Edit tour

Windows Analysis Report
https://us-usps-tsgczt.xyz/update/

Overview

General Information

Sample URL:	https://us-usps-tsgczt.xyz/update/
Analysis ID:	1526980
Tags:	openphish
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

HTML page contains obfuscated javascript

Performs DNS queries to domains with low reputation

Found iframes

HTML title does not match URL

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2012,i,1924874784246851968,15152242601922119156,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-usps-tsgczt.xyz/update/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /api/MC45MDI2NTcxNTA2MDk3ODg5 HTTP/1.1Host: us-usps-tsgczt.xyzConnection: keep-aliveContent-Length: 292sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/encryptAccept: */*Origin: https://us-usps-tsgczt.xyzSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://us-usps-tsgczt.xyz/update/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	HTTP Parser: Iframe src: //www.googletagmanager.com/ns.html?id=GTM-MVCC8H
Source: https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	HTTP Parser: Iframe src: https://3976941.fls.doubleclick.net/activityi;src=3976941;type=fy18r0;cat=click0;ord=694729575341;npa=0;auiddc=806361745.1728233476;ps=1;pcor=1439625517;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a20v9190898584z878733333za201zb78733333;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Freg.usps.com%2Fentreg%2FLoginAction_input%3Fapp%3DGSS%26appURL%3Dhttps%3A%2F%2Fcns.usps.com%2F?
Source: https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=3976941;type=fy18r0;cat=click0;ord=694729575341;npa=0;auiddc=806361745.1728233476;ps=1;pcor=1439625517;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a20v9190898584z878733333za201zb78733333;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Freg.usps.com%2Fentreg%2FLoginAction_input%3Fapp%3DGSS%26appURL%3Dhttps%3A%2F%2Fcns.usps.com%2F?
Source: https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	HTTP Parser: Iframe src: //www.googletagmanager.com/ns.html?id=GTM-MVCC8H
Source: https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	HTTP Parser: Iframe src: https://3976941.fls.doubleclick.net/activityi;src=3976941;type=fy18r0;cat=click0;ord=694729575341;npa=0;auiddc=806361745.1728233476;ps=1;pcor=1439625517;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a20v9190898584z878733333za201zb78733333;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Freg.usps.com%2Fentreg%2FLoginAction_input%3Fapp%3DGSS%26appURL%3Dhttps%3A%2F%2Fcns.usps.com%2F?
Source: https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=3976941;type=fy18r0;cat=click0;ord=694729575341;npa=0;auiddc=806361745.1728233476;ps=1;pcor=1439625517;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a20v9190898584z878733333za201zb78733333;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Freg.usps.com%2Fentreg%2FLoginAction_input%3Fapp%3DGSS%26appURL%3Dhttps%3A%2F%2Fcns.usps.com%2F?

Source: https://us-usps-tsgczt.xyz/update/	HTTP Parser: No favicon
Source: https://us-usps-tsgczt.xyz/update/	HTTP Parser: No favicon
Source: https://us-usps-tsgczt.xyz/update/	HTTP Parser: No favicon
Source: https://store.usps.com/store/results/free-shipping-supplies/shipping-supplies/_/N-alnx4jZ7d0v8v	HTTP Parser: No favicon
Source: https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	HTTP Parser: No favicon

Source: https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49755 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-tsgczt.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-tsgczt.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-tsgczt.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-tsgczt.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-tsgczt.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-tsgczt.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_635.2.dr	String found in binary or memory: <a href="https://www.facebook.com/USPS?rf=108501355848630" target="_blank" tabindex="0"> equals www.facebook.com (Facebook)
Source: chromecache_635.2.dr	String found in binary or memory: <a href="https://www.youtube.com/usps" target="_blank" tabindex="0" class="social-youtube"> equals www.youtube.com (Youtube)
Source: chromecache_332.2.dr, chromecache_340.2.dr	String found in binary or memory: <img alt="Image of Facebook social media icon." src="https://www.usps.com/global-elements/footer/images/facebook_logo.png"> equals www.facebook.com (Facebook)
Source: chromecache_332.2.dr, chromecache_340.2.dr	String found in binary or memory: <img alt="Image of Youtube social media icon." src="https://www.usps.com/global-elements/footer/images/youtube_logo.png"> equals www.youtube.com (Youtube)
Source: chromecache_332.2.dr, chromecache_340.2.dr	String found in binary or memory: <a target="_blank" style="text-decoration: none;" href="https://www.facebook.com/USPS?rf=108501355848630"> equals www.facebook.com (Facebook)
Source: chromecache_332.2.dr, chromecache_340.2.dr	String found in binary or memory: <a target="_blank" style="text-decoration: none;" href="https://www.youtube.com/usps"> equals www.youtube.com (Youtube)
Source: chromecache_804.2.dr, chromecache_653.2.dr, chromecache_418.2.dr, chromecache_584.2.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=zb()},nd:function(){d()}}};var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_663.2.dr, chromecache_489.2.dr	String found in binary or memory: e.page_referrer=C(document.referrer):document.referrer,e=z(F(e),"default");e=N(e);e=O(e);E("config",c.GWT_GA4ID[a],e)}y?H({search_term:y}):""})();var S=1;if(c.YOUTUBE){G=document.createElement("script");G.src="https://www.youtube.com/iframe_api";A=document.getElementsByTagName("script")[0];A.parentNode.insertBefore(G,A);var D=[],p=[],v=[],B=c.YT_MILESTONE,L=[];onYouTubeIframeAPIReady=function(){for(var a=0;a<D.length;a++)p[a]=new YT.Player(D[a],{events:{onReady:onPlayerReady,onStateChange:onPlayerStateChange, equals www.youtube.com (Youtube)
Source: chromecache_804.2.dr, chromecache_653.2.dr, chromecache_418.2.dr, chromecache_584.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={hh:e,fh:f,gh:g,Rh:k,Sh:m,He:n,Cb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(WC(w,"iframe_api")\|\|WC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!NC&&UC(x[A],p.He))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_828.2.dr, chromecache_410.2.dr, chromecache_333.2.dr, chromecache_443.2.dr, chromecache_300.2.dr, chromecache_335.2.dr, chromecache_619.2.dr, chromecache_318.2.dr, chromecache_824.2.dr, chromecache_799.2.dr, chromecache_890.2.dr, chromecache_775.2.dr	String found in binary or memory: return b}JC.F="internal.enableAutoEventOnTimer";var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_410.2.dr, chromecache_799.2.dr	String found in binary or memory: var YB=function(a,b,c,d,e){var f=Pz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Pz("fsl","nv.ids",[]):Pz("fsl","ids",[]);if(!g.length)return!0;var k=Uz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!Cy(k,Ey(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: us-usps-tsgczt.xyz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: moversguide.usps.com
Source: global traffic	DNS traffic detected: DNS query: store.usps.com
Source: global traffic	DNS traffic detected: DNS query: www.usps.com
Source: global traffic	DNS traffic detected: DNS query: fast.fonts.net
Source: global traffic	DNS traffic detected: DNS query: dap.digitalgov.gov
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: resources.digital-cloud-gov.medallia.com
Source: global traffic	DNS traffic detected: DNS query: cns.usps.com
Source: global traffic	DNS traffic detected: DNS query: reg.usps.com
Source: global traffic	DNS traffic detected: DNS query: 3976941.fls.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: adservice.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Sun, 06 Oct 2024 16:50:16 GMTTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Sun, 06 Oct 2024 16:50:22 GMTTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Sun, 06 Oct 2024 16:50:28 GMTTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2012,i,1924874784246851968,15152242601922119156,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-usps-tsgczt.xyz/update/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2012,i,1924874784246851968,15152242601922119156,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
http://malsup.com/jquery/block/	0%	URL Reputation	safe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Name	IP	Active	Malicious	Reputation
dart.l.doubleclick.net	142.250.186.38	true	false	unknown
ad.doubleclick.net	142.250.181.230	true	false	unknown
d27f3qgc9anoq2.cloudfront.net	108.156.60.13	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.34	true	false	unknown
adservice.google.com	142.250.185.130	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
stats.g.doubleclick.net	142.250.110.155	true	false	unknown
cs1799.wpc.upsiloncdn.net	192.229.221.165	true	false	unknown
fast.fonts.net	104.16.40.28	true	false	unknown
us-usps-tsgczt.xyz	170.106.137.178	true	true	unknown
s-part-0036.t-0009.t-msedge.net	13.107.246.64	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
td.doubleclick.net	142.250.186.34	true	false	unknown
reg.usps.com	unknown	unknown	false	unknown
3976941.fls.doubleclick.net	unknown	unknown	false	unknown
resources.digital-cloud-gov.medallia.com	unknown	unknown	false	unknown
store.usps.com	unknown	unknown	false	unknown
dap.digitalgov.gov	unknown	unknown	false	unknown
www.usps.com	unknown	unknown	false	unknown
cns.usps.com	unknown	unknown	false	unknown
moversguide.usps.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://www.usps.com/test/nav/images/business.svg	false	unknown
https://www.usps.com/international/go-now.png	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlOaI&sid=ekVPf_fQXKARaBX0AJgN	false	unknown
https://us-usps-tsgczt.xyz/update/assets/da2e0f69TeKnX.svg	true	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/request.js	false	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/touch.js	false	unknown
https://store.usps.com/media/psm/css/ps.css	false	unknown
https://www.usps.com/store/images/ps-subicon-supplies.png	false	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/_base/declare.js	false	unknown
https://www.usps.com/assets/images/home/change_address.svg	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlUmH	false	unknown
https://www.usps.com/assets/images/home/printcustomsforms.svg	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlM0_&sid=wJdZ-VIMBz-v-9z2AJgH	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlPo8&sid=FW24sJg3_cpF-KHCAJgQ	false	unknown
https://cns.usps.com/scripts/molasses.js	false	unknown
https://us-usps-tsgczt.xyz/update/assets/ae1f038aTeKnX.svg	true	unknown
https://reg.usps.com/entreg/assets/css/vendor/bootstrap/3.4.1/theme.css	false	unknown
https://cns.usps.com/global-elements/footer/css/footer-sb.css	false	unknown
https://www.usps.com/store/images/ps-subicon-cards.png	false	unknown
https://us-usps-tsgczt.xyz/update/assets/dc6d90ceKXMp5.js	true	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/_base/config.js	false	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/_base/browser.js	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlN9d&sid=7HIbvq0qPb_Bu7VVAJgK	false	unknown
https://www.usps.com/ecp/asset/images/O_FRB2-T0.jpg	false	unknown
https://www.usps.com/store/images/ps-subicon-business.png	false	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/dom-attr.js	false	unknown
https://us-usps-tsgczt.xyz/update/layout/images/63.png	true	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlNNw&sid=7HIbvq0qPb_Bu7VVAJgK	false	unknown
https://www.usps.com/ecp/asset/images/EP14PE-T0.jpg	false	unknown
https://store.usps.com/media/psm/script/popper.min.js	false	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/topic.js	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=websocket&sid=WMA22iQui3LE8nj_AJgT	false	unknown
https://www.usps.com/store/images/br_down.png	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlRZ7&sid=SVkQhtT64gZ0xcCFAJgW	false	unknown
https://store.usps.com/media/endeca/store/script/store-init.js	false	unknown
https://us-usps-tsgczt.xyz/update/assets/c27b6911KXMp5.js	true	unknown
https://www.usps.com/assets/images/home/free_boxes.svg	false	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/dom-form.js	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlaZ7&sid=DnbcUMDaPnxv-dw7AJgo	false	unknown
https://www.usps.com/ecp/asset/images/BOX_CREKIT1-T0.jpg	false	unknown
https://us-usps-tsgczt.xyz/update/assets/667bf194TeKnX.css	true	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/_base/lang.js	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlQXU&sid=WMA22iQui3LE8nj_AJgT	false	unknown
https://www.usps.com/manage/go-now.png	false	unknown
https://www.usps.com/global-elements/header/images/utility-header/mailman.svg	false	unknown
https://www.usps.com/assets/script/home/megamenu-additions.js	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=websocket&sid=HJf4QvZW6qN8unzcAJgE	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlVxi&sid=uvM0AksHTDnGB8veAJgf	false	unknown
https://reg.usps.com/entreg/LoginAction_input?app=GSS&appURL=https://cns.usps.com/	false	unknown
https://us-usps-tsgczt.xyz/update/assets/ffd7af61TeKnX.woff	true	unknown
https://www.usps.com/assets/images/home/holdmail.svg	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlOAK	false	unknown
https://us-usps-tsgczt.xyz/api/MC4wNDI4NDI5NjQ2NzI1NDQ3OA==	false	unknown
https://store.usps.com/external/scripts/dijit-1.9.7/_Container.js	false	unknown
https://reg.usps.com/entreg/assets/images/footer/footer-logo.png	false	unknown
https://cns.usps.com/global-elements/footer/script/jquery-3.7.1.js	false	unknown
https://store.usps.com/external/scripts/dojo-1.9.7/errors/create.js	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlZ4w&sid=4EhXSNnS_EJvzB5EAJgl	false	unknown
https://www.usps.com/assets/images/default/info-icon.svg	false	unknown
https://us-usps-tsgczt.xyz/update/layout/images/46.svg	true	unknown
https://www.usps.com/ecp/asset/images/EP_13_F-T0.jpg	false	unknown
https://us-usps-tsgczt.xyz/socket.io/?EIO=4&transport=polling&t=P9YlPan&sid=FW24sJg3_cpF-KHCAJgQ	false	unknown
https://us-usps-tsgczt.xyz/update/assets/c12815f2TeKnX.svg	true	unknown
https://www.usps.com/assets/fonts/4a9c62ab-b359-4081-8383-a0d1cdebd111.woff	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.youtube.com/usps	chromecache_635.2.dr, chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/assets/images/default/right-arrow-inactive.png);	chromecache_451.2.dr, chromecache_643.2.dr	false		unknown
https://www.usps.com/store/images/ps-plus.png);	chromecache_557.2.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_832.2.dr, chromecache_554.2.dr	false	URL Reputation: safe	unknown
https://store.usps.com/store	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/search/results.htm?PNO=1&keyword=Free%20Boxes	chromecache_340.2.dr	false		unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_605.2.dr, chromecache_561.2.dr	false	URL Reputation: safe	unknown
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_367.2.dr, chromecache_556.2.dr	false		unknown
https://www.usps.com/business/manage-mail.htm	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/ecpext/asset/images/oct24-supplies-d.jpg);	chromecache_332.2.dr	false		unknown
https://postalpro.usps.com	chromecache_635.2.dr	false		unknown
https://www.usps.com/international/	chromecache_340.2.dr	false		unknown
https://www.usps.com/store/images/info-icon.png	chromecache_557.2.dr	false		unknown
https://www.usps.com/global-elements/header/script/	chromecache_657.2.dr, chromecache_385.2.dr, chromecache_614.2.dr, chromecache_553.2.dr	false		unknown
https://www.usps.com/shop/money-orders.htm	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/business/verify-postage.htm	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/ship/insurance-extra-services.htm	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
http://creativecommons.org/licenses/by/3.0/.	chromecache_485.2.dr, chromecache_577.2.dr	false		unknown
https://www.usps.com/store/images/ps-carticon.png	chromecache_557.2.dr	false		unknown
https://about.usps.com/what/government-services/	chromecache_635.2.dr, chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://store.usps.com/store/cards-envelopes	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/store/images/usps_l_nav_red_arrow.svg	chromecache_557.2.dr	false		unknown
https://www.usps.com/store/images/new-icon.png)	chromecache_643.2.dr	false		unknown
https://about.usps.com/who/legal/terms-of-use.htm	chromecache_635.2.dr, chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://retail-pi.usps.com/retailpi/actions/index.action	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
http://malsup.com/jquery/block/	chromecache_605.2.dr, chromecache_561.2.dr	false	URL Reputation: safe	unknown
https://store.usps.com/store/stamps	chromecache_340.2.dr	false		unknown
https://postcalc.usps.com/?country=10440	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/business/label-broker.htm	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/international/letters.htm	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/international/first-class-package-international-service.htm	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://cfo.usps.com/cfo-web/labelInformation.html	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.usps.com/	chromecache_340.2.dr	false		unknown
https://informeddelivery.usps.com/	chromecache_340.2.dr	false		unknown
https://gateway.usps.com/	chromecache_332.2.dr, chromecache_340.2.dr	false		unknown
https://www.uspsoig.gov	chromecache_635.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.230	ad.doubleclick.net	United States	15169	GOOGLEUS	false
104.16.41.28	unknown	United States	13335	CLOUDFLARENETUS	false
170.106.137.178	us-usps-tsgczt.xyz	Singapore	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	true
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.34	td.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.186.38	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
216.58.206.66	unknown	United States	15169	GOOGLEUS	false
142.250.110.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
64.233.166.155	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.130	adservice.google.com	United States	15169	GOOGLEUS	false
192.229.221.165	cs1799.wpc.upsiloncdn.net	United States	15133	EDGECASTUS	false
108.156.60.13	d27f3qgc9anoq2.cloudfront.net	United States	16509	AMAZON-02US	false
104.16.40.28	fast.fonts.net	United States	13335	CLOUDFLARENETUS	false
13.32.27.91	unknown	United States	7018	ATT-INTERNET4US	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526980
Start date and time:	2024-10-06 18:49:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://us-usps-tsgczt.xyz/update/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.troj.win@23/986@57/17
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://moversguide.usps.com/?referral=MG80 Browse: https://store.usps.com/store/results/free-shipping-supplies/shipping-supplies/_/N-alnx4jZ7d0v8v Browse: https://cns.usps.com/ Browse: https://store.usps.com/store/results/business/_/N-1y2576k

Input	Output
URL: https://us-usps-tsgczt.xyz/update/ Model: jbxai	{ "brand":["unknown"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://store.usps.com/store/results/free-shipping-supplies/shipping-supplies/_/N-alnx4jZ7d0v8v Model: jbxai	{ "brand":["unknown"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://cns.usps.com/ Model: jbxai	{ "brand":["unknown"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:50:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9809664494610124
Encrypted:	false
SSDEEP:	48:8zcd8TAssHmidAKZdA19ehwiZUklqeh1y+3:8/Xdyy
MD5:	537DC21BAF9D21BBE986A7CCB3DE5858
SHA1:	62BDB0DE944CE4E09701C81F4C37C32B8D31ED03
SHA-256:	3214C21D3D76AB2A5BA7B8A5A6346250D27BD6940BDAB48FE7D507F57B6190C0
SHA-512:	33138EBA82D699E3EA1982A7A49CEAF855A876F978D5924DA07CC27067C04C5787FEAD27E1C8DE955E13529CFEB218DF8AB5BF84EACAF0568607B63F98256AC6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......<.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFYB.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFYB.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFYB.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFYB............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFYD............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._..a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 18:50:07.125360012 CEST	192.168.2.5	1.1.1.1	0xd119	Standard query (0)	us-usps-tsgczt.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:07.125494957 CEST	192.168.2.5	1.1.1.1	0xbf09	Standard query (0)	us-usps-tsgczt.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:50:08.208352089 CEST	192.168.2.5	1.1.1.1	0x402b	Standard query (0)	us-usps-tsgczt.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:08.216321945 CEST	192.168.2.5	1.1.1.1	0x1b2a	Standard query (0)	us-usps-tsgczt.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:50:08.782310009 CEST	192.168.2.5	1.1.1.1	0x25f2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:08.782588959 CEST	192.168.2.5	1.1.1.1	0xebf4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 6, 2024 18:50:11.354444981 CEST	192.168.2.5	1.1.1.1	0xabef	Standard query (0)	us-usps-tsgczt.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:11.354896069 CEST	192.168.2.5	1.1.1.1	0x536f	Standard query (0)	us-usps-tsgczt.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:50:27.830957890 CEST	192.168.2.5	1.1.1.1	0x9302	Standard query (0)	moversguide.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:27.831368923 CEST	192.168.2.5	1.1.1.1	0x80df	Standard query (0)	moversguide.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:50:31.679620028 CEST	192.168.2.5	1.1.1.1	0xfa86	Standard query (0)	store.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:31.679924965 CEST	192.168.2.5	1.1.1.1	0xa77e	Standard query (0)	store.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:50:33.571100950 CEST	192.168.2.5	1.1.1.1	0x156e	Standard query (0)	www.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:33.571240902 CEST	192.168.2.5	1.1.1.1	0xa324	Standard query (0)	www.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:50:35.345503092 CEST	192.168.2.5	1.1.1.1	0x4363	Standard query (0)	www.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:35.345558882 CEST	192.168.2.5	1.1.1.1	0x8e8b	Standard query (0)	www.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:50:35.708036900 CEST	192.168.2.5	1.1.1.1	0xae26	Standard query (0)	store.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:35.708188057 CEST	192.168.2.5	1.1.1.1	0xf509	Standard query (0)	store.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:50:37.058595896 CEST	192.168.2.5	1.1.1.1	0xf59e	Standard query (0)	fast.fonts.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:37.058875084 CEST	192.168.2.5	1.1.1.1	0x8fd6	Standard query (0)	fast.fonts.net	65	IN (0x0001)	false
Oct 6, 2024 18:50:37.078195095 CEST	192.168.2.5	1.1.1.1	0xee06	Standard query (0)	store.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:37.078447104 CEST	192.168.2.5	1.1.1.1	0xffe5	Standard query (0)	store.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:50:37.962012053 CEST	192.168.2.5	1.1.1.1	0x199c	Standard query (0)	fast.fonts.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:37.962178946 CEST	192.168.2.5	1.1.1.1	0x96a	Standard query (0)	fast.fonts.net	65	IN (0x0001)	false
Oct 6, 2024 18:50:55.161886930 CEST	192.168.2.5	1.1.1.1	0x6a54	Standard query (0)	dap.digitalgov.gov	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:55.162256956 CEST	192.168.2.5	1.1.1.1	0xa0fd	Standard query (0)	dap.digitalgov.gov	65	IN (0x0001)	false
Oct 6, 2024 18:50:55.178982019 CEST	192.168.2.5	1.1.1.1	0x192f	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:55.179178953 CEST	192.168.2.5	1.1.1.1	0xc460	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Oct 6, 2024 18:50:56.099700928 CEST	192.168.2.5	1.1.1.1	0xeaf3	Standard query (0)	resources.digital-cloud-gov.medallia.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.099926949 CEST	192.168.2.5	1.1.1.1	0x1b3b	Standard query (0)	resources.digital-cloud-gov.medallia.com	65	IN (0x0001)	false
Oct 6, 2024 18:50:56.103535891 CEST	192.168.2.5	1.1.1.1	0x8b4f	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.103718042 CEST	192.168.2.5	1.1.1.1	0xed4e	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Oct 6, 2024 18:50:56.199625969 CEST	192.168.2.5	1.1.1.1	0x2018	Standard query (0)	dap.digitalgov.gov	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.199829102 CEST	192.168.2.5	1.1.1.1	0xe287	Standard query (0)	dap.digitalgov.gov	65	IN (0x0001)	false
Oct 6, 2024 18:50:57.821753979 CEST	192.168.2.5	1.1.1.1	0x5edb	Standard query (0)	resources.digital-cloud-gov.medallia.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:57.822314978 CEST	192.168.2.5	1.1.1.1	0xbb7	Standard query (0)	resources.digital-cloud-gov.medallia.com	65	IN (0x0001)	false
Oct 6, 2024 18:51:03.551278114 CEST	192.168.2.5	1.1.1.1	0xedd9	Standard query (0)	cns.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:51:03.551278114 CEST	192.168.2.5	1.1.1.1	0xbd9d	Standard query (0)	cns.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:04.946351051 CEST	192.168.2.5	1.1.1.1	0x9fc4	Standard query (0)	cns.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:09.062613010 CEST	192.168.2.5	1.1.1.1	0x12f6	Standard query (0)	cns.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:09.062864065 CEST	192.168.2.5	1.1.1.1	0x164d	Standard query (0)	cns.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:51:15.114788055 CEST	192.168.2.5	1.1.1.1	0x53ce	Standard query (0)	reg.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:15.115148067 CEST	192.168.2.5	1.1.1.1	0xae0d	Standard query (0)	reg.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:51:20.877103090 CEST	192.168.2.5	1.1.1.1	0x7d5d	Standard query (0)	reg.usps.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:20.877851009 CEST	192.168.2.5	1.1.1.1	0x464	Standard query (0)	reg.usps.com	65	IN (0x0001)	false
Oct 6, 2024 18:51:27.024475098 CEST	192.168.2.5	1.1.1.1	0xcd55	Standard query (0)	3976941.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:27.026191950 CEST	192.168.2.5	1.1.1.1	0xb7c6	Standard query (0)	3976941.fls.doubleclick.net	65	IN (0x0001)	false
Oct 6, 2024 18:51:27.052007914 CEST	192.168.2.5	1.1.1.1	0x151a	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:27.056320906 CEST	192.168.2.5	1.1.1.1	0xddeb	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Oct 6, 2024 18:51:27.200975895 CEST	192.168.2.5	1.1.1.1	0x7476	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:27.201236963 CEST	192.168.2.5	1.1.1.1	0x2c55	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Oct 6, 2024 18:51:28.448225021 CEST	192.168.2.5	1.1.1.1	0xabfe	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:28.448488951 CEST	192.168.2.5	1.1.1.1	0x7c5c	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Oct 6, 2024 18:51:29.042714119 CEST	192.168.2.5	1.1.1.1	0x8a7b	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:29.043204069 CEST	192.168.2.5	1.1.1.1	0x65e0	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Oct 6, 2024 18:51:30.095422983 CEST	192.168.2.5	1.1.1.1	0x42ac	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:30.095624924 CEST	192.168.2.5	1.1.1.1	0x806a	Standard query (0)	adservice.google.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 18:50:08.470400095 CEST	1.1.1.1	192.168.2.5	0xd119	No error (0)	us-usps-tsgczt.xyz		170.106.137.178	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:08.789407969 CEST	1.1.1.1	192.168.2.5	0x25f2	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:08.789737940 CEST	1.1.1.1	192.168.2.5	0xebf4	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 6, 2024 18:50:08.929152966 CEST	1.1.1.1	192.168.2.5	0x402b	No error (0)	us-usps-tsgczt.xyz		170.106.137.178	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:11.789392948 CEST	1.1.1.1	192.168.2.5	0xabef	No error (0)	us-usps-tsgczt.xyz		170.106.137.178	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:18.463810921 CEST	1.1.1.1	192.168.2.5	0x49fc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:18.463810921 CEST	1.1.1.1	192.168.2.5	0x49fc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:18.695437908 CEST	1.1.1.1	192.168.2.5	0xebf8	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:18.695437908 CEST	1.1.1.1	192.168.2.5	0xebf8	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:27.957339048 CEST	1.1.1.1	192.168.2.5	0x80df	No error (0)	moversguide.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:27.957937002 CEST	1.1.1.1	192.168.2.5	0x9302	No error (0)	moversguide.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:27.957937002 CEST	1.1.1.1	192.168.2.5	0x9302	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:31.806093931 CEST	1.1.1.1	192.168.2.5	0xfa86	No error (0)	store.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:31.806093931 CEST	1.1.1.1	192.168.2.5	0xfa86	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:31.812289000 CEST	1.1.1.1	192.168.2.5	0xa77e	No error (0)	store.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:33.570403099 CEST	1.1.1.1	192.168.2.5	0x462d	No error (0)	shed.dual-low.s-part-0036.t-0009.t-msedge.net	s-part-0036.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:33.570403099 CEST	1.1.1.1	192.168.2.5	0x462d	No error (0)	s-part-0036.t-0009.t-msedge.net		13.107.246.64	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:33.748771906 CEST	1.1.1.1	192.168.2.5	0xa324	No error (0)	www.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:33.752429008 CEST	1.1.1.1	192.168.2.5	0x156e	No error (0)	www.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:33.752429008 CEST	1.1.1.1	192.168.2.5	0x156e	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:35.353068113 CEST	1.1.1.1	192.168.2.5	0x4363	No error (0)	www.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:35.353068113 CEST	1.1.1.1	192.168.2.5	0x4363	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:35.516113043 CEST	1.1.1.1	192.168.2.5	0x8e8b	No error (0)	www.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:37.066234112 CEST	1.1.1.1	192.168.2.5	0xf59e	No error (0)	fast.fonts.net		104.16.40.28	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:37.066234112 CEST	1.1.1.1	192.168.2.5	0xf59e	No error (0)	fast.fonts.net		104.16.41.28	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:37.067214012 CEST	1.1.1.1	192.168.2.5	0x8fd6	No error (0)	fast.fonts.net			65	IN (0x0001)	false
Oct 6, 2024 18:50:37.255287886 CEST	1.1.1.1	192.168.2.5	0xffe5	No error (0)	store.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:37.258637905 CEST	1.1.1.1	192.168.2.5	0xee06	No error (0)	store.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:37.258637905 CEST	1.1.1.1	192.168.2.5	0xee06	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:37.342103004 CEST	1.1.1.1	192.168.2.5	0xf509	No error (0)	store.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:37.384848118 CEST	1.1.1.1	192.168.2.5	0xae26	No error (0)	store.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:37.384848118 CEST	1.1.1.1	192.168.2.5	0xae26	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:37.969086885 CEST	1.1.1.1	192.168.2.5	0x199c	No error (0)	fast.fonts.net		104.16.41.28	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:37.969086885 CEST	1.1.1.1	192.168.2.5	0x199c	No error (0)	fast.fonts.net		104.16.40.28	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:37.969679117 CEST	1.1.1.1	192.168.2.5	0x96a	No error (0)	fast.fonts.net			65	IN (0x0001)	false
Oct 6, 2024 18:50:55.170140982 CEST	1.1.1.1	192.168.2.5	0xa0fd	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:55.170913935 CEST	1.1.1.1	192.168.2.5	0x6a54	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:55.170913935 CEST	1.1.1.1	192.168.2.5	0x6a54	No error (0)	d27f3qgc9anoq2.cloudfront.net		108.156.60.13	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:55.170913935 CEST	1.1.1.1	192.168.2.5	0x6a54	No error (0)	d27f3qgc9anoq2.cloudfront.net		108.156.60.60	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:55.170913935 CEST	1.1.1.1	192.168.2.5	0x6a54	No error (0)	d27f3qgc9anoq2.cloudfront.net		108.156.60.24	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:55.170913935 CEST	1.1.1.1	192.168.2.5	0x6a54	No error (0)	d27f3qgc9anoq2.cloudfront.net		108.156.60.15	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:55.185713053 CEST	1.1.1.1	192.168.2.5	0x192f	No error (0)	stats.g.doubleclick.net		142.250.110.155	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:55.185713053 CEST	1.1.1.1	192.168.2.5	0x192f	No error (0)	stats.g.doubleclick.net		142.250.110.154	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:55.185713053 CEST	1.1.1.1	192.168.2.5	0x192f	No error (0)	stats.g.doubleclick.net		142.250.110.156	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:55.185713053 CEST	1.1.1.1	192.168.2.5	0x192f	No error (0)	stats.g.doubleclick.net		142.250.110.157	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.110971928 CEST	1.1.1.1	192.168.2.5	0x8b4f	No error (0)	stats.g.doubleclick.net		64.233.166.155	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.110971928 CEST	1.1.1.1	192.168.2.5	0x8b4f	No error (0)	stats.g.doubleclick.net		64.233.166.157	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.110971928 CEST	1.1.1.1	192.168.2.5	0x8b4f	No error (0)	stats.g.doubleclick.net		64.233.166.156	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.110971928 CEST	1.1.1.1	192.168.2.5	0x8b4f	No error (0)	stats.g.doubleclick.net		64.233.166.154	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.127268076 CEST	1.1.1.1	192.168.2.5	0xeaf3	No error (0)	resources.digital-cloud-gov.medallia.com	resources.digital-cloud-gov.medallia.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:56.135122061 CEST	1.1.1.1	192.168.2.5	0x1b3b	No error (0)	resources.digital-cloud-gov.medallia.com	resources.digital-cloud-gov.medallia.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:56.207545996 CEST	1.1.1.1	192.168.2.5	0x2018	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:56.207545996 CEST	1.1.1.1	192.168.2.5	0x2018	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.91	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.207545996 CEST	1.1.1.1	192.168.2.5	0x2018	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.113	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.207545996 CEST	1.1.1.1	192.168.2.5	0x2018	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.50	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.207545996 CEST	1.1.1.1	192.168.2.5	0x2018	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.27.21	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:50:56.219436884 CEST	1.1.1.1	192.168.2.5	0xe287	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:57.853035927 CEST	1.1.1.1	192.168.2.5	0xbb7	No error (0)	resources.digital-cloud-gov.medallia.com	resources.digital-cloud-gov.medallia.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:50:57.853737116 CEST	1.1.1.1	192.168.2.5	0x5edb	No error (0)	resources.digital-cloud-gov.medallia.com	resources.digital-cloud-gov.medallia.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:00.933212042 CEST	1.1.1.1	192.168.2.5	0x462d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:00.933212042 CEST	1.1.1.1	192.168.2.5	0x462d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:03.688092947 CEST	1.1.1.1	192.168.2.5	0xedd9	No error (0)	cns.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:05.078191042 CEST	1.1.1.1	192.168.2.5	0x9fc4	No error (0)	cns.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:05.078191042 CEST	1.1.1.1	192.168.2.5	0x9fc4	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:05.224020004 CEST	1.1.1.1	192.168.2.5	0xbd9d	No error (0)	cns.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:05.224020004 CEST	1.1.1.1	192.168.2.5	0xbd9d	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:09.235146046 CEST	1.1.1.1	192.168.2.5	0x164d	No error (0)	cns.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:09.238538027 CEST	1.1.1.1	192.168.2.5	0x12f6	No error (0)	cns.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:09.238538027 CEST	1.1.1.1	192.168.2.5	0x12f6	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:15.241483927 CEST	1.1.1.1	192.168.2.5	0x53ce	No error (0)	reg.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:15.241483927 CEST	1.1.1.1	192.168.2.5	0x53ce	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:15.285948038 CEST	1.1.1.1	192.168.2.5	0xae0d	No error (0)	reg.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:18.883649111 CEST	1.1.1.1	192.168.2.5	0xecbf	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:18.883649111 CEST	1.1.1.1	192.168.2.5	0xecbf	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:20.013329029 CEST	1.1.1.1	192.168.2.5	0x4063	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:20.013329029 CEST	1.1.1.1	192.168.2.5	0x4063	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:20.013329029 CEST	1.1.1.1	192.168.2.5	0x4063	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:21.065635920 CEST	1.1.1.1	192.168.2.5	0x7d5d	No error (0)	reg.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:21.065635920 CEST	1.1.1.1	192.168.2.5	0x7d5d	No error (0)	cs1799.wpc.upsiloncdn.net		192.229.221.165	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:21.071121931 CEST	1.1.1.1	192.168.2.5	0x464	No error (0)	reg.usps.com	cs1799.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:27.036650896 CEST	1.1.1.1	192.168.2.5	0xcd55	No error (0)	3976941.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:27.036650896 CEST	1.1.1.1	192.168.2.5	0xcd55	No error (0)	dart.l.doubleclick.net		142.250.186.38	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:27.037844896 CEST	1.1.1.1	192.168.2.5	0xb7c6	No error (0)	3976941.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:51:27.059067965 CEST	1.1.1.1	192.168.2.5	0x151a	No error (0)	td.doubleclick.net		142.250.186.34	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:27.207803011 CEST	1.1.1.1	192.168.2.5	0x7476	No error (0)	ad.doubleclick.net		142.250.181.230	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:27.208748102 CEST	1.1.1.1	192.168.2.5	0x2c55	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Oct 6, 2024 18:51:28.455466032 CEST	1.1.1.1	192.168.2.5	0xabfe	No error (0)	ad.doubleclick.net		142.250.181.230	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:28.455677986 CEST	1.1.1.1	192.168.2.5	0x7c5c	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Oct 6, 2024 18:51:29.050121069 CEST	1.1.1.1	192.168.2.5	0x8a7b	No error (0)	adservice.google.com		142.250.185.130	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:29.050847054 CEST	1.1.1.1	192.168.2.5	0x65e0	No error (0)	adservice.google.com			65	IN (0x0001)	false
Oct 6, 2024 18:51:30.102255106 CEST	1.1.1.1	192.168.2.5	0x42ac	No error (0)	adservice.google.com		216.58.206.66	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:51:30.102380991 CEST	1.1.1.1	192.168.2.5	0x806a	No error (0)	adservice.google.com			65	IN (0x0001)	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://us-usps-tsgczt.xyz/update/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 256

Chrome Cache Entry: 257

Chrome Cache Entry: 258

Chrome Cache Entry: 259

Chrome Cache Entry: 260

Chrome Cache Entry: 261

Chrome Cache Entry: 262

Chrome Cache Entry: 263

Chrome Cache Entry: 264

Chrome Cache Entry: 265

Chrome Cache Entry: 266

Chrome Cache Entry: 267

Chrome Cache Entry: 268

Chrome Cache Entry: 269

Chrome Cache Entry: 270

Chrome Cache Entry: 271

Chrome Cache Entry: 272

Chrome Cache Entry: 273

Chrome Cache Entry: 274

Chrome Cache Entry: 275

Windows Analysis Report
https://us-usps-tsgczt.xyz/update/

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:09 UTC	668	OUT	GET /update/ HTTP/1.1 Host: us-usps-tsgczt.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 16:50:10 UTC	347	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 06 Oct 2024 16:50:09 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1638 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"666-190b57e26f0"
2024-10-06 16:50:10 UTC	1638	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 0a 20 20 20 20 20 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 0a 20 20 20 20 2f 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 73 72 63 3d 22 2e 2f 61 73 73 65 74 73 2f 69 6e 64 65 78 2d 34 62 30 32 30 62 64 36 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no" /> <script type="module" crossorigin src="./assets/index-4b020bd6.js"></script>

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:10 UTC	592	OUT	GET /update/assets/index-4b020bd6.js HTTP/1.1 Host: us-usps-tsgczt.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://us-usps-tsgczt.xyz sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://us-usps-tsgczt.xyz/update/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 16:50:10 UTC	364	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 06 Oct 2024 16:50:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 504970 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:28 GMT ETag: W/"7b48a-190b57e3e60"
2024-10-06 16:50:10 UTC	16020	IN	Data Raw: 76 61 72 20 61 33 38 5f 30 78 34 65 36 61 66 35 3d 61 33 38 5f 30 78 35 33 34 35 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 36 30 34 38 64 2c 5f 30 78 35 38 65 66 32 62 29 7b 76 61 72 20 5f 30 78 33 38 30 34 62 65 3d 61 33 38 5f 30 78 35 33 34 35 2c 5f 30 78 33 35 31 33 36 61 3d 5f 30 78 32 36 30 34 38 64 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 33 66 62 34 64 61 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 38 30 34 62 65 28 30 78 35 36 66 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 33 38 30 34 62 65 28 30 78 37 30 61 29 29 2f 30 78 32 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 38 30 34 62 65 28 30 78 32 34 38 29 29 2f 30 78 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 38 30 34 62 65 28 30 78 34 Data Ascii: var a38_0x4e6af5=a38_0x5345;(function(_0x26048d,_0x58ef2b){var _0x3804be=a38_0x5345,_0x35136a=_0x26048d();while(!![]){try{var _0x3fb4da=parseInt(_0x3804be(0x56f))/0x1+parseInt(_0x3804be(0x70a))/0x2*(-parseInt(_0x3804be(0x248))/0x3)+-parseInt(_0x3804be(0x4
2024-10-06 16:50:10 UTC	16384	IN	Data Raw: 38 5f 30 78 34 65 36 61 66 35 28 30 78 36 36 64 29 2b 61 33 38 5f 30 78 34 65 36 61 66 35 28 30 78 31 33 64 29 2c 4e 30 3d 5f 30 78 32 33 34 66 34 63 3d 3e 42 65 28 5f 30 78 32 33 34 66 34 63 29 26 26 5f 30 78 32 33 34 66 34 63 21 3d 3d 61 33 38 5f 30 78 34 65 36 61 66 35 28 30 78 34 30 31 29 26 26 5f 30 78 32 33 34 66 34 63 5b 30 78 30 5d 21 3d 3d 27 2d 27 26 26 27 27 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 32 33 34 66 34 63 2c 30 78 61 29 3d 3d 3d 5f 30 78 32 33 34 66 34 63 2c 54 72 3d 54 30 28 61 33 38 5f 30 78 34 65 36 61 66 35 28 30 78 36 31 34 29 2b 27 65 66 5f 66 6f 72 2c 72 65 66 27 2b 61 33 38 5f 30 78 34 65 36 61 66 35 28 30 78 32 31 34 29 2b 61 33 38 5f 30 78 34 65 36 61 66 35 28 30 78 31 38 65 29 2b 61 33 38 5f 30 78 34 65 36 61 66 35 28 30 78 Data Ascii: 8_0x4e6af5(0x66d)+a38_0x4e6af5(0x13d),N0=_0x234f4c=>Be(_0x234f4c)&&_0x234f4c!==a38_0x4e6af5(0x401)&&_0x234f4c[0x0]!=='-'&&''+parseInt(_0x234f4c,0xa)===_0x234f4c,Tr=T0(a38_0x4e6af5(0x614)+'ef_for,ref'+a38_0x4e6af5(0x214)+a38_0x4e6af5(0x18e)+a38_0x4e6af5(0x
2024-10-06 16:50:10 UTC	16384	IN	Data Raw: 20 46 72 28 74 68 69 73 2c 5f 30 78 35 38 32 65 62 31 2c 21 30 78 30 29 3b 7d 2c 67 65 74 20 27 73 69 7a 65 27 28 29 7b 72 65 74 75 72 6e 20 6b 72 28 74 68 69 73 2c 21 30 78 30 29 3b 7d 2c 27 68 61 73 27 28 5f 30 78 32 62 61 64 33 65 29 7b 72 65 74 75 72 6e 20 62 72 5b 27 63 61 6c 6c 27 5d 28 74 68 69 73 2c 5f 30 78 32 62 61 64 33 65 2c 21 30 78 30 29 3b 7d 2c 27 61 64 64 27 3a 67 74 28 5f 30 78 32 30 66 39 35 32 28 30 78 36 62 34 29 29 2c 27 73 65 74 27 3a 67 74 28 27 73 65 74 27 29 2c 27 64 65 6c 65 74 65 27 3a 67 74 28 5f 30 78 32 30 66 39 35 32 28 30 78 31 35 62 29 29 2c 27 63 6c 65 61 72 27 3a 67 74 28 5f 30 78 32 30 66 39 35 32 28 30 78 33 31 64 29 29 2c 27 66 6f 72 45 61 63 68 27 3a 44 72 28 21 30 78 30 2c 21 30 78 31 29 7d 2c 5f 30 78 31 36 33 62 Data Ascii: Fr(this,_0x582eb1,!0x0);},get 'size'(){return kr(this,!0x0);},'has'(_0x2bad3e){return br['call'](this,_0x2bad3e,!0x0);},'add':gt(_0x20f952(0x6b4)),'set':gt('set'),'delete':gt(_0x20f952(0x15b)),'clear':gt(_0x20f952(0x31d)),'forEach':Dr(!0x0,!0x1)},_0x163b
2024-10-06 16:50:10 UTC	16384	IN	Data Raw: 20 7b 70 72 6f 70 73 3a 5f 30 78 61 65 66 62 32 33 2c 63 68 69 6c 64 72 65 6e 3a 5f 30 78 32 39 30 65 34 31 2c 63 6f 6d 70 6f 6e 65 6e 74 3a 5f 30 78 32 35 38 34 33 30 7d 3d 5f 30 78 35 32 64 30 61 63 2c 7b 70 72 6f 70 73 3a 5f 30 78 33 62 61 32 31 38 2c 63 68 69 6c 64 72 65 6e 3a 5f 30 78 35 36 35 31 34 63 2c 70 61 74 63 68 46 6c 61 67 3a 5f 30 78 34 61 34 64 63 31 7d 3d 5f 30 78 35 36 39 30 62 34 2c 5f 30 78 34 32 35 63 65 64 3d 5f 30 78 32 35 38 34 33 30 5b 5f 30 78 31 37 39 33 34 38 28 30 78 36 65 34 29 2b 27 6e 73 27 5d 3b 69 66 28 5f 30 78 35 36 39 30 62 34 5b 5f 30 78 31 37 39 33 34 38 28 30 78 36 32 66 29 5d 7c 7c 5f 30 78 35 36 39 30 62 34 5b 5f 30 78 31 37 39 33 34 38 28 30 78 35 31 37 29 5d 29 72 65 74 75 72 6e 21 30 78 30 3b 69 66 28 5f 30 78 Data Ascii: {props:_0xaefb23,children:_0x290e41,component:_0x258430}=_0x52d0ac,{props:_0x3ba218,children:_0x56514c,patchFlag:_0x4a4dc1}=_0x5690b4,_0x425ced=_0x258430[_0x179348(0x6e4)+'ns'];if(_0x5690b4[_0x179348(0x62f)]\|\|_0x5690b4[_0x179348(0x517)])return!0x0;if(_0x
2024-10-06 16:50:10 UTC	16384	IN	Data Raw: 5f 30 78 31 31 31 33 32 37 2c 5f 30 78 32 64 39 64 39 34 29 7c 7c 74 30 28 5f 30 78 35 64 37 65 36 61 2c 5f 30 78 32 64 39 64 39 34 29 7c 7c 28 5f 30 78 31 64 31 33 36 66 3d 5f 30 78 35 61 32 31 39 35 5b 30 78 30 5d 29 26 26 64 65 28 5f 30 78 31 64 31 33 36 66 2c 5f 30 78 32 64 39 64 39 34 29 7c 7c 64 65 28 5f 30 78 32 61 64 63 35 66 2c 5f 30 78 32 64 39 64 39 34 29 7c 7c 64 65 28 75 72 2c 5f 30 78 32 64 39 64 39 34 29 7c 7c 64 65 28 5f 30 78 32 64 63 36 32 64 5b 27 63 6f 6e 66 69 67 27 5d 5b 5f 30 78 31 34 36 65 62 64 28 30 78 35 65 31 29 2b 27 65 72 74 69 65 73 27 5d 2c 5f 30 78 32 64 39 64 39 34 29 3b 7d 2c 27 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 27 28 5f 30 78 31 66 62 32 33 36 2c 5f 30 78 31 62 61 62 33 64 2c 5f 30 78 35 35 32 34 63 64 29 7b 76 Data Ascii: _0x111327,_0x2d9d94)\|\|t0(_0x5d7e6a,_0x2d9d94)\|\|(_0x1d136f=_0x5a2195[0x0])&&de(_0x1d136f,_0x2d9d94)\|\|de(_0x2adc5f,_0x2d9d94)\|\|de(ur,_0x2d9d94)\|\|de(_0x2dc62d['config'][_0x146ebd(0x5e1)+'erties'],_0x2d9d94);},'defineProperty'(_0x1fb236,_0x1bab3d,_0x5524cd){v
2024-10-06 16:50:10 UTC	16384	IN	Data Raw: 63 38 29 29 2c 5f 30 78 32 62 37 32 39 64 21 3d 6e 75 6c 6c 26 26 21 79 65 28 5f 30 78 32 62 37 32 39 64 29 26 26 28 5f 30 78 32 62 37 32 39 64 3d 6e 75 6c 6c 29 3b 63 6f 6e 73 74 20 5f 30 78 36 37 63 39 38 61 3d 7a 61 28 29 2c 5f 30 78 34 37 34 65 38 66 3d 6e 65 77 20 53 65 74 28 29 3b 6c 65 74 20 5f 30 78 33 66 62 64 34 61 3d 21 30 78 31 3b 63 6f 6e 73 74 20 5f 30 78 31 39 35 62 63 34 3d 5f 30 78 36 37 63 39 38 61 5b 5f 30 78 35 33 38 66 36 30 28 30 78 35 66 64 29 5d 3d 7b 27 5f 75 69 64 27 3a 6b 6c 2b 2b 2c 27 5f 63 6f 6d 70 6f 6e 65 6e 74 27 3a 5f 30 78 31 33 31 63 63 38 2c 27 5f 70 72 6f 70 73 27 3a 5f 30 78 32 62 37 32 39 64 2c 27 5f 63 6f 6e 74 61 69 6e 65 72 27 3a 6e 75 6c 6c 2c 27 5f 63 6f 6e 74 65 78 74 27 3a 5f 30 78 36 37 63 39 38 61 2c 27 5f Data Ascii: c8)),_0x2b729d!=null&&!ye(_0x2b729d)&&(_0x2b729d=null);const _0x67c98a=za(),_0x474e8f=new Set();let _0x3fbd4a=!0x1;const _0x195bc4=_0x67c98a[_0x538f60(0x5fd)]={'_uid':kl++,'_component':_0x131cc8,'_props':_0x2b729d,'_container':null,'_context':_0x67c98a,'_
2024-10-06 16:50:11 UTC	16384	IN	Data Raw: 5f 30 78 32 37 31 61 34 36 3d 5f 30 78 34 39 37 63 35 37 5b 5f 30 78 35 63 35 64 37 38 28 30 78 32 62 36 29 5d 3b 5f 30 78 34 39 37 63 35 37 5b 5f 30 78 35 63 35 64 37 38 28 30 78 32 62 36 29 5d 3d 5f 30 78 33 30 63 37 65 33 2c 5f 30 78 31 36 31 64 38 32 28 5f 30 78 32 37 31 61 34 36 2c 5f 30 78 33 30 63 37 65 33 2c 5f 30 78 66 31 39 37 38 61 28 5f 30 78 32 37 31 61 34 36 5b 27 65 6c 27 5d 29 2c 5f 30 78 31 63 64 65 30 35 28 5f 30 78 32 37 31 61 34 36 29 2c 5f 30 78 34 39 37 63 35 37 2c 5f 30 78 32 36 34 65 66 34 2c 5f 30 78 34 33 34 32 65 36 29 2c 5f 30 78 34 63 34 36 31 30 5b 27 65 6c 27 5d 3d 5f 30 78 33 30 63 37 65 33 5b 27 65 6c 27 5d 2c 5f 30 78 35 37 38 63 62 32 3d 3d 3d 6e 75 6c 6c 26 26 5a 75 28 5f 30 78 34 39 37 63 35 37 2c 5f 30 78 33 30 63 37 Data Ascii: _0x271a46=_0x497c57[_0x5c5d78(0x2b6)];_0x497c57[_0x5c5d78(0x2b6)]=_0x30c7e3,_0x161d82(_0x271a46,_0x30c7e3,_0xf1978a(_0x271a46['el']),_0x1cde05(_0x271a46),_0x497c57,_0x264ef4,_0x4342e6),_0x4c4610['el']=_0x30c7e3['el'],_0x578cb2===null&&Zu(_0x497c57,_0x30c7
2024-10-06 16:50:11 UTC	16384	IN	Data Raw: 61 37 66 34 32 65 3f 5f 30 78 34 34 61 36 32 62 3a 5f 30 78 34 33 32 35 37 33 2c 5f 30 78 34 32 37 66 61 37 3d 5f 30 78 61 37 66 34 32 65 3f 5f 30 78 63 62 30 31 61 61 3a 5f 30 78 33 64 31 37 61 33 3b 69 66 28 5f 30 78 35 33 66 39 38 31 3d 5f 30 78 35 33 66 39 38 31 7c 7c 6a 73 28 5f 30 78 34 33 32 35 37 33 29 2c 5f 30 78 31 33 33 33 32 32 3f 28 5f 30 78 32 61 61 61 32 39 28 5f 30 78 35 31 34 37 34 64 5b 5f 30 78 31 33 66 65 64 39 28 30 78 33 35 33 29 2b 27 6c 64 72 65 6e 27 5d 2c 5f 30 78 31 33 33 33 32 32 2c 5f 30 78 35 33 65 30 38 36 2c 5f 30 78 34 35 37 61 39 30 2c 5f 30 78 35 65 66 36 63 39 2c 5f 30 78 35 33 66 39 38 31 2c 5f 30 78 34 63 30 36 65 62 29 2c 51 30 28 5f 30 78 35 31 34 37 34 64 2c 5f 30 78 39 32 66 35 62 65 2c 21 30 78 30 29 29 3a 5f 30 Data Ascii: a7f42e?_0x44a62b:_0x432573,_0x427fa7=_0xa7f42e?_0xcb01aa:_0x3d17a3;if(_0x53f981=_0x53f981\|\|js(_0x432573),_0x133322?(_0x2aaa29(_0x51474d[_0x13fed9(0x353)+'ldren'],_0x133322,_0x53e086,_0x457a90,_0x5ef6c9,_0x53f981,_0x4c06eb),Q0(_0x51474d,_0x92f5be,!0x0)):_0
2024-10-06 16:50:11 UTC	16384	IN	Data Raw: 29 3a 49 65 28 5f 30 78 32 62 38 32 39 32 2c 5f 30 78 35 65 37 62 39 65 29 3a 49 65 28 5f 30 78 32 62 38 32 39 32 2c 6e 75 6c 6c 2c 5f 30 78 35 65 37 62 39 65 29 3a 28 5f 30 78 35 30 37 63 65 30 3e 30 78 33 3f 5f 30 78 63 62 63 36 61 64 3d 41 72 72 61 79 5b 27 70 72 6f 74 6f 74 79 70 65 27 5d 5b 5f 30 78 31 61 33 63 61 33 28 30 78 31 39 66 29 5d 5b 5f 30 78 31 61 33 63 61 33 28 30 78 34 35 64 29 5d 28 61 72 67 75 6d 65 6e 74 73 2c 30 78 32 29 3a 5f 30 78 35 30 37 63 65 30 3d 3d 3d 30 78 33 26 26 4b 72 28 5f 30 78 63 62 63 36 61 64 29 26 26 28 5f 30 78 63 62 63 36 61 64 3d 5b 5f 30 78 63 62 63 36 61 64 5d 29 2c 49 65 28 5f 30 78 32 62 38 32 39 32 2c 5f 30 78 35 65 37 62 39 65 2c 5f 30 78 63 62 63 36 61 64 29 29 3b 7d 63 6f 6e 73 74 20 47 6c 3d 53 79 6d 62 Data Ascii: ):Ie(_0x2b8292,_0x5e7b9e):Ie(_0x2b8292,null,_0x5e7b9e):(_0x507ce0>0x3?_0xcbc6ad=Array['prototype'][_0x1a3ca3(0x19f)][_0x1a3ca3(0x45d)](arguments,0x2):_0x507ce0===0x3&&Kr(_0xcbc6ad)&&(_0xcbc6ad=[_0xcbc6ad]),Ie(_0x2b8292,_0x5e7b9e,_0xcbc6ad));}const Gl=Symb
2024-10-06 16:50:11 UTC	16384	IN	Data Raw: 63 33 65 31 64 29 7b 69 66 28 21 5f 30 78 32 63 33 65 31 64 5b 5f 30 78 32 38 31 63 32 34 28 30 78 33 64 39 29 2b 5f 30 78 32 38 31 63 32 34 28 30 78 35 38 31 29 5d 28 5f 30 78 39 38 31 36 30 30 29 29 63 6f 6e 74 69 6e 75 65 3b 63 6f 6e 73 74 20 5f 30 78 32 32 39 37 30 64 3d 5f 30 78 32 63 33 65 31 64 5b 5f 30 78 39 38 31 36 30 30 5d 2c 5f 30 78 32 32 39 34 61 34 3d 5f 30 78 34 64 36 35 34 66 5b 5f 30 78 39 38 31 36 30 30 5d 3b 79 30 28 5f 30 78 32 32 39 34 61 34 29 26 26 79 30 28 5f 30 78 32 32 39 37 30 64 29 26 26 5f 30 78 34 64 36 35 34 66 5b 5f 30 78 32 38 31 63 32 34 28 30 78 33 64 39 29 2b 27 65 72 74 79 27 5d 28 5f 30 78 39 38 31 36 30 30 29 26 26 21 41 65 28 5f 30 78 32 32 39 37 30 64 29 26 26 21 43 74 28 5f 30 78 32 32 39 37 30 64 29 3f 5f 30 78 Data Ascii: c3e1d){if(!_0x2c3e1d[_0x281c24(0x3d9)+_0x281c24(0x581)](_0x981600))continue;const _0x22970d=_0x2c3e1d[_0x981600],_0x2294a4=_0x4d654f[_0x981600];y0(_0x2294a4)&&y0(_0x22970d)&&_0x4d654f[_0x281c24(0x3d9)+'erty'](_0x981600)&&!Ae(_0x22970d)&&!Ct(_0x22970d)?_0x

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-06 16:50:11 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=258931 Date: Sun, 06 Oct 2024 16:50:11 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:11 UTC	573	OUT	GET /update/assets/f6170fbbTeKnX.css HTTP/1.1 Host: us-usps-tsgczt.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://us-usps-tsgczt.xyz/update/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 16:50:11 UTC	322	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 06 Oct 2024 16:50:11 GMT Content-Type: text/css; charset=utf-8 Content-Length: 952 Connection: close Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"3b8-190b57e26f0"
2024-10-06 16:50:11 UTC	952	IN	Data Raw: 40 6b 65 79 66 72 61 6d 65 73 20 67 2d 6c 6f 61 64 69 6e 67 2d 62 67 41 6e 69 6d 7b 30 25 2c 74 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 2e 36 33 35 29 7d 35 30 25 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 29 7d 7d 2e 67 2d 6c 6f 61 64 69 6e 67 2d 6d 61 73 6b 7b 77 69 64 74 68 3a 31 30 30 76 77 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 3b 61 6e 69 6d 61 74 69 6f 6e 3a 67 2d 6c 6f 61 Data Ascii: @keyframes g-loading-bgAnim{0%,to{background-color:rgba(255,255,255,.635)}50%{background-color:rgba(255,255,255,0)}}.g-loading-mask{width:100vw;height:100vh;display:flex;justify-content:center;align-items:center;position:fixed;left:0;top:0;animation:g-loa

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:11 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-06 16:50:12 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=258866 Date: Sun, 06 Oct 2024 16:50:12 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-06 16:50:12 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:12 UTC	546	OUT	GET /update/assets/f0ee2557KXMp5.js HTTP/1.1 Host: us-usps-tsgczt.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://us-usps-tsgczt.xyz sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 16:50:13 UTC	362	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 06 Oct 2024 16:50:12 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 53442 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:26 GMT ETag: W/"d0c2-190b57e3690"
2024-10-06 16:50:13 UTC	16022	IN	Data Raw: 63 6f 6e 73 74 20 61 33 35 5f 30 78 31 30 36 33 61 36 3d 61 33 35 5f 30 78 35 65 61 35 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 38 38 38 32 32 2c 5f 30 78 33 63 36 35 31 37 29 7b 63 6f 6e 73 74 20 5f 30 78 35 63 39 61 62 64 3d 61 33 35 5f 30 78 35 65 61 35 2c 5f 30 78 34 66 37 64 62 30 3d 5f 30 78 31 38 38 38 32 32 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 63 6f 6e 73 74 20 5f 30 78 66 32 37 34 31 38 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 31 63 62 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 32 34 39 29 29 2f 30 78 32 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 62 64 28 30 78 31 64 34 29 29 2f 30 78 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 35 63 39 61 Data Ascii: const a35_0x1063a6=a35_0x5ea5;(function(_0x188822,_0x3c6517){const _0x5c9abd=a35_0x5ea5,_0x4f7db0=_0x188822();while(!![]){try{const _0xf27418=parseInt(_0x5c9abd(0x1cb))/0x1+parseInt(_0x5c9abd(0x249))/0x2*(-parseInt(_0x5c9abd(0x1d4))/0x3)+-parseInt(_0x5c9a
2024-10-06 16:50:13 UTC	16384	IN	Data Raw: 29 26 26 5f 30 78 34 32 36 30 37 66 28 5f 30 78 35 36 36 64 39 37 28 30 78 31 62 66 29 2b 5f 30 78 35 36 36 64 39 37 28 30 78 31 63 36 29 2b 5f 30 78 34 34 39 34 37 32 2b 28 5f 30 78 35 36 36 64 39 37 28 30 78 32 33 34 29 2b 5f 30 78 35 36 36 64 39 37 28 30 78 31 65 63 29 2b 5f 30 78 35 36 36 64 39 37 28 30 78 32 35 38 29 2b 5f 30 78 35 36 36 64 39 37 28 30 78 32 34 63 29 2b 5f 30 78 35 36 36 64 39 37 28 30 78 31 62 64 29 29 29 2c 5f 30 78 34 38 61 38 65 32 5b 27 70 75 73 68 27 5d 28 7b 27 74 79 70 65 27 3a 30 78 31 2c 27 76 61 6c 75 65 27 3a 5f 30 78 34 34 39 34 37 32 2c 27 72 65 67 65 78 70 27 3a 5f 30 78 34 35 63 31 63 30 2c 27 72 65 70 65 61 74 61 62 6c 65 27 3a 5f 30 78 34 63 64 35 62 66 3d 3d 3d 27 2a 27 7c 7c 5f 30 78 34 63 64 35 62 66 3d 3d 3d 27 Data Ascii: )&&_0x42607f(_0x566d97(0x1bf)+_0x566d97(0x1c6)+_0x449472+(_0x566d97(0x234)+_0x566d97(0x1ec)+_0x566d97(0x258)+_0x566d97(0x24c)+_0x566d97(0x1bd))),_0x48a8e2['push']({'type':0x1,'value':_0x449472,'regexp':_0x45c1c0,'repeatable':_0x4cd5bf==='*'\|\|_0x4cd5bf==='
2024-10-06 16:50:13 UTC	16384	IN	Data Raw: 6e 73 74 20 5f 30 78 35 35 36 31 61 39 3d 61 33 35 5f 30 78 31 30 36 33 61 36 2c 5f 30 78 34 64 35 33 34 38 3d 61 33 35 5f 30 78 32 61 64 65 30 62 28 4e 65 28 5f 30 78 34 35 34 32 39 37 29 29 2c 7b 6f 70 74 69 6f 6e 73 3a 5f 30 78 34 34 38 37 33 36 7d 3d 61 33 35 5f 30 78 31 33 65 38 63 32 28 65 65 29 2c 5f 30 78 31 61 37 38 35 39 3d 61 33 35 5f 30 78 33 31 38 39 39 36 28 28 29 3d 3e 28 7b 5b 49 65 28 5f 30 78 34 35 34 32 39 37 5b 5f 30 78 35 35 36 31 61 39 28 30 78 32 37 30 29 2b 27 73 27 5d 2c 5f 30 78 34 34 38 37 33 36 5b 5f 30 78 35 35 36 31 61 39 28 30 78 32 31 35 29 2b 5f 30 78 35 35 36 31 61 39 28 30 78 32 37 31 29 5d 2c 5f 30 78 35 35 36 31 61 39 28 30 78 32 35 31 29 2b 27 6b 2d 61 63 74 69 76 65 27 29 5d 3a 5f 30 78 34 64 35 33 34 38 5b 5f 30 78 Data Ascii: nst _0x5561a9=a35_0x1063a6,_0x4d5348=a35_0x2ade0b(Ne(_0x454297)),{options:_0x448736}=a35_0x13e8c2(ee),_0x1a7859=a35_0x318996(()=>({[Ie(_0x454297[_0x5561a9(0x270)+'s'],_0x448736[_0x5561a9(0x215)+_0x5561a9(0x271)],_0x5561a9(0x251)+'k-active')]:_0x4d5348[_0x
2024-10-06 16:50:13 UTC	4652	IN	Data Raw: 30 78 33 66 30 66 30 64 5b 27 67 6f 27 5d 28 2d 30 78 31 2c 21 30 78 31 29 3b 7d 29 5b 27 63 61 74 63 68 27 5d 28 57 29 2c 50 72 6f 6d 69 73 65 5b 27 72 65 6a 65 63 74 27 5d 28 29 29 3a 28 5f 30 78 33 38 63 62 64 31 5b 27 64 65 6c 74 61 27 5d 26 26 5f 30 78 33 66 30 66 30 64 5b 27 67 6f 27 5d 28 2d 5f 30 78 33 38 63 62 64 31 5b 27 64 65 6c 74 61 27 5d 2c 21 30 78 31 29 2c 5f 30 78 35 36 31 65 34 30 28 5f 30 78 33 35 32 30 61 63 2c 5f 30 78 32 64 31 35 62 36 2c 5f 30 78 31 38 31 63 36 35 29 29 29 5b 5f 30 78 35 62 31 34 38 36 28 30 78 32 37 33 29 5d 28 5f 30 78 31 37 37 32 34 64 3d 3e 7b 63 6f 6e 73 74 20 5f 30 78 34 37 64 66 64 64 3d 5f 30 78 35 62 31 34 38 36 3b 5f 30 78 31 37 37 32 34 64 3d 5f 30 78 31 37 37 32 34 64 7c 7c 5f 30 78 35 35 66 61 34 37 28 Data Ascii: 0x3f0f0d['go'](-0x1,!0x1);})['catch'](W),Promise['reject']()):(_0x38cbd1['delta']&&_0x3f0f0d['go'](-_0x38cbd1['delta'],!0x1),_0x561e40(_0x3520ac,_0x2d15b6,_0x181c65)))[_0x5b1486(0x273)](_0x17724d=>{const _0x47dfdd=_0x5b1486;_0x17724d=_0x17724d\|\|_0x55fa47(

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:12 UTC	546	OUT	GET /update/assets/143268e9KXMp5.js HTTP/1.1 Host: us-usps-tsgczt.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://us-usps-tsgczt.xyz sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 16:50:13 UTC	361	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 06 Oct 2024 16:50:12 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 4544 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"11c0-190b57e26f0"
2024-10-06 16:50:13 UTC	4544	IN	Data Raw: 63 6f 6e 73 74 20 61 32 5f 30 78 35 35 39 31 63 66 3d 61 32 5f 30 78 33 30 39 36 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 61 63 30 31 61 64 2c 5f 30 78 31 66 30 65 35 37 29 7b 63 6f 6e 73 74 20 5f 30 78 36 30 62 34 63 65 3d 61 32 5f 30 78 33 30 39 36 2c 5f 30 78 34 65 34 63 32 66 3d 5f 30 78 61 63 30 31 61 64 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 63 6f 6e 73 74 20 5f 30 78 62 36 64 38 64 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 62 35 29 29 2f 30 78 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 39 65 29 29 2f 30 78 32 29 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 63 31 29 29 2f 30 78 33 2a 28 70 61 72 73 65 49 6e 74 28 5f 30 78 36 30 62 34 63 65 28 30 78 63 35 Data Ascii: const a2_0x5591cf=a2_0x3096;(function(_0xac01ad,_0x1f0e57){const _0x60b4ce=a2_0x3096,_0x4e4c2f=_0xac01ad();while(!![]){try{const _0xb6d8d=parseInt(_0x60b4ce(0xb5))/0x1(-parseInt(_0x60b4ce(0x9e))/0x2)+parseInt(_0x60b4ce(0xc1))/0x3(parseInt(_0x60b4ce(0xc5

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:12 UTC	599	OUT	GET /favicon.ico HTTP/1.1 Host: us-usps-tsgczt.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://us-usps-tsgczt.xyz/update/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 16:50:13 UTC	326	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 06 Oct 2024 16:50:13 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 32038 Connection: close Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:14 GMT ETag: W/"7d26-190b57e07b0"
2024-10-06 16:50:13 UTC	16058	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 00 00 20 00 68 04 00 00 46 00 00 00 20 20 00 00 00 00 20 00 a8 10 00 00 ae 04 00 00 30 30 00 00 00 00 20 00 a8 25 00 00 56 15 00 00 40 40 00 00 00 00 20 00 28 42 00 00 fe 3a 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 65 32 31 1b 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 66 33 32 51 65 32 31 1b 66 33 32 51 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 51 e4 da d8 51 be a7 a5 ff 81 55 53 ff 66 33 32 ff 66 Data Ascii: hF 00 %V@@ (B:( @e21f32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qf32Qe21f32Qf32f32f32f32f32f32f32f32f32f32f32f32f32f32f32QQUSf32f
2024-10-06 16:50:13 UTC	15980	IN	Data Raw: 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 43 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 66 33 32 43 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 ff 66 33 32 Data Ascii: f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32Cf32Cf32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32f32

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:13 UTC	573	OUT	GET /update/assets/667bf194TeKnX.css HTTP/1.1 Host: us-usps-tsgczt.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://us-usps-tsgczt.xyz/update/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 16:50:14 UTC	349	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 06 Oct 2024 16:50:14 GMT Content-Type: text/css; charset=utf-8 Content-Length: 68953 Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"10d59-190b57e26f0"
2024-10-06 16:50:14 UTC	16035	IN	Data Raw: 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 33 2e 31 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 39 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 39 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 3a 72 6f 6f 74 7b 2d 2d 62 6c 75 65 3a 23 30 30 37 62 66 66 3b 2d 2d 69 6e 64 69 67 6f 3a 23 36 36 31 30 66 32 3b 2d 2d Data Ascii: /! Bootstrap v4.3.1 (https://getbootstrap.com/) * Copyright 2011-2019 The Bootstrap Authors * Copyright 2011-2019 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */:root{--blue:#007bff;--indigo:#6610f2;--
2024-10-06 16:50:14 UTC	16384	IN	Data Raw: 76 69 67 61 74 69 6f 6e 20 69 6e 70 75 74 2e 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 2d 2d 73 65 61 72 63 68 2d 74 72 61 63 6b 7b 62 6f 72 64 65 72 3a 30 3b 77 69 64 74 68 3a 38 30 25 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 6f 74 74 6f 6d 3b 68 65 69 67 68 74 3a 32 35 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 38 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 7d 2e 67 6c 6f 62 61 6c 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 20 69 6e 70 75 74 2e 69 6e 70 75 74 2d 2d 73 65 61 72 63 68 2e 73 65 61 72 63 68 2d 2d 73 75 62 6d 69 74 7b 62 6f 72 64 65 72 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2e 2f 65 33 39 34 65 64 39 37 54 65 4b 6e 58 2e 73 76 67 29 6e 6f 2d 72 65 Data Ascii: vigation input.global-header--search-track{border:0;width:80%;display:inline-block;vertical-align:bottom;height:25px;padding-left:18px;background:#fff}.global--navigation input.input--search.search--submit{border:0;background:url(./e394ed97TeKnX.svg)no-re
2024-10-06 16:50:14 UTC	16384	IN	Data Raw: 3a 62 65 66 6f 72 65 2c 2e 67 6c 6f 62 61 6c 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 20 6e 61 76 20 2e 74 6f 6f 6c 2d 69 6e 66 6f 72 6d 65 64 20 61 3a 66 6f 63 75 73 3a 62 65 66 6f 72 65 2c 2e 67 6c 6f 62 61 6c 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 20 6e 61 76 20 2e 74 6f 6f 6c 2d 69 6e 66 6f 72 6d 65 64 20 61 3a 68 6f 76 65 72 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2e 2f 38 37 66 32 36 62 35 39 54 65 4b 6e 58 2e 73 76 67 29 7d 2e 67 6c 6f 62 61 6c 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 20 6e 61 76 20 2e 74 6f 6f 6c 2d 69 6e 74 65 72 63 65 70 74 20 61 3a 62 65 66 6f 72 65 2c 2e 67 6c 6f 62 61 6c 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 20 6e 61 76 20 2e 74 6f 6f 6c 2d 69 6e 74 65 72 63 65 70 74 20 61 3a 66 6f 63 75 73 3a 62 65 66 6f 72 65 Data Ascii: :before,.global--navigation nav .tool-informed a:focus:before,.global--navigation nav .tool-informed a:hover:before{background:url(./87f26b59TeKnX.svg)}.global--navigation nav .tool-intercept a:before,.global--navigation nav .tool-intercept a:focus:before
2024-10-06 16:50:14 UTC	16384	IN	Data Raw: 6f 6e 20 6e 61 76 20 6c 69 2e 6d 65 6e 75 68 65 61 64 65 72 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 31 29 7b 77 69 64 74 68 3a 31 35 25 7d 2e 67 6c 6f 62 61 6c 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 20 6e 61 76 20 6c 69 2e 6d 65 6e 75 68 65 61 64 65 72 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 32 29 7b 77 69 64 74 68 3a 31 32 25 7d 2e 67 6c 6f 62 61 6c 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 20 6e 61 76 20 6c 69 2e 6d 65 6e 75 68 65 61 64 65 72 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 33 29 7b 77 69 64 74 68 3a 31 32 25 7d 2e 67 6c 6f 62 61 6c 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 20 6e 61 76 20 6c 69 2e 6d 65 6e 75 68 65 61 64 65 72 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 34 29 7b 77 69 64 74 68 3a 31 32 25 7d 2e 67 6c 6f 62 61 6c 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 20 Data Ascii: on nav li.menuheader:nth-of-type(1){width:15%}.global--navigation nav li.menuheader:nth-of-type(2){width:12%}.global--navigation nav li.menuheader:nth-of-type(3){width:12%}.global--navigation nav li.menuheader:nth-of-type(4){width:12%}.global--navigation
2024-10-06 16:50:14 UTC	3766	IN	Data Raw: 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 4e 65 75 65 57 30 32 2d 36 35 4d 65 64 69 3b 73 72 63 3a 75 72 6c 28 2e 2f 63 63 34 36 39 34 30 36 54 65 4b 6e 58 2e 77 6f 66 66 29 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 4e 65 75 65 57 30 32 2d 35 35 52 6f 6d 61 3b 73 72 63 3a 75 72 6c 28 2e 2f 66 32 65 32 65 66 36 33 54 65 4b 6e 58 2e 77 6f 66 66 29 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 4e 65 75 65 57 30 32 2d 37 35 42 6f 6c 64 3b 73 72 63 3a 75 72 6c 28 2e 2f 66 66 64 37 61 66 36 31 54 65 4b 6e 58 2e 77 6f 66 66 29 Data Ascii: nt-face{font-family:HelveticaNeueW02-65Medi;src:url(./cc469406TeKnX.woff)format("woff")}@font-face{font-family:HelveticaNeueW02-55Roma;src:url(./f2e2ef63TeKnX.woff)format("woff")}@font-face{font-family:HelveticaNeueW02-75Bold;src:url(./ffd7af61TeKnX.woff)

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:50:13 UTC	573	OUT	GET /update/assets/4cd1ec68TeKnX.css HTTP/1.1 Host: us-usps-tsgczt.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://us-usps-tsgczt.xyz/update/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 16:50:14 UTC	322	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 06 Oct 2024 16:50:14 GMT Content-Type: text/css; charset=utf-8 Content-Length: 323 Connection: close Access-Control-Allow-Origin: * Accept-Ranges: bytes Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 Jul 2024 08:24:22 GMT ETag: W/"143-190b57e26f0"
2024-10-06 16:50:14 UTC	323	IN	Data Raw: 68 31 2e 74 69 74 6c 65 5b 64 61 74 61 2d 76 2d 66 65 35 61 65 37 33 31 5d 7b 63 6f 6c 6f 72 3a 23 32 34 35 34 39 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 64 69 76 2e 63 6f 6e 74 65 6e 74 5b 64 61 74 61 2d 76 2d 66 65 35 61 65 37 33 31 5d 7b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 32 66 32 66 32 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 7d 75 6c 5b 64 61 74 61 2d 76 2d 66 65 35 61 65 37 33 31 5d 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 64 69 73 63 20 6f 75 74 73 69 64 65 20 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 75 6c 5b 64 61 74 61 2d 76 Data Ascii: h1.title[data-v-fe5ae731]{color:#24549d;font-size:2rem;text-align:center}div.content[data-v-fe5ae731]{padding:10px;background-color:#f2f2f2;border-radius:3px}ul[data-v-fe5ae731]{list-style:disc outside none!important;list-style:initial!important}ul[data-v