Edit tour

Windows Analysis Report
https://informed.deliveryerw.top/us/

Overview

General Information

Sample URL:	https://informed.deliveryerw.top/us/
Analysis ID:	1589680
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

AI detected suspicious Javascript

AI detected suspicious URL

HTML page contains obfuscated javascript

HTML body with high number of embedded images detected

HTML title does not match URL

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2504,i,16738957434862653999,3427656708703252019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5040 --field-trial-handle=2504,i,16738957434862653999,3427656708703252019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 --field-trial-handle=2504,i,16738957434862653999,3427656708703252019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://informed.deliveryerw.top/us/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Suricata Signatures

ETPRO PHISHING Darcula Landing Page M2 2024-01-02

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T01:05:47.053463+0100	2859493	1	Successful Credential Theft Detected	104.21.48.1	443	192.168.2.6	49755	TCP
2025-01-13T01:05:48.182710+0100	2859493	1	Successful Credential Theft Detected	104.21.48.1	443	192.168.2.6	49780	TCP

HTTP traffic detected: POST /api/MC4yMDM5MTgxNjY2MDIyNjk1OA== HTTP/1.1Host: informed.deliveryerw.topConnection: keep-aliveContent-Length: 292sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/encryptAccept: */*Origin: https://informed.deliveryerw.topSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://informed.deliveryerw.top/us/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_3LB&sid=0a7XwKvBpzzpiUs0AkjP	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-r-P&sid=EEd-NZZj7hSQvnyvAkiC	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/e65c6b17TeKnX.svg	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=websocket&sid=TNdFX77nKc4pUD33Akh-	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/e394ed97TeKnX.svg	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_5VS&sid=KWLpRq4tjuCSbqFTAkjX	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qCV&sid=TNdFX77nKc4pUD33Akh-	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-xKY&sid=g8ztw0ZOn7AWRVUeAkii	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-_Hx&sid=J6E_8lNEMeLQIf2XAkiq	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/8cf6cd52TeKnX.svg	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/layout/images/49.png	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/ffd7af61TeKnX.woff	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-p-2&sid=TNdFX77nKc4pUD33Akh-	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/layout/images/5.svg	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-sI0&sid=EEd-NZZj7hSQvnyvAkiC	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_2md&sid=0a7XwKvBpzzpiUs0AkjP	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qdU&sid=TNdFX77nKc4pUD33Akh-	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_4NG&sid=0a7XwKvBpzzpiUs0AkjP	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=websocket&sid=jqBmDq5RmIsfPBvgAkil	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-zk5&sid=jqBmDq5RmIsfPBvgAkil	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/f4397cedTeKnX.css	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-rqP&sid=EEd-NZZj7hSQvnyvAkiC	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/9b0c1debTeKnX.svg	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/4cd1ec68TeKnX.css	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-nn3&sid=Qr-EBVSRccC3wUxlAkh1	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=websocket&sid=KWLpRq4tjuCSbqFTAkjX	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/layout/images/11.svg	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/layout/images/46.svg	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS--3O&sid=jqBmDq5RmIsfPBvgAkil	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/3213f1cfKXMp5.js	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/api/MC4yMDM5MTgxNjY2MDIyNjk1OA==	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/layout/images/8.svg	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_5AH	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/layout/images/62.png	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/f6170fbbTeKnX.css	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/62ff200fKXMp5.js	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-x3w&sid=g8ztw0ZOn7AWRVUeAkii	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/c27b6911KXMp5.js	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qnC&sid=TNdFX77nKc4pUD33Akh-	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/layout/images/22.svg	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-xup&sid=g8ztw0ZOn7AWRVUeAkii	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_1bn&sid=4MZLrLH8W_kCdVtKAkiw	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_3dF&sid=0a7XwKvBpzzpiUs0AkjP	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_1np&sid=4MZLrLH8W_kCdVtKAkiw	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_0Nr&sid=4MZLrLH8W_kCdVtKAkiw	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qCX&sid=TNdFX77nKc4pUD33Akh-	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/f2e2ef63TeKnX.woff	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-t8j&sid=Ldup2XbUdHXkpLR3AkiL	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_5gS&sid=KWLpRq4tjuCSbqFTAkjX	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/us/assets/667bf194TeKnX.css	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/api/MC43MjEyMjEwODQzMDM4OTE4	Avira URL Cloud: Label: phishing
Source: https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-s8F&sid=EEd-NZZj7hSQvnyvAkiC	Avira URL Cloud: Label: phishing

Source: 1.11..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://informed.deliveryerw.top/us/assets/3213f1c... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While some of the functionality may be legitimate (e.g., analytics, error reporting), the overall level of suspicious activity warrants a closer review. The use of heavily encoded strings and the presence of unknown domains increase the risk score.
Source: 1.7..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://informed.deliveryerw.top/us/assets/78d5923... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. The use of `eval` and the construction of a function from a string indicate the potential for executing remote or malicious code. Additionally, the script appears to be sending user data to external servers, which could lead to data leaks or other security issues. The heavy obfuscation of the code further raises concerns about the script's true purpose and intent. While some of the behaviors could be legitimate, the overall risk profile of this script is high and warrants further investigation.

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://informed.deliveryerw.top
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://informed.deliveryerw.top

Source: https://moversguide.usps.com/mgo/?referral=MG80	HTTP Parser: Total embedded image size: 15424
Source: https://moversguide.usps.com/mgo/disclaimer?referral=MG80	HTTP Parser: Total embedded image size: 15424

Source: https://informed.deliveryerw.top/us/	HTTP Parser: No favicon
Source: https://informed.deliveryerw.top/us/	HTTP Parser: No favicon
Source: https://moversguide.usps.com/mgo/disclaimer?referral=MG80	HTTP Parser: No favicon
Source: https://moversguide.usps.com/mgo/disclaimer?referral=MG80	HTTP Parser: No favicon
Source: https://moversguide.usps.com/mgo/disclaimer?referral=MG80	HTTP Parser: No favicon
Source: https://moversguide.usps.com/mgo/disclaimer?referral=MG80	HTTP Parser: No favicon
Source: https://moversguide.usps.com/mgo/disclaimer?referral=MG80	HTTP Parser: No favicon
Source: https://moversguide.usps.com/mgo/disclaimer?referral=MG80	HTTP Parser: No favicon
Source: https://moversguide.usps.com/mgo/disclaimer?referral=MG80	HTTP Parser: No favicon
Source: https://store.usps.com/store/results/free-shipping-supplies/shipping-supplies/_/N-alnx4jZ7d0v8v	HTTP Parser: No favicon
Source: https://store.usps.com/store/results/free-shipping-supplies/shipping-supplies/_/N-alnx4jZ7d0v8v	HTTP Parser: No favicon
Source: https://cns.usps.com/	HTTP Parser: No favicon
Source: https://store.usps.com/store/business-supplies	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50285 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50860 version: TLS 1.2

Source: Network traffic	Suricata IDS: 2859493 - Severity 1 - ETPRO PHISHING Darcula Landing Page M2 2024-01-02 : 104.21.48.1:443 -> 192.168.2.6:49755
Source: Network traffic	Suricata IDS: 2859493 - Severity 1 - ETPRO PHISHING Darcula Landing Page M2 2024-01-02 : 104.21.48.1:443 -> 192.168.2.6:49780

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_332.4.dr, chromecache_318.4.dr, chromecache_703.4.dr	String found in binary or memory: F.src="https://www.youtube.com/iframe_api";z=document.getElementsByTagName("script")[0];z.parentNode.insertBefore(F,z);var C=[],p=[],u=[],A=d.YT_MILESTONE,K=[];onYouTubeIframeAPIReady=function(){for(var a=0;a<C.length;a++)p[a]=new YT.Player(C[a],{events:{onReady:onPlayerReady,onStateChange:onPlayerStateChange,onError:onPlayerError}})};onPlayerReady=function(a){};onPlayerError=function(a){q("video_error",{videotitle:void 0!==a.target.playerInfo?a.target.playerInfo.videoData.title:a.target.getVideoData().title})}; equals www.youtube.com (Youtube)
Source: chromecache_516.4.dr, chromecache_717.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_696.4.dr, chromecache_313.4.dr, chromecache_337.4.dr, chromecache_422.4.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Nk:function(){e=nb()},Kd:function(){d()}}};var Vb=wa(["data-gtm-yt-inspected-"]),QE=["www.youtube.com","www.youtube-nocookie.com"],RE,SE=!1; equals www.youtube.com (Youtube)
Source: chromecache_717.4.dr, chromecache_804.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_313.4.dr, chromecache_337.4.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=vC(a,c,e);U(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return U(122),!0;if(d&&f){for(var m=yb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},yC=function(){var a=[],b=function(c){return bb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_450.4.dr, chromecache_296.4.dr	String found in binary or memory: function X(a,b){this.v={};this.playerInfo={};this.videoTitle="";this.j=this.g=null;this.h=0;this.m=!1;this.l=[];this.i=null;this.A={};this.options=null;if(!a)throw Error("YouTube player element ID required.");this.id=qa(this);b=Object.assign({title:"video player",videoId:"",width:640,height:360},b\|\|{});var c=document;if(a=typeof a==="string"?c.getElementById(a):a){W.yt_embedsEnableRsaforFromIframeApi&&tb();c=a.tagName.toLowerCase()==="iframe";b.host\|\|(b.host=c?mb(a.src):"https://www.youtube.com");this.options= equals www.youtube.com (Youtube)
Source: chromecache_450.4.dr, chromecache_296.4.dr	String found in binary or memory: function tb(){var a=new rb,b=["https://www.youtube.com"];b=b===void 0?qb:b;oa(function(c){switch(c.g){case 1:return C(c,sb(),2);case 2:if(!c.m){c.g=3;break}return C(c,Promise.all(b.map(function(d){var g;return oa(function(k){if(k.g==1)return k.l=2,C(k,navigator.permissions.query({name:"top-level-storage-access",requestedOrigin:d}),4);k.g!=2?(g=k.m,g.state==="prompt"&&a.g.push(d),k.g=0,k.l=0):(k.l=0,k.i=null,k.g=0)})})),4); equals www.youtube.com (Youtube)
Source: chromecache_516.4.dr, chromecache_717.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_696.4.dr, chromecache_313.4.dr, chromecache_337.4.dr, chromecache_422.4.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Kh:e,Ih:f,Jh:g,ri:k,si:m,bf:n,Mb:b},q=A.YT;if(q)return q.ready&&q.ready(d),b;var r=A.onYouTubeIframeAPIReady;A.onYouTubeIframeAPIReady=function(){r&&r();d()};H(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(aF(w,"iframe_api")\|\|aF(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!SE&&ZE(x[B],p.bf))return lc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_776.4.dr, chromecache_371.4.dr, chromecache_884.4.dr, chromecache_613.4.dr, chromecache_565.4.dr, chromecache_477.4.dr, chromecache_378.4.dr, chromecache_635.4.dr, chromecache_448.4.dr, chromecache_847.4.dr, chromecache_820.4.dr, chromecache_810.4.dr	String found in binary or memory: return b}OE.F="internal.enableAutoEventOnTimer";var Vb=wa(["data-gtm-yt-inspected-"]),QE=["www.youtube.com","www.youtube-nocookie.com"],RE,SE=!1; equals www.youtube.com (Youtube)
Source: chromecache_717.4.dr, chromecache_804.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_448.4.dr, chromecache_847.4.dr, chromecache_313.4.dr, chromecache_337.4.dr	String found in binary or memory: var cE=function(a,b,c,d,e){var f=TB("fsl",c?"nv.mwt":"mwt",0),g;g=c?TB("fsl","nv.ids",[]):TB("fsl","ids",[]);if(!g.length)return!0;var k=YB(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);U(121);if(m==="https://www.facebook.com/tr/")return U(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!DA(k,FA(b, equals www.facebook.com (Facebook)
Source: chromecache_724.4.dr	String found in binary or memory: var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/3ede36f2\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: informed.deliveryerw.top
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: moversguide.usps.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ampersend.io
Source: global traffic	DNS traffic detected: DNS query: cdn.segment.com
Source: global traffic	DNS traffic detected: DNS query: api.ampersend.io
Source: global traffic	DNS traffic detected: DNS query: api.segment.io
Source: global traffic	DNS traffic detected: DNS query: store.usps.com
Source: global traffic	DNS traffic detected: DNS query: content.usps.com
Source: global traffic	DNS traffic detected: DNS query: aa.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: www.usps.com
Source: global traffic	DNS traffic detected: DNS query: h.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: h64.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: 3fym673kzk6fti5ueqzaf3c2kk7spi5ql6mgtn47ad3c443b3770d18cam1.e.aa.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: fast.fonts.net
Source: global traffic	DNS traffic detected: DNS query: dap.digitalgov.gov
Source: global traffic	DNS traffic detected: DNS query: resources.digital-cloud-gov.medallia.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: eu-aa.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: reg.usps.com
Source: global traffic	DNS traffic detected: DNS query: cns.usps.com
Source: global traffic	DNS traffic detected: DNS query: 3976941.fls.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: adservice.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 00:05:49 GMTTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vlMPeSAwqanRCQIxjZuxsRYbd0DCLvY44nM6Hkz%2BwItH03T2xMifKa6t6Fw%2FnsakdPn6KGsuXAL1d9OzOdPGnYiD4D3p8G4XaSe0l8OhEYx7SzC5Ai7qEsV9gB4Z2XcgfkjnsV9NxlRs9zU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 901123069d298c15-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1834&min_rtt=1825&rtt_var=691&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=958&delivery_rate=1600000&cwnd=238&unsent_bytes=0&cid=0051f53d540b5d19&ts=151&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 00:06:02 GMTTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hS1EYrWgK%2F0zuYdwYb4uueThOLxK%2BpbjKyi2GE0krxwNhpJ4li5Yexn1CnNcSW%2Bp3X%2B3WP2pULo6X3JtwNB3V%2FIbp7zsn%2BOn7cpJIrvwK608DEskZ0dElzZdSyVlIwaDUFirw0pw8cLnF%2Fs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 901123581fdc42e9-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1707&min_rtt=1698&rtt_var=655&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=954&delivery_rate=1647855&cwnd=240&unsent_bytes=0&cid=8ff3747066ba188e&ts=150&x=0"

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2504,i,16738957434862653999,3427656708703252019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://informed.deliveryerw.top/us/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5040 --field-trial-handle=2504,i,16738957434862653999,3427656708703252019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 --field-trial-handle=2504,i,16738957434862653999,3427656708703252019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2504,i,16738957434862653999,3427656708703252019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5040 --field-trial-handle=2504,i,16738957434862653999,3427656708703252019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 --field-trial-handle=2504,i,16738957434862653999,3427656708703252019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: chromecache_781.4.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_781.4.dr	String found in binary or memory: http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgConten
Source: chromecache_369.4.dr, chromecache_630.4.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_764.4.dr	String found in binary or memory: http://www.apple.com/legal/itunes/appstore/us/terms.html
Source: chromecache_348.4.dr, chromecache_529.4.dr, chromecache_849.4.dr	String found in binary or memory: http://www.linotype.com
Source: chromecache_348.4.dr, chromecache_529.4.dr, chromecache_849.4.dr	String found in binary or memory: http://www.linotype.com/fontdesigners
Source: chromecache_849.4.dr	String found in binary or memory: http://www.linotype.com/license
Source: chromecache_348.4.dr, chromecache_529.4.dr, chromecache_849.4.dr	String found in binary or memory: http://www.linotype.com/licensePart
Source: chromecache_348.4.dr, chromecache_529.4.dr, chromecache_849.4.dr	String found in binary or memory: http://www.linotype.comhttp://www.linotype.com/fontdesignersNOTIFICATION
Source: chromecache_875.4.dr, chromecache_321.4.dr, chromecache_465.4.dr, chromecache_545.4.dr	String found in binary or memory: https://about.usps.com
Source: chromecache_935.4.dr, chromecache_634.4.dr, chromecache_705.4.dr, chromecache_314.4.dr, chromecache_410.4.dr	String found in binary or memory: https://about.usps.com/who/legal/privacy-policy/full-privacy-policy.htm
Source: chromecache_569.4.dr	String found in binary or memory: https://ad.doubleclick.net
Source: chromecache_776.4.dr, chromecache_820.4.dr, chromecache_785.4.dr, chromecache_569.4.dr	String found in binary or memory: https://ade.googlesyndication.com
Source: chromecache_569.4.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_882.4.dr, chromecache_583.4.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_516.4.dr, chromecache_776.4.dr, chromecache_371.4.dr, chromecache_884.4.dr, chromecache_613.4.dr, chromecache_565.4.dr, chromecache_477.4.dr, chromecache_378.4.dr, chromecache_717.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_635.4.dr, chromecache_448.4.dr, chromecache_847.4.dr, chromecache_696.4.dr, chromecache_313.4.dr, chromecache_337.4.dr, chromecache_422.4.dr, chromecache_820.4.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_656.4.dr	String found in binary or memory: https://cdn.ampersend.io/26XHDMpyOV3qL7ZYed056wNv6sD.png)
Source: chromecache_332.4.dr, chromecache_318.4.dr, chromecache_703.4.dr	String found in binary or memory: https://dap.digitalgov.gov/web-vitals/dist/web-vitals.attribution.iife.js
Source: chromecache_450.4.dr, chromecache_296.4.dr	String found in binary or memory: https://developers.google.com/youtube/iframe_api_reference#Events
Source: chromecache_545.4.dr	String found in binary or memory: https://eddm.usps.com/eddm/
Source: chromecache_387.4.dr, chromecache_403.4.dr, chromecache_547.4.dr, chromecache_586.4.dr, chromecache_698.4.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_301.4.dr	String found in binary or memory: https://git.io/fjule
Source: chromecache_301.4.dr	String found in binary or memory: https://git.io/fxCyr
Source: chromecache_779.4.dr, chromecache_905.4.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_806.4.dr, chromecache_439.4.dr, chromecache_614.4.dr, chromecache_929.4.dr, chromecache_770.4.dr, chromecache_411.4.dr	String found in binary or memory: https://github.com/requirejs/requirejs/blob/master/LICENSE
Source: chromecache_387.4.dr, chromecache_403.4.dr, chromecache_547.4.dr, chromecache_586.4.dr, chromecache_698.4.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_403.4.dr, chromecache_586.4.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_569.4.dr	String found in binary or memory: https://google.com
Source: chromecache_569.4.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_545.4.dr	String found in binary or memory: https://informeddelivery.usps.com
Source: chromecache_939.4.dr	String found in binary or memory: https://informeddelivery.usps.com/box/pages/intro/start.action
Source: chromecache_705.4.dr, chromecache_410.4.dr	String found in binary or memory: https://m.usps.com/m/HoldMail
Source: chromecache_705.4.dr, chromecache_410.4.dr	String found in binary or memory: https://m.usps.com/m/POLocatorAction
Source: chromecache_705.4.dr, chromecache_410.4.dr	String found in binary or memory: https://m.usps.com/m/ScheduleAPickupAction
Source: chromecache_705.4.dr, chromecache_410.4.dr	String found in binary or memory: https://m.usps.com/m/TermsConditions
Source: chromecache_705.4.dr, chromecache_410.4.dr	String found in binary or memory: https://m.usps.com/m/ZipLookupAction
Source: chromecache_764.4.dr	String found in binary or memory: https://managemymove.usps.com
Source: chromecache_764.4.dr	String found in binary or memory: https://moversguide.usps.com/
Source: chromecache_705.4.dr, chromecache_410.4.dr	String found in binary or memory: https://moversguide.usps.com/?referral=MGOMOBILE
Source: chromecache_764.4.dr	String found in binary or memory: https://moversguide.usps.com/mgo/terms-of-use
Source: chromecache_569.4.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_516.4.dr, chromecache_776.4.dr, chromecache_371.4.dr, chromecache_884.4.dr, chromecache_613.4.dr, chromecache_565.4.dr, chromecache_477.4.dr, chromecache_378.4.dr, chromecache_717.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_635.4.dr, chromecache_448.4.dr, chromecache_847.4.dr, chromecache_696.4.dr, chromecache_313.4.dr, chromecache_337.4.dr, chromecache_422.4.dr, chromecache_820.4.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_752.4.dr	String found in binary or memory: https://postalpro.usps.com/NCOALink_Service_Providers
Source: chromecache_752.4.dr	String found in binary or memory: https://reg.usps.com/entreg/assets/html/informed-delivery.html
Source: chromecache_516.4.dr, chromecache_371.4.dr, chromecache_565.4.dr, chromecache_477.4.dr, chromecache_378.4.dr, chromecache_717.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_696.4.dr, chromecache_313.4.dr, chromecache_337.4.dr, chromecache_422.4.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_583.4.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_882.4.dr, chromecache_583.4.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_516.4.dr, chromecache_776.4.dr, chromecache_371.4.dr, chromecache_884.4.dr, chromecache_613.4.dr, chromecache_565.4.dr, chromecache_477.4.dr, chromecache_378.4.dr, chromecache_717.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_635.4.dr, chromecache_448.4.dr, chromecache_847.4.dr, chromecache_696.4.dr, chromecache_313.4.dr, chromecache_337.4.dr, chromecache_422.4.dr, chromecache_820.4.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_591.4.dr, chromecache_357.4.dr	String found in binary or memory: https://tools.usps.com/go/TrackConfirmAction?qtc_tLabels1=
Source: chromecache_705.4.dr, chromecache_410.4.dr	String found in binary or memory: https://tools.usps.com/go/ZipLookupAction_input
Source: chromecache_884.4.dr, chromecache_635.4.dr, chromecache_448.4.dr, chromecache_847.4.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_882.4.dr, chromecache_583.4.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_882.4.dr, chromecache_583.4.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_882.4.dr, chromecache_583.4.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_569.4.dr	String found in binary or memory: https://www.google.com
Source: chromecache_882.4.dr, chromecache_583.4.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_569.4.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_569.4.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_516.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_448.4.dr, chromecache_847.4.dr, chromecache_696.4.dr, chromecache_422.4.dr, chromecache_820.4.dr, chromecache_569.4.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_776.4.dr, chromecache_820.4.dr, chromecache_785.4.dr, chromecache_569.4.dr	String found in binary or memory: https://www.googletagmanager.com/dclk/ns/v1.js
Source: chromecache_882.4.dr, chromecache_332.4.dr, chromecache_583.4.dr, chromecache_318.4.dr, chromecache_703.4.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_516.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_448.4.dr, chromecache_847.4.dr, chromecache_696.4.dr, chromecache_422.4.dr, chromecache_820.4.dr, chromecache_569.4.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_516.4.dr, chromecache_371.4.dr, chromecache_565.4.dr, chromecache_477.4.dr, chromecache_378.4.dr, chromecache_717.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_696.4.dr, chromecache_313.4.dr, chromecache_337.4.dr, chromecache_422.4.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_752.4.dr, chromecache_939.4.dr	String found in binary or memory: https://www.mymove.com/moving/
Source: chromecache_705.4.dr, chromecache_764.4.dr, chromecache_410.4.dr	String found in binary or memory: https://www.usps.com/
Source: chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/blue-caret-down.svg);
Source: chromecache_480.4.dr, chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/close_x.svg);
Source: chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/info-icon.svg)
Source: chromecache_480.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/info-icon.svg);
Source: chromecache_480.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/left-arrow-inactive.png);
Source: chromecache_480.4.dr, chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/left-arrow.png);
Source: chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/nav-red-chevron.svg);
Source: chromecache_480.4.dr, chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/right-arrow-inactive.png);
Source: chromecache_480.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/right-arrow.png);
Source: chromecache_480.4.dr	String found in binary or memory: https://www.usps.com/assets/images/default/search.svg)
Source: chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/component-guide/blue-caret.svg)
Source: chromecache_480.4.dr, chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/component-guide/blue-caret.svg);
Source: chromecache_480.4.dr	String found in binary or memory: https://www.usps.com/component-guide/white-arrow.svg);
Source: chromecache_417.4.dr, chromecache_581.4.dr, chromecache_652.4.dr, chromecache_692.4.dr	String found in binary or memory: https://www.usps.com/global-elements/footer/script/jquery-3.7.1
Source: chromecache_417.4.dr, chromecache_581.4.dr, chromecache_652.4.dr, chromecache_692.4.dr	String found in binary or memory: https://www.usps.com/global-elements/header/script/
Source: chromecache_417.4.dr, chromecache_581.4.dr, chromecache_652.4.dr, chromecache_692.4.dr	String found in binary or memory: https://www.usps.com/global-elements/lib/script
Source: chromecache_417.4.dr, chromecache_581.4.dr, chromecache_652.4.dr, chromecache_692.4.dr	String found in binary or memory: https://www.usps.com/global-elements/lib/script/helpers
Source: chromecache_417.4.dr, chromecache_581.4.dr, chromecache_652.4.dr, chromecache_692.4.dr	String found in binary or memory: https://www.usps.com/global-elements/lib/script/require-jquery
Source: chromecache_545.4.dr	String found in binary or memory: https://www.usps.com/manage/informed-delivery.htm
Source: chromecache_764.4.dr	String found in binary or memory: https://www.usps.com/mobile/info.htm
Source: chromecache_752.4.dr	String found in binary or memory: https://www.usps.com/privacypolicy
Source: chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/store/images/Alert-Icon.png)
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/br_down.png
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/br_down.png)
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/close_x.svg
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/close_x.svg);
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/dropdown_carat_blue.svg
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/info-icon.png
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/new-icon.png
Source: chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/store/images/new-icon.png)
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/ps-breadcrumb-doublearrow.png
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/ps-carticon-hover.png
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/ps-carticon.png
Source: chromecache_480.4.dr	String found in binary or memory: https://www.usps.com/store/images/ps-carticon.png)
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/ps-minus.png);
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/ps-plus.png);
Source: chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/store/images/ps-search.png)
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/ps-star.png
Source: chromecache_668.4.dr	String found in binary or memory: https://www.usps.com/store/images/ps-subicon-navline.png)
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/red-x.png);
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/search-submit-white.png
Source: chromecache_674.4.dr	String found in binary or memory: https://www.usps.com/store/images/search-submit-white.png);
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/text-link-carat-red.svg);
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/usps_l_nav_red_arrow.svg
Source: chromecache_587.4.dr	String found in binary or memory: https://www.usps.com/store/images/zoom.png
Source: chromecache_296.4.dr, chromecache_354.4.dr, chromecache_724.4.dr	String found in binary or memory: https://www.youtube.com
Source: chromecache_516.4.dr, chromecache_332.4.dr, chromecache_717.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_696.4.dr, chromecache_313.4.dr, chromecache_337.4.dr, chromecache_422.4.dr, chromecache_318.4.dr, chromecache_703.4.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source	Detection	Scanner	Label
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_3LB&sid=0a7XwKvBpzzpiUs0AkjP	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-r-P&sid=EEd-NZZj7hSQvnyvAkiC	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/e65c6b17TeKnX.svg	100%	Avira URL Cloud	phishing
https://3fym673kzk6fti5ueqzaf3c2kk7spi5ql6mgtn47ad3c443b3770d18cam1.e.aa.online-metrix.net/eSbP4Lkdynkps-z0?3ba7e129a7d94a3a=_emslifjBo8pkKvXLwu8GGF4MnrVyclJXx8_M4YqaF6f1hYyY9yuPjI60sDY24Z1oqNGGA8On9-_vDx6SlEY32zKGabDJAsd6Obmvhihbd8ucadzwsowNeWmA5L83VR732BM9OVXiYFTIfegnYr3su4dYwpCtPgFSCul	0%	Avira URL Cloud	safe
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=websocket&sid=TNdFX77nKc4pUD33Akh-	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/e394ed97TeKnX.svg	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_5VS&sid=KWLpRq4tjuCSbqFTAkjX	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qCV&sid=TNdFX77nKc4pUD33Akh-	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-xKY&sid=g8ztw0ZOn7AWRVUeAkii	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-_Hx&sid=J6E_8lNEMeLQIf2XAkiq	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/8cf6cd52TeKnX.svg	100%	Avira URL Cloud	phishing
https://eddm.usps.com/eddm/	0%	Avira URL Cloud	safe
https://informed.deliveryerw.top/us/layout/images/49.png	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/ffd7af61TeKnX.woff	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-p-2&sid=TNdFX77nKc4pUD33Akh-	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/favicon.ico	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/layout/images/5.svg	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-sI0&sid=EEd-NZZj7hSQvnyvAkiC	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_2md&sid=0a7XwKvBpzzpiUs0AkjP	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qdU&sid=TNdFX77nKc4pUD33Akh-	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_4NG&sid=0a7XwKvBpzzpiUs0AkjP	100%	Avira URL Cloud	phishing
http://www.linotype.com/fontdesigners	0%	Avira URL Cloud	safe
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=websocket&sid=jqBmDq5RmIsfPBvgAkil	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-zk5&sid=jqBmDq5RmIsfPBvgAkil	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/f4397cedTeKnX.css	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-rqP&sid=EEd-NZZj7hSQvnyvAkiC	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/9b0c1debTeKnX.svg	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/4cd1ec68TeKnX.css	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-nn3&sid=Qr-EBVSRccC3wUxlAkh1	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=websocket&sid=KWLpRq4tjuCSbqFTAkjX	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/layout/images/11.svg	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/layout/images/46.svg	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS--3O&sid=jqBmDq5RmIsfPBvgAkil	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/3213f1cfKXMp5.js	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/api/MC4yMDM5MTgxNjY2MDIyNjk1OA==	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/layout/images/8.svg	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_5AH	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/layout/images/62.png	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/f6170fbbTeKnX.css	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/62ff200fKXMp5.js	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-x3w&sid=g8ztw0ZOn7AWRVUeAkii	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/c27b6911KXMp5.js	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qnC&sid=TNdFX77nKc4pUD33Akh-	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/layout/images/22.svg	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-xup&sid=g8ztw0ZOn7AWRVUeAkii	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_1bn&sid=4MZLrLH8W_kCdVtKAkiw	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_3dF&sid=0a7XwKvBpzzpiUs0AkjP	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_1np&sid=4MZLrLH8W_kCdVtKAkiw	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_0Nr&sid=4MZLrLH8W_kCdVtKAkiw	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qCX&sid=TNdFX77nKc4pUD33Akh-	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/f2e2ef63TeKnX.woff	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-t8j&sid=Ldup2XbUdHXkpLR3AkiL	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_5gS&sid=KWLpRq4tjuCSbqFTAkjX	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/us/assets/667bf194TeKnX.css	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/api/MC43MjEyMjEwODQzMDM4OTE4	100%	Avira URL Cloud	phishing
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-s8F&sid=EEd-NZZj7hSQvnyvAkiC	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Reputation
dart.l.doubleclick.net	142.250.185.166	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
h-usps.online-metrix.net	91.235.133.188	true	false	high
ad.doubleclick.net	142.250.185.134	true	false	high
informed.deliveryerw.top	104.21.48.1	true	true	unknown
d27f3qgc9anoq2.cloudfront.net	13.32.27.50	true	false	unknown
adservice.google.com	142.250.186.34	true	false	high
eu-aa.online-metrix.net	91.235.132.129	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
dbixd6p3vn7bv.cloudfront.net	13.35.58.47	true	false	unknown
amp-v3-public-api-production-1079934655.us-east-1.elb.amazonaws.com	98.80.39.185	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
d296je7bbdd650.cloudfront.net	99.86.8.175	true	false	high
3fym673kzk6fti5ueqzaf3c2kk7spi5ql6mgtn47ad3c443b3770d18cam1.e.aa.online-metrix.net	91.235.134.131	true	false	unknown
youtube-ui.l.google.com	216.58.206.78	true	false	high
fast.fonts.net	104.16.41.28	true	false	high
www.google.com	142.250.185.100	true	false	high
api.segment.io	35.166.226.67	true	false	high
h64.online-metrix.net	192.225.158.1	true	false	high
td.doubleclick.net	142.250.184.194	true	false	high
h.online-metrix.net	91.235.132.130	true	false	high
aa.online-metrix.net	91.235.132.129	true	false	high
reg.usps.com	unknown	unknown	false	high
dap.digitalgov.gov	unknown	unknown	false	high
content.usps.com	unknown	unknown	false	high
api.ampersend.io	unknown	unknown	false	high
cdn.segment.com	unknown	unknown	false	high
cdn.ampersend.io	unknown	unknown	false	high
www.usps.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
cns.usps.com	unknown	unknown	false	high
3976941.fls.doubleclick.net	unknown	unknown	false	high
resources.digital-cloud-gov.medallia.com	unknown	unknown	false	high
store.usps.com	unknown	unknown	false	high
moversguide.usps.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://informed.deliveryerw.top/us/assets/e394ed97TeKnX.svg	true	Avira URL Cloud: phishing	unknown
https://3fym673kzk6fti5ueqzaf3c2kk7spi5ql6mgtn47ad3c443b3770d18cam1.e.aa.online-metrix.net/eSbP4Lkdynkps-z0?3ba7e129a7d94a3a=_emslifjBo8pkKvXLwu8GGF4MnrVyclJXx8_M4YqaF6f1hYyY9yuPjI60sDY24Z1oqNGGA8On9-_vDx6SlEY32zKGabDJAsd6Obmvhihbd8ucadzwsowNeWmA5L83VR732BM9OVXiYFTIfegnYr3su4dYwpCtPgFSCul	false	Avira URL Cloud: safe	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-_Hx&sid=J6E_8lNEMeLQIf2XAkiq	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_3LB&sid=0a7XwKvBpzzpiUs0AkjP	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/assets/e65c6b17TeKnX.svg	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=websocket&sid=TNdFX77nKc4pUD33Akh-	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-xKY&sid=g8ztw0ZOn7AWRVUeAkii	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qCV&sid=TNdFX77nKc4pUD33Akh-	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_5VS&sid=KWLpRq4tjuCSbqFTAkjX	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-r-P&sid=EEd-NZZj7hSQvnyvAkiC	true	Avira URL Cloud: phishing	unknown
https://cdn.segment.com/v1/projects/UqpcmQEi1Z4oO1btpi5fjHrxJ7AIwGOu/settings	false		high
https://reg.usps.com/entreg/LoginAction_input?app=ATG&appURL=https%3A%2F%2Fstore.usps.com%2Fstore%2Fmyaccount%2FmyWishList.jsp%3Fselpage%3DWISHLIST	false		high
https://informed.deliveryerw.top/us/assets/8cf6cd52TeKnX.svg	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/layout/images/49.png	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/favicon.ico	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-p-2&sid=TNdFX77nKc4pUD33Akh-	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/layout/images/5.svg	true	Avira URL Cloud: phishing	unknown
https://h.online-metrix.net/doCGRjAEvQ8cdRJp?8bffedb298d4492f=kCrK3L_SDhTwkJ3phQMRmWPtSOa6MwvkF4nSmKw1nFro5pkB8TAoiCjGucFv8VAp_gWcLdoia6lzVhTpEEskLDXyZwNdLnRc43nLRPH_FOHGXUoJ4yj95H-DsuXN4dusbI3ZSoCZvH4dkSsSYZrJ_yRICB4&k=2	false		high
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_2md&sid=0a7XwKvBpzzpiUs0AkjP	true	Avira URL Cloud: phishing	unknown
https://h.online-metrix.net/CvFQYEsMvqX2VYPv?b0c3deba6ccc4386=6PaKxZCWQacSwu6dw9c3DTlmo0zNngn9EdVlCyiex9PPvtffaOqBVfsuzELoBT2qmMOSJ3q7K4gtccwlOfzYM84PnpR5OyITsec3Rr2jTqvYDauGQSm5PIukMdWnGIYQLHfHIVWZfulslQ8ZXEWB5FcjHlFxMIPKX9eMcAr-kEXxyOqGkTVt39G9whFgU5qblwmk9Jiri5cMUcSH6zE&jf=36313624716b66577a6c643f746c725f42653035474c6a306644756652387132267369665d646176673f333f3b343730363f38332e71616657767b78673d756760326763647361247169645d69677b353b32353b33383133383438353a633a3e36386167316c323230313034323832633a3436306b673366303b3031383538313c3032383234303a603a376666646467303265323332663e3860653a333e34623c3530373d353b6b376263353b3a32653261333b356334326164613e39366266383f3531383531633867666c37316131353d3434623438636364623b3560646c39303331363837616b633e3369343239376537346430343031646534643234346660303c38642671696c5f73616535313836373830323332326b646433366663336462346330633d6b646166643a313030336a313e63376a323666343a383b3138323432353636613032676e693a336663303362393539603132303a32306067673f3764323664323a3464613563336d6c37663b613b37336b346e356936356c64303461676c313733613232343461306635356b69673731653d643330247b6b6e703f39	false		high
https://informed.deliveryerw.top/us/assets/ffd7af61TeKnX.woff	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-sI0&sid=EEd-NZZj7hSQvnyvAkiC	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qdU&sid=TNdFX77nKc4pUD33Akh-	true	Avira URL Cloud: phishing	unknown
https://content.usps.com/9G6RidPor9HQ69CN?19ddc8a8dfece31f=5I8k32tIKQqrVKrx-vxEsAKSgBJDTd0DJS9LRUoxu8crsgVcj--kQgC1WqgE_M4CNTwWkiQEMHacnWKLK48jWt5HdC_hNYHAtgzzTgBdLmNU_oJBK6FyhiDPyWqrnUqWt8oGofOWIWyCIAWD-ALBNEiUpe4&jac=1&je=33323237242460697c71743f253f42253a3064677e676e2d3032273143392c3030253241273232717663767d7b273230253b41253a306b6a697065616c672730302d3544266175666a3d63676460636d3c353834373f66303a646a606c3b353b343135343b3a666264396334363530606437343c3934363b656a6566393731376960353c37613033333f246578333d30606264616431353e6c633636323d353030313f603a3a343a6639353b363c36616262356767343324677a36356b353835343a323869636e3b3a35363863336064376d32396265663435666332246871673555696c646777732d303833382477696a3d2735402d30326172636a6b7465617677706d2d303227334925323a7a30342d30302d30432730306a6b746e657371273232273143273a3a343427323a25324b273a306a70636666732730302d314125354227354225303060706966662530322d33412d303a45676d6564672530324160706f6d652530302532412730307e6d70736b6f6625323a273b432d30303933372730302d354425324327354225303060706966662530322d33412d303a4c6776273b40412731464a70616e642530302532412730307e6d70736b6f6625323a273b432d30303027323027354c2732432537402732326070636c6c2d303227334925323a416070676f6b7d6f253030273a4125323276677073696d6c27303a2d314127323a31313f273a302d35462d37442730412d303266756c6e546572716b6d6c4461717427323a253349273d402d35402d30326070636666253232253143253230456d6d6f64672530304b6872676f6d273a30273a41253030746d7073696f6e27303225314327303a3933372c302635393b3a26333b36273a30253546273a412537422530306272636c66273a3a273343253a324e67762d314a43273b464270636c6c2732322532412732327467707161676c2530322d33412d303a3a26322c382c302730302d354425324327354225303060706966662530322d33412d303a4160706d656b756f27303a273243253230746572716b6d6c2d3a302531412d323239333f2c382c373131382c33313c273232253746273544273041273a3a6f6f60696465253a302d314964636471652730412d30326d6f64676e2532302731432d3a302530322d32432d303a726463766e6d726f27303a27334125323055696e666d75712d3a302530432d3232786e69766e6d7065546570716b676c25323225314325323033322c3826322530322d32432d303a756775343c27323027314964616c73652735442677636e3f2d3f402530326a726166667b273a30273b43253740273f402532326270636e64273030273b4927323047676f6764672d3038416a7a6d6d6727303a273243253230746572716b6d6c2d3a302531412d323239333f273a30273f46253041273f402532326270636e64273030273b492732304e6774253b4049273b46407a636e6627303a273243253230746572716b6d6c2d3a302531412d323230273a302d35462d30432735402d30326272616c662532302731432d3a30436a72676d697d6f2d303a27304b27323074677a71696f6e2530302533432730303939352530322d37442d374c273a41273a306d6d606b646725323225314366616e7167273a4b273230706461746e6d7a6f2d30302d31412730305f6b6e646f7771273232273546	false		high
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_4NG&sid=0a7XwKvBpzzpiUs0AkjP	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/assets/f4397cedTeKnX.css	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-nn3&sid=Qr-EBVSRccC3wUxlAkh1	true	Avira URL Cloud: phishing	unknown
https://content.usps.com/jr672uzob7gtk5pc.js?mi472zpb6ocix8f9=3fym673k&d5tljl3yrhzrbopi=255fbbc9-752d-408b-b877-f52328610de3	false		high
https://informed.deliveryerw.top/us/assets/9b0c1debTeKnX.svg	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/assets/4cd1ec68TeKnX.css	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-zk5&sid=jqBmDq5RmIsfPBvgAkil	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=websocket&sid=jqBmDq5RmIsfPBvgAkil	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-rqP&sid=EEd-NZZj7hSQvnyvAkiC	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=websocket&sid=KWLpRq4tjuCSbqFTAkjX	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/layout/images/11.svg	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/layout/images/46.svg	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/layout/images/8.svg	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS--3O&sid=jqBmDq5RmIsfPBvgAkil	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_5AH	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/assets/3213f1cfKXMp5.js	true	Avira URL Cloud: phishing	unknown
https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	false		high
https://informed.deliveryerw.top/api/MC4yMDM5MTgxNjY2MDIyNjk1OA==	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/layout/images/62.png	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/assets/f6170fbbTeKnX.css	true	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=2Asio%2BxnQ6mbhQAkp4VslRM6yQOYkz35IlpQpjdGvABHWngAfwcMwiIApV5y4CN64JvnkXIYtXIPzbBKHjeCOOKPD%2FuRV%2BU3dWS%2BodbcBns7IwZxtnvmRosD1NQ2FaRX2CyEDaUmD9QayUg%3D	false		high
https://informed.deliveryerw.top/us/assets/62ff200fKXMp5.js	true	Avira URL Cloud: phishing	unknown
https://h.online-metrix.net/doCGRjAEvQ8cdRJp?893065c02e3351aa=kCrK3L_SDhTwkJ3phQMRmWPtSOa6MwvkF4nSmKw1nFro5pkB8TAoiCjGucFv8VAp_gWcLdoia6lzVhTpEEskLDXyZwNdLnRc43nLRPH_FOHGXUoJ4yj95H-DsuXN4dusbI3ZSgAELZ5g1EihgOct0hTkY8PQv1TEZpvkMOghfVUyrb8	false		high
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-x3w&sid=g8ztw0ZOn7AWRVUeAkii	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/assets/c27b6911KXMp5.js	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/layout/images/22.svg	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qnC&sid=TNdFX77nKc4pUD33Akh-	true	Avira URL Cloud: phishing	unknown
https://content.usps.com/2oWuCXGnOlB3H41V?79a19a5051dac18e=2npKyfzJSTIbjksDuMAP4JjlpXWiy0yDJbMYWl807I6XJMNXmTYAevnRKbm5gpHelWHXURC_RMkCcpufv8M7eTL2a8Beindbiglz739fvys7bq8LxJdQme2RJLnf17OwiUvMXDrfd99DM5loxargk52S8ik&jf=3136266e71603f396a373934373f633339306a36393435313063353b613a316263666160613133	false		high
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_1bn&sid=4MZLrLH8W_kCdVtKAkiw	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-xup&sid=g8ztw0ZOn7AWRVUeAkii	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_0Nr&sid=4MZLrLH8W_kCdVtKAkiw	true	Avira URL Cloud: phishing	unknown
https://cdn.ampersend.io/27qfd0nbCKt1nXcM5PFYh4mDyl3.svg	false		high
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_1np&sid=4MZLrLH8W_kCdVtKAkiw	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_3dF&sid=0a7XwKvBpzzpiUs0AkjP	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/assets/f2e2ef63TeKnX.woff	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-qCX&sid=TNdFX77nKc4pUD33Akh-	true	Avira URL Cloud: phishing	unknown
https://content.usps.com/7evYXKC79LNOVx-p?4a52b33ae7bbff1a=UHivVvpEasf9pvaIGApks2612AuU47L4SsPrEukGyve8ICkDOV1zliEqDutlU62xYABF7WHUvBBRmQsWI834sZ_J-gdqfU56iCyrDTjfiXWboPqGrWE5WzzVfhPPnexaiNeGAJJP0Zewj9C3NbhpGA	false		high
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-t8j&sid=Ldup2XbUdHXkpLR3AkiL	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS_5gS&sid=KWLpRq4tjuCSbqFTAkjX	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/us/assets/667bf194TeKnX.css	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/api/MC43MjEyMjEwODQzMDM4OTE4	true	Avira URL Cloud: phishing	unknown
https://informed.deliveryerw.top/socket.io/?EIO=4&transport=polling&t=PHS-s8F&sid=EEd-NZZj7hSQvnyvAkiC	true	Avira URL Cloud: phishing	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_516.4.dr, chromecache_371.4.dr, chromecache_565.4.dr, chromecache_477.4.dr, chromecache_378.4.dr, chromecache_717.4.dr, chromecache_804.4.dr, chromecache_420.4.dr, chromecache_648.4.dr, chromecache_457.4.dr, chromecache_696.4.dr, chromecache_313.4.dr, chromecache_337.4.dr, chromecache_422.4.dr	false		high
https://www.usps.com/assets/images/default/right-arrow-inactive.png);	chromecache_480.4.dr, chromecache_674.4.dr	false		high
https://about.usps.com/who/legal/privacy-policy/full-privacy-policy.htm	chromecache_935.4.dr, chromecache_634.4.dr, chromecache_705.4.dr, chromecache_314.4.dr, chromecache_410.4.dr	false		high
https://www.usps.com/store/images/ps-plus.png);	chromecache_587.4.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_882.4.dr, chromecache_583.4.dr	false		high
https://www.youtube.com	chromecache_296.4.dr, chromecache_354.4.dr, chromecache_724.4.dr	false		high
https://www.usps.com/store/images/ps-star.png	chromecache_587.4.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_403.4.dr, chromecache_586.4.dr	false		high
https://eddm.usps.com/eddm/	chromecache_545.4.dr	false	Avira URL Cloud: safe	unknown
https://www.usps.com/component-guide/white-arrow.svg);	chromecache_480.4.dr	false		high
https://stats.g.doubleclick.net/j/collect	chromecache_583.4.dr	false		high
https://www.usps.com/store/images/info-icon.png	chromecache_587.4.dr	false		high
https://www.usps.com/global-elements/header/script/	chromecache_417.4.dr, chromecache_581.4.dr, chromecache_652.4.dr, chromecache_692.4.dr	false		high
https://managemymove.usps.com	chromecache_764.4.dr	false		high
https://informeddelivery.usps.com/box/pages/intro/start.action	chromecache_939.4.dr	false		high
https://moversguide.usps.com/?referral=MGOMOBILE	chromecache_705.4.dr, chromecache_410.4.dr	false		high
http://www.linotype.com/fontdesigners	chromecache_348.4.dr, chromecache_529.4.dr, chromecache_849.4.dr	false	Avira URL Cloud: safe	unknown
https://git.io/fjule	chromecache_301.4.dr	false		high
https://www.usps.com/store/images/ps-carticon.png	chromecache_587.4.dr	false		high
https://www.usps.com/store/images/br_down.png	chromecache_587.4.dr	false		high
https://www.usps.com/store/images/usps_l_nav_red_arrow.svg	chromecache_587.4.dr	false		high
https://www.usps.com/privacypolicy	chromecache_752.4.dr	false		high
https://www.usps.com/store/images/new-icon.png)	chromecache_674.4.dr	false		high
https://www.usps.com/assets/images/default/close_x.svg);	chromecache_480.4.dr, chromecache_674.4.dr	false		high
https://www.usps.com/store/images/Alert-Icon.png)	chromecache_674.4.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_387.4.dr, chromecache_403.4.dr, chromecache_547.4.dr, chromecache_586.4.dr, chromecache_698.4.dr	false		high
https://www.usps.com/component-guide/blue-caret.svg)	chromecache_674.4.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_779.4.dr, chromecache_905.4.dr	false		high
https://www.usps.com/store/images/close_x.svg);	chromecache_587.4.dr	false		high
https://www.usps.com/	chromecache_705.4.dr, chromecache_764.4.dr, chromecache_410.4.dr	false		high
https://github.com/requirejs/requirejs/blob/master/LICENSE	chromecache_806.4.dr, chromecache_439.4.dr, chromecache_614.4.dr, chromecache_929.4.dr, chromecache_770.4.dr, chromecache_411.4.dr	false		high
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_450.4.dr, chromecache_296.4.dr	false		high
https://tools.usps.com/go/TrackConfirmAction?qtc_tLabels1=	chromecache_591.4.dr, chromecache_357.4.dr	false		high
https://informeddelivery.usps.com	chromecache_545.4.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	informed.deliveryerw.top	United States	13335	CLOUDFLARENETUS	true
13.32.27.50	d27f3qgc9anoq2.cloudfront.net	United States	7018	ATT-INTERNET4US	false
216.58.206.78	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.102	unknown	United States	15169	GOOGLEUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.166	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
216.58.206.36	unknown	United States	15169	GOOGLEUS	false
104.16.41.28	fast.fonts.net	United States	13335	CLOUDFLARENETUS	false
13.35.58.47	dbixd6p3vn7bv.cloudfront.net	United States	16509	AMAZON-02US	false
91.235.132.129	eu-aa.online-metrix.net	Netherlands	30286	THMUS	false
91.235.134.131	3fym673kzk6fti5ueqzaf3c2kk7spi5ql6mgtn47ad3c443b3770d18cam1.e.aa.online-metrix.net	Netherlands	30286	THMUS	false
142.250.184.226	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
13.35.58.83	unknown	United States	16509	AMAZON-02US	false
98.80.39.185	amp-v3-public-api-production-1079934655.us-east-1.elb.amazonaws.com	United States	11351	TWC-11351-NORTHEASTUS	false
13.32.27.113	unknown	United States	7018	ATT-INTERNET4US	false
142.250.186.34	adservice.google.com	United States	15169	GOOGLEUS	false
35.166.226.67	api.segment.io	United States	16509	AMAZON-02US	false
142.250.184.194	td.doubleclick.net	United States	15169	GOOGLEUS	false
91.235.133.188	h-usps.online-metrix.net	Netherlands	30286	THMUS	false
142.250.185.134	ad.doubleclick.net	United States	15169	GOOGLEUS	false
54.69.251.6	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.225.158.1	h64.online-metrix.net	United States	30286	THMUS	false
99.86.8.175	d296je7bbdd650.cloudfront.net	United States	16509	AMAZON-02US	false
91.235.132.130	h.online-metrix.net	Netherlands	30286	THMUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589680
Start date and time:	2025-01-13 01:04:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://informed.deliveryerw.top/us/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@31/991@106/29
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://moversguide.usps.com/?referral=MG80 Browse: https://store.usps.com/store/results/free-shipping-supplies/shipping-supplies/_/N-alnx4jZ7d0v8v Browse: https://cns.usps.com/ Browse: https://store.usps.com/store/results/business/_/N-1y2576k

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 227 x 170, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8026
Entropy (8bit):	7.908922983825871
Encrypted:	false
SSDEEP:	192:r0IjWvjdbeMsSpaYukMMX7wsjXqaD0Act/nt1BXINooBmd3:JjWvBTsS47kMMNjXxW/WBmF
MD5:	49754396635190A6532DD376ACC76EE1
SHA1:	526DF243E2ADBF5719B082C5E04190ED40209CCD
SHA-256:	0962CC2915393132882747BF55B069572324019764AF92EC02D5D0249BFDFF99
SHA-512:	11EC8C42F385C16F32230BE791A79562DA7E154D1F624920093EEF345693D574BC8DEDF2024F4633B0D8D24FDCF187E1E6191024FF8D546C1EC93B7105FF5A08
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR............._.......tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6fd77a10-676f-44f6-a353-407f8f859d5b" xmpMM:DocumentID="xmp.did:07828012246811E8B1A59F4166EA9B6B" xmpMM:InstanceID="xmp.iid:07828011246811E8B1A59F4166EA9B6B" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f425a6e4-329c-4799-8d88-af7935edefe3" stRef:documentID="adobe:docid:photoshop:cdee8da3-ed4a-0846-96ea-aad89bc53531"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>].qu...oIDATx..]..c.u.M.(

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 01:05:41.284354925 CET	192.168.2.6	1.1.1.1	0xbbf2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:05:41.284581900 CET	192.168.2.6	1.1.1.1	0xdc90	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 13, 2025 01:05:43.338269949 CET	192.168.2.6	1.1.1.1	0xcd97	Standard query (0)	informed.deliveryerw.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:05:43.338500977 CET	192.168.2.6	1.1.1.1	0x2e69	Standard query (0)	informed.deliveryerw.top	65	IN (0x0001)	false
Jan 13, 2025 01:05:45.545340061 CET	192.168.2.6	1.1.1.1	0xda56	Standard query (0)	informed.deliveryerw.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:05:45.545581102 CET	192.168.2.6	1.1.1.1	0x2284	Standard query (0)	informed.deliveryerw.top	65	IN (0x0001)	false
Jan 13, 2025 01:05:49.547460079 CET	192.168.2.6	1.1.1.1	0x8c67	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:05:49.547645092 CET	192.168.2.6	1.1.1.1	0xf41b	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:03.774516106 CET	192.168.2.6	1.1.1.1	0x60cc	Standard query (0)	moversguide.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:03.774820089 CET	192.168.2.6	1.1.1.1	0x247c	Standard query (0)	moversguide.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:06.546649933 CET	192.168.2.6	1.1.1.1	0x7ac9	Standard query (0)	cdn.ampersend.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:06.546786070 CET	192.168.2.6	1.1.1.1	0xf7aa	Standard query (0)	cdn.ampersend.io	65	IN (0x0001)	false
Jan 13, 2025 01:06:08.059190035 CET	192.168.2.6	1.1.1.1	0xf0e0	Standard query (0)	cdn.ampersend.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:08.059384108 CET	192.168.2.6	1.1.1.1	0xd610	Standard query (0)	cdn.ampersend.io	65	IN (0x0001)	false
Jan 13, 2025 01:06:08.060726881 CET	192.168.2.6	1.1.1.1	0xeac0	Standard query (0)	moversguide.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:08.060857058 CET	192.168.2.6	1.1.1.1	0xf29f	Standard query (0)	moversguide.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:08.135268927 CET	192.168.2.6	1.1.1.1	0x506b	Standard query (0)	cdn.segment.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:08.135478020 CET	192.168.2.6	1.1.1.1	0xcd10	Standard query (0)	cdn.segment.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:09.249939919 CET	192.168.2.6	1.1.1.1	0xaf1	Standard query (0)	cdn.segment.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:09.250246048 CET	192.168.2.6	1.1.1.1	0xe86c	Standard query (0)	cdn.segment.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:12.893255949 CET	192.168.2.6	1.1.1.1	0x31b5	Standard query (0)	api.ampersend.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:12.893642902 CET	192.168.2.6	1.1.1.1	0x4988	Standard query (0)	api.ampersend.io	65	IN (0x0001)	false
Jan 13, 2025 01:06:14.385023117 CET	192.168.2.6	1.1.1.1	0xe293	Standard query (0)	api.segment.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:14.385023117 CET	192.168.2.6	1.1.1.1	0xa2f4	Standard query (0)	api.segment.io	65	IN (0x0001)	false
Jan 13, 2025 01:06:15.495676041 CET	192.168.2.6	1.1.1.1	0xfd5d	Standard query (0)	api.segment.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:15.495887041 CET	192.168.2.6	1.1.1.1	0x8c1e	Standard query (0)	api.segment.io	65	IN (0x0001)	false
Jan 13, 2025 01:06:15.812100887 CET	192.168.2.6	1.1.1.1	0xb4fd	Standard query (0)	api.ampersend.io	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:15.812222004 CET	192.168.2.6	1.1.1.1	0x88c6	Standard query (0)	api.ampersend.io	65	IN (0x0001)	false
Jan 13, 2025 01:06:15.830697060 CET	192.168.2.6	1.1.1.1	0xd1bd	Standard query (0)	store.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:15.831053972 CET	192.168.2.6	1.1.1.1	0x3bd0	Standard query (0)	store.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:16.512689114 CET	192.168.2.6	1.1.1.1	0x8cb8	Standard query (0)	content.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:16.512814045 CET	192.168.2.6	1.1.1.1	0xa538	Standard query (0)	content.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:16.588581085 CET	192.168.2.6	1.1.1.1	0x5b67	Standard query (0)	aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:16.589046001 CET	192.168.2.6	1.1.1.1	0x115	Standard query (0)	aa.online-metrix.net	28	IN (0x0001)	false
Jan 13, 2025 01:06:16.596919060 CET	192.168.2.6	1.1.1.1	0x5b41	Standard query (0)	aa.online-metrix.net	28	IN (0x0001)	false
Jan 13, 2025 01:06:16.644387007 CET	192.168.2.6	1.1.1.1	0x2742	Standard query (0)	aa.online-metrix.net	28	IN (0x0001)	false
Jan 13, 2025 01:06:16.645530939 CET	192.168.2.6	1.1.1.1	0x1afe	Standard query (0)	aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:17.374576092 CET	192.168.2.6	1.1.1.1	0xe076	Standard query (0)	www.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:17.374706984 CET	192.168.2.6	1.1.1.1	0x86a2	Standard query (0)	www.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:17.819011927 CET	192.168.2.6	1.1.1.1	0x95c8	Standard query (0)	content.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:17.821491003 CET	192.168.2.6	1.1.1.1	0x6bcb	Standard query (0)	content.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:18.709475040 CET	192.168.2.6	1.1.1.1	0xce6e	Standard query (0)	www.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:18.709728956 CET	192.168.2.6	1.1.1.1	0x4d1b	Standard query (0)	www.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:18.756413937 CET	192.168.2.6	1.1.1.1	0xcf47	Standard query (0)	store.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:18.756901026 CET	192.168.2.6	1.1.1.1	0xd205	Standard query (0)	store.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:18.848898888 CET	192.168.2.6	1.1.1.1	0x699a	Standard query (0)	content.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:20.154395103 CET	192.168.2.6	1.1.1.1	0x53c3	Standard query (0)	h.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:20.154778004 CET	192.168.2.6	1.1.1.1	0x742a	Standard query (0)	h.online-metrix.net	65	IN (0x0001)	false
Jan 13, 2025 01:06:20.156866074 CET	192.168.2.6	1.1.1.1	0xaea1	Standard query (0)	h64.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:20.158961058 CET	192.168.2.6	1.1.1.1	0x2c43	Standard query (0)	h64.online-metrix.net	65	IN (0x0001)	false
Jan 13, 2025 01:06:20.161319017 CET	192.168.2.6	1.1.1.1	0xa28d	Standard query (0)	3fym673kzk6fti5ueqzaf3c2kk7spi5ql6mgtn47ad3c443b3770d18cam1.e.aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:20.161319017 CET	192.168.2.6	1.1.1.1	0x621f	Standard query (0)	3fym673kzk6fti5ueqzaf3c2kk7spi5ql6mgtn47ad3c443b3770d18cam1.e.aa.online-metrix.net	65	IN (0x0001)	false
Jan 13, 2025 01:06:20.162472963 CET	192.168.2.6	1.1.1.1	0x277b	Standard query (0)	h.online-metrix.net	65	IN (0x0001)	false
Jan 13, 2025 01:06:20.162472963 CET	192.168.2.6	1.1.1.1	0x7544	Standard query (0)	h.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:20.167831898 CET	192.168.2.6	1.1.1.1	0x9441	Standard query (0)	fast.fonts.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:20.169313908 CET	192.168.2.6	1.1.1.1	0x1fba	Standard query (0)	fast.fonts.net	65	IN (0x0001)	false
Jan 13, 2025 01:06:22.281354904 CET	192.168.2.6	1.1.1.1	0x8017	Standard query (0)	dap.digitalgov.gov	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:22.283483982 CET	192.168.2.6	1.1.1.1	0x5c31	Standard query (0)	dap.digitalgov.gov	65	IN (0x0001)	false
Jan 13, 2025 01:06:22.304393053 CET	192.168.2.6	1.1.1.1	0xc3f4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:22.304574966 CET	192.168.2.6	1.1.1.1	0x8eb8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:22.360354900 CET	192.168.2.6	1.1.1.1	0x41a2	Standard query (0)	resources.digital-cloud-gov.medallia.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:22.360615015 CET	192.168.2.6	1.1.1.1	0x442d	Standard query (0)	resources.digital-cloud-gov.medallia.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:24.985151052 CET	192.168.2.6	1.1.1.1	0x153b	Standard query (0)	fast.fonts.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:24.985611916 CET	192.168.2.6	1.1.1.1	0xd335	Standard query (0)	fast.fonts.net	65	IN (0x0001)	false
Jan 13, 2025 01:06:24.995491982 CET	192.168.2.6	1.1.1.1	0xe8b1	Standard query (0)	h64.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:24.995630026 CET	192.168.2.6	1.1.1.1	0x2317	Standard query (0)	h64.online-metrix.net	65	IN (0x0001)	false
Jan 13, 2025 01:06:24.996336937 CET	192.168.2.6	1.1.1.1	0x83f1	Standard query (0)	3fym673kzk6fti5ueqzaf3c2kk7spi5ql6mgtn47ad3c443b3770d18cam1.e.aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:24.996480942 CET	192.168.2.6	1.1.1.1	0x6404	Standard query (0)	3fym673kzk6fti5ueqzaf3c2kk7spi5ql6mgtn47ad3c443b3770d18cam1.e.aa.online-metrix.net	65	IN (0x0001)	false
Jan 13, 2025 01:06:25.003688097 CET	192.168.2.6	1.1.1.1	0xfe9d	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:25.004025936 CET	192.168.2.6	1.1.1.1	0x80f7	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:25.579633951 CET	192.168.2.6	1.1.1.1	0x5966	Standard query (0)	eu-aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:25.580326080 CET	192.168.2.6	1.1.1.1	0xcca8	Standard query (0)	eu-aa.online-metrix.net	28	IN (0x0001)	false
Jan 13, 2025 01:06:25.589135885 CET	192.168.2.6	1.1.1.1	0xdae7	Standard query (0)	dap.digitalgov.gov	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:25.589287043 CET	192.168.2.6	1.1.1.1	0xaa8	Standard query (0)	dap.digitalgov.gov	65	IN (0x0001)	false
Jan 13, 2025 01:06:25.589915037 CET	192.168.2.6	1.1.1.1	0x724e	Standard query (0)	eu-aa.online-metrix.net	28	IN (0x0001)	false
Jan 13, 2025 01:06:25.616261005 CET	192.168.2.6	1.1.1.1	0x302	Standard query (0)	resources.digital-cloud-gov.medallia.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:25.616394043 CET	192.168.2.6	1.1.1.1	0xe619	Standard query (0)	resources.digital-cloud-gov.medallia.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:26.948278904 CET	192.168.2.6	1.1.1.1	0x12a3	Standard query (0)	eu-aa.online-metrix.net	28	IN (0x0001)	false
Jan 13, 2025 01:06:27.050803900 CET	192.168.2.6	1.1.1.1	0x8a9c	Standard query (0)	eu-aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:27.281696081 CET	192.168.2.6	1.1.1.1	0xa22b	Standard query (0)	h.online-metrix.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:27.282191038 CET	192.168.2.6	1.1.1.1	0x7137	Standard query (0)	h.online-metrix.net	65	IN (0x0001)	false
Jan 13, 2025 01:06:27.369605064 CET	192.168.2.6	1.1.1.1	0xb411	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:27.370035887 CET	192.168.2.6	1.1.1.1	0xac9c	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:39.855119944 CET	192.168.2.6	1.1.1.1	0x9968	Standard query (0)	reg.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:39.855264902 CET	192.168.2.6	1.1.1.1	0x6fce	Standard query (0)	reg.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:43.615736008 CET	192.168.2.6	1.1.1.1	0x6c3e	Standard query (0)	reg.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:43.616072893 CET	192.168.2.6	1.1.1.1	0x8245	Standard query (0)	reg.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:43.723745108 CET	192.168.2.6	1.1.1.1	0x4a9e	Standard query (0)	cns.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:43.723885059 CET	192.168.2.6	1.1.1.1	0xb6a4	Standard query (0)	cns.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:49.582700014 CET	192.168.2.6	1.1.1.1	0xd625	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:49.583157063 CET	192.168.2.6	1.1.1.1	0xf338	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:50.367783070 CET	192.168.2.6	1.1.1.1	0xd15	Standard query (0)	cns.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:06:50.368379116 CET	192.168.2.6	1.1.1.1	0xc52f	Standard query (0)	cns.usps.com	65	IN (0x0001)	false
Jan 13, 2025 01:06:50.828787088 CET	192.168.2.6	1.1.1.1	0x8163	Standard query (0)	cns.usps.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:07:02.392680883 CET	192.168.2.6	1.1.1.1	0xdc6b	Standard query (0)	3976941.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:07:02.392680883 CET	192.168.2.6	1.1.1.1	0x4e01	Standard query (0)	3976941.fls.doubleclick.net	65	IN (0x0001)	false
Jan 13, 2025 01:07:02.393501997 CET	192.168.2.6	1.1.1.1	0xba76	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:07:02.393501997 CET	192.168.2.6	1.1.1.1	0x94a6	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Jan 13, 2025 01:07:02.396969080 CET	192.168.2.6	1.1.1.1	0x730a	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:07:02.397222996 CET	192.168.2.6	1.1.1.1	0x618e	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Jan 13, 2025 01:07:04.302485943 CET	192.168.2.6	1.1.1.1	0xa75b	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:07:04.302660942 CET	192.168.2.6	1.1.1.1	0x65b2	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Jan 13, 2025 01:07:06.773539066 CET	192.168.2.6	1.1.1.1	0x1585	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:07:06.773969889 CET	192.168.2.6	1.1.1.1	0x4861	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Jan 13, 2025 01:07:07.532426119 CET	192.168.2.6	1.1.1.1	0x7776	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:07:07.532675982 CET	192.168.2.6	1.1.1.1	0xbe34	Standard query (0)	adservice.google.com	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 37 51 69 52 36 70 45 43 4a 55 79 33 75 69 4a 56 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 37 65 33 66 38 36 34 35 30 33 37 65 66 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 7QiR6pECJUy3uiJV.1Context: 877e3f8645037ef7
2025-01-13 00:05:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:05:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 37 51 69 52 36 70 45 43 4a 55 79 33 75 69 4a 56 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 37 65 33 66 38 36 34 35 30 33 37 65 66 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 45 62 61 77 4d 51 6c 6a 50 68 4d 64 55 41 5a 35 4f 61 56 4c 42 31 57 78 6d 35 58 4c 46 77 6f 66 79 31 66 44 47 45 73 6e 59 4a 50 34 61 58 57 75 2b 4b 37 72 41 68 72 4c 7a 69 35 32 7a 59 77 6f 50 62 38 44 2f 76 7a 52 4d 58 78 57 65 4d 34 52 35 38 6f 68 79 67 35 59 62 39 5a 73 6b 66 58 4b 6e 73 72 4f 2f 30 79 58 68 70 57 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 7QiR6pECJUy3uiJV.2Context: 877e3f8645037ef7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfEbawMQljPhMdUAZ5OaVLB1Wxm5XLFwofy1fDGEsnYJP4aXWu+K7rAhrLzi52zYwoPb8D/vzRMXxWeM4R58ohyg5Yb9ZskfXKnsrO/0yXhpWA
2025-01-13 00:05:39 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 37 51 69 52 36 70 45 43 4a 55 79 33 75 69 4a 56 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 37 65 33 66 38 36 34 35 30 33 37 65 66 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 7QiR6pECJUy3uiJV.3Context: 877e3f8645037ef7<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:05:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:05:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 70 68 49 37 4c 2b 71 30 30 36 6e 37 51 70 54 63 69 6c 72 62 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gphI7L+q006n7QpTcilrbw.0Payload parsing failed.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://informed.deliveryerw.top/us/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 295

Chrome Cache Entry: 296

Chrome Cache Entry: 297

Chrome Cache Entry: 298

Chrome Cache Entry: 299

Chrome Cache Entry: 300

Chrome Cache Entry: 301

Chrome Cache Entry: 302

Chrome Cache Entry: 303

Chrome Cache Entry: 304

Chrome Cache Entry: 305

Chrome Cache Entry: 306

Chrome Cache Entry: 307

Chrome Cache Entry: 308

Chrome Cache Entry: 309

Chrome Cache Entry: 310

Chrome Cache Entry: 311

Chrome Cache Entry: 312

Chrome Cache Entry: 313

Chrome Cache Entry: 314

Chrome Cache Entry: 315

Chrome Cache Entry: 316

Chrome Cache Entry: 317

Chrome Cache Entry: 318

Chrome Cache Entry: 319

Chrome Cache Entry: 320

Chrome Cache Entry: 321

Windows Analysis Report
https://informed.deliveryerw.top/us/

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:44 UTC	670	OUT	GET /us/ HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:44 UTC	935	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LJydeezLxx32vzyA6ojcFfDp5xFLWn80D22hgJCQHhGNpJJUcZPKanB%2B4oDXMBCywB0kZDjFzwVaBI4KQ0g8s4nR1jdntck6ZX4kb9aCm3fW8yHMupNxcpRdgGL3PJ2waCdioIFbM3r7PP4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122e83ae343be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1643&min_rtt=1642&rtt_var=619&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1248&delivery_rate=1764350&cwnd=229&unsent_bytes=0&cid=ec11b8e69c8bc914&ts=215&x=0"
2025-01-13 00:05:44 UTC	434	IN	Data Raw: 36 36 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 0a 20 20 20 20 20 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 0a 20 20 20 20 2f 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 73 72 63 3d 22 2e 2f 61 73 73 65 74 73 2f 69 6e 64 65 78 2d 34 62 30 32 30 62 64 36 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 Data Ascii: 666<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no" /> <script type="module" crossorigin src="./assets/index-4b020bd6.js"></scrip
2025-01-13 00:05:44 UTC	1211	IN	Data Raw: 6c 65 3a 22 29 7b 77 69 6e 64 6f 77 2e 5f 5f 76 69 74 65 5f 69 73 5f 6d 6f 64 65 72 6e 5f 62 72 6f 77 73 65 72 3d 74 72 75 65 7d 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 77 69 6e 64 6f 77 2e 5f 5f 76 69 74 65 5f 69 73 5f 6d 6f 64 65 72 6e 5f 62 72 6f 77 73 65 72 29 72 65 74 75 72 6e 3b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 76 69 74 65 3a 20 6c 6f 61 64 69 6e 67 20 6c 65 67 61 63 79 20 63 68 75 6e 6b 73 2c 20 73 79 6e 74 61 78 20 65 72 72 6f 72 20 61 62 6f 76 65 20 61 6e 64 20 74 68 65 20 73 61 6d 65 20 65 72 72 6f 72 20 62 65 6c 6f 77 20 73 68 6f 75 6c 64 20 62 65 20 69 67 6e 6f 72 65 64 22 29 3b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e Data Ascii: le:"){window.__vite_is_modern_browser=true}</script> <script type="module">!function(){if(window.__vite_is_modern_browser)return;console.warn("vite: loading legacy chunks, syntax error above and the same error below should be ignored");var e=document.
2025-01-13 00:05:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:44 UTC	602	OUT	GET /us/assets/index-4b020bd6.js HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://informed.deliveryerw.top sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://informed.deliveryerw.top/us/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:44 UTC	993	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:44 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:28 GMT ETag: W/"7b48a-190b57e3e60" CF-Cache-Status: HIT Age: 50646 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P1vdp8u4CfrnhGh7Q%2FtF5DtxUAXOKMgO1uM%2BxHoqg0dH%2FzdGudN4K0JHppd9N166tnlnrUARlOGnenRA8y08GI1wiZC9n9qMsE1Vj%2F1C4ATaTuTzjI%2FvmtmqCApzndGIS76zYkvCtiphoy8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122ebddf38cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1970&min_rtt=1924&rtt_var=814&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1180&delivery_rate=1272885&cwnd=244&unsent_bytes=0&cid=84669eae8e86fa25&ts=592&x=0"
2025-01-13 00:05:44 UTC	376	IN	Data Raw: 37 63 39 35 0d 0a 76 61 72 20 61 33 38 5f 30 78 34 65 36 61 66 35 3d 61 33 38 5f 30 78 35 33 34 35 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 36 30 34 38 64 2c 5f 30 78 35 38 65 66 32 62 29 7b 76 61 72 20 5f 30 78 33 38 30 34 62 65 3d 61 33 38 5f 30 78 35 33 34 35 2c 5f 30 78 33 35 31 33 36 61 3d 5f 30 78 32 36 30 34 38 64 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 33 66 62 34 64 61 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 38 30 34 62 65 28 30 78 35 36 66 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 33 38 30 34 62 65 28 30 78 37 30 61 29 29 2f 30 78 32 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 38 30 34 62 65 28 30 78 32 34 38 29 29 2f 30 78 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 38 30 34 Data Ascii: 7c95var a38_0x4e6af5=a38_0x5345;(function(_0x26048d,_0x58ef2b){var _0x3804be=a38_0x5345,_0x35136a=_0x26048d();while(!![]){try{var _0x3fb4da=parseInt(_0x3804be(0x56f))/0x1+parseInt(_0x3804be(0x70a))/0x2*(-parseInt(_0x3804be(0x248))/0x3)+-parseInt(_0x3804
2025-01-13 00:05:44 UTC	1369	IN	Data Raw: 28 5f 30 78 33 38 30 34 62 65 28 30 78 34 63 65 29 29 2f 30 78 38 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 33 38 30 34 62 65 28 30 78 35 62 61 29 29 2f 30 78 39 3b 69 66 28 5f 30 78 33 66 62 34 64 61 3d 3d 3d 5f 30 78 35 38 65 66 32 62 29 62 72 65 61 6b 3b 65 6c 73 65 20 5f 30 78 33 35 31 33 36 61 5b 27 70 75 73 68 27 5d 28 5f 30 78 33 35 31 33 36 61 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 63 61 74 63 68 28 5f 30 78 33 35 32 35 38 61 29 7b 5f 30 78 33 35 31 33 36 61 5b 27 70 75 73 68 27 5d 28 5f 30 78 33 35 31 33 36 61 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 7d 7d 28 61 33 38 5f 30 78 31 64 65 38 2c 30 78 61 63 37 65 34 29 29 3b 66 75 6e 63 74 69 6f 6e 20 4f 78 28 29 7b 76 61 72 20 5f 30 78 32 31 61 34 33 66 3d 61 33 38 5f 30 78 35 33 34 35 3b 69 6d 70 Data Ascii: (_0x3804be(0x4ce))/0x8+parseInt(_0x3804be(0x5ba))/0x9;if(_0x3fb4da===_0x58ef2b)break;else _0x35136a['push'](_0x35136a['shift']());}catch(_0x35258a){_0x35136a['push'](_0x35136a['shift']());}}}(a38_0x1de8,0xac7e4));function Ox(){var _0x21a43f=a38_0x5345;imp
2025-01-13 00:05:44 UTC	1369	IN	Data Raw: 79 27 5d 29 2c 5f 30 78 62 31 35 35 32 64 5b 27 63 72 6f 73 73 6f 72 69 67 69 27 2b 27 6e 27 5d 3d 3d 3d 5f 30 78 35 63 66 38 65 34 28 30 78 31 63 65 29 2b 27 74 69 61 6c 73 27 3f 5f 30 78 34 31 35 31 35 64 5b 27 63 72 65 64 65 6e 74 69 61 6c 27 2b 27 73 27 5d 3d 5f 30 78 35 63 66 38 65 34 28 30 78 35 33 33 29 3a 5f 30 78 62 31 35 35 32 64 5b 27 63 72 6f 73 73 6f 72 69 67 69 27 2b 27 6e 27 5d 3d 3d 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3f 5f 30 78 34 31 35 31 35 64 5b 5f 30 78 35 63 66 38 65 34 28 30 78 33 63 36 29 2b 27 73 27 5d 3d 5f 30 78 35 63 66 38 65 34 28 30 78 36 61 33 29 3a 5f 30 78 34 31 35 31 35 64 5b 5f 30 78 35 63 66 38 65 34 28 30 78 33 63 36 29 2b 27 73 27 5d 3d 5f 30 78 35 63 66 38 65 34 28 30 78 31 33 39 29 2b 27 6e 27 2c 5f 30 78 34 31 35 Data Ascii: y']),_0xb1552d['crossorigi'+'n']===_0x5cf8e4(0x1ce)+'tials'?_0x41515d['credential'+'s']=_0x5cf8e4(0x533):_0xb1552d['crossorigi'+'n']==='anonymous'?_0x41515d[_0x5cf8e4(0x3c6)+'s']=_0x5cf8e4(0x6a3):_0x41515d[_0x5cf8e4(0x3c6)+'s']=_0x5cf8e4(0x139)+'n',_0x415
2025-01-13 00:05:44 UTC	1369	IN	Data Raw: 28 30 78 32 31 30 29 2b 27 5c 78 32 32 27 2b 5f 30 78 38 63 66 65 66 37 2b 27 5c 78 32 32 5d 27 2b 5f 30 78 35 39 62 35 30 35 29 29 72 65 74 75 72 6e 3b 7d 63 6f 6e 73 74 20 5f 30 78 36 63 34 39 62 65 3d 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 34 30 37 65 37 66 28 30 78 34 36 66 29 2b 5f 30 78 34 30 37 65 37 66 28 30 78 33 34 66 29 5d 28 5f 30 78 34 30 37 65 37 66 28 30 78 31 62 33 29 29 3b 69 66 28 5f 30 78 36 63 34 39 62 65 5b 5f 30 78 34 30 37 65 37 66 28 30 78 31 63 35 29 5d 3d 5f 30 78 64 30 39 61 37 30 3f 5f 30 78 34 30 37 65 37 66 28 30 78 36 38 30 29 3a 71 6f 2c 5f 30 78 64 30 39 61 37 30 7c 7c 28 5f 30 78 36 63 34 39 62 65 5b 27 61 73 27 5d 3d 5f 30 78 34 30 37 65 37 66 28 30 78 35 65 39 29 2c 5f 30 78 36 63 34 39 62 65 5b 27 63 72 6f 73 73 4f 72 69 Data Ascii: (0x210)+'\x22'+_0x8cfef7+'\x22]'+_0x59b505))return;}const _0x6c49be=document[_0x407e7f(0x46f)+_0x407e7f(0x34f)](_0x407e7f(0x1b3));if(_0x6c49be[_0x407e7f(0x1c5)]=_0xd09a70?_0x407e7f(0x680):qo,_0xd09a70\|\|(_0x6c49be['as']=_0x407e7f(0x5e9),_0x6c49be['crossOri
2025-01-13 00:05:44 UTC	1369	IN	Data Raw: 5f 30 78 35 65 63 35 39 30 28 30 78 37 30 62 29 5d 28 5f 30 78 34 66 65 62 38 33 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 56 6f 28 29 7b 76 61 72 20 5f 30 78 34 32 35 39 31 32 3d 61 33 38 5f 30 78 34 65 36 61 66 35 3b 63 6f 6e 73 74 20 5f 30 78 31 66 39 36 31 33 3d 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 34 32 35 39 31 32 28 30 78 31 33 62 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 36 61 37 29 5d 28 5f 30 78 34 32 35 39 31 32 28 30 78 33 63 30 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 34 66 62 29 29 2c 5f 30 78 32 31 65 38 32 38 3d 64 6f 63 75 6d 65 6e 74 5b 27 71 75 65 72 79 53 65 6c 65 63 27 2b 5f 30 78 34 32 35 39 31 32 28 30 78 36 61 37 29 5d 28 5f 30 78 34 32 35 39 31 32 28 30 78 33 63 30 29 2b 27 2d 6d 61 73 6b 27 29 3b 5f 30 78 32 31 65 38 32 38 26 26 64 6f Data Ascii: _0x5ec590(0x70b)](_0x4feb83);}function Vo(){var _0x425912=a38_0x4e6af5;const _0x1f9613=document[_0x425912(0x13b)+_0x425912(0x6a7)](_0x425912(0x3c0)+_0x425912(0x4fb)),_0x21e828=document['querySelec'+_0x425912(0x6a7)](_0x425912(0x3c0)+'-mask');_0x21e828&&do
2025-01-13 00:05:44 UTC	1369	IN	Data Raw: 31 66 39 36 31 33 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 78 30 3a 5f 30 78 31 66 39 36 31 33 5b 5f 30 78 34 32 35 39 31 32 28 30 78 35 37 39 29 2b 27 74 65 27 5d 28 27 66 69 6c 6c 27 29 29 2b 28 5f 30 78 34 32 35 39 31 32 28 30 78 33 61 34 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 35 34 32 29 2b 27 61 74 74 72 69 62 75 74 65 4e 27 2b 27 61 6d 65 3d 5c 78 32 32 6f 70 61 63 69 27 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 65 34 29 2b 27 3d 5c 78 32 32 31 3b 30 5c 78 32 32 5c 78 32 30 6b 65 79 27 2b 5f 30 78 34 32 35 39 31 32 28 30 78 34 62 30 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 38 33 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 33 63 62 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 32 62 33 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 36 32 63 29 2b 5f 30 78 Data Ascii: 1f9613==null?void 0x0:_0x1f9613[_0x425912(0x579)+'te']('fill'))+(_0x425912(0x3a4)+_0x425912(0x542)+'attributeN'+'ame=\x22opaci'+_0x425912(0x1e4)+'=\x221;0\x22\x20key'+_0x425912(0x4b0)+_0x425912(0x183)+_0x425912(0x3cb)+_0x425912(0x2b3)+_0x425912(0x62c)+_0x
2025-01-13 00:05:45 UTC	1369	IN	Data Raw: 30 27 2b 5f 30 78 34 32 35 39 31 32 28 30 78 33 66 31 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 35 65 29 2b 27 69 74 65 5c 78 32 32 2f 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 27 2b 5f 30 78 34 32 35 39 31 32 28 30 78 34 34 66 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 37 31 30 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 35 63 63 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 32 34 36 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 39 31 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 39 30 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 32 32 36 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 66 37 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 64 62 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 35 63 30 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 35 32 30 29 2b 5f 30 78 Data Ascii: 0'+_0x425912(0x3f1)+_0x425912(0x15e)+'ite\x22/>\x0a\x20\x20\x20'+_0x425912(0x44f)+_0x425912(0x710)+_0x425912(0x5cc)+_0x425912(0x246)+_0x425912(0x191)+_0x425912(0x190)+_0x425912(0x226)+_0x425912(0x1f7)+_0x425912(0x1db)+_0x425912(0x5c0)+_0x425912(0x520)+_0x
2025-01-13 00:05:45 UTC	1369	IN	Data Raw: 35 39 31 32 28 30 78 32 35 35 29 29 2b 28 5f 30 78 31 66 39 36 31 33 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 78 30 3a 5f 30 78 31 66 39 36 31 33 5b 5f 30 78 34 32 35 39 31 32 28 30 78 35 37 39 29 2b 27 74 65 27 5d 28 27 66 69 6c 6c 27 29 29 2b 28 5f 30 78 34 32 35 39 31 32 28 30 78 33 61 34 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 35 34 32 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 35 63 31 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 32 35 66 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 65 34 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 32 33 37 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 34 62 30 29 2b 27 5c 78 32 32 5c 78 32 30 64 75 72 3d 5c 78 32 32 31 73 5c 78 32 32 27 2b 27 5c 78 32 30 62 65 67 69 6e 3d 5c 78 32 32 2d 30 27 2b 5f 30 78 34 32 35 39 31 32 28 Data Ascii: 5912(0x255))+(_0x1f9613==null?void 0x0:_0x1f9613[_0x425912(0x579)+'te']('fill'))+(_0x425912(0x3a4)+_0x425912(0x542)+_0x425912(0x5c1)+_0x425912(0x25f)+_0x425912(0x1e4)+_0x425912(0x237)+_0x425912(0x4b0)+'\x22\x20dur=\x221s\x22'+'\x20begin=\x22-0'+_0x425912(
2025-01-13 00:05:45 UTC	1369	IN	Data Raw: 78 35 34 36 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 34 61 65 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 32 61 35 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 33 62 66 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 33 65 31 29 2b 27 61 6e 73 66 6f 72 6d 3d 5c 78 32 32 72 27 2b 27 6f 74 61 74 65 28 32 37 30 5c 78 32 30 27 2b 5f 30 78 34 32 35 39 31 32 28 30 78 34 65 33 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 32 61 66 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 35 65 34 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 36 37 62 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 34 38 62 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 33 33 65 29 2b 27 65 69 67 68 74 3d 5c 78 32 32 31 32 5c 78 32 32 27 2b 5f 30 78 34 32 35 39 31 32 28 30 78 34 33 38 29 29 2b 28 5f 30 78 31 66 39 36 31 33 Data Ascii: x546)+_0x425912(0x4ae)+_0x425912(0x2a5)+_0x425912(0x3bf)+_0x425912(0x3e1)+'ansform=\x22r'+'otate(270\x20'+_0x425912(0x4e3)+_0x425912(0x2af)+_0x425912(0x5e4)+_0x425912(0x67b)+_0x425912(0x48b)+_0x425912(0x33e)+'eight=\x2212\x22'+_0x425912(0x438))+(_0x1f9613
2025-01-13 00:05:45 UTC	1369	IN	Data Raw: 32 35 39 31 32 28 30 78 35 37 39 29 2b 27 74 65 27 5d 28 5f 30 78 34 32 35 39 31 32 28 30 78 35 62 65 29 29 29 2b 28 5f 30 78 34 32 35 39 31 32 28 30 78 33 61 34 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 35 34 32 29 2b 27 61 74 74 72 69 62 75 74 65 4e 27 2b 5f 30 78 34 32 35 39 31 32 28 30 78 32 35 66 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 65 34 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 32 33 37 29 2b 27 54 69 6d 65 73 3d 5c 78 32 32 30 3b 31 27 2b 5f 30 78 34 32 35 39 31 32 28 30 78 31 38 33 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 34 35 66 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 35 35 32 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 36 66 31 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 33 61 66 29 2b 5f 30 78 34 32 35 39 31 32 28 30 78 33 31 30 29 2b Data Ascii: 25912(0x579)+'te'](_0x425912(0x5be)))+(_0x425912(0x3a4)+_0x425912(0x542)+'attributeN'+_0x425912(0x25f)+_0x425912(0x1e4)+_0x425912(0x237)+'Times=\x220;1'+_0x425912(0x183)+_0x425912(0x45f)+_0x425912(0x552)+_0x425912(0x6f1)+_0x425912(0x3af)+_0x425912(0x310)+

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:45 UTC	577	OUT	GET /us/assets/f6170fbbTeKnX.css HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://informed.deliveryerw.top/us/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:45 UTC	971	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:45 GMT Content-Type: text/css; charset=utf-8 Content-Length: 952 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"3b8-190b57e26f0" CF-Cache-Status: HIT Age: 50647 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FBLhenh%2Bd%2FA76v%2B3UW6R7iqPE7%2Bh82DHSebnUEal42bkmp43V1RKAOzpxWlvLerYraUyI2OzrHFYKVlB%2FQq8uTrtd6lITCNnvbQsyAZbEu7zW%2Brfh8rFm6W0AuG7DyosggUHa1Sg2BzpFCs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122ef0a28c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1704&min_rtt=1482&rtt_var=1000&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1155&delivery_rate=895980&cwnd=214&unsent_bytes=0&cid=e1a6ca01e312cc60&ts=163&x=0"
2025-01-13 00:05:45 UTC	398	IN	Data Raw: 40 6b 65 79 66 72 61 6d 65 73 20 67 2d 6c 6f 61 64 69 6e 67 2d 62 67 41 6e 69 6d 7b 30 25 2c 74 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 2e 36 33 35 29 7d 35 30 25 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 29 7d 7d 2e 67 2d 6c 6f 61 64 69 6e 67 2d 6d 61 73 6b 7b 77 69 64 74 68 3a 31 30 30 76 77 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 3b 61 6e 69 6d 61 74 69 6f 6e 3a 67 2d 6c 6f 61 Data Ascii: @keyframes g-loading-bgAnim{0%,to{background-color:rgba(255,255,255,.635)}50%{background-color:rgba(255,255,255,0)}}.g-loading-mask{width:100vw;height:100vh;display:flex;justify-content:center;align-items:center;position:fixed;left:0;top:0;animation:g-loa
2025-01-13 00:05:45 UTC	554	IN	Data Raw: 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 7d 2e 67 2d 6c 6f 61 64 69 6e 67 2d 6d 61 73 6b 2e 73 68 6f 77 7b 6f 70 61 63 69 74 79 3a 31 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 69 6e 69 74 69 61 6c 7d 2e 67 2d 6c 6f 61 64 69 6e 67 2d 6d 61 73 6b 20 2e 6c 6f 61 64 69 6e 67 7b 77 69 64 74 68 3a 33 38 70 78 3b 68 65 69 67 68 74 3a 33 38 70 78 7d 68 74 6d 6c 2c 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 61 75 74 6f 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 20 61 75 74 6f 7d 5b 64 61 74 61 2d 74 5d 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 64 61 74 61 2d 74 5d Data Ascii: ;z-index:999999999}.g-loading-mask.show{opacity:1;pointer-events:initial}.g-loading-mask .loading{width:38px;height:38px}html,body{padding:0;border:0;margin:0;overflow-x:hidden;overflow-y:auto;overflow:hidden auto}[data-t]{font-size:1em!important}[data-t]

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:46 UTC	554	OUT	GET /us/assets/143268e9KXMp5.js HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://informed.deliveryerw.top sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:46 UTC	990	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:46 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"11c0-190b57e26f0" CF-Cache-Status: HIT Age: 50648 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7L%2B8K9rBV511SXO2gfP8lWCkEig59S2wQeTBuO4KBF1wmfp9tSYVS0Ho4Y%2Ft8gEKM9EdTE4r%2BAuixS8mw4KNPd4tFQuGlJ5KJ8SmpRnnnY1M74ezCjBPPUmk%2FriBW1LuK1y5GYGjreB8wyw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122f35d28c461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1650&min_rtt=1644&rtt_var=630&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1132&delivery_rate=1719670&cwnd=228&unsent_bytes=0&cid=7c69673377240d90&ts=155&x=0"
2025-01-13 00:05:46 UTC	379	IN	Data Raw: 31 31 63 30 0d 0a 63 6f 6e 73 74 20 61 32 5f 30 78 35 35 39 31 63 66 3d 61 32 5f 30 78 33 30 39 36 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 61 63 30 31 61 64 2c 5f 30 78 31 66 30 65 35 37 29 7b 63 6f 6e 73 74 20 5f 30 78 36 30 62 34 63 65 3d 61 32 5f 30 78 33 30 39 36 2c 5f 30 78 34 65 34 63 32 66 3d 5f 30 78 61 63 30 31 61 64 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 63 6f 6e 73 74 20 5f 30 78 62 36 64 38 64 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 62 35 29 29 2f 30 78 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 39 65 29 29 2f 30 78 32 29 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 63 31 29 29 2f 30 78 33 2a 28 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 Data Ascii: 11c0const a2_0x5591cf=a2_0x3096;(function(_0xac01ad,_0x1f0e57){const _0x60b4ce=a2_0x3096,_0x4e4c2f=_0xac01ad();while(!![]){try{const _0xb6d8d=parseInt(_0x60b4ce(0xb5))/0x1(-parseInt(_0x60b4ce(0x9e))/0x2)+parseInt(_0x60b4ce(0xc1))/0x3(parseInt(_0x60b4c
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 62 34 63 65 28 30 78 63 62 29 29 2f 30 78 38 29 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 62 64 29 29 2f 30 78 39 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 62 65 29 29 2f 30 78 61 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 62 66 29 29 2f 30 78 62 29 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 63 34 29 29 2f 30 78 63 3b 69 66 28 5f 30 78 62 36 64 38 64 3d 3d 3d 5f 30 78 31 66 30 65 35 37 29 62 72 65 61 6b 3b 65 6c 73 65 20 5f 30 78 34 65 34 63 32 66 5b 27 70 75 73 68 27 5d 28 5f 30 78 34 65 34 63 32 66 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 63 61 74 63 68 28 5f 30 78 31 61 63 36 61 35 29 7b 5f 30 78 34 65 34 63 32 66 5b 27 70 75 73 68 27 5d 28 5f 30 78 Data Ascii: b4ce(0xcb))/0x8)+-parseInt(_0x60b4ce(0xbd))/0x9+parseInt(_0x60b4ce(0xbe))/0xa*(-parseInt(_0x60b4ce(0xbf))/0xb)+parseInt(_0x60b4ce(0xc4))/0xc;if(_0xb6d8d===_0x1f0e57)break;else _0x4e4c2f['push'](_0x4e4c2f['shift']());}catch(_0x1ac6a5){_0x4e4c2f['push'](_0x
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 30 78 32 39 31 32 35 31 28 29 2c 27 73 63 72 6f 6c 6c 42 65 68 61 76 69 6f 72 27 3a 28 29 3d 3e 28 64 6f 63 75 6d 65 6e 74 5b 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 61 64 29 5d 5b 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 63 30 29 5d 28 30 78 30 2c 30 78 30 29 2c 7b 27 74 6f 70 27 3a 30 78 30 2c 27 6c 65 66 74 27 3a 30 78 30 7d 29 2c 27 72 6f 75 74 65 73 27 3a 5b 7b 27 70 61 74 68 27 3a 27 27 2c 27 63 6f 6d 70 6f 6e 65 6e 74 27 3a 28 29 3d 3e 61 32 5f 30 78 33 37 66 66 31 64 28 28 29 3d 3e 69 6d 70 6f 72 74 28 27 2e 2f 36 32 66 66 32 30 30 66 27 2b 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 63 61 29 29 2c 5b 27 2e 2f 36 32 66 66 32 30 30 66 27 2b 27 4b 58 4d 70 35 2e 6a 73 27 2c 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 61 35 29 2b 61 32 5f 30 78 35 35 Data Ascii: 0x291251(),'scrollBehavior':()=>(document[a2_0x5591cf(0xad)][a2_0x5591cf(0xc0)](0x0,0x0),{'top':0x0,'left':0x0}),'routes':[{'path':'','component':()=>a2_0x37ff1d(()=>import('./62ff200f'+a2_0x5591cf(0xca)),['./62ff200f'+'KXMp5.js',a2_0x5591cf(0xa5)+a2_0x55
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 66 36 31 37 30 66 62 62 27 2b 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 61 61 29 2c 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 62 32 29 2b 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 63 61 29 2c 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 62 61 29 2b 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 63 61 29 2c 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 61 38 29 2b 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 63 61 29 2c 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 61 65 29 2b 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 63 61 29 2c 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 62 33 29 2b 27 4b 58 4d 70 35 2e 6a 73 27 2c 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 61 35 29 2b 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 63 61 29 2c 61 32 5f 30 78 35 35 39 31 63 66 28 30 78 61 32 29 2b Data Ascii: f6170fbb'+a2_0x5591cf(0xaa),a2_0x5591cf(0xb2)+a2_0x5591cf(0xca),a2_0x5591cf(0xba)+a2_0x5591cf(0xca),a2_0x5591cf(0xa8)+a2_0x5591cf(0xca),a2_0x5591cf(0xae)+a2_0x5591cf(0xca),a2_0x5591cf(0xb3)+'KXMp5.js',a2_0x5591cf(0xa5)+a2_0x5591cf(0xca),a2_0x5591cf(0xa2)+
2025-01-13 00:05:46 UTC	66	IN	Data Raw: 6e 28 29 7b 72 65 74 75 72 6e 20 5f 30 78 31 34 64 36 39 66 3b 7d 3b 72 65 74 75 72 6e 20 61 32 5f 30 78 31 38 34 63 28 29 3b 7d 65 78 70 6f 72 74 7b 5f 20 61 73 20 64 65 66 61 75 6c 74 7d 3b 0d 0a Data Ascii: n(){return _0x14d69f;};return a2_0x184c();}export{_ as default};
2025-01-13 00:05:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:46 UTC	554	OUT	GET /us/assets/f0ee2557KXMp5.js HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://informed.deliveryerw.top sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:46 UTC	998	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:46 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:26 GMT ETag: W/"d0c2-190b57e3690" CF-Cache-Status: HIT Age: 50648 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2cHW1%2Bq95%2F0C7xZS1xc8GaGUbAYD9WbnkNt7kbDE3jfd51%2FW4Ul4cL%2FGRL5P7Frc%2BYO4aZOou%2FDGVYxwAdLFSJfxWSKE2QL9bdLWJsCfwK1K1W9ZWHZ%2BxTLZHnphpFWKM%2F0xbQnu6CrxuyE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122f35b4b42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1963&min_rtt=1673&rtt_var=835&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1132&delivery_rate=1745367&cwnd=240&unsent_bytes=0&cid=490435ef30f33ff8&ts=144&x=0"
2025-01-13 00:05:46 UTC	371	IN	Data Raw: 37 63 39 31 0d 0a 63 6f 6e 73 74 20 61 33 35 5f 30 78 31 30 36 33 61 36 3d 61 33 35 5f 30 78 35 65 61 35 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 38 38 38 32 32 2c 5f 30 78 33 63 36 35 31 37 29 7b 63 6f 6e 73 74 20 5f 30 78 35 63 39 61 62 64 3d 61 33 35 5f 30 78 35 65 61 35 2c 5f 30 78 34 66 37 64 62 30 3d 5f 30 78 31 38 38 38 32 32 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 63 6f 6e 73 74 20 5f 30 78 66 32 37 34 31 38 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 31 63 62 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 32 34 39 29 29 2f 30 78 32 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 31 64 34 29 29 2f 30 78 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 5f Data Ascii: 7c91const a35_0x1063a6=a35_0x5ea5;(function(_0x188822,_0x3c6517){const _0x5c9abd=a35_0x5ea5,_0x4f7db0=_0x188822();while(!![]){try{const _0xf27418=parseInt(_0x5c9abd(0x1cb))/0x1+parseInt(_0x5c9abd(0x249))/0x2*(-parseInt(_0x5c9abd(0x1d4))/0x3)+-parseInt(_
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 37 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 32 34 62 29 29 2f 30 78 38 29 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 31 61 30 29 29 2f 30 78 39 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 32 31 31 29 29 2f 30 78 61 29 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 32 32 61 29 29 2f 30 78 62 2a 28 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 31 65 30 29 29 2f 30 78 63 29 3b 69 66 28 5f 30 78 66 32 37 34 31 38 3d 3d 3d 5f 30 78 33 63 36 35 31 37 29 62 72 65 61 6b 3b 65 6c 73 65 20 5f 30 78 34 66 37 64 62 30 5b 27 70 75 73 68 27 5d 28 5f 30 78 34 66 37 64 62 30 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 63 61 74 63 68 28 5f 30 78 31 38 34 35 Data Ascii: 7(-parseInt(_0x5c9abd(0x24b))/0x8)+parseInt(_0x5c9abd(0x1a0))/0x9(-parseInt(_0x5c9abd(0x211))/0xa)+parseInt(_0x5c9abd(0x22a))/0xb*(parseInt(_0x5c9abd(0x1e0))/0xc);if(_0xf27418===_0x3c6517)break;else _0x4f7db0['push'](_0x4f7db0['shift']());}catch(_0x1845
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 62 29 5d 28 27 23 27 29 3b 6c 65 74 20 5f 30 78 31 36 66 64 32 37 3d 5f 30 78 31 30 63 65 37 36 5b 5f 30 78 33 64 36 34 34 61 28 30 78 31 64 62 29 5d 28 27 3f 27 29 3b 72 65 74 75 72 6e 20 5f 30 78 63 61 61 65 65 65 3c 5f 30 78 31 36 66 64 32 37 26 26 5f 30 78 63 61 61 65 65 65 3e 3d 30 78 30 26 26 28 5f 30 78 31 36 66 64 32 37 3d 2d 30 78 31 29 2c 5f 30 78 31 36 66 64 32 37 3e 2d 30 78 31 26 26 28 5f 30 78 32 61 31 37 31 65 3d 5f 30 78 31 30 63 65 37 36 5b 27 73 6c 69 63 65 27 5d 28 30 78 30 2c 5f 30 78 31 36 66 64 32 37 29 2c 5f 30 78 33 35 66 37 66 33 3d 5f 30 78 31 30 63 65 37 36 5b 27 73 6c 69 63 65 27 5d 28 5f 30 78 31 36 66 64 32 37 2b 30 78 31 2c 5f 30 78 63 61 61 65 65 65 3e 2d 30 78 31 3f 5f 30 78 63 61 61 65 65 65 3a 5f 30 78 31 30 63 65 37 36 Data Ascii: b)]('#');let _0x16fd27=_0x10ce76[_0x3d644a(0x1db)]('?');return _0xcaaeee<_0x16fd27&&_0xcaaeee>=0x0&&(_0x16fd27=-0x1),_0x16fd27>-0x1&&(_0x2a171e=_0x10ce76['slice'](0x0,_0x16fd27),_0x35f7f3=_0x10ce76['slice'](_0x16fd27+0x1,_0xcaaeee>-0x1?_0xcaaeee:_0x10ce76
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 2c 5f 30 78 31 65 30 62 64 64 29 7b 63 6f 6e 73 74 20 5f 30 78 31 36 33 31 34 32 3d 61 33 35 5f 30 78 31 30 36 33 61 36 3b 72 65 74 75 72 6e 28 5f 30 78 34 30 36 36 35 62 5b 5f 30 78 31 36 33 31 34 32 28 30 78 31 62 61 29 5d 7c 7c 5f 30 78 34 30 36 36 35 62 29 3d 3d 3d 28 5f 30 78 31 65 30 62 64 64 5b 5f 30 78 31 36 33 31 34 32 28 30 78 31 62 61 29 5d 7c 7c 5f 30 78 31 65 30 62 64 64 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 71 65 28 5f 30 78 31 32 35 37 35 39 2c 5f 30 78 31 61 64 39 31 33 29 7b 63 6f 6e 73 74 20 5f 30 78 33 38 33 30 61 62 3d 61 33 35 5f 30 78 31 30 36 33 61 36 3b 69 66 28 4f 62 6a 65 63 74 5b 5f 30 78 33 38 33 30 61 62 28 30 78 31 62 30 29 5d 28 5f 30 78 31 32 35 37 35 39 29 5b 5f 30 78 33 38 33 30 61 62 28 30 78 32 31 61 29 5d 21 3d 3d 4f 62 Data Ascii: ,_0x1e0bdd){const _0x163142=a35_0x1063a6;return(_0x40665b[_0x163142(0x1ba)]\|\|_0x40665b)===(_0x1e0bdd[_0x163142(0x1ba)]\|\|_0x1e0bdd);}function qe(_0x125759,_0x1ad913){const _0x3830ab=a35_0x1063a6;if(Object[_0x3830ab(0x1b0)](_0x125759)[_0x3830ab(0x21a)]!==Ob
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 61 28 30 78 31 62 65 29 5d 28 27 2f 27 29 2b 27 2f 27 2b 5f 30 78 34 30 32 35 38 62 5b 27 73 6c 69 63 65 27 5d 28 5f 30 78 34 37 32 61 38 35 2d 28 5f 30 78 34 37 32 61 38 35 3d 3d 3d 5f 30 78 34 30 32 35 38 62 5b 5f 30 78 35 61 64 38 31 61 28 30 78 32 31 61 29 5d 3f 30 78 31 3a 30 78 30 29 29 5b 27 6a 6f 69 6e 27 5d 28 27 2f 27 29 3b 7d 76 61 72 20 59 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 34 34 38 35 63 37 29 7b 63 6f 6e 73 74 20 5f 30 78 39 37 64 63 31 62 3d 61 33 35 5f 30 78 31 30 36 33 61 36 3b 5f 30 78 34 34 38 35 63 37 5b 27 70 6f 70 27 5d 3d 5f 30 78 39 37 64 63 31 62 28 30 78 31 66 65 29 2c 5f 30 78 34 34 38 35 63 37 5b 5f 30 78 39 37 64 63 31 62 28 30 78 31 63 66 29 5d 3d 5f 30 78 39 37 64 63 31 62 28 30 78 31 63 66 29 3b 7d 28 59 7c 7c 28 59 Data Ascii: a(0x1be)]('/')+'/'+_0x40258b['slice'](_0x472a85-(_0x472a85===_0x40258b[_0x5ad81a(0x21a)]?0x1:0x0))['join']('/');}var Y;(function(_0x4485c7){const _0x97dc1b=a35_0x1063a6;_0x4485c7['pop']=_0x97dc1b(0x1fe),_0x4485c7[_0x97dc1b(0x1cf)]=_0x97dc1b(0x1cf);}(Y\|\|(Y
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 35 32 36 35 31 36 29 2c 73 74 28 5f 30 78 35 32 36 35 31 36 29 3b 7d 63 6f 6e 73 74 20 75 74 3d 2f 5e 5b 5e 23 5d 2b 23 2f 3b 66 75 6e 63 74 69 6f 6e 20 66 74 28 5f 30 78 35 30 34 34 30 63 2c 5f 30 78 34 34 62 37 63 31 29 7b 72 65 74 75 72 6e 20 5f 30 78 35 30 34 34 30 63 5b 27 72 65 70 6c 61 63 65 27 5d 28 75 74 2c 27 23 27 29 2b 5f 30 78 34 34 62 37 63 31 3b 7d 66 75 6e 63 74 69 6f 6e 20 68 74 28 5f 30 78 61 64 34 63 61 30 2c 5f 30 78 31 34 63 63 38 61 29 7b 63 6f 6e 73 74 20 5f 30 78 33 36 62 31 62 31 3d 61 33 35 5f 30 78 31 30 36 33 61 36 2c 5f 30 78 33 65 63 38 37 37 3d 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 33 36 62 31 62 31 28 30 78 31 66 30 29 2b 27 65 6d 65 6e 74 27 5d 5b 5f 30 78 33 36 62 31 62 31 28 30 78 31 62 33 29 2b 27 67 43 6c 69 65 6e 74 52 Data Ascii: 526516),st(_0x526516);}const ut=/^[^#]+#/;function ft(_0x50440c,_0x44b7c1){return _0x50440c['replace'](ut,'#')+_0x44b7c1;}function ht(_0xad4ca0,_0x14cc8a){const _0x36b1b1=a35_0x1063a6,_0x3ec877=document[_0x36b1b1(0x1f0)+'ement'][_0x36b1b1(0x1b3)+'gClientR
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 30 78 33 31 35 34 33 62 28 30 78 31 62 39 29 5d 3a 77 69 6e 64 6f 77 5b 5f 30 78 33 31 35 34 33 62 28 30 78 31 65 33 29 2b 27 74 27 5d 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 6b 65 28 5f 30 78 34 36 39 61 61 30 2c 5f 30 78 34 32 32 66 30 62 29 7b 63 6f 6e 73 74 20 5f 30 78 34 66 34 35 66 34 3d 61 33 35 5f 30 78 31 30 36 33 61 36 3b 72 65 74 75 72 6e 28 68 69 73 74 6f 72 79 5b 5f 30 78 34 66 34 35 66 34 28 30 78 32 31 66 29 5d 3f 68 69 73 74 6f 72 79 5b 5f 30 78 34 66 34 35 66 34 28 30 78 32 31 66 29 5d 5b 5f 30 78 34 66 34 35 66 34 28 30 78 32 33 30 29 5d 2d 5f 30 78 34 32 32 66 30 62 3a 2d 30 78 31 29 2b 5f 30 78 34 36 39 61 61 30 3b 7d 63 6f 6e 73 74 20 68 65 3d 6e 65 77 20 4d 61 70 28 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 74 28 5f 30 78 33 39 34 61 30 63 2c Data Ascii: 0x31543b(0x1b9)]:window[_0x31543b(0x1e3)+'t']);}function ke(_0x469aa0,_0x422f0b){const _0x4f45f4=a35_0x1063a6;return(history[_0x4f45f4(0x21f)]?history[_0x4f45f4(0x21f)][_0x4f45f4(0x230)]-_0x422f0b:-0x1)+_0x469aa0;}const he=new Map();function mt(_0x394a0c,
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 30 78 31 63 66 29 5d 28 5f 30 78 31 62 62 35 33 61 29 2c 28 29 3d 3e 7b 63 6f 6e 73 74 20 5f 30 78 34 62 36 31 37 32 3d 5f 30 78 65 31 37 36 32 65 2c 5f 30 78 32 30 66 62 35 61 3d 5f 30 78 35 62 64 35 34 32 5b 5f 30 78 34 62 36 31 37 32 28 30 78 31 64 62 29 5d 28 5f 30 78 31 62 62 35 33 61 29 3b 5f 30 78 32 30 66 62 35 61 3e 2d 30 78 31 26 26 5f 30 78 35 62 64 35 34 32 5b 5f 30 78 34 62 36 31 37 32 28 30 78 32 36 30 29 5d 28 5f 30 78 32 30 66 62 35 61 2c 30 78 31 29 3b 7d 3b 7d 2c 27 64 65 73 74 72 6f 79 27 28 29 7b 5f 30 78 35 62 64 35 34 32 3d 5b 5d 2c 5f 30 78 32 66 32 30 39 66 3d 5b 75 65 5d 2c 5f 30 78 34 61 64 39 66 31 3d 30 78 30 3b 7d 2c 27 67 6f 27 28 5f 30 78 33 38 64 30 63 63 2c 5f 30 78 32 65 37 33 32 38 3d 21 30 78 30 29 7b 63 6f 6e 73 74 20 Data Ascii: 0x1cf)](_0x1bb53a),()=>{const _0x4b6172=_0xe1762e,_0x20fb5a=_0x5bd542[_0x4b6172(0x1db)](_0x1bb53a);_0x20fb5a>-0x1&&_0x5bd542[_0x4b6172(0x260)](_0x20fb5a,0x1);};},'destroy'(){_0x5bd542=[],_0x2f209f=[ue],_0x4ad9f1=0x0;},'go'(_0x38d0cc,_0x2e7328=!0x0){const
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 4c 28 5f 30 78 35 38 33 65 35 61 2c 5f 30 78 34 30 37 35 63 35 29 7b 72 65 74 75 72 6e 20 6b 28 6e 65 77 20 45 72 72 6f 72 28 29 2c 7b 27 74 79 70 65 27 3a 5f 30 78 35 38 33 65 35 61 2c 5b 4b 65 5d 3a 21 30 78 30 7d 2c 5f 30 78 34 30 37 35 63 35 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 49 28 5f 30 78 32 32 38 62 65 66 2c 5f 30 78 63 62 61 63 38 35 29 7b 63 6f 6e 73 74 20 5f 30 78 33 66 34 31 36 65 3d 61 33 35 5f 30 78 31 30 36 33 61 36 3b 72 65 74 75 72 6e 20 5f 30 78 32 32 38 62 65 66 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 26 26 4b 65 20 69 6e 20 5f 30 78 32 32 38 62 65 66 26 26 28 5f 30 78 63 62 61 63 38 35 3d 3d 6e 75 6c 6c 7c 7c 21 21 28 5f 30 78 32 32 38 62 65 66 5b 5f 30 78 33 66 34 31 36 65 28 30 78 32 35 35 29 5d Data Ascii: function L(_0x583e5a,_0x4075c5){return k(new Error(),{'type':_0x583e5a,[Ke]:!0x0},_0x4075c5);}function I(_0x228bef,_0xcbac85){const _0x3f416e=a35_0x1063a6;return _0x228bef instanceof Error&&Ke in _0x228bef&&(_0xcbac85==null\|\|!!(_0x228bef[_0x3f416e(0x255)]
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 38 66 32 37 38 28 30 78 31 61 65 29 2b 5f 30 78 35 38 66 32 37 38 28 30 78 32 33 61 29 2b 27 70 5c 78 32 30 66 6f 72 5c 78 32 30 70 61 72 61 27 2b 5f 30 78 35 38 66 32 37 38 28 30 78 31 62 36 29 2b 5f 30 78 34 34 65 31 31 66 2b 5f 30 78 35 38 66 32 37 38 28 30 78 32 36 63 29 2b 5f 30 78 34 35 61 30 65 30 2b 5f 30 78 35 38 66 32 37 38 28 30 78 32 32 63 29 2b 5f 30 78 34 66 38 64 30 31 5b 5f 30 78 35 38 66 32 37 38 28 30 78 31 63 30 29 5d 29 3b 7d 7d 6c 65 74 20 5f 30 78 32 36 35 34 30 61 3d 5f 30 78 31 35 66 30 64 65 3f 27 28 28 3f 3a 27 2b 5f 30 78 34 35 61 30 65 30 2b 5f 30 78 35 38 66 32 37 38 28 30 78 32 30 61 29 2b 5f 30 78 34 35 61 30 65 30 2b 5f 30 78 35 38 66 32 37 38 28 30 78 32 32 64 29 3a 27 28 27 2b 5f 30 78 34 35 61 30 65 30 2b 27 29 27 3b 5f Data Ascii: 8f278(0x1ae)+_0x58f278(0x23a)+'p\x20for\x20para'+_0x58f278(0x1b6)+_0x44e11f+_0x58f278(0x26c)+_0x45a0e0+_0x58f278(0x22c)+_0x4f8d01[_0x58f278(0x1c0)]);}}let _0x26540a=_0x15f0de?'((?:'+_0x45a0e0+_0x58f278(0x20a)+_0x45a0e0+_0x58f278(0x22d):'('+_0x45a0e0+')';_

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:46 UTC	607	OUT	GET /favicon.ico HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://informed.deliveryerw.top/us/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:46 UTC	975	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:46 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 32038 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:14 GMT ETag: W/"7d26-190b57e07b0" CF-Cache-Status: HIT Age: 50652 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nJKpRaoEXbAGY5ps6aSeF79HPBSZL5cZy8GrCLSn2TxSrcQ6bmOr%2BxqzEtjP0A8IoJlrJlzEl%2FDh%2FUlOXu9fyvbPGTb%2FQMPJSVvJL%2FWTCOrOglHfOVj0x%2F6N5kqbvsJjXzNRm0FX9jXQpl0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122f359f58c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1864&min_rtt=1864&rtt_var=699&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1185&delivery_rate=1566523&cwnd=238&unsent_bytes=0&cid=cd72ade9394cdfc7&ts=144&x=0"
2025-01-13 00:05:46 UTC	394	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 00 00 20 00 68 04 00 00 46 00 00 00 20 20 00 00 00 00 20 00 a8 10 00 00 ae 04 00 00 30 30 00 00 00 00 20 00 a8 25 00 00 56 15 00 00 40 40 00 00 00 00 20 00 28 42 00 00 fe 3a 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 65 32 31 1b 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 65 32 31 1b 66 33 32 51 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 51 e4 da d8 51 be a7 a5 ff 81 55 53 ff 66 33 32 ff 66 Data Ascii: hF 00 %V@@ (B:( @e21f32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qe21f32Qf32f32f32f32f32f32f32f32f32f32f32f32f32f32f32QQUSf32f
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 7f 52 50 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 51 66 33 32 51 66 33 32 ff 66 33 32 ff 66 33 32 ff 78 4b 4a ff bf aa aa ff f8 f6 f6 ff fd fc fc ff d8 c9 c7 ff 9a 76 75 ff 6b 39 38 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 51 66 33 32 51 66 33 32 ff 66 33 32 ff 66 33 32 ff 67 34 33 ff ab 8f 8e ff 86 5e 5d ff b6 9d 9d ff f0 eb eb ff ff ff ff ff ef e9 e9 ff b6 9b 9a ff 7b 4e 4c ff 66 33 32 ff 66 33 32 ff 66 33 32 51 66 33 32 51 66 33 32 ff 66 33 32 ff 66 33 32 ff 85 5c 5b ff fe fd fd ff f7 f5 f5 ff c9 b7 b6 ff 97 74 73 ff 99 77 77 ff c7 b4 b4 ff f1 ed ed ff fb f9 f9 ff cd bb b9 ff 6b 39 38 ff 66 33 32 51 66 33 32 51 66 33 32 ff 66 33 32 ff 66 33 32 ff b4 9b 9b ff ff ff ff ff ff ff ff Data Ascii: RPf32f32f32f32f32f32f32f32Qf32Qf32f32f32xKJvuk98f32f32f32f32f32Qf32Qf32f32f32g43^]{NLf32f32f32Qf32Qf32f32f32\[tswwk98f32Qf32Qf32f32f32
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 39 37 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 a1 ff ff ff 01 ff ff ff 01 fe fd fd a1 fe fd fd ff f1 eb ea ff bb a1 9f ff 7d 4e 4b ff 68 36 34 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 a1 ff ff ff 01 ff ff ff 01 a4 86 85 a1 da ce ce ff Data Ascii: 97f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32}NKh64f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: e8 ff c2 aa a7 ff 84 59 56 ff 66 33 32 ff 66 33 32 ff 66 33 32 a1 ff ff ff 01 ff ff ff 01 66 33 32 a1 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff ba a3 a2 ff fe fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff fe fe fe ff f7 f4 f4 ff d4 c6 c6 ff a0 81 80 ff 72 43 42 ff 6b 39 38 ff 7b 4f 4e ff a7 8a 8a ff d2 c4 c3 ff f7 f4 f4 ff ff ff ff ff ff ff ff ff fe fe fe ff f0 ea e9 ff 7c 4e 4c ff 66 33 32 ff 66 33 32 a1 ff ff ff 01 ff ff ff 01 66 33 32 a1 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 6b 39 38 ff e6 dd dd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb fa fa ff db cf cf ff b1 98 97 ff 8d 68 67 ff 74 45 44 ff 72 43 42 ff 8c 65 65 ff c5 Data Ascii: YVf32f32f32f32f32f32f32f32f32f32f32rCBk98{ON\|NLf32f32f32f32f32f32f32f32f32k98hgtEDrCBee
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 a1 ff ff ff 01 ff ff ff 01 fd fd fd a1 fb fa fa ff f2 ed ec ff ce b9 b6 ff b2 97 95 ff 8c 61 5e ff 73 42 3f ff 6a 38 37 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 a1 ff ff ff 01 ff ff ff 01 95 6f 6c a1 79 48 45 ff 67 34 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 Data Ascii: f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32a^sB?j87f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32olyHEg42f32f32f32f32f32f32f32f32f32f32f32f3
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 66 33 32 e3 65 32 31 f1 66 33 31 f1 66 33 32 f1 66 33 32 f1 66 33 32 f1 66 33 32 f1 66 33 32 f1 65 32 32 f1 65 32 32 f1 65 32 32 f1 66 33 32 f1 65 32 32 f1 65 32 32 f1 66 33 32 f1 65 32 32 f1 65 32 32 f1 66 33 32 f1 65 32 32 f1 66 33 32 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 66 33 32 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 66 33 32 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 65 32 31 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 66 33 31 f1 65 32 32 f1 65 32 32 f1 66 33 32 e3 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 65 32 32 f1 66 33 32 ff 66 33 32 ff 65 32 31 ff 65 32 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 Data Ascii: f32e21f31f32f32f32f32f32e22e22e22f32e22e22f32e22e22f32e22f32f31f31f31f32f31f31f31f31f32f31f31f31f31f31f31e21f31f31f31f31f31e22e22f32e22f32f32e21e22f32f32f32f32f32
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: a9 a8 f1 e9 e3 e2 ff fe fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff fb f9 f9 ff ca b3 af ff a0 7d 7b ff 75 42 3f ff 67 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 65 32 31 ff 66 33 31 ff 65 32 31 ff 65 32 31 ff 66 33 31 ff 66 33 32 ff 65 32 31 ff 66 33 32 ff 66 33 32 ff 65 32 31 ff 65 32 31 ff 65 32 32 ff 65 32 31 ff 66 33 31 ff 66 33 31 ff 65 32 31 ff 66 33 32 ff 65 32 31 ff 66 33 31 ff 66 33 31 ff 66 33 32 ff 66 33 31 ff 66 33 31 ff 66 33 31 f1 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 6a 39 38 f1 83 5a 59 ff c1 ac ac ff f6 f3 f2 ff fe fe fe ff ff ff ff ff fe fe fe ff fe fe fe ff f9 f6 f6 ff dd cf cd ff b6 99 95 ff 77 44 41 ff 68 35 34 ff 66 33 32 ff 66 33 32 ff 65 32 32 ff Data Ascii: }{uB?g32f32f32f32f32f32f32f32f32f32e21f31e21e21f31f32e21f32f32e21e21e22e21f31f31e21f32e21f31f31f32f31f31f31j98ZYwDAh54f32f32e22
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 32 ff 66 33 31 ff 65 32 31 ff 65 32 31 ff 65 32 31 ff 66 33 31 ff 6d 3d 3c ff 9a 79 78 ff cf bf be ff fa f8 f8 ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fc fa fa ff d3 c0 bd ff ac 8d 8a ff 79 47 44 ff 66 33 32 ff 66 33 31 ff 66 33 32 ff 66 33 31 ff 66 33 31 ff 66 33 32 ff 65 32 31 ff 65 32 31 ff 66 33 31 ff 65 32 31 ff 66 33 32 ff 66 33 31 ff 66 33 32 ff 65 32 31 ff 66 33 31 ff 66 33 32 ff 66 33 31 f1 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 66 33 32 f1 66 33 32 ff 66 33 32 ff 65 32 31 ff 66 33 32 ff 66 33 32 ff 65 32 32 ff 65 32 31 ff 66 33 32 ff 66 33 32 ff 65 32 31 ff 65 32 31 ff 66 33 32 ff 66 34 33 ff 6f 3f 3e ff 92 6d 6c ff d3 c5 c4 ff f3 ef ef ff fe fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff fe Data Ascii: 2f31e21e21e21f31m=<yxyGDf32f31f32f31f31f32e21e21f31e21f32f31f32e21f31f32f31f32f32f32e21f32f32e22e21f32f32e21e21f32f43o?>ml
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff f0 eb eb ff d9 cd cd ff af 95 95 ff 80 55 54 ff 67 34 33 ff 66 33 32 ff 68 36 35 ff 7a 4e 4d ff 8f 69 69 ff b3 99 98 ff d9 cd cc ff fb fa fa ff fe fe fe ff fe fe fe ff ff ff ff ff fe fe fe ff fe fe fe ff f4 ef ee ff 94 6c 69 ff 66 33 32 ff 65 32 31 ff 66 33 31 f1 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 66 33 31 f1 66 33 32 ff 66 33 32 ff 66 33 32 ff 65 32 31 ff 66 33 32 ff 65 32 31 ff 65 32 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 91 6d 6c ff f8 f5 f5 ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e8 e1 e0 ff be a8 a8 ff 97 75 Data Ascii: UTg43f32h65zNMiilif32e21f31f31f32f32f32e21f32e21e22f32f32f32mlu
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff bb a4 a4 ff b9 a1 a1 ff ca b9 b9 ff bc a7 a7 ff bc a7 a7 ff bc a7 a7 ff c3 af ae ff d1 c2 c2 ff ed e7 e7 ff fe fe fe ff e5 da d9 ff 6d 39 36 ff 65 32 31 f1 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 66 33 31 f1 65 32 31 ff 66 33 32 ff 65 32 31 ff 66 33 32 ff 66 33 31 ff 66 33 32 ff 66 33 31 ff 66 33 31 ff 65 32 31 ff 66 33 32 ff 66 33 31 ff 66 33 32 ff 66 33 32 ff 65 32 31 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 31 ff 66 33 31 ff 66 33 32 ff 66 33 31 ff 66 33 32 ff 65 32 31 ff 66 33 32 ff 65 32 31 ff 66 33 31 ff 66 33 32 ff 6f 3f 3e ff a0 80 7f ff fe fe fe ff fe fe fe Data Ascii: m96e21f31e21f32e21f32f31f32f31f31e21f32f31f32f32e21f32f32f32f32f32f32f31f31f32f31f32e21f32e21f31f32o?>

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:46 UTC	577	OUT	GET /us/assets/667bf194TeKnX.css HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://informed.deliveryerw.top/us/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:47 UTC	973	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:46 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"10d59-190b57e26f0" CF-Cache-Status: HIT Age: 50648 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sHOQe3BpWbzm7y4BMH3fgOwabhxy1QULyk2EepoL8srtZmm87T24YE4d8soy6XJkkxmNg1O4dE0lrHmqOOGSEW97AL9A%2Fu80BP%2FRo8sxKx724e9fJhrpnBejE4VcqfpEP5DEHMKoUaiMUog%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122f87bf0c461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1604&min_rtt=1592&rtt_var=621&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1155&delivery_rate=1726788&cwnd=228&unsent_bytes=0&cid=4daed79311a4d98c&ts=154&x=0"
2025-01-13 00:05:47 UTC	396	IN	Data Raw: 37 63 61 39 0d 0a 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 33 2e 31 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 39 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 39 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 3a 72 6f 6f 74 7b 2d 2d 62 6c 75 65 3a 23 30 30 37 62 66 66 3b 2d 2d 69 6e 64 69 67 6f 3a 23 36 36 31 Data Ascii: 7ca9/! Bootstrap v4.3.1 (https://getbootstrap.com/) * Copyright 2011-2019 The Bootstrap Authors * Copyright 2011-2019 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */:root{--blue:#007bff;--indigo:#661
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 66 3b 2d 2d 67 72 61 79 3a 23 36 63 37 35 37 64 3b 2d 2d 67 72 61 79 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 70 72 69 6d 61 72 79 3a 23 30 30 37 62 66 66 3b 2d 2d 73 65 63 6f 6e 64 61 72 79 3a 23 36 63 37 35 37 64 3b 2d 2d 73 75 63 63 65 73 73 3a 23 32 38 61 37 34 35 3b 2d 2d 69 6e 66 6f 3a 23 31 37 61 32 62 38 3b 2d 2d 77 61 72 6e 69 6e 67 3a 23 66 66 63 31 30 37 3b 2d 2d 64 61 6e 67 65 72 3a 23 64 63 33 35 34 35 3b 2d 2d 6c 69 67 68 74 3a 23 66 38 66 39 66 61 3b 2d 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 73 3a 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 73 6d 3a 35 37 36 70 78 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 6d 64 3a 37 36 38 70 78 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 6c 67 3a 39 39 32 Data Ascii: f;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 3a 6e 6f 74 28 5b 68 72 65 66 5d 29 3a 6e 6f 74 28 5b 74 61 62 69 6e 64 65 78 5d 29 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 30 7d 69 6d 67 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 6c 61 62 65 6c 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 3a 35 70 78 20 61 75 74 6f 20 2d 77 65 62 6b 69 74 2d 66 6f 63 75 73 2d 72 69 6e 67 2d 63 6f 6c 6f 72 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 6d 61 72 67 69 6e 3a 30 3b 66 Data Ascii: text-decoration:none;text-decoration:none}a:not([href]):not([tabindex]):focus{outline:0}img{vertical-align:middle;border-style:none}label{margin-bottom:.5rem}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input{margin:0;f
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6c 67 2d 35 7b 66 6c 65 78 3a 30 20 30 20 34 31 2e 36 36 36 36 36 37 25 3b 6d 61 78 2d 77 69 64 74 68 3a 34 31 2e 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6c 67 2d 37 7b 66 6c 65 78 3a 30 20 30 20 35 38 2e 33 33 33 33 33 33 25 3b 6d 61 78 2d 77 69 64 74 68 3a 35 38 2e 33 33 33 33 33 33 25 7d 2e 6f 72 64 65 72 2d 6c 67 2d 32 7b 6f 72 64 65 72 3a 32 7d 2e 6f 72 64 65 72 2d 6c 67 2d 31 30 7b 6f 72 64 65 72 3a 31 30 7d 7d 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 2e 33 37 35 72 65 6d 20 2e 37 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6c 69 Data Ascii: 33333%}.col-lg-5{flex:0 0 41.666667%;max-width:41.666667%}.col-lg-7{flex:0 0 58.333333%;max-width:58.333333%}.order-lg-2{order:2}.order-lg-10{order:10}}.form-control{display:block;padding:.375rem .75rem;font-weight:400;background-color:#fff;background-cli
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 77 3a 30 20 30 20 30 20 2e 32 72 65 6d 20 72 67 62 61 28 30 2c 31 32 33 2c 32 35 35 2c 2e 32 35 29 7d 2e 62 74 6e 2e 64 69 73 61 62 6c 65 64 2c 2e 62 74 6e 3a 64 69 73 61 62 6c 65 64 7b 6f 70 61 63 69 74 79 3a 2e 36 35 7d 2e 63 6f 6c 6c 61 70 73 65 3a 6e 6f 74 28 2e 73 68 6f 77 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 69 6e 70 75 74 2d 67 72 6f 75 70 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 69 6e 70 75 74 2d 67 72 6f 75 70 3e 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 7b 66 6c 65 78 3a 31 20 31 20 61 75 74 6f 3b 77 69 64 74 68 3a 31 25 7d 2e 69 6e 70 75 74 2d 67 72 6f 75 70 3e 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 Data Ascii: w:0 0 0 .2rem rgba(0,123,255,.25)}.btn.disabled,.btn:disabled{opacity:.65}.collapse:not(.show){display:none}.input-group{display:flex;flex-wrap:wrap;align-items:stretch;width:100%}.input-group>.form-control{flex:1 1 auto;width:1%}.input-group>.custom-file
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 7d 2e 6a 75 6d 62 6f 74 72 6f 6e 7b 70 61 64 64 69 6e 67 3a 32 72 65 6d 20 31 72 65 6d 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 39 65 63 65 66 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 33 72 65 6d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 7b 2e 6a 75 6d 62 6f 74 72 6f 6e 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 32 72 65 6d 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 70 72 6f 67 72 65 73 73 2d 62 61 72 2d 73 74 72 69 70 65 73 7b 30 25 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 31 72 65 6d 20 30 7d 74 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 30 7d 7d 2e 63 6c 6f 73 65 7b 66 6c 6f 61 74 3a 72 69 67 68 Data Ascii: ttom-left-radius:0}.jumbotron{padding:2rem 1rem;background-color:#e9ecef;border-radius:.3rem}@media (min-width:576px){.jumbotron{padding:4rem 2rem}}@keyframes progress-bar-stripes{0%{background-position:1rem 0}to{background-position:0 0}}.close{float:righ
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 63 61 72 6f 75 73 65 6c 2d 63 6f 6e 74 72 6f 6c 2d 6e 65 78 74 2d 69 63 6f 6e 2c 2e 63 61 72 6f 75 73 65 6c 2d 63 6f 6e 74 72 6f 6c 2d 70 72 65 76 2d 69 63 6f 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 2d 72 65 70 65 61 74 20 35 30 25 2f 31 30 30 25 20 31 30 30 25 7d 2e 63 61 72 6f 75 73 65 6c 2d 69 6e 64 69 63 61 74 6f 72 73 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 30 3b 6c 65 66 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 31 35 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 35 25 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 Data Ascii: carousel-control-next-icon,.carousel-control-prev-icon{display:inline-block;background:no-repeat 50%/100% 100%}.carousel-indicators{position:absolute;right:0;left:0;z-index:15;display:flex;justify-content:center;padding-left:0;margin-right:15%;margin-left
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 6f 70 3a 30 3b 7a 2d 69 6e 64 65 78 3a 31 30 32 30 7d 7d 2e 73 72 2d 6f 6e 6c 79 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 70 78 3b 68 65 69 67 68 74 3a 31 70 78 3b 70 61 64 64 69 6e 67 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 63 6c 69 70 3a 72 65 63 74 28 30 2c 30 2c 30 2c 30 29 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 62 6f 72 64 65 72 3a 30 7d 2e 6d 78 2d 61 75 74 6f 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 78 2d 61 75 74 6f 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 74 65 78 74 2d 6c 65 66 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 74 65 78 74 Data Ascii: op:0;z-index:1020}}.sr-only{position:absolute;width:1px;height:1px;padding:0;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}.mx-auto{margin-right:auto!important}.mx-auto{margin-left:auto!important}.text-left{text-align:left!important}.text
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 73 70 73 2d 63 6f 76 69 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 7b 2e 75 73 70 73 2d 75 70 64 61 74 65 73 2e 75 73 70 73 2d 63 6f 76 69 64 20 2e 72 6f 77 20 2e 61 72 74 69 63 6c 65 3a 6e 6f 74 28 3a 6c 61 73 74 2d 6f 66 2d 74 79 70 65 29 3a 61 66 74 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 74 69 74 6c 65 2d 61 72 65 61 2d 31 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 30 25 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 30 25 7d 7d 73 65 63 74 69 6f 6e 2e 6a 75 6d 62 6f 74 72 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 37 66 37 66 37 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 Data Ascii: sps-covid{margin-bottom:20px}@media screen and (min-width: 992px){.usps-updates.usps-covid .row .article:not(:last-of-type):after{display:none}.title-area-1{padding-left:10%;padding-right:10%}}section.jumbotron{background-color:#f7f7f7}@media (min-width:
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 2d 31 32 2e 61 72 74 69 63 6c 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6c 65 78 3a 30 20 30 20 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 66 65 61 74 75 72 65 64 2d 75 73 70 73 20 70 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 37 70 78 29 7b 2e 66 65 61 74 75 72 65 64 2d 75 73 70 73 20 2e 61 72 74 69 63 6c 65 20 68 33 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 7b 2e 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 20 69 6d 67 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 32 35 30 70 78 7d 23 75 73 70 73 2d Data Ascii: -12.article{display:block;flex:0 0 100%;max-width:100%}.featured-usps p{display:block;text-align:center}}@media screen and (max-width: 767px){.featured-usps .article h3{padding-top:30px}}@media (min-width: 992px){.carousel-item img{min-height:250px}#usps-

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:46 UTC	577	OUT	GET /us/assets/4cd1ec68TeKnX.css HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://informed.deliveryerw.top/us/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:46 UTC	969	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:46 GMT Content-Type: text/css; charset=utf-8 Content-Length: 323 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"143-190b57e26f0" CF-Cache-Status: HIT Age: 50648 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rnLgMnlKN%2FqthRDgsXL6OrF3oZKlPrXwjWQMiGqUbYEjjvsgS5jDp9CJpxQzkULoRi3EAqCpIKuRei7tq33SdCZl6DZm361navKNNkjSU%2FQx2wm%2FXm%2B2OrxRwoRDvOKA%2By2ue7kycUqnZso%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122f869f742e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1678&min_rtt=1664&rtt_var=652&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1155&delivery_rate=1641371&cwnd=240&unsent_bytes=0&cid=453477796d6812f5&ts=136&x=0"
2025-01-13 00:05:46 UTC	323	IN	Data Raw: 68 31 2e 74 69 74 6c 65 5b 64 61 74 61 2d 76 2d 66 65 35 61 65 37 33 31 5d 7b 63 6f 6c 6f 72 3a 23 32 34 35 34 39 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 64 69 76 2e 63 6f 6e 74 65 6e 74 5b 64 61 74 61 2d 76 2d 66 65 35 61 65 37 33 31 5d 7b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 32 66 32 66 32 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 7d 75 6c 5b 64 61 74 61 2d 76 2d 66 65 35 61 65 37 33 31 5d 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 64 69 73 63 20 6f 75 74 73 69 64 65 20 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 75 6c 5b 64 61 74 61 2d 76 Data Ascii: h1.title[data-v-fe5ae731]{color:#24549d;font-size:2rem;text-align:center}div.content[data-v-fe5ae731]{padding:10px;background-color:#f2f2f2;border-radius:3px}ul[data-v-fe5ae731]{list-style:disc outside none!important;list-style:initial!important}ul[data-v

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:46 UTC	554	OUT	GET /us/assets/78d59236KXMp5.js HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://informed.deliveryerw.top sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:46 UTC	990	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:46 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:24 GMT ETag: W/"88d1-190b57e2ec0" CF-Cache-Status: HIT Age: 50648 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hfvDGXhB3MWZAIn45StqOTc2r95do92JMsa%2BUha6WxBcxFuvWNuUOnnr4zcXdODxsYt5pzSfyeNHEY99OWOIpgq%2BNJM3zP8FkN9tYoEYoOTxTczY%2BeGcEyLKMIIrT7h%2F7WlcOfUIgrjarjA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122f86edb8cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1985&min_rtt=1979&rtt_var=754&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1132&delivery_rate=1439132&cwnd=244&unsent_bytes=0&cid=35cb46ef2b54ae37&ts=133&x=0"
2025-01-13 00:05:46 UTC	379	IN	Data Raw: 37 63 39 39 0d 0a 76 61 72 20 61 31 39 5f 30 78 65 64 64 35 37 36 3d 61 31 39 5f 30 78 31 36 61 35 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 35 66 30 63 61 2c 5f 30 78 35 32 30 36 64 33 29 7b 76 61 72 20 5f 30 78 33 37 34 38 61 39 3d 61 31 39 5f 30 78 31 36 61 35 2c 5f 30 78 32 34 63 32 61 35 3d 5f 30 78 32 35 66 30 63 61 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 34 34 65 34 30 63 3d 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 37 34 38 61 39 28 30 78 65 64 29 29 2f 30 78 31 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 37 34 38 61 39 28 30 78 31 34 34 29 29 2f 30 78 32 2a 28 70 61 72 73 65 49 6e 74 28 5f 30 78 33 37 34 38 61 39 28 30 78 31 62 35 29 29 2f 30 78 33 29 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 33 37 34 38 61 Data Ascii: 7c99var a19_0xedd576=a19_0x16a5;(function(_0x25f0ca,_0x5206d3){var _0x3748a9=a19_0x16a5,_0x24c2a5=_0x25f0ca();while(!![]){try{var _0x44e40c=-parseInt(_0x3748a9(0xed))/0x1+-parseInt(_0x3748a9(0x144))/0x2*(parseInt(_0x3748a9(0x1b5))/0x3)+parseInt(_0x3748a
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 38 61 39 28 30 78 31 61 30 29 29 2f 30 78 38 2a 28 70 61 72 73 65 49 6e 74 28 5f 30 78 33 37 34 38 61 39 28 30 78 31 38 30 29 29 2f 30 78 39 29 3b 69 66 28 5f 30 78 34 34 65 34 30 63 3d 3d 3d 5f 30 78 35 32 30 36 64 33 29 62 72 65 61 6b 3b 65 6c 73 65 20 5f 30 78 32 34 63 32 61 35 5b 27 70 75 73 68 27 5d 28 5f 30 78 32 34 63 32 61 35 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 63 61 74 63 68 28 5f 30 78 32 38 39 38 33 37 29 7b 5f 30 78 32 34 63 32 61 35 5b 27 70 75 73 68 27 5d 28 5f 30 78 32 34 63 32 61 35 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 7d 7d 28 61 31 39 5f 30 78 31 37 31 35 2c 30 78 34 35 61 66 34 29 29 3b 69 6d 70 6f 72 74 7b 6c 20 61 73 20 61 31 39 5f 30 78 35 32 35 30 32 63 2c 5f 20 61 73 20 61 31 39 5f 30 78 34 34 34 36 66 65 7d 66 72 6f 6d Data Ascii: 8a9(0x1a0))/0x8*(parseInt(_0x3748a9(0x180))/0x9);if(_0x44e40c===_0x5206d3)break;else _0x24c2a5['push'](_0x24c2a5['shift']());}catch(_0x289837){_0x24c2a5['push'](_0x24c2a5['shift']());}}}(a19_0x1715,0x45af4));import{l as a19_0x52502c,_ as a19_0x4446fe}from
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 27 2c 27 6c 61 73 75 74 6f 70 66 68 76 27 2c 27 6f 70 73 27 2c 27 55 6e 6b 6e 6f 77 6e 27 2c 27 72 69 6e 67 43 6f 6e 74 65 78 27 2c 27 63 6f 6e 6e 65 63 74 27 2c 27 5f 5f 77 65 62 64 72 69 76 65 27 2c 27 63 68 72 6f 6d 69 75 6d 27 2c 27 72 5f 65 76 61 6c 75 61 74 65 27 2c 27 77 69 6e 64 6f 77 2e 4e 6f 74 27 2c 27 6f 70 65 72 61 27 2c 27 70 72 6f 74 6f 74 79 70 65 27 2c 27 76 61 6c 75 65 27 2c 27 24 63 68 72 6f 6d 65 5f 61 73 27 2c 27 61 67 65 27 2c 27 74 72 79 73 27 2c 27 74 6f 4c 6f 77 65 72 43 61 73 27 2c 27 64 65 74 65 63 74 27 2c 27 75 61 67 65 27 2c 27 6f 6e 50 65 72 6d 69 73 73 69 27 2c 27 43 53 53 50 72 69 6d 69 74 69 27 2c 27 6e 61 6d 65 27 2c 27 67 65 62 27 2c 27 65 66 69 6e 65 64 27 2c 27 5c 78 32 30 6e 6f 74 5c 78 32 30 61 5c 78 32 30 66 75 6e Data Ascii: ','lasutopfhv','ops','Unknown','ringContex','connect','__webdrive','chromium','r_evaluate','window.Not','opera','prototype','value','$chrome_as','age','trys','toLowerCas','detect','uage','onPermissi','CSSPrimiti','name','geb','efined','\x20not\x20a\x20fun
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 27 2c 27 76 65 72 73 69 6f 6e 73 27 2c 27 62 75 69 6c 64 49 44 27 2c 27 5c 78 32 30 75 6e 65 78 70 65 63 74 65 27 2c 27 79 6e 63 53 63 72 69 70 74 49 27 2c 27 77 65 62 6b 69 74 27 2c 27 43 65 66 53 68 61 72 70 27 2c 27 77 65 62 64 72 69 76 65 72 27 2c 27 73 74 61 72 74 73 57 69 74 68 27 2c 27 64 61 74 61 49 64 27 2c 27 6f 72 69 6e 67 27 2c 27 57 65 62 44 72 69 76 65 72 49 27 2c 27 41 77 65 73 6f 6d 69 75 6d 27 2c 27 77 69 6e 64 6f 77 2e 65 78 74 27 2c 27 43 6c 61 73 73 5c 78 32 30 65 78 74 65 27 2c 27 73 5c 78 32 30 6e 6f 74 5c 78 32 30 61 5c 78 32 30 66 75 27 2c 27 4e 69 67 68 74 6d 61 72 65 4a 27 2c 27 74 5c 78 32 30 61 5c 78 32 30 66 75 6e 63 74 69 27 2c 27 52 45 4e 44 45 52 45 52 27 2c 27 42 72 69 61 6e 5c 78 32 30 50 61 75 6c 27 2c 27 5c 78 32 30 69 Data Ascii: ','versions','buildID','\x20unexpecte','yncScriptI','webkit','CefSharp','webdriver','startsWith','dataId','oring','WebDriverI','Awesomium','window.ext','Class\x20exte','s\x20not\x20a\x20fu','NightmareJ','t\x20a\x20functi','RENDERER','Brian\x20Paul','\x20i
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 27 2c 27 65 74 65 72 5c 78 32 30 69 73 5c 78 32 30 6e 6f 27 2c 27 72 6e 61 6c 27 2c 27 63 6f 64 65 27 2c 27 6e 63 65 27 2c 27 72 74 74 27 2c 27 6c 65 53 79 73 74 65 6d 55 52 27 2c 27 4d 6f 7a 41 70 70 65 61 72 61 27 2c 27 2e 2f 66 36 31 37 30 66 62 62 27 2c 27 5f 65 76 61 6c 75 61 74 65 27 2c 27 2e 72 74 74 5c 78 32 30 69 73 5c 78 32 30 75 6e 27 2c 27 48 54 4d 4c 43 61 6e 76 61 73 27 2c 27 5f 5f 61 70 70 5f 73 65 74 74 27 2c 27 6d 65 73 73 61 67 65 27 2c 27 63 72 65 61 74 65 45 6c 65 6d 27 2c 27 64 5c 78 32 30 62 65 68 61 76 69 6f 75 27 2c 27 64 6f 6d 41 75 74 6f 6d 61 74 27 2c 27 77 69 6e 64 6f 77 53 69 7a 65 27 2c 27 52 75 6e 50 65 72 66 54 65 73 27 2c 27 48 65 61 64 6c 65 73 73 43 68 27 2c 27 64 65 6e 79 21 21 21 27 2c 27 6f 6e 6f 72 69 65 6e 74 61 74 Data Ascii: ','eter\x20is\x20no','rnal','code','nce','rtt','leSystemUR','MozAppeara','./f6170fbb','_evaluate','.rtt\x20is\x20un','HTMLCanvas','__app_sett','message','createElem','d\x20behaviou','domAutomat','windowSize','RunPerfTes','HeadlessCh','deny!!!','onorientat
2025-01-13 00:05:46 UTC	1369	IN	Data Raw: 39 7c 7c 28 5f 30 78 33 61 65 63 63 39 3d 50 72 6f 6d 69 73 65 29 29 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 64 64 34 39 64 61 2c 5f 30 78 32 38 63 32 33 63 29 7b 76 61 72 20 5f 30 78 31 62 65 38 64 31 3d 61 31 39 5f 30 78 31 36 61 35 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 34 38 64 66 33 66 28 5f 30 78 32 65 62 31 32 38 29 7b 74 72 79 7b 5f 30 78 33 39 64 31 36 64 28 5f 30 78 39 34 36 62 31 36 5b 27 6e 65 78 74 27 5d 28 5f 30 78 32 65 62 31 32 38 29 29 3b 7d 63 61 74 63 68 28 5f 30 78 33 61 64 38 63 38 29 7b 5f 30 78 32 38 63 32 33 63 28 5f 30 78 33 61 64 38 63 38 29 3b 7d 7d 66 75 6e 63 74 69 6f 6e 20 5f 30 78 31 63 31 37 62 64 28 5f 30 78 35 62 65 30 38 39 29 7b 74 72 79 7b 5f 30 78 33 39 64 31 36 64 28 5f 30 78 39 34 36 62 31 36 5b 27 74 68 72 6f 77 27 Data Ascii: 9\|\|(_0x3aecc9=Promise))(function(_0xdd49da,_0x28c23c){var _0x1be8d1=a19_0x16a5;function _0x48df3f(_0x2eb128){try{_0x39d16d(_0x946b16['next'](_0x2eb128));}catch(_0x3ad8c8){_0x28c23c(_0x3ad8c8);}}function _0x1c17bd(_0x5be089){try{_0x39d16d(_0x946b16['throw'
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 64 31 37 64 33 3d 5f 30 78 36 39 63 64 37 36 5b 30 78 30 5d 26 30 78 32 3f 5f 30 78 34 61 37 36 37 35 5b 27 72 65 74 75 72 6e 27 5d 3a 5f 30 78 36 39 63 64 37 36 5b 30 78 30 5d 3f 5f 30 78 34 61 37 36 37 35 5b 5f 30 78 32 32 32 37 31 34 28 30 78 31 33 39 29 5d 7c 7c 28 28 5f 30 78 35 64 31 37 64 33 3d 5f 30 78 34 61 37 36 37 35 5b 5f 30 78 32 32 32 37 31 34 28 30 78 65 35 29 5d 29 26 26 5f 30 78 35 64 31 37 64 33 5b 5f 30 78 32 32 32 37 31 34 28 30 78 65 31 29 5d 28 5f 30 78 34 61 37 36 37 35 29 2c 30 78 30 29 3a 5f 30 78 34 61 37 36 37 35 5b 5f 30 78 32 32 32 37 31 34 28 30 78 31 34 63 29 5d 29 26 26 21 28 5f 30 78 35 64 31 37 64 33 3d 5f 30 78 35 64 31 37 64 33 5b 27 63 61 6c 6c 27 5d 28 5f 30 78 34 61 37 36 37 35 2c 5f 30 78 36 39 63 64 37 36 5b 30 78 Data Ascii: d17d3=_0x69cd76[0x0]&0x2?_0x4a7675['return']:_0x69cd76[0x0]?_0x4a7675[_0x222714(0x139)]\|\|((_0x5d17d3=_0x4a7675[_0x222714(0xe5)])&&_0x5d17d3[_0x222714(0xe1)](_0x4a7675),0x0):_0x4a7675[_0x222714(0x14c)])&&!(_0x5d17d3=_0x5d17d3['call'](_0x4a7675,_0x69cd76[0x
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 5d 26 26 5f 30 78 32 38 39 30 62 31 5b 5f 30 78 32 32 32 37 31 34 28 30 78 31 35 66 29 5d 5b 5f 30 78 32 32 32 37 31 34 28 30 78 31 38 66 29 5d 28 29 2c 5f 30 78 32 38 39 30 62 31 5b 27 74 72 79 73 27 5d 5b 5f 30 78 32 32 32 37 31 34 28 30 78 31 38 66 29 5d 28 29 3b 63 6f 6e 74 69 6e 75 65 3b 7d 5f 30 78 36 39 63 64 37 36 3d 5f 30 78 32 36 61 38 37 39 5b 27 63 61 6c 6c 27 5d 28 5f 30 78 31 33 62 65 32 32 2c 5f 30 78 32 38 39 30 62 31 29 3b 7d 63 61 74 63 68 28 5f 30 78 34 64 63 61 30 37 29 7b 5f 30 78 36 39 63 64 37 36 3d 5b 30 78 36 2c 5f 30 78 34 64 63 61 30 37 5d 2c 5f 30 78 34 61 37 36 37 35 3d 30 78 30 3b 7d 66 69 6e 61 6c 6c 79 7b 5f 30 78 61 66 63 36 64 33 3d 5f 30 78 35 64 31 37 64 33 3d 30 78 30 3b 7d 69 66 28 5f 30 78 36 39 63 64 37 36 5b 30 78 Data Ascii: ]&&_0x2890b1[_0x222714(0x15f)][_0x222714(0x18f)](),_0x2890b1['trys'][_0x222714(0x18f)]();continue;}_0x69cd76=_0x26a879['call'](_0x13be22,_0x2890b1);}catch(_0x4dca07){_0x69cd76=[0x6,_0x4dca07],_0x4a7675=0x0;}finally{_0xafc6d3=_0x5d17d3=0x0;}if(_0x69cd76[0x
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 73 43 68 72 6f 6d 65 27 3a 61 31 39 5f 30 78 65 64 64 35 37 36 28 30 78 63 65 29 2b 61 31 39 5f 30 78 65 64 64 35 37 36 28 30 78 65 30 29 2c 27 55 6e 6b 6e 6f 77 6e 27 3a 61 31 39 5f 30 78 65 64 64 35 37 36 28 30 78 65 62 29 7d 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 64 35 34 30 38 29 7b 76 61 72 20 5f 30 78 31 38 65 64 34 39 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 35 34 38 35 65 35 3d 21 21 5b 5d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 66 66 62 65 64 2c 5f 30 78 32 65 62 32 61 62 29 7b 76 61 72 20 5f 30 78 35 37 39 64 36 34 3d 5f 30 78 35 34 38 35 65 35 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 5f 30 78 32 65 62 32 61 62 29 7b 76 61 72 20 5f 30 78 32 32 62 39 66 66 3d 5f 30 78 32 65 62 32 61 62 5b 27 Data Ascii: sChrome':a19_0xedd576(0xce)+a19_0xedd576(0xe0),'Unknown':a19_0xedd576(0xeb)},c=function(_0x2d5408){var _0x18ed49=(function(){var _0x5485e5=!![];return function(_0x2ffbed,_0x2eb2ab){var _0x579d64=_0x5485e5?function(){if(_0x2eb2ab){var _0x22b9ff=_0x2eb2ab['
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 38 29 7b 72 65 74 75 72 6e 20 5f 30 78 37 30 31 64 65 32 5b 27 69 6e 64 65 78 4f 66 27 5d 28 5f 30 78 32 34 37 38 33 38 29 21 3d 3d 2d 30 78 31 3b 7d 66 75 6e 63 74 69 6f 6e 20 77 28 5f 30 78 32 38 64 39 38 65 2c 5f 30 78 32 35 63 36 31 66 29 7b 76 61 72 20 5f 30 78 38 38 35 30 61 38 3d 61 31 39 5f 30 78 65 64 64 35 37 36 3b 72 65 74 75 72 6e 20 5f 30 78 32 38 64 39 38 65 5b 5f 30 78 38 38 35 30 61 38 28 30 78 31 32 63 29 5d 28 5f 30 78 32 35 63 36 31 66 29 21 3d 3d 2d 30 78 31 3b 7d 66 75 6e 63 74 69 6f 6e 20 49 28 5f 30 78 34 36 34 65 31 64 2c 5f 30 78 32 63 33 33 33 35 29 7b 76 61 72 20 5f 30 78 62 39 35 63 33 39 3d 61 31 39 5f 30 78 65 64 64 35 37 36 3b 69 66 28 5f 30 78 62 39 35 63 33 39 28 30 78 31 62 61 29 69 6e 20 5f 30 78 34 36 34 65 31 64 29 72 Data Ascii: 8){return _0x701de2['indexOf'](_0x247838)!==-0x1;}function w(_0x28d98e,_0x25c61f){var _0x8850a8=a19_0xedd576;return _0x28d98e[_0x8850a8(0x12c)](_0x25c61f)!==-0x1;}function I(_0x464e1d,_0x2c3335){var _0xb95c39=a19_0xedd576;if(_0xb95c39(0x1ba)in _0x464e1d)r

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:05:46 UTC	554	OUT	GET /us/assets/09bf01f8KXMp5.js HTTP/1.1 Host: informed.deliveryerw.top Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://informed.deliveryerw.top sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 00:05:47 UTC	991	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 00:05:46 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"7f7-190b57e26f0" CF-Cache-Status: HIT Age: 50648 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N1BfdxxJ9a6TgxMUjBqqyAj64B00fmiPHA32iXTO1feS7u%2B7SUiGzmr%2Bgw%2BcRaZ9p1Y364KaS3L9320JV3cJB42BFENGvW2iPncdZg5B%2B8aDYvrAvDAam%2FEvIQXVkhFaNpb9v57q8NnMdgQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901122f87ab9c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1457&min_rtt=1448&rtt_var=562&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1132&delivery_rate=1914754&cwnd=214&unsent_bytes=0&cid=b7aa7f5f5d82f3e7&ts=158&x=0"
2025-01-13 00:05:47 UTC	378	IN	Data Raw: 37 66 37 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 39 30 61 32 30 34 2c 5f 30 78 33 61 31 32 32 34 29 7b 63 6f 6e 73 74 20 5f 30 78 35 61 32 62 35 66 3d 61 30 5f 30 78 31 35 66 35 2c 5f 30 78 32 32 39 38 36 65 3d 5f 30 78 39 30 61 32 30 34 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 63 6f 6e 73 74 20 5f 30 78 31 30 37 61 36 38 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 61 32 62 35 66 28 30 78 31 34 64 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 35 61 32 62 35 66 28 30 78 31 34 36 29 29 2f 30 78 32 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 61 32 62 35 66 28 30 78 31 34 32 29 29 2f 30 78 33 2a 28 70 61 72 73 65 49 6e 74 28 5f 30 78 35 61 32 62 35 66 28 30 78 31 34 63 29 29 2f 30 78 34 29 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 Data Ascii: 7f7(function(_0x90a204,_0x3a1224){const _0x5a2b5f=a0_0x15f5,_0x22986e=_0x90a204();while(!![]){try{const _0x107a68=parseInt(_0x5a2b5f(0x14d))/0x1+parseInt(_0x5a2b5f(0x146))/0x2+-parseInt(_0x5a2b5f(0x142))/0x3*(parseInt(_0x5a2b5f(0x14c))/0x4)+parseInt(_0x
2025-01-13 00:05:47 UTC	1369	IN	Data Raw: 74 28 5f 30 78 35 61 32 62 35 66 28 30 78 31 34 30 29 29 2f 30 78 39 29 3b 69 66 28 5f 30 78 31 30 37 61 36 38 3d 3d 3d 5f 30 78 33 61 31 32 32 34 29 62 72 65 61 6b 3b 65 6c 73 65 20 5f 30 78 32 32 39 38 36 65 5b 27 70 75 73 68 27 5d 28 5f 30 78 32 32 39 38 36 65 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 63 61 74 63 68 28 5f 30 78 34 62 61 66 65 32 29 7b 5f 30 78 32 32 39 38 36 65 5b 27 70 75 73 68 27 5d 28 5f 30 78 32 32 39 38 36 65 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 7d 7d 28 61 30 5f 30 78 32 30 65 35 2c 30 78 65 31 65 35 31 29 29 3b 63 6f 6e 73 74 20 61 30 5f 30 78 35 61 33 37 36 38 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 5f 30 78 35 32 66 63 62 32 3d 21 21 5b 5d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 30 37 39 Data Ascii: t(_0x5a2b5f(0x140))/0x9);if(_0x107a68===_0x3a1224)break;else _0x22986e['push'](_0x22986e['shift']());}catch(_0x4bafe2){_0x22986e['push'](_0x22986e['shift']());}}}(a0_0x20e5,0xe1e51));const a0_0x5a3768=(function(){let _0x52fcb2=!![];return function(_0x1079
2025-01-13 00:05:47 UTC	299	IN	Data Raw: 69 6e 67 27 2c 27 63 6c 69 63 6b 27 2c 27 68 72 65 66 27 2c 27 72 65 6d 6f 76 65 27 2c 27 37 34 31 33 38 34 62 51 43 71 68 73 27 2c 27 28 28 28 2e 2b 29 2b 29 2b 29 27 2c 27 31 34 37 32 34 33 6c 63 79 70 45 54 27 2c 27 73 65 61 72 63 68 27 2c 27 34 30 45 42 49 61 67 52 27 2c 27 61 70 70 65 6e 64 27 2c 27 33 30 38 33 35 33 34 4f 42 75 5a 6d 69 27 2c 27 37 31 36 30 35 39 35 69 68 4a 4f 73 63 27 2c 27 31 30 35 38 37 39 36 36 6f 41 47 6c 45 49 27 2c 27 72 65 6c 27 2c 27 33 32 33 32 30 32 36 4b 48 44 41 71 78 27 2c 27 6e 6f 6f 70 65 6e 65 72 27 2c 27 39 36 69 46 69 4d 48 47 27 2c 27 31 37 36 37 35 38 32 50 6e 57 51 59 42 27 2c 27 63 6f 6e 73 74 72 75 63 74 6f 27 2c 27 63 72 65 61 74 65 45 6c 65 6d 27 5d 3b 61 30 5f 30 78 32 30 65 35 3d 66 75 6e 63 74 69 6f 6e Data Ascii: ing','click','href','remove','741384bQCqhs','(((.+)+)+)','147243lcypET','search','40EBIagR','append','3083534OBuZmi','7160595ihJOsc','10587966oAGlEI','rel','3232026KHDAqx','noopener','96iFiMHG','1767582PnWQYB','constructo','createElem'];a0_0x20e5=function
2025-01-13 00:05:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0