08 00 04 20 05 84 6a 07 81 f9 06 5b 0a f0 b5 80 7f da f3 74 e7 da 84 e8 99 15 4a 9a 2f ea 86 08 b0 7d b3 d6 68 9a f4 e7 1f 9d 08 35 ee d6 a0 f3 d8 35 a2 f9 82 05 ee 53 f4 23 e8 b6 4d c8 67 a6 37 eb 75 f7 8e 6e 83 f5 ec ff ff ff ff ff ff ff ff d5 c9 42 6a 73 77 72 37 9b 4d 2e e1 e0 97 4f 05 a1 68 f1 ab 58 6b ed 23 34 14 3d c5 dc 29 2f 9e 41 ac 11 7a 63 03 dc f7 19 44 0e 5d 46 63 e5 b8 30 0f 00 27 42 30 75 43 19 f4 54 33 14 e7 b2 b8 42 4b 5b 81 1e 67 6f cd 5a 6c a4 28 cb 00 36 be 64 13 9b 6d 1c 37 e1 2d bc 1e de e4 9c d5 ac f9 db f0 9d 74 20 16 Data Ascii: wOF2\KTT``c6$ j[tJ/}h55S#Mg7unBjswr7M.OhXk#4=)/AzcD]Fc0'B0uCT3BK[goZl(6dm7-t
2025-01-09 06:23:54 UTC	1369	IN	Data Raw: 6c c2 63 e3 db 01 34 06 0f 31 c3 0f e1 3f 0c 8e d9 1a 86 9f 0d 1a 5b e3 0c 7e 23 8c 6c cd 99 c1 17 c2 c8 d6 90 c1 af 84 37 6c 4d 64 f0 3b a1 61 36 4f 36 77 d2 73 4d b5 03 0c 59 04 b0 99 9f fa 43 ef 2e 42 f0 cb 88 28 14 be a8 4f aa df 5f 3a 2b 36 73 bc 9f 53 28 bf 27 86 ce 67 d3 57 94 4c 9d 64 1a 2d 6a 8a 9b 8e 04 e7 6c e8 0a 78 40 74 64 06 59 0c a4 18 a3 44 ba 8b 75 74 ca d8 cd 93 a9 93 50 d7 aa bb 29 8a 9e 4e 5f f2 5c 46 9d 3c c9 e9 41 0e b7 f1 e6 fa cb 0f 52 57 9d 27 13 ba 32 aa 1a 3f a2 09 15 25 e9 a4 0f 54 89 9c 3f 9a fe 90 a5 8c 55 02 6f ea 22 51 7a 5d 65 0f bc c8 1f c0 04 93 44 e8 5d b9 ac 27 ef aa 6b df a7 cc c0 42 fe c2 39 e1 3f f9 df 92 67 88 22 97 b5 07 00 cc 24 65 d6 26 b3 4b 0f c9 79 b5 95 9b a9 27 5e 3e ac 5f 5f da 5b 9b 24 af 64 e6 d7 5d 75 Data Ascii: lc41?[~#l7lMd;a6O6wsMYC.B(O_:+6sS('gWLd-jlx@tdYDutP)N_\F<ARW'2?%T?Uo"Qz]eD]'kB9?g"$e&Ky'^>__[$d]u
2025-01-09 06:23:54 UTC	1369	IN	Data Raw: 58 f4 3d dd 3d d2 c8 e6 91 4c 32 0b 8c 6b c8 ac dc 75 7d 9e 83 2e d7 aa 6b d5 35 a1 61 c0 d0 cd 02 c3 0c 4b 5a 40 d9 9f 60 ca 2d 83 16 da b8 20 f9 77 ee 5e b5 5f d8 f9 89 58 d5 70 2d d4 df ab 21 11 c5 f4 24 b2 12 08 26 53 ab 2a c7 a6 c8 de fb d0 95 42 80 f1 af b0 75 8c 30 f8 4d 74 62 f9 da a6 a1 f4 6d bf e0 0b d6 47 f8 14 61 11 38 96 5a 98 9c 55 28 42 cd 65 f7 da e3 49 8a 7d cf 0f 86 b1 4c 8c 80 0c 23 7b 7d f3 5f aa f6 df b6 20 b5 64 52 a1 9b b2 5f 90 bb ff 3f c7 fd a2 fd a3 df 0f 7b db 9d dd 7f 42 8e 2b dc 50 05 de 4a 60 55 a1 40 16 02 49 04 4a 04 41 ca 2c 80 94 08 82 b4 81 42 01 04 c0 60 00 04 a3 64 3f 05 db 23 bb c3 48 7a ea fe 76 a7 21 18 6c 06 c9 16 29 27 5a 2f 48 76 27 f7 eb f3 a7 e3 84 e8 d4 3d ee ec f6 4f 29 f9 79 52 bf 89 9e dc b3 7b b3 4b 61 35 Data Ascii: X==L2ku}.k5aKZ@`- w^_Xp-!$&S*Bu0MtbmGa8ZU(BeI}L#{}_ dR_?{B+PJ`U@IJA,B`d?#Hzv!l)'Z/Hv'=O)yR{Ka5
2025-01-09 06:23:54 UTC	1369	IN	Data Raw: 92 15 55 d3 0d d3 f1 83 a2 ac ea a6 ed 87 71 fa 1e 87 27 10 49 64 0a 95 46 67 30 59 6c 0e 97 c7 17 08 45 62 89 5c a1 54 a9 35 5a 9d 31 26 52 e9 71 47 18 39 9c 2e ae 1e 9e 5e de 3e be 84 0a a9 b4 61 5a b6 e3 46 f1 30 6f 0f 30 38 0e 4f 20 92 29 54 1a 9d c1 64 f1 f8 02 a1 48 2c d1 e9 0d 46 93 d9 62 b5 d9 1d 4e 97 db e3 f5 f9 01 80 20 30 04 0a 83 23 90 28 34 06 8b c3 13 88 24 32 85 4a a3 33 98 2c 36 87 cb e3 0b c4 12 a9 4c ae 50 aa d4 1a ad 4e 6f 30 9a cc 16 ab cd ee 70 ba b8 ba b9 7b 78 02 80 20 30 04 0a 83 23 90 28 34 06 8b c3 13 c8 14 2a 8d ce 60 b2 d8 1c 2e 8f 2f 10 8a c4 12 a9 4c ae 50 aa d4 1a ad 4e fb f6 82 e7 07 61 14 27 79 d1 76 fd 30 4e f3 b2 6e fb 71 5e 37 00 62 38 41 52 34 c3 72 8a aa e9 86 69 87 51 92 97 55 dd b4 5d 3f 8c d3 bc ac d7 fd bc df 0f Data Ascii: Uq'IdFg0YlEb\T5Z1&RqG9.^>aZF0o08O )TdH,FbN 0#(4$2J3,6LPNo0p{x 0#(4*`./LPNa'yv0Nnq^7b8AR4riQU]?
2025-01-09 06:23:54 UTC	1369	IN	Data Raw: f7 84 9f c8 13 7d 62 07 48 39 ba ee 57 e2 49 24 09 99 28 d6 f2 ff ad 3f 31 b7 ea 62 62 62 e3 e2 13 12 93 92 53 52 d3 d2 33 32 b3 b2 73 72 f3 f2 0b 0a fb 98 15 79 17 0a 83 23 90 28 34 06 8b c3 13 88 24 32 85 4a a3 33 58 6c 2e ef d4 e9 dc bc fc 82 fe 57 d7 d4 d6 d5 37 35 b7 b4 b6 77 74 ed d6 bd 47 cf cf bf 68 02 d4 8f fd 76 ee d2 b5 5b f7 1e 3d 7b f5 ee d3 b7 ff 90 c8 d8 e5 99 b7 bd 3a c7 ec ec e2 ea e6 ee e1 e9 e5 ed e3 eb 0f 00 04 81 21 50 18 1c 31 23 33 da 87 fd 10 7f 72 f4 8f f7 ed ef b3 59 bd 6c 6a 86 19 65 5c 57 97 fe 75 c6 64 fa bc 24 d1 19 cc 23 91 29 54 1a 9d c1 8c 77 be c6 cf ec be df f9 ff fc 29 bf 92 bd 39 fb e2 97 b8 96 05 0f 5e b5 ef 46 8f 99 3c a5 8f f0 84 b3 88 60 15 e9 da a7 13 06 2c 00 00 e8 1a 3a a0 bd 9f 2e 81 84 bc e6 b2 20 4c 28 c2 85 Data Ascii: }bH9WI$(?1bbbSR32sry#(4$2J3Xl.W75wtGhv[={:!P1#3rYlje\Wud$#)Tw)9^F<`,:. L(
2025-01-09 06:23:54 UTC	1369	IN	Data Raw: 4a a7 62 19 54 2a 93 ca 65 51 a5 6c aa 96 43 b5 72 a9 5e 1e 35 ca a7 66 05 d4 aa 90 da 15 51 a7 62 ea 56 42 bd 4a bd bf 32 ea 57 4e 83 2a 68 58 25 8d ab a2 49 d5 34 ad 86 66 d5 d2 bc 3a 5a 54 4f cb 1a 68 55 23 ad 6b a2 4d cd b4 ad 85 76 b5 d2 be 36 3a d4 4e c7 3a e8 54 27 9d eb a2 4b dd 74 ad 87 6e f5 d2 bd 3e 7a d4 4f cf 06 e8 d5 20 bd 1b a2 4f c3 f4 6d 84 7e 8d d2 bf 31 06 34 ce c0 26 18 d4 24 43 9a 62 68 d3 0c 6b 86 e1 cd 32 a2 39 46 36 cf a8 16 18 dd 22 63 5a 62 6c cb 8c 6b 85 f1 ad 32 a9 35 26 b7 ce 94 36 98 da 26 d3 da 62 7a db cc 68 87 99 ed 32 ab 3d e6 b6 cf 82 0e 58 d8 21 2b 3b 62 55 c7 ac ee 84 35 9d b2 b6 33 d6 75 ce 86 2e d8 d8 25 9b ba 62 73 d7 9c d3 0d e7 75 cb 05 dd 71 51 f7 5c d2 03 97 f5 c8 15 3d 71 55 cf 5c d3 0b d7 f5 ca 0d bd 71 53 ef Data Ascii: JbTeQlCr^5fQbVBJ2WNhX%I4f:ZTOhU#kMv6:N:T'Ktn>zO Om~14&$Cbhk29F6"cZblk25&6&bzh2=X!+;bU53u.%bsuqQ\=qU\qS
2025-01-09 06:23:54 UTC	1369	IN	Data Raw: bc 26 c8 6f 92 82 a6 28 6c 9a a2 66 28 6e 96 92 e6 28 6d 9e b2 16 28 6f 91 8a 96 a8 6c 99 9a 56 a8 6d 95 ba d6 a8 6f 9d 86 36 68 6c 93 a6 b6 68 6e 9b 81 76 18 69 97 b1 f6 18 6f 9f e9 0e ee e9 64 c4 0e c5 8e c4 8e c5 4e a4 ef 4e c5 ce c4 ce c5 2e c4 2e c5 ae c4 ae e5 fe 6e c4 6e c5 ee 24 b7 7b 69 ed 41 ec 51 ec 49 ec 59 ec 45 ec 55 ec 4d ec 1d 5e fb c8 75 9f ce eb eb bc be cf eb 07 bf fd e2 af 3f fc f7 cf 01 56 cd e1 3f 83 04 c0 60 00 32 58 40 0c 01 30 43 04 c2 50 80 32 54 60 0c 0d 38 43 07 c1 30 41 32 2c 50 0c 1b 34 c3 01 c3 70 c1 32 32 70 8c 1c 3c a3 80 c0 28 21 32 2a 48 8c 1a 32 a3 81 c2 68 a1 32 3a 68 8c 1e 3a 63 80 c1 18 61 32 26 58 8c 19 36 63 81 c3 58 e1 32 6e 78 8c 07 3e e3 45 c0 f8 10 32 19 44 4c 16 31 93 43 c2 94 91 32 15 64 4c 15 39 53 43 c1 d4 Data Ascii: &o(lf(n(m(olVmo6hlhnviodNN..nn${iAQIYEUM^u?V?`2X@0CP2T`8C0A2,P4p22p<(!2*H2h2:h:ca2&X6cX2nx>E2DL1C2dL9SC
2025-01-09 06:23:54 UTC	1369	IN	Data Raw: 81 c1 d7 c8 88 d2 c4 98 d0 cc 98 d2 c2 98 d1 ca 98 d3 46 bc a0 9d b1 a0 83 b1 a4 93 b1 a2 8b b1 a6 9b b1 a1 87 b1 a5 97 b1 a3 8f b1 a7 9f 71 60 80 71 64 90 05 36 44 7c 65 98 95 60 84 95 62 94 95 66 8c 35 61 9c 35 65 82 35 63 92 35 67 8a b5 60 9a b5 64 86 b5 62 96 3d 64 8e 3d 62 9e 3d 61 81 3d 65 91 3d 67 89 bd 60 99 bd 64 85 fd b6 4a 49 b1 c6 89 67 9d 93 c0 06 db c0 26 db c8 16 db c2 36 db c9 0e db c5 2e db cd 1e db c3 3e f1 bf 03 2e a6 1c 92 e7 1c 71 cc 38 a6 b9 9c d0 b2 9c d2 72 9c d1 6a 9c d3 ea 5c d0 ce 5c d2 2e 5c d1 39 5c 33 52 dc 30 d2 dc 72 31 e7 8e 4c e0 9e 35 e2 81 35 e6 91 6d e2 89 6d e6 99 6d e5 85 6d e3 95 6d e7 8d ed e0 9d 34 e2 83 9c e2 93 9c e6 8b 9c e1 9b 9c e5 87 3c e3 97 56 e1 8f 56 e5 9f 95 f1 d3 d9 00 a0 7e 01 a4 7e 03 a2 fe 00 4c fd Data Ascii: Fq`qd6D\|e`bf5a5e5c5g`db=d=b=a=e=g`dJIg&6.>.q8rj\\.\9\3R0r1L55mmmmm4<VV~~L
2025-01-09 06:23:54 UTC	1369	IN	Data Raw: 18 08 65 0c 85 31 d5 c2 99 1a 11 4c ad 48 a6 4e 14 53 2f 9a 69 10 c3 34 8b 65 5a c4 31 ad e2 99 36 09 4c 87 44 a6 53 12 d3 23 99 e9 95 c2 f4 49 65 fa a5 31 03 d2 99 41 19 cc 90 4c 66 58 16 5b 25 9b 6d 91 c3 b6 ca 65 db e4 b1 ed f2 d9 0e 05 6c a7 42 b6 4b 11 db ad 98 ed 51 c2 f6 2a 65 fb 94 b1 fd ca d9 41 15 ec a8 4a 76 4a 15 3b a7 9a 68 a8 e1 d8 d4 72 ec ea 78 3f d4 d3 2d 1a e8 56 8d 74 9b 26 ba 5d 33 dd a1 85 ee d4 4a 77 69 a3 bb b5 d3 3d 3a e8 5e 9d 74 9f 2e ba 5f 37 3d a0 87 1e d4 4b 0f e9 a3 87 f5 d3 23 06 e8 51 83 f4 98 21 7a dc 30 3d 61 84 9e 34 7a f3 8c dd 3c e3 ac 8d 09 76 de 24 bb 60 8a f4 9a e6 c4 cd 70 fb 66 d9 2c 73 6c b6 79 42 62 81 18 58 24 86 96 88 91 65 62 6c 85 74 59 25 dd d6 c8 b3 75 0e d5 06 a7 67 93 d3 b7 c5 79 d9 e6 92 ec 70 19 76 b9 Data Ascii: e1LHNS/i4eZ16LDS#Ie1ALfX[%melBKQ*eAJvJ;hrx?-Vt&]3Jwi=:^t._7=K#Q!z0=a4z<v$`pf,slyBbX$ebltY%ugypv
2025-01-09 06:23:54 UTC	1369	IN	Data Raw: 52 91 4c a0 41 9b 14 0b 9a 24 27 48 ae 48 39 7b eb 3b ff fc e7 a7 cb e5 f6 89 aa 7c 68 9b e6 9e 55 e5 44 08 52 44 03 38 2f 9f c1 3b 7a bf 9b b5 47 1e f0 45 98 ba aa ca 22 bd c8 02 3c 08 fb f4 a1 7b a8 31 ab c3 41 0d 7b cc 54 2d a8 ca a6 21 43 91 49 6b 9c 38 3b 1c 6e c8 c2 6c d9 39 5d 3b 81 4a e3 a6 d9 8c ed f1 88 74 65 f7 f8 fc c9 76 1a dc 84 74 b8 21 63 64 67 72 61 ce 8a e4 f9 a2 38 95 f5 cb e9 c4 18 c9 9d de fb 48 7a df 8f 98 85 36 69 c7 64 83 12 ed 3e 9c ed 5e 28 62 cf 72 75 d5 47 c9 53 6f 35 71 5f 59 4f da be 1e 99 b6 a9 ac a9 55 cd 9e 37 de f1 9e ac 18 10 aa 6d 14 e0 82 ed 96 ba cc 1c 7b 6f a5 27 e9 3c 7d f0 2e 7c 24 77 d4 89 f4 34 6f d6 f7 c8 8d 81 13 80 a2 86 b4 36 ef cd 18 95 03 47 91 b8 c3 ca a4 ef 63 92 5e 7d 6f b0 d6 d0 f5 12 7c af ac 94 35 6b Data Ascii: RLA$'HH9{;\|hUDRD8/;zGE"<{1A{T-!CIk8;nl9];Jtevt!cdgra8Hz6id>^(bruGSo5q_YOU7m{o'<}.\|$w4o6Gc^}o\|5k